Yet another malware block script using ipset (v4 and v6)

Przem · Oct 5, 2017

@redhat27:
Thank you VERY MUCH! The script does not show any errors in Tomato logs neither when run via SSH.
Is there other simple way to check if its working?

P.

VZ3 · Oct 9, 2017

You can use next command to monitor malware packets been dropped

iptables -vL -t raw

If you see chain pkts counter goes up that means your firewall is doing it's thing.

Przem · Oct 9, 2017

@VZ3:
Thank you, I have run command you send, and it is working.

Wysłane z iPad za pomocą Tapatalk Pro

moooooooo · Oct 18, 2017

thanks for this as i've been wondering if it was possible to do it!
/jffs/scripts/ya-malware-block.sh: Loaded sets YAMalwareBlock1IP (53445) and YAMalwareBlockCIDR (5811) in 11 seconds

RT-AC68U here on a gigabit fibre connection. I'll see if any of my regular sites break and then play around with the whitelist mentioned on page 1!
cheers
peter

Builder71 · Oct 18, 2017

moooooooo said:
thanks for this as i've been wondering if it was possible to do it!
/jffs/scripts/ya-malware-block.sh: Loaded sets YAMalwareBlock1IP (53445) and YAMalwareBlockCIDR (5811) in 11 seconds

RT-AC68U here on a gigabit fibre connection. I'll see if any of my regular sites break and then play around with the whitelist mentioned on page 1!
cheers
peter

Have a look at post #420.
You can make the script even better by implementing what's mentioned there.
(Put the code in between the "esac" and "startTS" command to the ya-malware-block.sh script.)

I hope @redhat27 will add this, but he seems to be offline quite a lot.

redhat27 · Oct 20, 2017

Builder71 said:
Have a look at post #420.
You can make the script even better by implementing what's mentioned there.
(Put the code in between the "esac" and "startTS" command to the ya-malware-block.sh script.)

I hope @redhat27 will add this, but he seems to be offline quite a lot.

Version 2.5 (just uploaded in github) will take care of the issue of removing older ipsets and rules if they are no longer needed.

Builder71 · Oct 20, 2017

Thx!

Also read your Git comment.
To make sure I understand it correct.

I don't change my ya-malware-block.urls file at all.
It's just the active urls in it make I often go up and down around 65k.
Simply because the content changes a bit grabbed from the urls.

Does your change account for that?

redhat27 · Oct 20, 2017

Builder71 said:
I don't change my ya-malware-block.urls file at all.

Apologies, I had misunderstood. Regardless, this version should take care of it. Thanks for pushing me to do it. BTW: I should post a similar fix to your other gihub issue soon (create-ipset-lists.sh)

Builder71 said:
Does your change account for that?

Yes, and just to test it, you can edit the /jffs/ipset_lists/ya-malware-block.urls file and uncomment the level4 url, run it (it creates few more ipsets) check the iptable rules and ipsets, and then comment it back and run it again. You should see the older ipsets and iptables rules removed.

Builder71 · Oct 20, 2017

redhat27 said:
Apologies, I had misunderstood. Regardless, this version should take care of it. Thanks for pushing me to do it. BTW: I should post a similar fix to your other gihub issue soon (create-ipset-lists.sh)

Yes, and just to test it, you can edit the /jffs/ipset_lists/ya-malware-block.urls file and uncomment the level4 url, run it (it creates few more ipsets) check the iptable rules and ipsets, and then comment it back and run it again. You should see the older ipsets and iptables rules removed.

Tested as you suggested and works like a charm.

Just want to make sure the script isn't looking at the ya-malware-block.urls file being edited or something like that.
Because, in my case, that file is always the same and not the issue here.

As a script noob I can't understand how you fixed it because the script is just too complicated for me.

