Menu
What's new
By:
Filters Better Search

How to Dynamically Ban Malicious IP's using IPSet (Martineau version)

  • SNBForums Code of Conduct

    SNBForums is a community for everyone, no matter what their level of experience.

    Please be tolerant and patient of others, especially newcomers. We are all here to share and learn!

    The rules are simple: Be patient, be nice, be helpful or be gone!

Martineau said:
Try starting IPSET_Block.sh manually:
Code: 
cd /jffs/scripts
./IPSET_Block.sh   init   reset

Can you please provide the output from these 4 commands:
Code: 
iptables --line -nvL Blacklist

iptables --line -nvL logdrop

iptables --line -nvL INPUT | grep Blacklist

nvram get wan0_ifname

Do you get any data when you issue the following command: ?
Code: 
grep -E "[DROP IN=|Block IN=]$(nvram get wan0_ifname)" /tmp/syslog.log
Click to expand...
i get this from your commands:
Code: 
ASUSWRT-Merlin RT-AC3200 380.66-beta3-geb129ac Mon May  1 04:24:55 UTC 2017
admin@RT-AC3200-0000:/tmp/home/root# iptables --line -nvL Blacklist
iptables: No chain/target/match by that name.

admin@RT-AC3200-0000:/tmp/home/root# iptables --line -nvL logdrop
Chain logdrop (0 references)
num   pkts bytes target     prot opt in     out     source               destination
1        0     0 LOG        all  --  *      *       0.0.0.0/0            0.0.0.0/0            state NEW LOG flags 7 level 4 prefix "DROP "
2        0     0 DROP       all  --  *      *       0.0.0.0/0            0.0.0.0/0

admin@RT-AC3200-0000:/tmp/home/root# iptables --line -nvL INPUT | grep Blacklist

admin@RT-AC3200-0000:/tmp/home/root# nvram get wan0_ifname
eth0

admin@RT-AC3200-0000:/tmp/home/root# grep -E "[DROP IN=|Block IN=]$(nvram get wa
n0_ifname)" /tmp/syslog.log
May  4 14:50:30 kernel: device eth0 left promiscuous mode
May  4 14:50:30 kernel: device eth0 entered promiscuous mode
Aug  1 02:00:12 kernel: eth0: Broadcom BCM47XX 10/100/1000 Mbps Ethernet Controller 7.14.43.40 (r527781)
Aug  1 02:00:12 kernel: device eth0 entered promiscuous mode
Aug  1 02:00:23 pppd[570]: Connected to 00:30:88:19:c5:61 via interface eth0
Aug  1 02:00:23 pppd[570]: Connect: ppp0 <--> eth0
May  4 14:57:43 kernel: device eth0 left promiscuous mode
May  4 14:57:43 kernel: device eth0 entered promiscuous mode
Aug  1 02:00:12 kernel: device eth0 entered promiscuous mode
Aug  1 02:00:23 pppd[570]: Connected to 00:30:88:19:c5:61 via interface eth0
Aug  1 02:00:23 pppd[570]: Connect: ppp0 <--> eth0
May  4 15:12:46 kernel: device eth0 left promiscuous mode
May  4 15:12:46 kernel: device eth0 entered promiscuous mode
Aug  1 02:00:12 kernel: device eth0 entered promiscuous mode
Aug  1 02:00:22 pppd[570]: Connected to 00:30:88:19:c5:61 via interface eth0
Aug  1 02:00:22 pppd[570]: Connect: ppp0 <--> eth0
May  4 15:41:13 kernel: device eth0 left promiscuous mode
May  4 15:41:13 kernel: device eth0 entered promiscuous mode
Aug  1 02:00:12 kernel: eth0: Broadcom BCM47XX 10/100/1000 Mbps Ethernet Controller 7.14.43.40 (r527781)
Aug  1 02:00:12 kernel: device eth0 entered promiscuous mode
Aug  1 02:00:22 pppd[571]: Connected to 00:30:88:19:c5:61 via interface eth0
Aug  1 02:00:22 pppd[571]: Connect: ppp0 <--> eth0
May  4 15:55:41 kernel: device eth0 left promiscuous mode
May  4 15:55:41 kernel: device eth0 entered promiscuous mode
Aug  1 02:00:12 kernel: eth0: Broadcom BCM47XX 10/100/1000 Mbps Ethernet Controller 7.14.43.40 (r527781)
Aug  1 02:00:12 kernel: device eth0 entered promiscuous mode
Aug  1 02:00:22 pppd[571]: Connected to 00:30:88:19:c5:61 via interface eth0
Aug  1 02:00:22 pppd[571]: Connect: ppp0 <--> eth0
admin@RT-AC3200-0000:/tmp/home/root#
 
bayern1975 said:
i get this from your commands:
Code: 
ASUSWRT-Merlin RT-AC3200 380.66-beta3-geb129ac Mon May  1 04:24:55 UTC 2017
admin@RT-AC3200-0000:/tmp/home/root# iptables --line -nvL Blacklist
iptables: No chain/target/match by that name.
Click to expand...

