redhat27
Very Senior Member
As if we don't have enough already 
Here is yet another malware blocking script that uses ipset (v4 and v6). So why put up another one?
The sources lists are mainly from the Cybercrime IP Feeds by FireHOL site:
As per the site, there are 4 blocking tiers:
Level1 (around 652 Million unique IPs): A firewall blacklist composed from IP lists, providing maximum protection with minimum false positives. Suitable for basic protection on all internet facing servers, routers, and firewalls. (includes: bambenek_c2 dshield feodo fullbogons spamhaus_drop spamhaus_edrop sslbl zeus_badips ransomware_rw)
Level2 (around 47 Thousand unique IPs): An ipset made from blocklists that track attacks, during about the last 48 hours. (includes: blocklist_de dshield_1d greensnow)
Level3 (around 119 Thousand unique IPs): An ipset made from blocklists that track attacks, spyware, viruses. It includes IPs that have been reported or detected in the last 30 days. (includes: bruteforceblocker ciarmy dragon_http dragon_sshpauth dragon_vncprobe dshield_30d dshield_top_1000 malc0de maxmind_proxy_fraud myip shunlist snort_ipfilter sslbl_aggressive talosintel_ipfilter zeus vxvault)
Level4 (around 9.4 Million unique IPs): An ipset made from blocklists that track attacks, but may include a large number of false positives. (includes: cleanmx_viruses blocklist_net_ua botscout_30d cruzit_web_attacks cybercrime haley_ssh iblocklist_hijacked iblocklist_spyware iblocklist_webexploit ipblacklistcloud_top iw_wormlist malwaredomainlist)
Level1 through Level3 is enabled on this script by default.
Note on Level4: Because of a large number of false positives in the Level4 ipset, I've disabled it in the sources list. After you install the script, you can, (if you so want) edit the sources list /jffs/ipset_lists/ya-malware-block.urls (default location) to remove the comment '#' on the level4 source. But you may need to whitelist if you discover some of your desired domains are blocked.
Install/Reinstall:
Running:
Run via cru or on the command line as many times as you want:
cru (example run every 6 hours):
Put the above line in your existing /jffs/scripts/init-start to create a cron schedule at boot time.
To schedule the job right away (without waiting for the next reboot of your router), just run the above command at the shell prompt. But please note that if you run the cru command from the command line, the schedule will only remain in effect till the next router boot unless also put in init-start
In addition, you can also run the script once at router boot:
append the following 2 lines at end of your existing /jffs/scripts/services-start:
Doing so will ensure that the script is run also at boot time so that you are covered in the interval your router has just rebooted but your scheduled run via cron has not occurred yet.
You can also just run it at any time from your router prompt:
This is a sample run on my (slow) router from the terminal with the default blocking (Level1 through Level3)
And this is with all 4 Levels enabled:
Whitelisting [manual]:
This script does have provision for whitelisting discrete IPs that have been blocked on the YAMalwareBlock?IP sets. Although you'd typically not want to whitelist identified malware, sometimes you may find that you need to, especially if you enable FireHOL Level4.
You can add any IP you would want to whitelist to the file: /jffs/ipset_lists/ya-malware-block.whites (default location)
You should only append to this file, and only add IPs (no other characters or comments).
Notes on whitelisting:
You should keep the regex entries on the top (private/unroutable over the internet) and then append regular IPs down after that.
The regex entries ensure that your LAN IPs are never blocked. You do not need to whitelist your LAN IPs.
I've added 3 additional myself (as an example: You may remove these if you want, but be aware of the below, see why I added those):
The reasoning here of adding IPs without any regex is that the dots need not be escaped (though you could if you wanted to) as dots will replace dots in the regex.
Blacklisting [manual|optional]:
This script also has provision for blacklisting discrete IPs and/or CIDR ranges in addition to the blocking provided by the lists defined by the urls file.
You can add any IP/CIDR entries you would want to blacklist to the file: /jffs/ipset_lists/ya-malware-block.blacks (default location)
Unlike the whitelists file, this file is totally optional, and the script will run fine without it.