Hence my question.

redhat27 · Oct 20, 2017

No, it's not looking at .urls being edited

I've added some new lists to the .urls file in github. These are not included in FireHOL levels 1 through 4:

Counts are as of the time of writing this post and will vary over time:

Users of this script can update their ya-malware-block.urls file from the GitHub version if they choose to include these additional lists

Csection · Oct 20, 2017

redhat27 said:
No, it's not looking at .urls being edited

I've added some new lists to the .urls file in github. These are not included in FireHOL levels 1 through 4:

Counts are as of the time of writing this post and will vary over time:

https://raw.githubusercontent.com/firehol/blocklist-ipsets/master/alienvault_reputation.ipset (68255 unique IPs)
https://raw.githubusercontent.com/firehol/blocklist-ipsets/master/bbcan177_ms1.netset (2565 subnets, 5268567 unique IPs)
https://raw.githubusercontent.com/firehol/blocklist-ipsets/master/bbcan177_ms3.netset (1146 subnets, 30151694 unique IPs)
https://raw.githubusercontent.com/firehol/blocklist-ipsets/master/bds_atif.ipset (5022 unique IPs)
https://raw.githubusercontent.com/firehol/blocklist-ipsets/master/blocklist_de_bots.ipset (143 unique IPs)
https://raw.githubusercontent.com/firehol/blocklist-ipsets/master/blocklist_de_ssh.ipset (11261 unique IPs)
https://raw.githubusercontent.com/firehol/blocklist-ipsets/master/blocklist_de_strongips.ipset (104 unique IPs)
https://raw.githubusercontent.com/firehol/blocklist-ipsets/master/dyndns_ponmocup.ipset (163 unique IPs)
https://raw.githubusercontent.com/firehol/blocklist-ipsets/master/et_block.netset (1980 subnets, 24411811 unique IPs)
https://raw.githubusercontent.com/firehol/blocklist-ipsets/master/et_botcc.ipset (728 unique IPs)
https://raw.githubusercontent.com/firehol/blocklist-ipsets/master/et_compromised.ipset (1801 unique IPs)
https://raw.githubusercontent.com/firehol/blocklist-ipsets/master/hphosts_exp.ipset (314 unique IPs)
https://raw.githubusercontent.com/firehol/blocklist-ipsets/master/hphosts_hjk.ipset (57 unique IPs)
https://raw.githubusercontent.com/firehol/blocklist-ipsets/master/hphosts_mmt.ipset (1136 unique IPs)
https://raw.githubusercontent.com/firehol/blocklist-ipsets/master/ransomware_feed.ipset (5216 unique IPs)
https://raw.githubusercontent.com/firehol/blocklist-ipsets/master/ransomware_locky_ps.ipset (3 unique IPs)
https://raw.githubusercontent.com/firehol/blocklist-ipsets/master/taichung.ipset (10694 unique IPs)
https://raw.githubusercontent.com/firehol/blocklist-ipsets/master/urandomusto_ssh.ipset (410 unique IPs)
https://raw.githubusercontent.com/firehol/blocklist-ipsets/master/urandomusto_telnet.ipset (445 unique IPs)
https://raw.githubusercontent.com/firehol/blocklist-ipsets/master/uscert_hidden_cobra.ipset (627 unique IPs)

Users of this script can update their ya-malware-block.urls file from the GitHub version if they choose to include these additional lists

Should these new lists be just appended to the bottom of the .url file.
I have already updated to 2.5.

redhat27 · Oct 21, 2017

Csection said:
Should these new lists be just appended to the bottom of the .url file.
I have already updated to 2.5.

You can simply replace your .urls file. Let the script redownload it on the next run:

Code:

rm /jffs/ipset_lists/ya-malware-block.urls

or download it yourself:

Code:

wget --no-check-certificate -O /jffs/ipset_lists/ya-malware-block.urls https://raw.githubusercontent.com/shounak-de/misc-scripts/master/ya-malware-block.urls

Uncomment Level4 if you want

Builder71 · Oct 21, 2017

Version 2.5 is working great!

Also deleted ya-malware-block.urls to get the new one.
A lot of new urls!
I was still using the below urls because of the recent GitHub drama.

https://iplists.firehol.org/files/firehol_level1.netset
https://iplists.firehol.org/files/firehol_level2.netset
https://iplists.firehol.org/files/firehol_level3.netset
https://iplists.firehol.org/files/firehol_level4.netset

Is it OK if we use Git now?

