Menu
What's new
By:
Filters Better Search

Malware Filter / bad host IPSET

  • SNBForums Code of Conduct

    SNBForums is a community for everyone, no matter what their level of experience.

    Please be tolerant and patient of others, especially newcomers. We are all here to share and learn!

    The rules are simple: Be patient, be nice, be helpful or be gone!

Another alternative

#WAN Down Values...
noLnk="0.0.0.0";

#Get values from NVRAM
ipAddr="$(nvram get wan0_ipaddr)";
lnkWan="$(nvram get link_internet)";

if ( ([ $ipAddr == $noLnk ]) || ([ $lnkWan == 0 ]) );
then
echo "Network Down"
fi
 
im probobly not gonna rely on nvram for future revision since its so bound to asuswrt and i want it to be more generic so im gonna keep on figuring out a way for it to work out of the box for all types.
 
So scrapped the nvram solution so that other distroes can use this script so far the script is only in my git as always its a test version for anyone brave enough to try
 
swetoast said:
So scrapped the nvram solution so that other distroes can use this script so far the script is only in my git as always its a test version for anyone brave enough to try
Click to expand...
This works for me on two arm and one mips routers (all ASUS) running merlin firmware.
 
No idea what you are tryinig to do, but is it not possible to use ping in a bash script? Why not do the same ping wanduck is doing to that microsoft ncsi address?

Code: 
RESULT="1"
PING=$(ping www.msftncsi.com -c 1 | grep -E -o '[0-9]+ received' | cut -f1 -d' ')
if [ "$RESULT" != "$PING" ]
then
   DO SOMETHING
else
   DO SOMETHING
fi
 
elorimer said:
No idea what you are tryinig to do, but is it not possible to use ping in a bash script? Why not do the same ping wanduck is doing to that microsoft ncsi address?

Code: 
RESULT="1"
PING=$(ping www.msftncsi.com -c 1 | grep -E -o '[0-9]+ received' | cut -f1 -d' ')
if [ "$RESULT" != "$PING" ]
then
   DO SOMETHING
else
   DO SOMETHING
fi
Click to expand...
But definitely not to that host as many people block it...
 
the only reason online check is in the script is due to if your wan connection is down then it doesnt run and remove the lists, had serious downtime awhile back and i noticed that malware-filter spammed the syslog with empty results and thats why i included online check since its on a cron job and not running from wan_start

in anycase "happy beerday since its friday ;)"
 
swetoast said:
So scrapped the nvram solution so that other distroes can use this script so far the script is only in my git as always its a test version for anyone brave enough to try
Click to expand...

Updated malware-block to use revised check_online function and can confirm it works on DD-WRT and ASUS Merlin.
 
kewl will update tomorrow once is im sober :D haha dont let this deter anyone from trying my stuff :D
 
Here is the update as promised :)

Code: 
#!/bin/sh
# Author: Toast
# Contributers: Octopus, Tomsk, Neurophile, jimf, spalife, visortgw, Cedarhillguy, redhat27
# Testers: shooter40sw
# Supporters: lesandie
# Revision 19

blocklist=/jffs/malware-filter.list                     # Set your path here
retries=3                                               # Set number of tries here
regexp=`echo "\b([0-9]{1,3}\.){3}[0-9]{1,3}\b"`         # Dont change this value

case $(ipset -v | grep -o "v[4,6]") in
  v6)
    MATCH_SET='--match-set'; CREATE='create'; ADD='add'; SWAP='swap'; IPHASH='hash:ip'; NETHASH='hash:net family inet'; FLUSH='flush'; DESTROY='destroy';
    lsmod | grep -q "xt_set" || \
    for module in ip_set ip_set_nethash ip_set_iphash xt_set; do
      insmod $module
    done;;
  v4)
    MATCH_SET='--set'; CREATE='--create'; ADD='--add'; SWAP='--swap'; IPHASH='iphash'; NETHASH='nethash'; FLUSH='--flush'; DESTROY='--destroy'
    lsmod | grep -q "ipt_set" || \
    for module in ip_set ip_set_nethash ip_set_iphash ipt_set; do
      insmod $module
    done;;
  *) echo "unsupported version"; exit 1 ;;
esac