Did you restart IPSET_Block.sh manually:
Code: 
cd /jffs/scripts
./IPSET_Block.sh   init   reset

before issuing the diagnostic commands?
 
ok, solved....script working again....why is hackereport file still empty if script block some IP addresses? i realy do not understand this part? and this file for blocked IP is in tmp/....so if i reboot router then lost all blocked IP and everything goes from begining?
Code: 
admin@RT-AC3200-0000:/jffs/scripts# ./IPSET_Block.sh
(IPSET_Block.sh): 10158 v3.05 ▒ 2016-2017 Martineau, Dynamic IPSET Blacklist banning request.....

        Summary Blacklist: 4 Successful blocks! ( 18 IPs currently banned - 15 added since: May 4 16:44 ), Entries auto-expire after 168:00:00 hrs

(HackerPorts.sh): 10233 v2.02 Hacker Port attacks Report starting.....


Thu May 4 16:52:46 DST 2017 Statistics: Total Unique Ports attacked: 0 (out of 0 attempts) tracked using SYSLOG between May  4 16:31:49 - May  4 16:52:45


        Top 3 Ports attacked:

        Top 3 attackers:

        Last 3 most recent attackers:

admin@RT-AC3200-0000:/jffs/scripts#
 
bayern1975 said:
ok, solved....script working again....why is hackereport file still empty if script block some IP addresses?
Click to expand...

That is why I asked you to run the diagnostic commands. You will need to run them again.

bayern1975 said:
this file for blocked IP is in tmp/....so if i reboot router then lost all blocked IP and everything goes from beginning?
Click to expand...

Yes, so if you read the thread I have already explained to another user that you should update the script to ensure the hourly 'save' function will write to a persistent file that is available immediately after the reboot.

https://www.snbforums.com/threads/h...et-martineau-version.38748/page-3#post-320379

Here is the help.....
Code: 
#     IPSET_Block   init
#                   If 'IPSET_Block.config' exists it will be used to restore IPSETs Blacklist and Whitelist,
#                      otherwise the IPSETs are created empty - same as if 'init reset' was specified to override the auto-restore

So if you have a USB disk mounted you will need to edit the script to change the $DIR variable:
Code: 
################################################Customise for local use #############################################
if [ -d  "/tmp/mnt/"$MYROUTER ];then
    DIR="/tmp/mnt/"$MYROUTER    # <== USB Location of IPSET save/restore configuration
else
    DIR="/tmp"                  #  NOTE: /TMP isn't permanent! ;-) but allows testing of save/restore
fi
 
Martineau said:
That is why I asked you to run the diagnostic commands. You will need to run them again.



Yes, so if you read the thread I have already explained to another user that you should update the script to ensure the hourly 'save' function will write to a persistent file that is available immediately after the reboot.

https://www.snbforums.com/threads/h...et-martineau-version.38748/page-3#post-320379

Here is the help.....
Code: 
#     IPSET_Block   init
#                   If 'IPSET_Block.config' exists it will be used to restore IPSETs Blacklist and Whitelist,
#                      otherwise the IPSETs are created empty - same as if 'init reset' was specified to override the auto-restore

So if you have a USB disk mounted you will need to edit the script to change the $DIR variable:
Code: 
################################################Customise for local use #############################################
if [ -d  "/tmp/mnt/"$MYROUTER ];then
    DIR="/tmp/mnt/"$MYROUTER    # <== USB Location of IPSET save/restore configuration
else
    DIR="/tmp"                  #  NOTE: /TMP isn't permanent! ;-) but allows testing of save/restore
fi
Click to expand...
so if i set like this should be work?
################################################Customise for local use #############################################
if [ -d "/tmp/mnt/sda1/IPSET ];then
DIR="/tmp/mnt/sda1/IPSET # <== USB Location of IPSET save/restore configuration
else
DIR="/tmp" # NOTE: /TMP isn't permanent! ;-) but allows testing of save/restore
fi
 
bayern1975 said:
so if i set like this should be work?
################################################Customise for local use #############################################
if [ -d "/tmp/mnt/sda1/IPSET ];then
DIR="/tmp/mnt/sda1/IPSET # <== USB Location of IPSET save/restore configuration
else
DIR="/tmp" # NOTE: /TMP isn't permanent! ;-) but allows testing of save/restore
fi
Click to expand...

Yes.

So when you create the IPSET directory simply run
Code: 
./IPSET_Block.sh   save

and the IPSET restore file '$DIR/IPSET_Block.config' should be created to be used each time the following is run @boot.
Code: 
./IPSET_Block.sh   init

NOTE: I still need the output of the diagnostic commands to try and establish why HackerPorts.sh seemingly still fails for you in your environment.
 
yes, hackerports.sh still fails, empty file, statistics everytime......
 
bayern1975 said:
yes, hackerports.sh still fails, empty file, statistics everytime......
Click to expand...

OK, since you clearly can't be bothered to provide diagnostics, may I politely request you remove all of my scripts from your system.

I am afraid I am no longer able/willing to provide you with ANY further support.

Good luck.
 
This script is awesome man and we'll supported!!
 
