1. This site uses cookies. By continuing to use this site, you are agreeing to our use of cookies. Learn More.
Dismiss Notice

Welcome To SNBForums

SNBForums is a community for anyone who wants to learn about or discuss the latest in wireless routers, network storage and the ins and outs of building and maintaining a small network.

If you'd like to post a question, simply register and have at it!

While you're at it, please check out SmallNetBuilder for product reviews and our famous Router Charts, Ranker and plenty more!

Skynet - Asus Firewall Addition (Dynamic Malware/Country/Manual IP Blocking)

Discussion in 'Asuswrt-Merlin' started by Adamm, Apr 16, 2014.

  1. Adamm

    Adamm Very Senior Member

    Joined:
    Mar 26, 2013
    Messages:
    1,582
    UPDATED 15/09/2018


    Skynet - Asus Firewall Addition



    Skynet is the first comprehensive IP banning and security tool exclusively for Asus Devices.


    The goal of this tool is to enhance the firmware's built in functionality such as the SPI Firewall, Brute Force Detection and AiProtect while adding easy to use tools for users to implement custom firewall rules they desire. Skynet has a range of feature from banning single IPs, domains, entire countries or pulling predefined malware lists from reputable providers. It is the one stop shop for router security and the first line of defense in your home network.

    Skynet fully supports (router) OpenVPN implementations and the Astrill VPN Plugin along with user scripts like Diversion. You can read about explanations for common errors here.


    This script is open source and free to use, but if you want to support future development you can do so by donating here.


    [​IMG]



    INSTALLATION;


    All that's required is a USB drive that's at-least 500MB, After downloading it just works.

    This script is now hosted on GitHub, you can follow the most recent changes here.

    In your favourite SSH terminal;

    Code:
    /usr/sbin/curl --retry 3 "https://raw.githubusercontent.com/Adamm00/IPSet_ASUS/master/firewall.sh" -o "/jffs/scripts/firewall" && chmod +x /jffs/scripts/firewall && sh /jffs/scripts/firewall install
    

    After installation (or reboot) you should see output similar the following indicating the script is working.

    Code:
    Sep 15 21:55:39 Skynet: [%] Startup Initiated... ( skynetloc=/tmp/mnt/Elements/skynet )
    Sep 15 21:56:00 Skynet: [#] 132577 IPs (+0) -- 1828 Ranges Banned (+0) || 0 Inbound -- 0 Outbound Connections Blocked! [start] [21s]
    




    USAGE;

    Skynet provides both a user interactive menu, and command line interface for those who prefer it.

    To open the menu its as simple as;

    Code:
    sh /jffs/scripts/firewall
    And for the CLI users, here's a list of possible commands.

    Code:
    Here Are Some Example Unban Commands;
    ( sh /jffs/scripts/firewall unban ip 8.8.8.8 ) This Unbans The IP Specified
    ( sh /jffs/scripts/firewall unban range 8.8.8.8/24 ) This Unbans the CIDR Block Specified
    ( sh /jffs/scripts/firewall unban domain google.com ) This Unbans the URL Specified
    ( sh /jffs/scripts/firewall unban comment "Apples" ) This Unbans Entries With The Comment Apples
    ( sh /jffs/scripts/firewall unban country ) This Unbans Entries Added By The "Ban Country" Feature
    ( sh /jffs/scripts/firewall unban malware ) This Unbans Entries Added By The "Ban Malware" Feature
    ( sh /jffs/scripts/firewall unban nomanual ) This Unbans Everything But Manual Bans
    ( sh /jffs/scripts/firewall unban all ) This Unbans All Entries From Both Blacklists
    
    Here Are Some Example Ban Commands;
    ( sh /jffs/scripts/firewall ban ip 8.8.8.8 "Apples" ) This Bans The IP Specified With The Comment Apples
    ( sh /jffs/scripts/firewall ban range 8.8.8.8/24 "Apples" ) This Bans the CIDR Block Specified With The Comment Apples
    ( sh /jffs/scripts/firewall ban domain google.com ) This Bans the URL Specified
    ( sh /jffs/scripts/firewall ban country "pk cn sa" ) This Bans The Known IPs For The Specified Countries (Accepts Single/Multiple Inputs If Quoted) http://www.ipdeny.com/ipblocks/data/countries/
    
    Here Are Some Example Banmalware Commands;
    ( sh /jffs/scripts/firewall banmalware ) This Bans IPs From The Predefined Filter List
    ( sh /jffs/scripts/firewall banmalware google.com/filter.list ) This Uses The Fitler List From The Specified URL
    ( sh /jffs/scripts/firewall banmalware reset ) This Will Reset Skynet Back To The Default Filter URL
    ( sh /jffs/scripts/firewall banmalware exclude "list1.ipset|list2.ipset" ) This Will Exclude Lists Matching The Names "list1.ipset list2.ipset" From The Current Filter (Quotes And Pipes Are Nessessary For Seperating Multiple Entries!)
    ( sh /jffs/scripts/firewall banmalware exclude reset ) This Will Reset The Exclusion List
    