check_online () {
  ping -q -c 1 google.com >/dev/null 2>&1 && get_list || exit 1
}

get_list () {
url=https://gitlab.com/swe_toast/malware-filter/raw/master/malware-filter.list
if [ ! -f $blocklist ]
then wget $url -O $blocklist; get_source; else get_source; fi
}

get_source () {
wget -q --tries=$retries --show-progress -i $blocklist -O /tmp/malware-filter-raw.part
    awk '!/(^127\.)|(^10\.)|(^172\.1[6-9]\.)|(^172\.2[0-9]\.)|(^172\.3[0-1]\.)|(^192\.168\.)/' /tmp/malware-filter-raw.part > /tmp/malware-filter-presort.part
    cat /tmp/malware-filter-presort.part | grep -oE "$regexp" | sort -u > /tmp/malware-filter-sorted.part
}

run_ipset () {
echo "adding ipset rule to firewall this will take time."
ipset -L malware-filter >/dev/null 2>&1
if [ $? -ne 0 ]; then
    if [ "$(ipset --swap malware-filter malware-filter 2>&1 | grep -E 'Unknown set|The set with the given name does not exist')" != "" ]; then
    nice -n 2 ipset $CREATE malware-filter $IPHASH
    if [ -f /opt/bin/xargs ]; then
    /opt/bin/xargs -P10 -I "PARAM" -n1 -a /tmp/malware-filter-sorted.part nice -n 2 ipset  $ADD malware-filter PARAM
    else cat /tmp/malware-filter-sorted.part | xargs -I {} ipset $ADD malware-filter {}; fi
fi
else
    nice -n 2 ipset $CREATE malware-update $IPHASH
    if [ -f /opt/bin/xargs ]; then
    /opt/bin/xargs -P10 -I "PARAM" -n1 -a /tmp/malware-filter-sorted.part nice -n 2 ipset  $ADD malware-update PARAM
    else cat /tmp/malware-filter-sorted.part | xargs -I {} ipset $ADD malware-update {}; fi
    nice -n 2 ipset $SWAP malware-update malware-filter
    nice -n 2 ipset $DESTROY malware-update
fi
iptables -L | grep malware-filter > /dev/null 2>&1
if [ $? -ne 0 ]; then
    nice -n 2 iptables -I FORWARD -m set $MATCH_SET malware-filter src,dst -j REJECT
else
    nice -n 2 iptables -D FORWARD -m set $MATCH_SET malware-filter src,dst -j REJECT
    nice -n 2 iptables -I FORWARD -m set $MATCH_SET malware-filter src,dst -j REJECT
fi }

cleanup () {
logger -s -t system "Malware Filter loaded $(ipset -L malware-filter | wc -l | awk '{print $1-7}') unique ip addresses."
find /tmp -name 'malware-filter-*.part' -exec rm {} +
}

check_online
run_ipset
cleanup

exit $?
 
Hi, I tested this one, and the difference between this and the 17 version is that now I get printed on the ssh screen this:
Code: 
pset v4.5: 181.214.63.133 is already in set malware-update.
ipset v4.5: 181.215.113.46 is already in set malware-update.
ipset v4.5: 181.215.244.14 is already in set malware-update.
system: Malware Filter loaded 37930 unique ip addresses.
and I suppose that it does it the 37930 times. The script works


swetoast said:
Here is the update as promised :)