Martineau said:
OK, since you clearly can't be bothered to provide diagnostics, may I politely request you remove all of my scripts from your system.

I am afraid I am no longer able/willing to provide you with ANY further support.

Good luck.
Click to expand...

i see you got tired of helping the same user as i did :)
 
Martineau said:
OK, since you clearly can't be bothered to provide diagnostics, may I politely request you remove all of my scripts from your system.

I am afraid I am no longer able/willing to provide you with ANY further support.

Good luck.
Click to expand...
i removed as you suggested....i can live without it.....thanks for helping me anyway.....:)
 
I finally got around to reformatting and repartitioning my USB drive that has entware and absolution on it so I can have a FAT32 partition for the IPSET_Block.sh script to save to. I was not able to label it to use the computer name using the Mini Tool Partition Wizard utility. The last two characters were getting truncated from a copy/paste. So I looked online and it appears there is an 11 character limit on label names for FAT partitions. So RT-AC88U-1234 (13 characters) for a label name was not going to work. As a result, I labeled the FAT32 partition RT-AC88U and changed the script to use the nvram parameter "model" instead of "computer_name".
Code: 
MYROUTER=$(nvram get computer_name)

changed to

MYROUTER=$(nvram get model)

Thank you @Martineau for a great script and the support you provide.
 
swetoast said:
fat32 ? why not ext4 ?
Click to expand...
I may have made an incorrect assumption that it needed to be a fat format. @Martineau can clarify. If I recall earlier, another person was using the USB drive they have the NVRAM Backup and Restore Utility installed on, and that one needs to formatted as (I originally thought FAT or FAT32, but I just checked the insructions) NTFS. So I goofed. I need to make it NTFS. Before doing so, I guess @Martineau can clarify what format to use.

Edit: So I did goof up! looking online some more, 32 characters appear to be the limit for NTFS. So I changed my format to NTFS and changed the code back to as it was to use computer_name nvram parameter. HackerReport.txt is alive and well on the partition!
 
Last edited:
tend to use ext4 with arm devices not a huge fan of the older ext version but each to his own, the main thing if it works for ya then it works.
 
Apologies if this has been covered and I missed it, can I run this on the inbuilt JFFS partition, or should I be using a USB drive? If so, how?
 
Jack Yaz said:
Apologies if this has been covered and I missed it, can I run this on the inbuilt JFFS partition, or should I be using a USB drive? If so, how?
Click to expand...
You install it on /jffs partition. The script is placed in the /jffs/scripts folder. Look at the comments section of the script for the install info or read through the posts. The use of the USB is optional. It saves off information in the blacklist so the information survives a router reboot.
 
Xentrk said:
You install it on /jffs partition. The script is placed in the /jffs/scripts folder. Look at the comments section of the script for the install info or read through the posts. The use of the USB is optional. It saves off information in the blacklist so the information survives a router reboot.
Click to expand...
Ok I'll do that. Only got my Asus a week ago and don't want to wear the flash too quickly!
 
ANother stupid question, on the wiki, it mentions:

Code: 
# Reinstate the ipset rules if they have been created already
[ "$(uname -m)" = "mips" ] && MATCH_SET='--set' || MATCH_SET='--match-set'
for ipSet in $(ipset -L | sed -n '/^Name:/s/^.* //p'); do
  case $ipSet in
    AcceptList) iptables-save | grep -q "$ipSet" || iptables -I INPUT -m set $MATCH_SET $ipSet src -j ACCEPT;;
    TorNodes|BlockedCountries|CustomBlock) iptables-save | grep -q "$ipSet" || iptables -I INPUT -m set $MATCH_SET $ipSet src -j DROP;;
    MicrosoftSpyServers) iptables-save | grep -q "$ipSet" || iptables -I FORWARD -m set $MATCH_SET $ipSet dst -j DROP;;
    *) iptables-save | grep -q "$ipSet" || iptables -I FORWARD -m set $MATCH_SET $ipSet src,dst -j DROP;;
  esac
done

Is it a good idea to use this as a matter of course, in case I change anything in the UI?
 
You must log in or register to reply here.

Similar threads

MON@H Rasta
Tutorial Using TOR to unblock sites blocked by ISP on [Fork] Asuswrt-Merlin 374 LTS
Replies
14
Views
4K
Vas99
V
redhat27
Yet another malware block script using ipset (v4 and v6)
24 25 26
Replies
512
Views
129K
thelonelycoder
thelonelycoder
N
Ipset not working
Replies
0
Views
1K
Nikecow
N
R
How to disable Windows 10 tracking using ipset + Entware
6 7 8
Replies
155
Views
53K
swetoast
swetoast
Similar threads
Thread starter Title Forum Replies Date
devhell How I can dynamically manage VPN director rules list by CLI Asuswrt-Merlin 0
G Malicious sites being blocked but AiProtection is off Asuswrt-Merlin 3

Similar threads

Latest threads

Sign Up For SNBForums Daily Digest

Get an update of what's new every day delivered to your mailbox. Sign up here!

Members online

Total: 772 (members: 18, guests: 754)
Top