    Here Are Some Example Whitelist Commands;
    ( sh /jffs/scripts/firewall whitelist ip 8.8.8.8 "Apples" ) This Whitelists The IP Specified With The Comment Apples
    ( sh /jffs/scripts/firewall whitelist range 8.8.8.8/24 "Apples" ) This Whitelists The Range Specified With The Comment Apples
    ( sh /jffs/scripts/firewall whitelist domain google.com) This Whitelists the URL Specified
    ( sh /jffs/scripts/firewall whitelist vpn) Refresh VPN Whitelist
    ( sh /jffs/scripts/firewall whitelist remove all) This Removes All Non-Default Entries
    ( sh /jffs/scripts/firewall whitelist remove entry 8.8.8.8) This Removes IP/Range Specified
    ( sh /jffs/scripts/firewall whitelist remove comment "Apples" ) This Removes Entries With The Comment Apples
    ( sh /jffs/scripts/firewall whitelist refresh ) Regenerate Shared Whitelist Files
    ( sh /jffs/scripts/firewall whitelist list ips|domains|imported ) List Whitelist Entries Based On Category (Leave Blank For All)
    
    Here Are Some Example Import Commands;
    ( sh /jffs/scripts/firewall import blacklist file.txt "Apples" ) This Bans All IPs From URL/Local File With The Comment Apples
    ( sh /jffs/scripts/firewall import whitelist file.txt "Apples" ) This Whitelists All IPs From URL/Local File With The Comment Apples
    
    Here Are Some Example Deport Commands;
    ( sh /jffs/scripts/firewall deport blacklist file.txt ) This Unbans All IPs From URL/Local File
    ( sh /jffs/scripts/firewall deport whitelist file.txt ) This Unwhitelists All IPs From URL/Local File
    
    Here Are Some Example Update Commands;
    ( sh /jffs/scripts/firewall update ) Standard Update Check - If Nothing Detected Exit
    ( sh /jffs/scripts/firewall update check ) Check For Updates Only - Wont Update If Detected
    ( sh /jffs/scripts/firewall update -f ) Force Update Even If No Changes Detected
    
    Here Are Some Example Settings Commands;
    ( sh /jffs/scripts/firewall settings autoupdate enable|disable ) Enable/Disable Skynet Autoupdating
    ( sh /jffs/scripts/firewall settings banmalware daily|weekly|disable ) Enable/Disable Automatic Banmalware Updating
    ( sh /jffs/scripts/firewall settings debugmode enable|disable ) Enable/Disable Debug Mode
    ( sh /jffs/scripts/firewall settings filter all|inbound|outbound ) Select What Traffic To Filter
    ( sh /jffs/scripts/firewall settings unbanprivate enable|disable ) Enable/Disable Unban_PrivateIP Function
    ( sh /jffs/scripts/firewall settings loginvalid enable|disable ) Enable/Disable Invalid Packet Logging
    ( sh /jffs/scripts/firewall settings banaiprotect enable|disable ) Enable/Disable Banning IP's Flagged By AiProtect
    ( sh /jffs/scripts/firewall settings securemode enable|disable ) Enable/Disable Insecure Settings Being Applied In WebUI
    
    Here Are Some Example Debug Commands;
    ( sh /jffs/scripts/firewall debug watch ) Show Debug Entries As They Appear
    ( sh /jffs/scripts/firewall debug info ) Print Useful Debug Info
    ( sh /jffs/scripts/firewall debug clean ) Cleanup Syslog Entries
    ( sh /jffs/scripts/firewall debug swap install|uninstall ) Install/Uninstall SWAP File
    ( sh /jffs/scripts/firewall debug backup ) Backup Skynet Files To Skynets Install Directory With The Name "Skynet-Backup.tar.gz"
    ( sh /jffs/scripts/firewall debug restore ) Restore Backup Files From Skynets Install Directory With The Name "Skynet-Backup.tar.gz"
    