In the new ya-malware-block.urls file a lot is active. (No # sign in front.)
What about false positives?
Run into that before and then the family goes

.

redhat27 · Oct 22, 2017

I would tend to be an optimist and think that GitHub incident to be a one-off. Let's see if that recurs.
Regarding false positives, I think if a site gets blocked, or something stops working, it should be fairly easy to whitelist: Just ping the domain to verify its blocked, and if it is, then just add that IP to the .whites file and rerun the script. A family typically has a handful of favourite sites (at least mine does) and I've whitelisted what I've seen blocked (I have Level4 active)

Mircica · Nov 3, 2017

Need some help

I am having this

/jffs/scripts/ya-malware-block.sh
/jffs/scripts/ya-malware-block.sh: Adding ya-malware-block rules to firewall...
>>> Downloading and aggregating malware sources (also processing whitelists)...[87619/80687/6932] ~18s
>>> Adding data and processing rule for YAMalwareBlock1IP...Can't find library for match `webstr'
~4s
>>> Adding data and processing rule for YAMalwareBlock2IP...Can't find library for match `webstr'
~1s
>>> Adding data and processing rule for YAMalwareBlockCIDR...Can't find library for match `webstr'
~1s
>>> Cleaning up... ~0s
/jffs/scripts/ya-malware-block.sh: Loaded sets YAMalwareBlock1IP (65535) YAMalwareBlock2IP (15152) and YAMalwareBlockCIDR (6932) in 24 seconds

but this shows right

iptables -vL -t raw
Chain PREROUTING (policy ACCEPT 223K packets, 185M bytes)
pkts bytes target prot opt in out source destination
63 3507 DROP all -- any any anywhere anywhere match-set YAMalwareBlockCIDR src
126 5967 DROP all -- any any anywhere anywhere match-set YAMalwareBlock2IP src
194 11880 DROP all -- any any anywhere anywhere match-set YAMalwareBlock1IP src

Chain OUTPUT (policy ACCEPT 16415 packets, 4212K bytes)
pkts bytes target prot opt in out source destination

Any idea?

Builder71 · Nov 3, 2017

We have to guess which router you use?

Mircica · Nov 3, 2017

ASUS RT-AC66U, ASUSWRT Merlin 380 68 4

redhat27 · Nov 3, 2017

Mircica said:
ASUS RT-AC66U, ASUSWRT Merlin 380 68 4

Thank you. Can you post the output of these?

Code:

ipset --version
iptables --version

Also, do you get the 'webstr' library error on each run of the script, or just the first time?

Mircica · Nov 4, 2017

ipset --version
ipset v4.5, protocol version 4.
Kernel module protocol version 4.

iptables --version
iptables v1.4.21

each time

redhat27 · Nov 6, 2017

Mircica said:
ipset --version
ipset v4.5, protocol version 4.
Kernel module protocol version 4.

iptables --version
iptables v1.4.21

each time

Sorry for the late reply. I'm assuming that you are running the script unmodified. Let me know if that is not the case.

Do you get any output when you issue these commands:

Code:

iptables-save | grep -q YAMalwareBlockCIDR && echo "found"

iptables -t raw -I PREROUTING -m set --set YAMalwareBlockCIDR src -j DROP

Thread starter	Title	Forum	Replies	Date
D	Yet another question about VLANs (any HowTo recommended?)	Asuswrt-Merlin	24	May 28, 2023
S	Transfer files to another device (raspi) in the same network	Asuswrt-Merlin	3	Apr 5, 2024
M	Allow admin web GUI access on another interface (tailscale0)	Asuswrt-Merlin	0	Mar 14, 2024
S	Another DNS Director clarification	Asuswrt-Merlin	1	Feb 3, 2024
	Might be ready to give AiMesh another look	Asuswrt-Merlin	8	Jan 8, 2024
D	Connecting to internet via another router	Asuswrt-Merlin	10	Jun 12, 2023
	Malware /jffs/updater script.	Asuswrt-Merlin	167	May 27, 2023

Yet another malware block script using ipset (v4 and v6)

New Around Here

Regular Contributor

New Around Here

Occasional Visitor

Very Senior Member

Very Senior Member

Very Senior Member

Very Senior Member

Very Senior Member

Very Senior Member

Senior Member

Very Senior Member

Very Senior Member

Very Senior Member

Regular Contributor

Very Senior Member

Regular Contributor

Very Senior Member

Regular Contributor

Very Senior Member

Similar threads

Similar threads

Sign Up For SNBForums Daily Digest