I don't think the easy-to-use firewall Network Services Filter GUI fully meets your requirements, so here are a couple of scripting solutions.
iptables -I FORWARD "$(iptables -nvL FORWARD --line -t filter | grep -m 1 "other2wan" | cut -d' ' -f1)" -s 192.168.10.24 -d $MICROSOFT -i br0 -o eth0 -p tcp -m multiport --dport 12345,54321 -m time --timestart 02:00 --timestop 07:59 -j ACCEPT
iptables -I FORWARD "$(iptables -nvL FORWARD --line -t filter | grep -m 1 "other2wan" | cut -d' ' -f1)" -s 192.168.10.24 -d $MICROSOFT -i br0 -o eth0 -j DROPcru a XBOXAllow "00 02 * * *" iptables -I FORWARD "$(iptables -nvL FORWARD --line -t filter | grep -m 1 "other2wan" | cut -d' ' -f1)" -s 192.168.10.24 -d $MICROSOFT -i br0 -o eth0 -p tcp -m multiport --dport 12345,54321 -j ACCEPT
cru a XBOXBlock "59 07 * * *" iptables -D FORWARD -s 192.168.10.24 -d $MICROSOFT -i br0 -o eth0 -p tcp -m multiport --dport 12345,54321 -j ACCEPT
Yes.
Not 100% sure
, but I think my example solution will grant access to the two ports ONLY during the 7 hour period 02:00-08:00 as you originally required, but for the rest of the 24 hour period (17 hours) the DROP rule BLOCKS ALL access for the Xbox.Same as I already answered in your other post, but I suggest you read/digest the RMerlin Wiki especially the section User scripts and how to exploit/enable them.
No
No idea
Client Name: XBOX1
App Name Upload Download Total
XBOX 1.06 GB 47.67 GB 48.72 GB
General 40.22 MB 72.46 MB 112.68 MB
Web File Transfer 1.41 MB 70.40 MB 71.81
MBSSL/TLS 4.57 MB 53.61 MB 58.19 MB
Electronic Arts 3.07 MB 51.82 MB 54.89 MB
Microsoft(SSL) 7.93 MB 33.46 MB 41.39 MB
Akamai.net88.76 KB3.24 MB3.33 MBMicrosoft Windows Update288.36 KB714.88 KB1003.24 KBSkype140.12 KB283.65 KB423.77 KBHTTP72.39 KB233.73 KB306.12 KBHTTP Protocol over TLS SSL164.75 KB144.00 Bytes164.89 KBYoutube5.83 KB103.37 KB109.20 KBOneDrive3.66 KB52.50 KB56.16 KBWorld Wide Web HTTP13.08 KB156.00 Bytes13.23 KBThe distinction between the two is clearly highlighted in bold in the solution I posted (see post #3)
What is an IPSET ?
When scripting it is convenient to use variables, so as an example, script variable $MICROSOFT would contain a CSV list of their update servers (assuming you have identified all of them rather than store them in an IPSET), to reduce the number of code lines required in the script.
Create a logging rule based on either the Xbox's MAC address (one for each Xbox)
iptables -I FORWARD -i br0 -m mac --mac-source xx:xx:xx:xx:xx:xx -m state --state NEW -j LOG --log-prefix "Xbox " --log-tcp-sequence --log-tcp-options --log-ip-optionsiptables -I FORWARD -i br0 -s Xbox1,Xbox2 -m state --state NEW -j LOG --log-prefix "Xbox " --log-tcp-sequence --log-tcp-options --log-ip-options./TrafficAnalyzer_Report.sh date=2018/11/19 ip=10.88.8.157 time=10:
(TrafficAnalyzer_Report.sh): 8160 v1.07 Traffic Analyzer starting.....