    
    Here Are Some Example Stats Commands;
    ( sh /jffs/scripts/firewall stats ) Compile Stats With Default Top10 Output
    ( sh /jffs/scripts/firewall stats 20 ) Compile Stats With Customizable Top20 Output
    ( sh /jffs/scripts/firewall stats tcp ) Compile Stats Showing Only TCP Entries
    ( sh /jffs/scripts/firewall stats tcp 20 ) Compile Stats Showing Only TCP Entries With Customizable Top20 Output
    ( sh /jffs/scripts/firewall stats search port 23 ) Search All Debug Data For Entries On Port 23
    ( sh /jffs/scripts/firewall stats search port 23 20 ) Search All Debug Data For Entries On Port 23 With Customizable Top20 Output
    ( sh /jffs/scripts/firewall stats search ip 8.8.8.8 ) Search All Debug Data For Entries On 8.8.8.8
    ( sh /jffs/scripts/firewall stats search ip 8.8.8.8 20 ) Search All Debug Data For Entries On 8.8.8.8 With Customizable Top20 Output
    ( sh /jffs/scripts/firewall stats search malware 8.8.8.8 ) Search Malwarelists For Specified IP
    ( sh /jffs/scripts/firewall stats search manualbans ) Search For All Manual Bans
    ( sh /jffs/scripts/firewall stats search device 192.168.1.134 ) Search For All Outbound Entries From Local Device 192.168.1.134
    ( sh /jffs/scripts/firewall stats search device reports ) Search Previous Hourly Report History
    ( sh /jffs/scripts/firewall stats remove ip 8.8.8.8 ) Remove Log Entries Containing IP 8.8.8.8
    ( sh /jffs/scripts/firewall stats remove port 23 ) Remove Log Entries Containing Port 23
    ( sh /jffs/scripts/firewall stats reset ) Reset All Collected Debug Data
    
     
    Last edited: Sep 15, 2018 at 8:04 AM
  2. Please support SNBForums! Just click on this link before you buy something from Amazon and we'll get a small commission on anything you buy. Thanks!
  3. Adamm

    Adamm Very Senior Member

    Joined:
    Mar 26, 2013
    Messages:
    1,582
    Halp - BestApp.exe or BestWebsite.com Is Being Blocked;

    Don't worry, tracking down false positive bans was at the core of design. Generally speaking you can follow these steps to find (and whitelist) anything incorrectly on your Blacklist!

    1.) Enable Debug Mode
    Code:
    sh /jffs/scripts/firewall settings debugmode enable
    2.) Open the blocked application/website and use the command;

    Code:
    sh /jffs/scripts/firewall debug watch
    Now look for a flood of [BLOCKED - OUTBOUND] coming from the same IP. This most likely will be the IP you are looking for if its being spammed in large numbers.

    3.) Copy the IP following "DST=" it should look something like this;
    Code:
    DST=175.115.37.52
    4.) Double check the IP is not actually something that should be banned, use a search tool like alienvault. If its related to a domain additional "Associated Domain" information should be printed beneath the log.

    Code:
    https://otx.alienvault.com/indicator/ip/175.115.37.52/
    5.) Great we have confirmed we found the IP of the blocked website/application we are looking for, lets whitelist it!

    Code:
    sh /jffs/scripts/firewall whitelist ip 175.115.37.52
     
    Last edited: Sep 10, 2018
  4. jernau

    jernau Regular Contributor

    Joined:
    May 30, 2013
    Messages:
    70
    Unfortunately this script doesn't work for me, I just get loads of errors stating that the --match-set argument is not available in the version of iptables installed;

    iptables v1.3.8: Unknown arg `--match-set'

    I'm running 374.41 Beta 1

    Also the firewall.sh script as downloaded appears to be in DOS format i.e. includes windows linefeeds (^M) so wouldn't run until I ran dos2unix on another machine against the file.
     
  5. Adamm

    Adamm Very Senior Member

    Joined:
    Mar 26, 2013
    Messages:
    1,582
    Thanks for pointing that out, for some reason my encoding settings seem to hate me and constantly change back (lol). Fixed and tested it to make sure it works.
     
  6. shooter40sw

    shooter40sw Senior Member

    Joined:
    Mar 3, 2013
    Messages:
    307
    Hi guys, I already have donwload manager installed, and no planes de uninstall it, or install entware, also have active ssh brute force prevention on the admin page, can I use this script?, I also use a "wierd" :D LAN setup! x.x.x.x/27 thanks
     
  7. Adamm

    Adamm Very Senior Member

    Joined:
    Mar 26, 2013
    Messages:
    1,582
    Yes this will also work with DLM installed, the requirement is so that optware is installed which happens during the DLM setup process.

    This script also should not interfere with any settings so go wild. The script also automatically detects your lan setup on start-up and whitelist's it (using the lan_ipaddr var)

    Hope this helps.
     
  8. jernau

    jernau Regular Contributor

    Joined:
    May 30, 2013
    Messages:
    70
    Does this script only work on certain Merlin versions as I mentioned before I keep getting the following error when running the script;

    iptables v1.3.8: Unknown arg `--match-set'
     
  9. Adamm

    Adamm Very Senior Member

    Joined:
    Mar 26, 2013
    Messages:
    1,582
    What router are you running and which firmware? Your IPTables is out of date compared to the latest release which the script is based on.

    [email protected]:/tmp/home/root# iptables -V
    iptables v1.4.14

    [email protected]:/tmp/home/root# ipset -V
    ipset v4.5, protocol version 4.
    Kernel module protocol version 4.


    Edit; Okay so just realized the AC66U for whatever reason is based on an older IPTables version. For now support is limited to the AC56U and AC68U. Sorry about that.
     
    Last edited: Apr 16, 2014
  10. octopus

    octopus Very Senior Member

    Joined:
    Jul 17, 2012
    Messages:
    971
    Use: -m set --match-set
     
    Last edited: Nov 7, 2016
  11. Adamm

    Adamm Very Senior Member

    Joined:
    Mar 26, 2013
    Messages:
    1,582
    I will eventually make the script dynamically adjust the IPTables syntax based on the router model, currently the N56U/AC66U/AC68U all run different versions of IPTables and IPSet which makes things painful as I'm maintaining 3 different scripts that do the same thing. I'll get around to it sooner or later.
     
  12. wbennett77

    wbennett77 Regular Contributor

    Joined:
    Jan 5, 2014
    Messages:
    160
    Location:
    Canada
    Hey Adamm,

    Thanks for sharing your work with us. I am using your script and being this is the first time I have ever used SSH and I have one question. I just upgraded the firmare to Merlins final .41 and I wanted to know if this area gets overwritten during the upgrade. I don't see the "starting ...." but I do see this:
    Apr 19 09:45:52 Firewall: [Complete] 0 IPs currently banned. 0 New IP's Banned.
    I am assuming that this means that it didn't get overwritten but being a rookie in this area just need to know for sure.

    Cheers!
     
  13. Adamm

    Adamm Very Senior Member

    Joined:
    Mar 26, 2013
    Messages:
    1,582
    Looks like its working fine, if you see anything like that in the syslog you can confirm its been executed.
     
  14. wbennett77

    wbennett77 Regular Contributor

    Joined:
    Jan 5, 2014
    Messages:
    160
    Location:
    Canada
    Thanks Adamm!
     
  15. idolza

    idolza New Around Here

    Joined:
    Apr 6, 2014
    Messages:
    3
    @Adamm thank you so much.

    Managed to get it working and its been doing its work for me :

    Apr 21 15:11:38 Firewall: [IP Banning Started] ... ... ...
    Apr 21 15:11:39 Firewall: [Complete] 159 IPs currently banned. 2 New IP's Banned.

    Having teenagers on the network, who aren't as careful - this also helps along with all the other measures I've put in place.
     
  16. wbennett77

    wbennett77 Regular Contributor

    Joined:
    Jan 5, 2014
    Messages:
    160
    Location:
    Canada
    That's a lot of banned IPs. Did you add anything to the defaults such as additional countries?
    Cheers!

    Sent from my Galaxy S4 using Tapatalk
     
  17. sinshiva

    sinshiva Very Senior Member

    Joined:
    Nov 8, 2013
    Messages:
    1,030
    Location:
    FL
    sometimes JFFS is overwritten during upgrades so it would definitely be wise to backup from time to time.
     
  18. wbennett77

    wbennett77 Regular Contributor

    Joined:
    Jan 5, 2014
    Messages:
    160
    Location:
    Canada
    One possibly strange question (rookie) but do I have to leave SSH enabled on the router for this to run correctly? The reason I ask is because as soon as I enable SSH the router log showed this but nothing before being enabled:
    Maybe it's just a coincidence?

    Cheers!
     
  19. Adamm

    Adamm Very Senior Member

    Joined:
    Mar 26, 2013
    Messages:
    1,582
    I believe your question was answered on IRC but for convience of others, no SSH being enabled is not a requirement but it is required to install the script (that or Telnet).

    And for clarification, the "firewall-start" script is how the firewall addition is initiated on boot (or firewall restart), along with setting up two conjobs that save the IP list and back it up.


    For others to see the scripts effectiveness, here's my firewalls results after a week.

     
    Last edited: Apr 22, 2014
  20. wbennett77

    wbennett77 Regular Contributor

    Joined:
    Jan 5, 2014
    Messages:
    160
    Location:
    Canada
    Good morning,

    Yes, after writing here I went directly to IRC and got the answer I was looking for.

    A couple other things.....how do I get an update as to how many ip's have currently been banned and where would I go to get a country list that works with your script.

    Thanks again!

    Cheers!
     
  21. Adamm

    Adamm Very Senior Member

    Joined:
    Mar 26, 2013
    Messages:
    1,582
    By default the cron should show this information every hour when the save command is executed. You can do this in ssh by using "firewall save"

    Also the country lists are located here. The country can be added using "firewall country" command then it prompts you type the two letter abbreviation.
     
Please support SNBForums! Just click on this link before you buy something from Amazon and we'll get a small commission on anything you buy. Thanks!