The custom blacklist supports line comments, but not in-line comments. Sample here. Data in that sample file are just test data demonstrating usage/syntax. Please don't use that file as is!
Uninstall:
Enjoy!
Here is yet another malware blocking script that uses ipset (v4 and v6). So why put up another one?
- Over 650 Million unique IPs blocked
- Simpler (minimalist script with only 26 lines (which includes a couple of blank lines and comment lines)
- Quicker (about 20 secs typical runtime with default lists depending on CPU load, processing power and bandwidth)
- Less CPU cycles for your router to load the lists (kinda saying the same thing as above)
- Entware not required (Can run without extended packages or external storage)
- Only one single preprocess file created in /tmp (that is removed right afterward)
- Also supports both ipset v4 and ipset v6
- Overcomes ipset-v4 limitation to handle more than 64k elements by splitting into multiple sets.
- Can also be run in cru
- You can manually whitelist specific IPs
- Starting with version 2.3, you can manually blacklist discrete IPs and/or CIDR ranges in addition to the lists defined in the urls file.
- Blocks on the PREROUTING chain of the iptables raw table (affects both traffic initiated by malware sources and also traffic initiated inside your LAN trying to connect to malware destinations)
- Works on other firmwares (Tomato by Shibby, for example). Script here.
The sources lists are mainly from the Cybercrime IP Feeds by FireHOL site:
As per the site, there are 4 blocking tiers:
Level1 (around 652 Million unique IPs): A firewall blacklist composed from IP lists, providing maximum protection with minimum false positives. Suitable for basic protection on all internet facing servers, routers, and firewalls. (includes: bambenek_c2 dshield feodo fullbogons spamhaus_drop spamhaus_edrop sslbl zeus_badips ransomware_rw)
Level2 (around 47 Thousand unique IPs): An ipset made from blocklists that track attacks, during about the last 48 hours. (includes: blocklist_de dshield_1d greensnow)
Level3 (around 119 Thousand unique IPs): An ipset made from blocklists that track attacks, spyware, viruses. It includes IPs that have been reported or detected in the last 30 days. (includes: bruteforceblocker ciarmy dragon_http dragon_sshpauth dragon_vncprobe dshield_30d dshield_top_1000 malc0de maxmind_proxy_fraud myip shunlist snort_ipfilter sslbl_aggressive talosintel_ipfilter zeus vxvault)
Level4 (around 9.4 Million unique IPs): An ipset made from blocklists that track attacks, but may include a large number of false positives. (includes: cleanmx_viruses blocklist_net_ua botscout_30d cruzit_web_attacks cybercrime haley_ssh iblocklist_hijacked iblocklist_spyware iblocklist_webexploit ipblacklistcloud_top iw_wormlist malwaredomainlist)
Level1 through Level3 is enabled on this script by default.
Note on Level4: Because of a large number of false positives in the Level4 ipset, I've disabled it in the sources list. After you install the script, you can, (if you so want) edit the sources list /jffs/ipset_lists/ya-malware-block.urls (default location) to remove the comment '#' on the level4 source. But you may need to whitelist if you discover some of your desired domains are blocked.
Install/Reinstall:
Code:
wget --no-check-certificate -O /jffs/scripts/ya-malware-block.sh https://raw.githubusercontent.com/shounak-de/misc-scripts/master/ya-malware-block.sh
chmod +x /jffs/scripts/ya-malware-block.shRunning:
Run via cru or on the command line as many times as you want:
cru (example run every 6 hours):
Code:
cru a UpdateYAMalwareBlock "0 */6 * * * /jffs/scripts/ya-malware-block.sh"To schedule the job right away (without waiting for the next reboot of your router), just run the above command at the shell prompt. But please note that if you run the cru command from the command line, the schedule will only remain in effect till the next router boot unless also put in init-start
In addition, you can also run the script once at router boot:
append the following 2 lines at end of your existing /jffs/scripts/services-start:
Code:
sleep 600
sh /jffs/scripts/ya-malware-block.shYou can also just run it at any time from your router prompt:
Code:
/jffs/scripts/ya-malware-block.shThis is a sample run on my (slow) router from the terminal with the default blocking (Level1 through Level3)
Code:
admin@RT-AC66R-D700:/tmp/home/root# ya-malware-block.sh
/jffs/scripts/ya-malware-block.sh: Adding ya-malware-block rules to firewall...
