Blocking URL's/IP's
From DD-WRT Wiki
Revision as of 10:46, 22 October 2010 (edit) Sash (Talk | contribs) (New page: __TOC__ ==Block URLs with an Automatically Downloaded Host File== This was originally taken from mraneri from the Linksys forum, but was heavily modified. <pre> #!/bin/sh logger WAN up ...) ← Previous diff |
Revision as of 11:33, 22 October 2010 (edit) (undo) Sash (Talk | contribs) (→Global Management of Blacklists) Next diff → |
||
Line 56: | Line 56: | ||
- | ==Global | + | ==Global Blacklisting per MAC== |
If you have a lot of DD-WRT routers, then denying of access for abusing users through the web interface of each router can be time consuming.<p> | If you have a lot of DD-WRT routers, then denying of access for abusing users through the web interface of each router can be time consuming.<p> | ||
Here is a small firewall script to automatically download MAC-addresses of computers that should be denied access. The format of the file is Unix textfile one MAC address per line. The script assumes that you have a jffs partition. You can run it at startup by saving it as /jffs/etc/config/wifi_bl.wanup | Here is a small firewall script to automatically download MAC-addresses of computers that should be denied access. The format of the file is Unix textfile one MAC address per line. The script assumes that you have a jffs partition. You can run it at startup by saving it as /jffs/etc/config/wifi_bl.wanup | ||
Line 79: | Line 79: | ||
done | done | ||
</pre> | </pre> | ||
- | |||
- | |||
- | |||
==White Listing== | ==White Listing== |
Revision as of 11:33, 22 October 2010
Contents |
Block URLs with an Automatically Downloaded Host File
This was originally taken from mraneri from the Linksys forum, but was heavily modified.
#!/bin/sh logger WAN up script executing sleep 5 if test ! -s /tmp/dlhosts then cat >/tmp/dlhosts <<"EOF" #!/bin/sh logger Downloading http://www.mvps.org/winhelp2002/hosts.txt wget -O - http://www.mvps.org/winhelp2002/hosts.txt | grep 127.0.0.1 | sed '2,$s/127.0.0.1/0.0.0.0/g; s/[[:space:]]*#.*$//g;' | grep -v localhost | tr ' ' '\t' | tr -s '\t' | tr -d '\015' | sort -u >/tmp/hosts0 grep addn-hosts /tmp/dnsmasq.conf || echo "addn-hosts=/tmp/hosts0" >>/tmp/dnsmasq.conf logger Restarting dnsmasq killall dnsmasq dnsmasq --conf-file=/tmp/dnsmasq.conf EOF chmod 777 /tmp/dlhosts /tmp/dlhosts fi grep -q '/tmp/dlhosts' /tmp/crontab || echo "45 23 * * 5 root /tmp/dlhosts" >>/tmp/crontab
This script automatically downloads a host file from: "http://www.mvps.org/winhelp2002/hosts.txt" and redirects all the URLs in that file to 127.0.0.1. All those URLs are common malware or advertisement sites so is better to block them. You can also download the file, modify it with new URLs that you want to block or delete the ones you don't want to block and then upload to a web site and change the URL in the code to your custom one. Be aware that the more URLs in the file the more RAM that you will be eating from your router. Check the file size and your free memory to see if it will suit you. If not just erase some URLs... If you want to block all URLs since the router boots then just placed in the startup scripts.
--Brueggmann 10.17.2010 - I've modified the "killall" line as sending a HUP didn't reread the configuration file for me. Please see the dnsmasq man page.
Update by Aviad (A.K.A. Hotfortech): While the above works just fine, there are two main disadvantages of the above method:
1. The blocked content will be shown as "page cannot be displayed" within the websites advertisement segments and will cause the page to not load until the browser gives up on the missing object.
2. If you want to add sites to the block list, you have to do it on a per host bases... (tedious)
Enter shameless self promotion -> I have created a script on my wiki that deals with the above and more by using the pixelserv method described in the forum. you can find the script and a detailed explanation on how it works on my wiki: http://hotfortech.wikispaces.com/How+to+remove+advertisements+with+pixelserv+on+DD-WRT
Hope this helps anyone.
Global Blacklisting per MAC
If you have a lot of DD-WRT routers, then denying of access for abusing users through the web interface of each router can be time consuming.Here is a small firewall script to automatically download MAC-addresses of computers that should be denied access. The format of the file is Unix textfile one MAC address per line. The script assumes that you have a jffs partition. You can run it at startup by saving it as /jffs/etc/config/wifi_bl.wanup
#!/bin/sh cd /jffs rm wifi_blacklist.txt #Please modify the script to download the blacklist file from your web server wget http://www.myserver.com/wifi_blacklist.txt module_exists=`lsmod | grep ipt_mac` if [ -z "$module_exists" ] ; then insmod ipt_mac fi #Deleting the old table old_mac=`iptables -L | egrep "..:..:..:..:..:.." | sed "s/.*\(..:..:..:..:..:..\).*/\1/"` for mac in $old_mac ; do iptables -D FORWARD -p tcp -m mac --mac-source $mac -j REJECT --reject-with tcp-reset done #Adding the table again for mac in `cat /jffs/wifi_blacklist.txt` ; do iptables -I FORWARD -p tcp -m mac --mac-source $mac -j REJECT --reject-with tcp-reset done
White Listing
If you want to create a white list to block access by default but allow certain traffic through, then you can use this script to do it. Remove any junk comment lines beginning with # to save nvram space. Discuss here.
# IP Tables White Listing script by phuzi0n -Tek @ http://www.dd-wrt.com/phpBB2/viewtopic.php?t=56588 # Version 4. Please increment version number with subsequent modifications. GeeTek. # Set up the chain iptables -N wanout iptables -I INPUT -i `nvram get lan_ifname` -j wanout iptables -I FORWARD -i `nvram get lan_ifname` -j wanout # Create whitelist 'function' script WOUT="/tmp/wanout" echo 'iptables -I wanout -j ACCEPT' > $WOUT chmod 777 $WOUT # Exempt Machine MAC # load xt_mac instead of ipt_mac on k2.6 builds insmod ipt_mac $WOUT '-m mac --mac-source 00:30:18:A9:A9:C6' # Exempt Machine IP $WOUT '-s 192.168.1.2' # Allow everyone access to these sites $WOUT '-d www.google.com' $WOUT '-d www.yahoo.com' $WOUT '-d www.dd-wrt.com' # Allow everyone access to these IP Addresses $WOUT '-d 74.125.67.100' $WOUT '-d 74.125.127.100' $WOUT '-d 74.125.45.100' $WOUT '-d 209.131.36.158' #Allow everyone access to specific destination ports $WOUT '-p udp --dport 8000' $WOUT '-p tcp --dport 80' # Everything else gets blocked iptables -A wanout -j REJECT --reject-with icmp-proto-unreachablehttp://www.dd-wrt.com/wiki/index.php/Ad_blocking