NOTE: Columns in white are eligible for filters; red text indicates a match on the filters requested. (URLs are Xshell5/MobaXterm hyperlinks)
Filter by Date, AND by IP, AND by Time ==> '2018-11-19|58:XX:XX:XX:XX:4B|10:'
Rx Bytes Tx Bytes YYYY/MM/DD HH:MM:SS MAC address Host Name IP address Category Application
575 520 2018/11/19 10:00:36 58:XX:XX:XX:XX:4B SGA5 10.88.8.157 Web services HTTP
62377 120912 2018/11/19 10:00:36 58:XX:XX:XX:XX:4B SGA5 10.88.8.157 Network protocols Google APIs(SSL)
565 351 2018/11/19 10:00:36 58:XX:XX:XX:XX:4B SGA5 10.88.8.157 Network protocols World Wide Web HTTP
152 152 2018/11/19 10:00:37 58:XX:XX:XX:XX:4B SGA5 10.88.8.157 Network protocols Network Time Protocol
776 7299 2018/11/19 10:00:37 58:XX:XX:XX:XX:4B SGA5 10.88.8.157 VoIP services Skype
32178 80194 2018/11/19 10:00:37 58:XX:XX:XX:XX:4B SGA5 10.88.8.157 Web services Google
3884 39908 2018/11/19 10:00:37 58:XX:XX:XX:XX:4B SGA5 10.88.8.157 File sharing services and tools OneDrive
2432 6780 2018/11/19 10:00:38 58:XX:XX:XX:XX:4B SGA5 10.88.8.157 Management tools and protocols DNS
18036 17199 2018/11/19 10:00:38 58:XX:XX:XX:XX:4B SGA5 10.88.8.157 General General
4550 4412 2018/11/19 10:00:39 58:XX:XX:XX:XX:4B SGA5 10.88.8.157 Social networks Facebook
21290 58919 2018/11/19 10:00:39 58:XX:XX:XX:XX:4B SGA5 10.88.8.157 Network protocols HTTP Protocol over TLS SSL
5161 12682 2018/11/19 10:00:39 58:XX:XX:XX:XX:4B SGA5 10.88.8.157 Network protocols Microsoft(SSL)
---------- ----------
148.41 KB 341.14 KB
========== ==========iptables -I FORWARD -i br0 -s xxx.xxx.xxx.xxx -m state --state NEW -j LOG --log-prefix "Xbox " --log-tcp-sequence --log-tcp-options --log-ip-options
iptables --line -t filter -nvL FORWARD | grep -E "Chain|pkts|Xbox"destinations I've tried blocking :
8.253.95.0/24
8.248.117.0/24
8.253.204.0/24
8.253.207.0/24
67.27.157.0/24
68.232.34.0/24
104.43.128.0/24
104.43.128.0/24
94.46.155.0/24
13.107.4.0/24
40.77.229.0/24
40.77.226.0/24
185.11.14.0/24cru a XBOX2 "* 08,09,10,11,12,13,14,15,16,17,18,19,20,21,22,23,00,01 * * *" /jffs/scripts/xboxac
ctblk 192.168.254.38 >/dev/null 2>/dev/null
cru a XBOX1 "* 08,09,10,11,12,13,14,15,16,17,18,19,20,21,22,23,00,01 * * *" /jffs/scripts/xboxac
ctblk 192.168.254.37 >/dev/null 2>/dev/null
cru l
0 7 */7 * * service restart_letsencrypt #LetsEncrypt#
* 08,09,10,11,12,13,14,15,16,17,18,19,20,21,22,23,00,01 * * * /jffs/scripts/xboxacctblk 192.168.254.38 #XBOX2#
* 08,09,10,11,12,13,14,15,16,17,18,19,20,21,22,23,00,01 * * * /jffs/scripts/xboxacctblk 192.168.254.37 #XBOX1##!/bin/sh
ip=$1
min=`date +%M`
iptables -nvxL FORWARD --line -t filter | grep "0.0.0.0/0 $1" > /dev/null 2>/dev/null
if [ $? -eq 1 ];
then
iptables -I FORWARD 1 -d $1 -o br0 -j ACCEPT
else
xa1=`iptables -nvxL FORWARD --line -t filter | grep "0.0.0.0/0 $1" | awk '{print $3}'`
if [ "$xa1" -gt 5000 ];
then
iptables -D FORWARD "$(iptables -nvL FORWARD --line -t filter | grep "ppp0 $ip" | awk '{print $1}')"
