Privacy Filter (Another IPSET Script)

[swetoast]

dude i got the flu..

run it manually /jffs/scripts/privacy-filter

if the result is 33 then this it is 33 cant make it go bigger already explained it over and over.

if there are other scripts running then if they are blocking then privacy-filter wont block those that are already blocked.

and yes you can run each step manually its right there in the script how to

 

[skeal]

Sorry to hear your real sick! I hate the flu. One last question....does nat acceleration when enabled interfere with this script or for that matter any of your scripts?

 

[swetoast]

no that shouldn't matter

 

[swetoast]

so in an effort to provide better support ive made a little debugging tool that helps me help you

https://gitlab.com/swe_toast/debugtool/raw/master/debugtool.sh

it checks for dependencies and path for my scripts and then lets you review and transmit em so that you can post it to me the logs looks like this

Router Model:

ASUSWRT-Merlin RT-AC56U 380.66-alpha2 Mon Mar  6 18:13:45 UTC 2017

Entware requierment for uBlockr
/opt/bin/opkg
wget - 1.18-2
grep - 2.26-1
pixelserv-tls - V35.HZ12.Ki-1
ca-certificates - 20161130
coreutils-stat - 8.23-2

Locating uBlockr Paths
/tmp/mnt/Main/entware/etc/ublockr.cfg
/tmp/mnt/Main/entware/bin/ublockr
/tmp/mnt/Main/entware/var/cache/ublockr
/tmp/mnt/Main/entware/var/cache/ublockr/no.list
/tmp/mnt/Main/entware/var/cache/ublockr/whitelist.filter
/tmp/mnt/Main/entware/var/cache/ublockr/ipv4_hosts
/tmp/mnt/Main/entware/var/cache/ublockr/ip.list

Locating Malware-Filter Paths
/jffs/malware-filter.list
/tmp/mnt/Main/entware/bin/malware-filter

Detecting Ipset version on router
ipset v6.29, protocol version: 6

Locating Malware-Filter Paths
/jffs/privacy-filter.list
/tmp/mnt/Main/entware/bin/privacy-filter

Detecting Ipset version on router
ipset v6.29, protocol version: 6

then it prints out a address for the log
https://clbin.com/dMy4P

im gonna work on it pretty hard cause this helps me see what differences there are in your envoirment and allows me to improve upon my scripts.

 

[Xentrk]

Hi @swetoast,
I ran the script on the school router that gave me the usage message with traceroute: https://clbin.com/l9OwU

It looks like it is missing the /tmp/privacy-filter_ipv4_raw.part file where the traceroute is sending output to when the usage message error occurs.

Here is the output of the router where it worked with no usage error:
https://clbin.com/lJSwc

Both locations give me this at script start:

admin@RT-AC88U:/jffs/scripts# sh debugtool.sh
wget not installedgrep not installedca-certificates not installedcoreutils-stat not installedDo you want to review the debug log and send it (y/n)?y

I just looked at the script code and see it is checking if the entware version of wget is installed, and ca-certificates, which is why I get the message. Should I install them? I see that wget on entware is more recent version.

 

[swetoast]

tnx

you can delete
/tmp/privacy-filter_ipv4.prelist

 

[swetoast]

mind printing the the content of /tmp/privacy-filter_ipv4_raw.part

 

[Xentrk]

mind printing the the content of /tmp/privacy-filter_ipv4_raw.part

It is gone now . I reran the script and it is not in the /tmp folder any longer.

 

[swetoast]

ok well atleast we kinda know where it goes wrong sometimes.

in anycase im gonna rewrite privacy-filter very soon

 

[Xentrk]

Thank you @swetoast. I am a good test candidate if you want to try it out on me before you release to the general public. Router at the school is all native WAN. One at home is all traffic VPN and the other is VPN with policy rules.

EDIT: And I forgot, I also have it installed on a DD-WRT router. As long as you do not use nvram variables that are specific to ASUS Merlin, it works. On malware-block script, I have to stay at an earlier version because of this.

 

[swetoast]

malware-filter doesnt use nvram at all check the lastest rev in that thread.

 

[swetoast]

MS published what telemetry collects

https://technet.microsoft.com/itpro...ic-level-windows-diagnostic-events-and-fields

pretty interesting read

 

[skeal]

MS published what telemetry collects

https://technet.microsoft.com/itpro...ic-level-windows-diagnostic-events-and-fields

pretty interesting read

Wow! They collect a lot of information! The average person like me had no idea what they collect. I'm very surprised. Corporations must opt out of this some how. It would be seen as a security flaw where I work.

 

[PeterR]

Seems that the latest changes broke the script ...

admin@r1:/jffs/scripts# ./privacy-filter
./privacy-filter: line 118: syntax error: unexpected ";;" (expecting "}")

 

[Xentrk]

Seems that the latest changes broke the script ...

admin@r1:/jffs/scripts# ./privacy-filter
./privacy-filter: line 118: syntax error: unexpected ";;" (expecting "}")

I can't duplicate your error. I ran the script and get this message which means the addresses below in the privacy-filter.list file can't be found:

traceroute: bad address 'fe2.update.microsoft.com.akadns.net'
traceroute: bad address 's.gateway.messenger.live.com'

system: Privacy Filter (ipv4) loaded 43 unique ip addresses that will be rejected from contacting your router.

Do you have dos characters inside the script? Do you have this file: /jffs/privacy-filter.list?

Run the following and post the link:
https://gitlab.com/swe_toast/debugtool/raw/master/debugtool.sh

 

[swetoast]

yeah @PeterR seems like my changes was a dud that time need to set up a Work in Progress dir so i dont change the live script like i did on malware-filter.

in anycase fixed on gitlab.

 

[Xentrk]

Hi @swetoast,

Since I am on AC88U with ipset version 6, why is the match-set block getting an ipv4 rather than ipv6?

  409 21108 REJECT     all  --  any    any     anywhere             anywhere             match-set privacy-filter_ipv4 src,dst reject-with icmp-port-unreachable

 

[visortgw]

Hi @swetoast,

Since I am on AC88U with ipset version 6, why is the match-set block getting an ipv4 rather than ipv6?

  409 21108 REJECT     all  --  any    any     anywhere             anywhere             match-set privacy-filter_ipv4 src,dst reject-with icmp-port-unreachable

Do you have IPv6 enabled on the router? ipset v6 is a completely different beast than IPv6.

 

[Xentrk]

Do you have IPv6 enabled on the router? ipset v6 is a completely different beast than IPv6.

I do not. I'm still IPv4. So that explains it then. Too many acronyms. Doh!

 

[swetoast]

lesson learned, check first ask later