>>> Downloading and aggregating malware sources (also processing whitelists)...[131428/122042/9386] ~11s
>>> Adding data and processing rule for YAMalwareBlock1IP... ~4s
>>> Adding data and processing rule for YAMalwareBlock2IP... ~4s
>>> Adding data and processing rule for YAMalwareBlockCIDR... ~1s
>>> Cleaning up... ~0s
/jffs/scripts/ya-malware-block.sh: Loaded sets YAMalwareBlock1IP (65535) YAMalwareBlock2IP (56507) and YAMalwareBlockCIDR (9386) in 20 secondsAnd this is with all 4 Levels enabled:
Code:
admin@RT-AC66R-D700:/tmp/home/root# ya-malware-block.sh
/jffs/scripts/ya-malware-block.sh: Adding ya-malware-block rules to firewall...
>>> Downloading and aggregating malware sources (also processing whitelists)...[250472/238198/12274] ~23s
>>> Adding data and processing rule for YAMalwareBlock1IP... ~5s
>>> Adding data and processing rule for YAMalwareBlock2IP... ~5s
>>> Adding data and processing rule for YAMalwareBlock3IP... ~5s
>>> Adding data and processing rule for YAMalwareBlock4IP... ~3s
>>> Adding data and processing rule for YAMalwareBlockCIDR... ~2s
>>> Cleaning up... ~0s
/jffs/scripts/ya-malware-block.sh: Loaded sets YAMalwareBlock1IP (65535) YAMalwareBlock2IP (65535) YAMalwareBlock3IP (65535) YAMalwareBlock4IP (41593) and YAMalwareBlockCIDR (12274) in 43 secondsWhitelisting [manual]:
This script does have provision for whitelisting discrete IPs that have been blocked on the YAMalwareBlock?IP sets. Although you'd typically not want to whitelist identified malware, sometimes you may find that you need to, especially if you enable FireHOL Level4.
You can add any IP you would want to whitelist to the file: /jffs/ipset_lists/ya-malware-block.whites (default location)
You should only append to this file, and only add IPs (no other characters or comments).
Notes on whitelisting:
You should keep the regex entries on the top (private/unroutable over the internet) and then append regular IPs down after that.
The regex entries ensure that your LAN IPs are never blocked. You do not need to whitelist your LAN IPs.
I've added 3 additional myself (as an example: You may remove these if you want, but be aware of the below, see why I added those):
- A regex ^216\.239\.3[2468]\.21 for Nintendo users, as per @VZ3 's post
- AB solution uses a hosts list provider from pgl.yoyo.org. That was being blocked on the default Level1 through Level3 blocking of FireHOL tiers. That 213.230.210.230 IP is for pgl.yoyo.org
- I use all 4 Levels and noticed that androidfilehost.com (needed by most files hosted in xda-developers.com) was blocked on Level4. That 192.124.249.10 IP is for androidfilehost.com
The reasoning here of adding IPs without any regex is that the dots need not be escaped (though you could if you wanted to) as dots will replace dots in the regex.
Blacklisting [manual|optional]:
This script also has provision for blacklisting discrete IPs and/or CIDR ranges in addition to the blocking provided by the lists defined by the urls file.
You can add any IP/CIDR entries you would want to blacklist to the file: /jffs/ipset_lists/ya-malware-block.blacks (default location)
Unlike the whitelists file, this file is totally optional, and the script will run fine without it.
The custom blacklist supports line comments, but not in-line comments. Sample here. Data in that sample file are just test data demonstrating usage/syntax. Please don't use that file as is!
Uninstall
:
Code:
rm -f /jffs/ipset_lists/ya-malware-block.*
rm -f /jffs/scripts/ya-malware-block.sh
In addition,
Undo your changes to /jffs/scripts/init-start and /jffs/scripts/services-start
Reboot (optional)Enjoy!
Last edited:
