[R7800, R9000 & probably others] Blocklist based Firewall addon

[kamoj]

You can remove your USB devices and reboot without entware?

That is probably the case, but I don’t see how... This is very tricky...

 

[kamoj]

Yes, by all means! The more the merrier!

@kamoj Do you want me to test these commands?

About the entware i think the problem is that I dont know what the problem is... But my goal has been to get iprange for this blocklist firewall.

 

[KW.]

Command 1

find / -name tty                                                                                         
 /dev/tty                                                                                                               
 /overlay/opt/bin/tty     
    /overlay/hipplay/usr/bin/tty                                                                                           
 /proc/tty                                                                                                               
find: /proc/5126/task/5126/fdinfo/5: No such file or directory                         
 /rom/dev/tty                                             
 /sys/devices/soc.0/fd883000.uart0/tty         
    /sys/devices/soc.0/fd884000.uart1/tty         
 /sys/devices/virtual/tty   
   /sys/devices/virtual/tty/tty                   
  /sys/devices/platform/serial8250/tty                                                                                   
/sys/class/tty     
    /sys/class/tty/tty

Command 2

find / -name stty                                                                                       
 /overlay/opt/bin/stty                                                       
 /overlay/hipplay/bin/stty                                                                                             
  find: /proc/32230: No such file or directory

 

[HELLO_wORLD]

You can remove your USB devices and reboot without entware?

Yes, I was thinking of doing that... Just can’t disrupt internet now... Maybe tomorrow morning.

root@HERMES:~$ find / -name tty
/dev/tty
/proc/tty
/sys/devices/virtual/tty
/sys/devices/virtual/tty/tty
/sys/devices/platform/msm_serial_hsl.1/tty
/sys/devices/platform/serial8250/tty
/sys/class/tty
/sys/class/tty/tty
/tmp/mnt/sda1/entware/bin/tty
root@HERMES:~$ find / -name stty
/tmp/mnt/sda1/entware/bin/stty
root@HERMES:~$

 

[HELLO_wORLD]

Ok @KW. , last 2 tries:

echo -n "say y: "; echo "answer: $(head -c1 /dev/tty)"

And

echo -n "say y: "; A=$(dd ibs=1 count=1 2>/dev/null); echo -e "\nanswer: $A"

If it does not work, I will disconnect Entware tomorrow on my router (and hopefully have exact same environment than you have for testing) and/or wait for @kamoj ’s solution once he’s back home.

 

[KW.]

Here it is. Dont worry about throwing out commands you want to try. I like to play with the big guys

Command 1

echo -n "say y: "; echo "answer: $(head -c1 /dev/tty)"       
say y: y                                                                                                                                           
answer:

Command 2

echo -n "say y: "; A=$(dd ibs=1 count=1 2>/dev/null); echo -e "\nanswer: $A"           
 say y: y                                 
 answer:                                                                                                               
 root@R9000:/$ y                                                                                                       
  /bin/ash: y: not found

 

[HELLO_wORLD]

Thank you for calling me a big guy, I’m not at the level of @kamoj or the ultimate @Voxel .

As you guessed, none of those are working. I give up for today.
Have a good Sunday

Here it is. Dont worry about throwing out commands you want to try. I like to play with the big guys

Command 1

echo -n "say y: "; echo "answer: $(head -c1 /dev/tty)"      
say y: y                                                                                                                                          
answer:

Command 2

echo -n "say y: "; A=$(dd ibs=1 count=1 2>/dev/null); echo -e "\nanswer: $A"          
 say y: y                                
 answer:                                                                                                              
 root@R9000:/$ y                                                                                                      
  /bin/ash: y: not found

 

[kamoj]

Ok, back and found it.
Apart from this there is also a trick involving sed and tty...
I don't think you need any instruction, so here is my current solution (one of many):

Q="Do you want to uninstall the kamoj add-on? "; echo -n "$Q"
ANSWER="$(i=0;while [ $i -lt 2 ];do i=$((i+1));read -p "" yn </dev/tty;[ -n "$yn" ] && echo -n "$yn" && break;done)"
echo "$ANSWER"

 

[kamoj]

Don't be so modest! Your work, enthusiasm, helpfulness and creativity is top class!
I'm very happy to have you in this community, indeed!

(And don't compare me with the @Voxel . I'm far from his level!)

Thank you for calling me a big guy, I’m not at the level of @kamoj or the ultimate @Voxel .

As you guessed, none of those are working. I give up for today.
Have a good Sunday

 

[HELLO_wORLD]

Ah! Trap the stdin inside a while loop so ash does not receive it as a command, smart!

Thank you @kamoj

So, @KW. : this should work:

echo -n "say y: "; case "$(i=0;while [ $i -lt 2 ];do i=$((i+1));read -p "" yn </dev/tty;[ -n "$yn" ] && echo "$yn" && break;done)" in Y|y|yes|Yes|YES) echo 'answer is YES';; *) echo 'answer is NO';; esac

And I will be able to update my script (tomorrow) to fix the asking yes or no bug while trying to upgrade (and fix that in install.sh as it asks a question too).

Ok, back and found it.
Apart from this there is also a trick involving sed and tty...
I don't think you need any instruction, so here is my current solution (one of many):

Q="Do you want to uninstall the kamoj add-on? "; echo -n "$Q"
ANSWER="$(i=0;while [ $i -lt 2 ];do i=$((i+1));read -p "" yn </dev/tty;[ -n "$yn" ] && echo -n "$yn" && break;done)"
echo "$ANSWER"

 

[KW.]

Nah Im done testing for today... haha sorry just kidding Im never done. I think something happened. You guys are so impressive! I love the comment "Ah! Trap the stdin inside a while loop so ash does not receive it as a command, smart!" It is so far away from my understanding but breath so much knowledge.

echo -n "say y: "; case "$(i=0;while [ $i -lt 2 ];do i=$((i+1));read -p "" yn </dev/tty;[ -n "$yn" ] && echo "$yn" && break;done)" in Y|y|yes|Yes|YES) echo 'answer is YES';; *) echo 'answer is NO';; esac

 

[KW.]

sorry. missed a line:

say y: y
answer is YES

 

[HELLO_wORLD]

sorry. missed a line:

say y: y
answer is YES

Great

 

[HELLO_wORLD]

v3.2.2

 

[KW.]

v3.2.2

Fantastic! Here is my report of the update.
Befor the update running the clean command:

/opt/bolemo/scripts/firewall-blocklist clean
 iptables v1.4.21: mark: bad mark value for option "--mark", or out of range.                                                                                                                                                          
Try `iptables -h' or 'iptables --help' for more information.                                                   
grep: xregcomp: Unmatched [ or [^
 root@R9000:/$

After installation:

Info:
 - The script is properly installed.                                                                             
- firewall-blocklist version: v3.2.2                                                                         
  - This is the last version.                                                                                     
- iprange is not installed.

rm -r fbl command didnt work

rm -r fbl                                                                            
rm: descend into directory 'fbl'? y                                                                                                          

root@R9000:/tmp/mnt/sdb1$

Status:

Status:                                                                                                       
 - firewall-blocklist version: v3.2.2                                                       
  - iprange is not installed.                                                                 
- Firewall blocklist is set and active.                               
  - Filtering 619977398 IP adresses.
 Logging is off.

/opt/bolemo/scripts/firewall-blocklist update -v                       
firewall-blocklist v3.2.2 - Verbose mode                     
Initializing...                                  
 - /opt/scripts/firewall-start.sh was edited and is now ok.
 Updating blocklist from sources...
 - Downloading lists defined in /opt/bolemo/etc/firewall-blocklist.sources
1) https://raw.githubusercontent.com/firehol/blocklist-ipsets/master/firehol_level1.netset    
 -      100%[===================>]  38.90K  --.-KB/s    in 0.004s                                          

2) https://raw.githubusercontent.com/firehol/blocklist-ipsets/master/firehol_level2.netset
-     100%[===================>] 273.25K  --.-KB/s    in 0.04s                                               

3) https://raw.githubusercontent.com/firehol/blocklist-ipsets/master/firehol_level3.netset  -

100%[===================>] 258.12K  --.-KB/s    in 0.03s

4) https://raw.githubusercontent.com/firehol/blocklist-ipsets/master/iblocklist_ciarmy_malicious.netset           
  -
100%[===================>] 202.70K  --.-KB/s    in 0.02s                                                      

5) https://raw.githubusercontent.com/firehol/blocklist-ipsets/master/malwaredomainlist.ipset                            -          
  100%[===================>]  14.49K  --.-KB/s    in 0.002s                                                      - iprange not installed, passing optimization and reduction process.                                         
  - Removing duplicates...                                                                                       
 - Done.                                                                                                       
  Building ipset blocklist (44959 entries blocking 619977398 ips)...                                           
  - Created blocklist.                                                                                           
- Done.                                                                                                         
Restarting firewall...                                                                                         
 iptables v1.4.21: mark: bad mark value for option "--mark", or out of range.
Try `iptables -h' or 'iptables --help' for more information.              
 grep: xregcomp: Unmatched [ or [^
- Built-in firewall restarted.
  Status:
 - firewall-blocklist version: v3.2.2                                            
- iprange is not installed.           
 - Firewall blocklist is set and active.
- Filtering 619977398 IP adresses.                                                                             
- Logging is off.        
 Detailed status:                    
- /opt/scripts/firewall-start.sh exists with correct settings.   
- Actual router time: Sun May  3 18:18:42 UTC 2020                                                             
 - Blocklist generation time: Sun May  3 18:18:42 UTC 2020                    
- Router firewall was last started Sun May  3 18:18:43 UTC 2020:
  ipset blocklist was already loaded and was kept.                                   
 blocklist rules were added to iptables.                                                    
- iptables rules are set:                                                                     
iptables -N FwBl_DROP
  iptables -A INPUT -i brwan -m set --match-set FwBl_BL src -j FwBl_DROP
iptables -A FORWARD -i brwan -m set --match-set FwBl_BL src -j FwBl_DROP       
iptables -A FORWARD -o brwan -m set --match-set FwBl_BL dst -j FwBl_DROP
  iptables -A OUTPUT -o brwan -m set --match-set FwBl_BL dst -j FwBl_DROP
iptables -A FwBl_DROP -j DROP                                                      
- Logging is inactive.                                                         
- ipset filter (blocklist) is set:                                                               
 Name: FwBl_BL                                                             
 Type: hash:net                                                                                
 Revision: 6
 Header: family inet hashsize 32768 maxelem 65536                                 
  Size in memory: 1396788                                                                      
  References: 4
  Number of entries: 44959                                                   
 - ipset bypass (whitelist) is not set.

 

[HELLO_wORLD]

Fantastic! Here is my report of the update.
Befor the update running the clean command:

/opt/bolemo/scripts/firewall-blocklist clean
 iptables v1.4.21: mark: bad mark value for option "--mark", or out of range.                                                                                                                                                        
Try `iptables -h' or 'iptables --help' for more information.                                                 
grep: xregcomp: Unmatched [ or [^
 root@R9000:/$

For info, this iptables error you get is not coming for the script. Apparently, native NG setups are throwing some errors (likely to be without incidence because all routers sold are concerned).

After installation:

Info:
 - The script is properly installed.                                                                           
- firewall-blocklist version: v3.2.2                                                                       
  - This is the last version.                                                                                   
- iprange is not installed.

rm -r fbl command didnt work

rm -r fbl                                                                          
rm: descend into directory 'fbl'? y                                                                                                        

root@R9000:/tmp/mnt/sdb1$

Interesting. Did it do that before?
Anyway, not major. You can remove doing exactly:

cd /mnt/optware

(or whatever is the root of your USB)
Then

rm -rf fbl

I will improve the install script to delete the directory by itself. The simpler to install, the better.

Status:

Status:                                                                                                     
 - firewall-blocklist version: v3.2.2                                                     
  - iprange is not installed.                                                               
- Firewall blocklist is set and active.                             
  - Filtering 619977398 IP adresses.
 Logging is off.

/opt/bolemo/scripts/firewall-blocklist update -v                     
firewall-blocklist v3.2.2 - Verbose mode                   
Initializing...                                
 - /opt/scripts/firewall-start.sh was edited and is now ok.
 Updating blocklist from sources...
 - Downloading lists defined in /opt/bolemo/etc/firewall-blocklist.sources
1) https://raw.githubusercontent.com/firehol/blocklist-ipsets/master/firehol_level1.netset  
 -      100%[===================>]  38.90K  --.-KB/s    in 0.004s                                        

2) https://raw.githubusercontent.com/firehol/blocklist-ipsets/master/firehol_level2.netset
-     100%[===================>] 273.25K  --.-KB/s    in 0.04s                                             

3) https://raw.githubusercontent.com/firehol/blocklist-ipsets/master/firehol_level3.netset  -

100%[===================>] 258.12K  --.-KB/s    in 0.03s

4) https://raw.githubusercontent.com/firehol/blocklist-ipsets/master/iblocklist_ciarmy_malicious.netset         
  -
100%[===================>] 202.70K  --.-KB/s    in 0.02s                                                    

5) https://raw.githubusercontent.com/firehol/blocklist-ipsets/master/malwaredomainlist.ipset                            -        
  100%[===================>]  14.49K  --.-KB/s    in 0.002s                                                      - iprange not installed, passing optimization and reduction process.                                       
  - Removing duplicates...                                                                                     
 - Done.                                                                                                     
  Building ipset blocklist (44959 entries blocking 619977398 ips)...                                         
  - Created blocklist.                                                                                         
- Done.                                                                                                       
Restarting firewall...                                                                                       
 iptables v1.4.21: mark: bad mark value for option "--mark", or out of range.
Try `iptables -h' or 'iptables --help' for more information.            
 grep: xregcomp: Unmatched [ or [^
- Built-in firewall restarted.
  Status:
 - firewall-blocklist version: v3.2.2                                          
- iprange is not installed.         
 - Firewall blocklist is set and active.
- Filtering 619977398 IP adresses.                                                                           
- Logging is off.      
 Detailed status:                  
- /opt/scripts/firewall-start.sh exists with correct settings. 
- Actual router time: Sun May  3 18:18:42 UTC 2020                                                           
 - Blocklist generation time: Sun May  3 18:18:42 UTC 2020                  
- Router firewall was last started Sun May  3 18:18:43 UTC 2020:
  ipset blocklist was already loaded and was kept.                                 
 blocklist rules were added to iptables.                                                  
- iptables rules are set:                                                                   
iptables -N FwBl_DROP
  iptables -A INPUT -i brwan -m set --match-set FwBl_BL src -j FwBl_DROP
iptables -A FORWARD -i brwan -m set --match-set FwBl_BL src -j FwBl_DROP     
iptables -A FORWARD -o brwan -m set --match-set FwBl_BL dst -j FwBl_DROP
  iptables -A OUTPUT -o brwan -m set --match-set FwBl_BL dst -j FwBl_DROP
iptables -A FwBl_DROP -j DROP                                                    
- Logging is inactive.                                                       
- ipset filter (blocklist) is set:                                                             
 Name: FwBl_BL                                                           
 Type: hash:net                                                                              
 Revision: 6
 Header: family inet hashsize 32768 maxelem 65536                               
  Size in memory: 1396788                                                                    
  References: 4
  Number of entries: 44959                                                 
 - ipset bypass (whitelist) is not set.

Good evening

 

[KW.]

The blocklist works very fine and as before I notice no drawbacks on my networks performance. All i got with your script is a safer network Now on my wish list is the iprange. I hope it is possible to get in the script for r9000 sometime in the future.
Your script is here to stay thank you allot for sharing it!

 

[HELLO_wORLD]

The blocklist works very fine and as before I notice no drawbacks on my networks performance. All i got with your script is a safer network Now on my wish list is the iprange. I hope it is possible to get in the script for r9000 sometime in the future.
Your script is here to stay thank you allot for sharing it!

Thank you!
I am glad this is useful to other people

For iprange on R9000 (without Entware), I will need to ask @Voxel as he has the compiling environment.
Entware was easy to install for me following Voxel’s readme, but maybe it’s a little different for R9000.

 

[HELLO_wORLD]

@KW. interested in iprange for R9000?
Can you run that for me and report the output:

/bin/uname -p

That is to update my install script to recognize when it is launched from a R9000 and offer to install iprange

@Voxel kindly compiled it.

 

[KW.]

You are kidding! You and @Voxel are great. I wonder if Netgear knows that their crappy locked firmware created a community that so damn great.

/bin/uname -p   
 unknown