A Question re blocking IPs via iptables and aiprotect

[Marcus Yansen]

So I am getting a bunch of attacks I see in aiprotect. They seem to be from the same set of ips. I blocked these ips using iptables, but i still see the attacks coming from these ips - did I use the wrong commands, or should I see the attacks even after I blocked ips? I am on asus merlin, latest version.

This the command I used:

iptables -I INPUT -s [117.48.157.75] -j DROP

iptables -I OUTPUT -d [117.48.157.75] -j DROP

screenshot of the attacks:

 

[dave14305]

If the traffic is between a client and the remote IP, you should test the FORWARD chain. INPUT and OUTPUT are for traffic coming to or from the router only.

Any incoming traffic should be blocked by default, so if it’s a response to a client connection, it should be inserted early in the forward chain.

Better to create a single rule that references an ipset containing all the IPs. Or look at Skynet Addon.

 

[Marcus Yansen]

Ok thank you. yes these attacks are hitting my computer - i assumed that first they had to get through the router so i thought blocking at router level was sufficient. I will be installing Skynet tomorrow. and i suppose i have to install ipset too, correct? Is this an appropriate guide for using ipset to block multiple ips?

https://www.randomdevstuff.com/use-ipset-to-block-multiple-ips/

to add multiple multiple ips i separate them by commas?
For example, sudo ipset add blacklist 192.168.10.10, 192.168.10.11

 

[dave14305]

Just install Skynet and be sure the “Import AiProtect Data” is enabled in its settings.

 

[Marcus Yansen]

Just install Skynet and be sure the “Import AiProtect Data” is enabled in its settings.

After I install skynet, I'll be turning of airprotect right as it would be somewhat redundant? Or does it provide any benefits? - i only have the Two-Way IPS and infected device prevention and blocking checked on though, I don't use the malicious site blocking feature.

 

[dave14305]

After I install skynet, I'll be turning of airprotect right as it would be somewhat redundant? Or does it provide any benefits?

You should keep them both. Skynet will keep importing any new IPs identified by AiProtection.

 

[Marcus Yansen]

Thank you so much,, all done and i imported aiprotect settings through the settings option of skynet.