Code: 
#!/bin/sh
# Author: Toast
# Contributers: Octopus, Tomsk, Neurophile, jimf, spalife, visortgw, Cedarhillguy, redhat27
# Testers: shooter40sw
# Supporters: lesandie
# Revision 19

blocklist=/jffs/malware-filter.list                     # Set your path here
retries=3                                               # Set number of tries here
regexp=`echo "\b([0-9]{1,3}\.){3}[0-9]{1,3}\b"`         # Dont change this value

case $(ipset -v | grep -o "v[4,6]") in
  v6)
    MATCH_SET='--match-set'; CREATE='create'; ADD='add'; SWAP='swap'; IPHASH='hash:ip'; NETHASH='hash:net family inet'; FLUSH='flush'; DESTROY='destroy';
    lsmod | grep -q "xt_set" || \
    for module in ip_set ip_set_nethash ip_set_iphash xt_set; do
      insmod $module
    done;;
  v4)
    MATCH_SET='--set'; CREATE='--create'; ADD='--add'; SWAP='--swap'; IPHASH='iphash'; NETHASH='nethash'; FLUSH='--flush'; DESTROY='--destroy'
    lsmod | grep -q "ipt_set" || \
    for module in ip_set ip_set_nethash ip_set_iphash ipt_set; do
      insmod $module
    done;;
  *) echo "unsupported version"; exit 1 ;;
esac

check_online () {
  ping -q -c 1 google.com >/dev/null 2>&1 && get_list || exit 1
}

get_list () {
url=https://gitlab.com/swe_toast/malware-filter/raw/master/malware-filter.list
if [ ! -f $blocklist ]
then wget $url -O $blocklist; get_source; else get_source; fi
}

get_source () {
wget -q --tries=$retries --show-progress -i $blocklist -O /tmp/malware-filter-raw.part
    awk '!/(^127\.)|(^10\.)|(^172\.1[6-9]\.)|(^172\.2[0-9]\.)|(^172\.3[0-1]\.)|(^192\.168\.)/' /tmp/malware-filter-raw.part > /tmp/malware-filter-presort.part
    cat /tmp/malware-filter-presort.part | grep -oE "$regexp" | sort -u > /tmp/malware-filter-sorted.part
}

run_ipset () {
echo "adding ipset rule to firewall this will take time."
ipset -L malware-filter >/dev/null 2>&1
if [ $? -ne 0 ]; then
    if [ "$(ipset --swap malware-filter malware-filter 2>&1 | grep -E 'Unknown set|The set with the given name does not exist')" != "" ]; then
    nice -n 2 ipset $CREATE malware-filter $IPHASH
    if [ -f /opt/bin/xargs ]; then
    /opt/bin/xargs -P10 -I "PARAM" -n1 -a /tmp/malware-filter-sorted.part nice -n 2 ipset  $ADD malware-filter PARAM
    else cat /tmp/malware-filter-sorted.part | xargs -I {} ipset $ADD malware-filter {}; fi
fi
else
    nice -n 2 ipset $CREATE malware-update $IPHASH
    if [ -f /opt/bin/xargs ]; then
    /opt/bin/xargs -P10 -I "PARAM" -n1 -a /tmp/malware-filter-sorted.part nice -n 2 ipset  $ADD malware-update PARAM
    else cat /tmp/malware-filter-sorted.part | xargs -I {} ipset $ADD malware-update {}; fi
    nice -n 2 ipset $SWAP malware-update malware-filter
    nice -n 2 ipset $DESTROY malware-update
fi
iptables -L | grep malware-filter > /dev/null 2>&1
if [ $? -ne 0 ]; then
    nice -n 2 iptables -I FORWARD -m set $MATCH_SET malware-filter src,dst -j REJECT
else
    nice -n 2 iptables -D FORWARD -m set $MATCH_SET malware-filter src,dst -j REJECT
    nice -n 2 iptables -I FORWARD -m set $MATCH_SET malware-filter src,dst -j REJECT
fi }

cleanup () {
logger -s -t system "Malware Filter loaded $(ipset -L malware-filter | wc -l | awk '{print $1-7}') unique ip addresses."
find /tmp -name 'malware-filter-*.part' -exec rm {} +
}

check_online
run_ipset
cleanup

exit $?
Click to expand...
 
octopus said:
Just a suggestion: in FORWARD chain use REJECT that prevent DROP wait out timing and drop after n-seconds.
Code: 
 iptables -I FORWARD -m set $MATCH_SET malware-filter src,dst -j REJECT
Click to expand...

