Malware Filter / bad host IPSET

[Xentrk]

No need unless you are getting an error. Changing it would not alter the behavior. Users of dd-wrt do not have iptables-save, so that was a workaround. BTW the wiki is here

And no support for it in the entware package either Thanks for suggesting the work around solution @redhat27.

 

[redhat27]

@Xentrk You're most welcome Did the modified blockstats alias work?

 

[Xentrk]

@Xentrk You're most welcome Did the modified blockstats alias work?

I just tried it and YES!! it worked. I'll make the change permanent now. THANK YOU!

 

[swetoast]

feel free to add blockstats on my filters if you have a working solution or post em here in the thread

 

[Csection]

No need unless you are getting an error. Changing it would not alter the behavior. Users of dd-wrt do not have iptables-save, so that was a workaround. BTW the wiki is here

Thanks soo much!
I kinda thought that was ok, but I wanted expert opinion.
I'll bm the wiki.
Thanks again!

 

[redhat27]

feel free to add blockstats on my filters

The alias greps for all blocklist sets (matches "match-set") So all active blocklist stats will display (malware blocks, country blocks, tor blocks, iblocklist blocks or anything else that is is an ipset blocklist or allowlist that is enabled in iptables)

 

[swetoast]

ok havent bothered with that since i dont really check my stats that often but nice to know gonna do some changes since they apply to all active blockfilter

 

[Csection]

I have a question.
When "Malware-Filter" runs on the crontab. My CPU's both cores jump up all over the place up to 97%.
Is this normal? Is this ok?

 

[visortgw]

I have a question.
When "Malware-Filter" runs on the crontab. My CPU's both cores jump up all over the place up to 97%.
Is this normal? Is this ok?

Yes, and yes.

 

[Csection]

Yes, and yes.

Thanks!
I assumed it was, but wanted to be sure.

 

[swetoast]

https://security.radware.com/ddos-threats-attacks/brickerbot-pdos-permanent-denial-of-service/

so this is pretty scary gonna see if i can find a blocklist for this

 

[swetoast]

NOTE: Reboot and remove old verson before running new.

Rev. 25

• Rewrite
• IPv6 support (no hosts files however for that)
• Proper CIDR Support

https://gitlab.com/swe_toast/malware-filter/raw/master/malware-filter

 

[Csection]

New test version if it doesnt work for you revert to earlier version and report what went wrong

NOTE: Reboot and remove old verson before running new.

Rev. 20

• Rewrite
• IPv6 support (no hosts files however for that)
• Proper CIDR Support

https://gitlab.com/swe_toast/malware-filter/raw/master/WIP/malware-filter

I loaded the new ver. 20. rebooted, but the new scripts says, "ip V4" loaded. I have V6. Is that incorrect?

 

[Xentrk]

I loaded the new ver. 20. rebooted, but the new scripts says, "ip V4" loaded. I have V6. Is that incorrect?

That refers to IP addresses vs the ipset version. I had the same question awhile back.

 

[Csection]

That refers to IP addresses vs the ipset version. I had the same question awhile back.

Ahh!
That makes complete sense!
I just thought it was an odd msg. in my logs.
Thank you for clearing that up.
By the way the script worked fine for me.

 

[swetoast]

actually its how many ipv4 addresses are loaded, but if you have ipv6 enabled it should say 0 cause I haven't included any ipv6 blocklists yet

 

[swetoast]

but aslong as it says blocked x amount in syslog then its working, but as of now ipv6 should say 0 cause I have no ipv6 blocklists yet

 

[Csection]

but aslong as it says blocked x amount in syslog then its working, but as of now ipv6 should say 0 cause I have no ipv6 blocklists yet

Yes!
It says it blocked 36000 ip's and the next line says blocked 850 ip ranges
I don't use v6 ip addresses, so as Xentrk said it must be working right.
Thanks!

 

[swetoast]

it is

 

[elorimer]

I'm a little confused--are we on version 20 or 24?