iptables -D FORWARD "$(iptables -nvL FORWARD --line -t filter | grep "ppp1 $ip" | awk '{print $1}')"
n1=`iptables -nvL FORWARD --line -t filter | grep "0.0.0.0/0 $1" | awk '{print $1}'`
# iptables -D FORWARD $n1
iptables -I FORWARD $n1 -s $1 -i br0 -o ppp0 -j DROP
iptables -I FORWARD $n1 -s $1 -i br0 -o ppp1 -j DROP
else
n1=`iptables -nvL FORWARD --line -t filter | grep "0.0.0.0/0 $1" | awk '{print $1}'`
iptables -D FORWARD $n1
iptables -I FORWARD $n1 -d $1 -o br0 -j ACCEPT
fi
fi
if [ "$min" -eq "59" ];
then
iptables -D FORWARD "$(iptables -nvL FORWARD --line -t filter | grep "ppp0 $ip" | awk '{print $1}')"
iptables -D FORWARD "$(iptables -nvL FORWARD --line -t filter | grep "ppp1 $ip" | awk '{print $1}')"
n1=`iptables -nvL FORWARD --line -t filter | grep "0.0.0.0/0 $1" | awk '{print $1}'`
iptables -D FORWARD $n1
iptables -I FORWARD $n1 -d $1 -o br0 -j ACCEPT
fiNot sure if your cron statements are the most efficient, but I personally would only use cron to start the script monitoring @08:00 and terminate it @02:00
#!/bin/sh
#***** NOTE: This script does not handle DUPLICATE rules *****
#
# but is simple to follow/understand the implementation of your requirements ;)
#
iptables -N Xbox_IN # Split monitoring into Inbound
iptables -Z Xbox_IN
iptables -N Xbox_OUT # OutBound
iptables -Z Xbox_OUT
XBOX1_IP="192.168.254.37"
XBOX2_IP="192.168.254.38"
iptables -A Xbox_IN -d $XBOX1_IP -m comment --comment "Xbox1"
iptables -A Xbox_IN -d $XBOX2_IP -m comment --comment "Xbox2"
iptables -I FORWARD -i ppp+ -j Xbox_IN
iptables -I FORWARD -o br0 -j Xbox_OUT
XBOX1=$(iptables --line -nvxL Xbox_IN | grep "Xbox1" | awk '{print $3}')
XBOX2=$(iptables --line -nvxL Xbox_IN | grep "Xbox2" | awk '{print $3}')
LIMIT=5000000 # Bytes
while true # Check every 60 seconds to see if the Xboxs have exceeded their DOWNLOAD limit
do
sleep 60
NOWXBOX1=$(iptables --line -nvxL Xbox_IN | grep "Xbox1" | awk '{print $3}')
NOWXBOX2=$(iptables --line -nvxL Xbox_IN | grep "Xbox2" | awk '{print $3}')
[ $(($NOWXBOX1-$XBOX1)) -gt $LIMIT ] && iptables -I Xbox_IN -s $XBOX1_IP -i br0 -j DROP -m comment --comment "Block Xbox1"
[ $(($NOWXBOX2-$XBOX2)) -gt $LIMIT ] && iptables -I Xbox_IN -s $XBOX2_IP -i br0 -j DROP -m comment --comment "Block Xbox2"
XBOX1=$NOWXBOX1
XBOX2=$NOWXBOX2
done
exitiptables -D Xbox_OUT -s $XBOX1_IP -i br0 -j DROP -m comment --comment "Block Xbox1"
iptables -D Xbox_OUT -s $XBOX2_IP -i br0 -j DROP -m comment --comment "Block Xbox2"
kill -9 $(ps | grep -v grep | grep your_script_name | cut -d' ' -f1)
Welcome To SNBForums
SNBForums is a community for anyone who wants to learn about or discuss the latest in wireless routers, network storage and the ins and outs of building and maintaining a small network.
If you'd like to post a question, simply register and have at it!
While you're at it, please check out SmallNetBuilder for product reviews and our famous Router Charts, Ranker and plenty more!