I do not agree with this suggestion. As this is for blocking known bad, why we need to use REJECT to actively respond to all malicious requests? REJECT only increases the router load and potentially allows more malicious requests.
In company firewall configuration, it is common sense to use the DROP action instead of REJECT.
This is not like M$ privacy filter that timeout will be a concern for web page loading. As malware filter, it is more IP based, not URL based. Timeout is not usually observed by normal users. It's the time to check your system security if you see long waiting time loading a suspicious website.
 
well thats easily changed i can make a simple value for it in the settings does that sound better ?
 
swetoast said:
well thats easily changed i can make a simple value for it in the settings does that sound better ?
Click to expand...
If there's option to choose REJECT or DROP, it will suit everyone.

BTW, are these the three lines to change REJECT to DROP if I want to modify it myself? I am not a script person, only working in infosec.
Code: 
nice -n 2 iptables -I FORWARD -m set $MATCH_SET malware-filter src,dst -j REJECT
else
   nice -n 2 iptables -D FORWARD -m set $MATCH_SET malware-filter src,dst -j REJECT
   nice -n 2 iptables -I FORWARD -m set $MATCH_SET malware-filter src,dst -j REJECT
 
Hi @swetoast a question, apart of the discussion of whether reject or drop is the correct option, maybe drop is the correct one... but Im looking at the command iptables -L -v -n and Im looking and rejected inputs...

Code: 
 pkts bytes target     prot opt in     out     source               destination
    5   915 REJECT     all  --  *      *       0.0.0.0/0            0.0.0.0/0           set malware-filter src,dst reject-with icmp-port-unreachable
7865K 2324M ACCEPT     all  --  *      *       0.0.0.0/0            0.0.0.0/0           state RELATED,ESTABLISHED

So great its working, ... is there a command that I cant execute that can tell me if the rejected package is from what source IP address? I want to know if this is coming from an internal IP or external

regards, great scripts!
 
florid said:
I do not agree with this suggestion. As this is for blocking known bad, why we need to use REJECT to actively respond to all malicious requests? REJECT only increases the router load and potentially allows more malicious requests.
In company firewall configuration, it is common sense to use the DROP action instead of REJECT.
This is not like M$ privacy filter that timeout will be a concern for web page loading. As malware filter, it is more IP based, not URL based. Timeout is not usually observed by normal users. It's the time to check your system security if you see long waiting time loading a suspicious website.
Click to expand...
Everyone can do what they want with their skills and experience. Feel free to do what suits the individual.
 
You must log in or register to reply here.

Similar threads

A
Policy-based port routing to bypass NordVPN client
Replies
10
Views
1K
Don->
D
K
Can't get SNAT/MASQ to work.
2
Replies
24
Views
2K
eibgrad
eibgrad
R
Script to detect backup wan and disable certain devices from internet access
Replies
0
Views
340
RandomUser777
R
M
Firewall doesen't block custom rules, neighter Skynet
Replies
0
Views
1K
MamaLing
M
M
Entware Guide to Adding 2FA to Incoming Ports on AX86U
Replies
6
Views
870
ColinTaylor
C
Similar threads
Thread starter Title Forum Replies Date
Swistheater Malware /jffs/updater script. Asuswrt-Merlin 167
M Wireless Mac filter defaulting to whitelist. Asuswrt-Merlin 5
R Wireless MAC (Band filter filtering out Guest network) Asuswrt-Merlin 2
G Feature request: firewall url filter log Asuswrt-Merlin 0
TanyaC cannot add domain to router URL filter Asuswrt-Merlin 15
C How to filter out foreign countries Asuswrt-Merlin 3
D Network Services Filter - rules don't persist? Asuswrt-Merlin 13
Nas.CloudBusinessPortal Network Services Filter Asuswrt-Merlin 0
P Inbound OpenVPN Server IP address range filter Asuswrt-Merlin 2
HOgi Manage WLAN-MAC-Filter list via command line (ssh) in a file? Asuswrt-Merlin 3

Similar threads

Latest threads

Sign Up For SNBForums Daily Digest

Get an update of what's new every day delivered to your mailbox. Sign up here!

Members online

Total: 890 (members: 23, guests: 867)
Top