Hmm that could be a problem. It was running on my x86 OpenWRT box that I had since switching to PPPoE…I have the package installed on my mt-6000 but haven’t got round to configuring it.
NFTables is needed I believe since it uses ipsets
I had assumed that since gl-inet base their software off OpenWRT 23 the backend would be using NFTables…is this not the case?
Yeah, it’s true; GL customizations to make key GUI functions happen still relying on iptables, even on their flagship the Flint v2 which runs OWRT 23.05. I’ve been on their case about it but most of the other devices still run OWRT 21.02 so…
The good news is that upstream OWRT has a 23.05 dev snapshot available. Related thread:
if command -v iptables; then
if iptables -V | grep -E ' \(nf_tables\) *$'; then
echo "nft"
else
echo "iptables"
fi
elif command -v nft; then
echo "nft";
fi
I don’t have the issue; I run vanilla/pure OWRT 23.05’s PBR as a jump box behind a Slate AX as a WG gateway. I’m not inclined to trust ‘shim’ procs; not when there’s a chance of tunnel leakage. There’s a reason I don’t run without a kill switch on my gateway. YMMV.
Here, so you can fcvk around yet still unfcvk yourself :
Thank you, but respectfully disagree on that one - remember my use case is detecting IOCs going outbound not banning bad stuff in the WAN INPUT chain (the latter I think you might be referring to).
Malware commonly uses hard coded IP addresses to talk back to C2 servers, either for stealth or simplicity.
DNS blocking (e.g Adblock with Malware feed) will not stop these connections.
An ideal solution is to look for IOCs in both firewall and DNS logs.
I guess its a nice idea , but im afraid banip will not work on all routers due the hardware specifications it might need.
And sometimes banip can also become too restrictive , for example in one of my feeds it appears it blocked some ip from spotify so i had to add the offending domain names in the allow list, other times it blocked my local ranges.
Its a nice feature but im very afraid people might lack the essential skill to find the right offender in such situations
Edit:
Also ip addresses can change from ownership, the sad truth is that you can never fully control it, and often a entry can become a false positive.
I think Safing’s Portmaster Plus (read: paid) subscription should be handle that for you. It’s client side though. The F/OSS/Free-beer edition is great if you’re just looking for interception, denial.
@xize11 Thanks, was that the Firehol lists - they have many AWS/Azure ranges associated with spam email, and even RFC1918 ranges in there(!). I had the same problem with NGBlocker on PFSense.
URLHaus has had the least false positives and real hits for me, I use this professionally in an enterprise setting.
@bring.fringe18 Thanks, really interesting product. Although the appeal of the mt-6000 is that it’s the exit point to the internet, provides a shell/python, runs 24x7 at 7-10 watts and through Adblock/BanIP it can block IOT/mobile threats.
Anyway, thanks for the feedback everyone - it looks like it works fine on my router and I’m very happy.
Perhaps someone from @staff could kindly consider this for a feature request, Unifi have a similar feature on their high end solutions but I’d rather use gl-inet.
Well IDK how much this could be useful to you but dnscrypt-proxy2 can log all DNS lookups in conjunction w/ dnsmasq logging the LAN client/host. IDK about outbound IP attempts though. Still, it might be of interest to your use case. ‘More tools for the box’, if you will.
:
, for example in one of my feeds it appears it blocked some ip from spotify so i had to add the offending domain names in the allow list, other times it blocked my local ranges.