Asus opens plenty of listening ports, some of which have been used to hack the device in the past ("Asusgate" etc).
If you're not using any Asus services from the internet, maybe it'd be smarter to block them to avoid security holes.
The problem is some of the ports are dynamic, a fixed script will not catch all of them.
The script creates two ipset tables for open udp and tcp ports on the router, which you can then block with iptables as
where eth0 is your wan interface.
You need to load modules needed by ipset in init-start:
And the script, blockasusports.sh:
Note: the script blocks all ports which are listening on all interfaces (0.0.0.0
ort).
Should there be some which are only listening on your wan interface you need to modify the script, check with netstat -aen .
Something like
using the tcp ports match as an example.
To check what has been blocked
or tcp, and the ports are also saved in /tmp/blockasusports-udp and -tcp.
If you're not using any Asus services from the internet, maybe it'd be smarter to block them to avoid security holes.
The problem is some of the ports are dynamic, a fixed script will not catch all of them.
The script creates two ipset tables for open udp and tcp ports on the router, which you can then block with iptables as
Code:
iptables -A INPUT -i eth0 -p udp -m set --set blockasusports-udp dst -j DROP
iptables -A INPUT -i eth0 -p tcp -m set --set blockasusports-tcp dst -j DROP
iptables -A OUTPUT -o eth0 -p udp -m set --set blockasusports-udp src -j DROP
iptables -A OUTPUT -o eth0 -p tcp -m set --set blockasusports-tcp src -j DROPYou need to load modules needed by ipset in init-start:
Code:
insmod ip_set.ko
insmod ip_set_iphash.ko
insmod ip_set_ipmap.ko
insmod ip_set_ipporthash.ko
insmod ip_set_ipportiphash.ko
insmod ip_set_ipportnethash.ko
insmod ip_set_iptree.ko
insmod ip_set_iptreemap.ko
insmod ip_set_macipmap.ko
insmod ip_set_nethash.ko
insmod ip_set_portmap.ko
insmod ip_set_setlist.koAnd the script, blockasusports.sh:
Code:
#!/bin/sh
# blockasusports.sh
set -x # echo commands for debugging
ipset -N blockasusports-udp portmap --from 0 --to 65535
# if you really need port 0 connectivity, change line to: :>/tmp/blo...
echo "0" > /tmp/blockasusports-udp
while read port
do
test $port -eq 123 && continue
ipset -A blockasusports-udp $port
echo $port>>/tmp/blockasusports-udp
done <<EOT
`netstat -uaen | grep -E "0.0.0.0:[[:digit:]]+" | awk -F "[ :\t]+" '{print $5}'`
EOT
ipset -N blockasusports-tcp portmap --from 0 --to 65535
echo "0" > /tmp/blockasusports-tcp
while read port
do
ipset -A blockasusports-tcp $port
echo $port>>/tmp/blockasusports-tcp
done <<EOT
`netstat -taen | grep -E "0.0.0.0:[[:digit:]]+" | awk -F "[ :\t]+" '{print $6}'`
EOT
set +x
return 0 2>/dev/null # exit if sourced
exit 0Note: the script blocks all ports which are listening on all interfaces (0.0.0.0
ort).Should there be some which are only listening on your wan interface you need to modify the script, check with netstat -aen .
Something like
Code:
wanip=`nvram get wan_ipaddr`
netstat -taen | grep -E "$wanip:[[:digit:]]+" | awk -F "[ :\t]+" '{print $6}To check what has been blocked
Code:
ipset -L blockasusports-udp
Last edited:
