TomatoUSB

Hi guys,

I've spent over an hour trying to find a thread on this forum on how to fix my problem but have had little luck. I'm obviously missing something so elementary that I'll kick myself once a viable answer is given, but I have no idea what it is at this point and could use a nudge in the right direction. Here's my situation:

I am running a ZyXEL NSA325 NAS on my network, which is running PureFTPD so that my friends and I can access needed files.

The problem is that I keep getting script-kiddies pounding at the gates at all times, now. There is no anonymous access and both the logins and passwords are very secure, but I just don't like giving these little twerps the satisfaction. As is usual on the net, most IPs resolve to China or Russia. I would like to block these IPs at the router, but can't seem to find a way to do it in the GUI.

I'm running Shibby's Tomato Firmware 1.28.0000 MIPSR2-102 K26 USB AIO on an ASUS RT-N16. I would think something as simple as blocking an IP range would be a rudimentary need for just about any user, but I can't seem to figure a way to do it. Sadly, the firewall GUI has nothing in the way of this kind of functionality and I am pretty much clueless when it comes to working with iptables at this point.

Any help would be greatly appreciated.

8-) LJ

dd-wrt with OTRW (Optware the right way) had a set of scripts called Asiablock which would do exactly what you want, sadly it seems no longer maintained, but there's a now a newer version created by basmaf, and he is looking to make a version for tomato…

I think you could use Tomato GUI access restriction for remote IP ranges, but I think the lists are so big they need to be in scripts not nvram!

see http://www.ipdeny.com/ipblocks/data/countries/ for lists of addresses

You can use ipset module on iptables to handle this

@guest
"You can use ipset module on iptables to handle this"

As I said in my original post, I have no knowledge as yet on how to work with iptables.

From the Linux Journal homepage:

"Getting ipset

ipset is a simple package option in many distributions, and since plenty of other installation resources are available, I don't spend a whole lot of time on that here.

The important thing to understand is that like iptables, ipset consists of both a user-space tool and a kernel module, so you need both for it to work properly. You also need an "ipset-aware" iptables binary to be able to add rules that match against sets.

Start by simply doing a search for "ipset" in your distribution's package management tool. There is a good chance you'll be able to find an easy procedure to install ipset in a turn-key way. In Ubuntu (and probably Debian), install the ipset and xtables-addons-source packages. Then, run module-assistant auto-install xtables-addons, and ipset is ready to go in less than 30 seconds.

If your distro doesn't have built-in support, follow the manual installation procedure listed on the ipset home page (see Resources) to build from source and patch your kernel and iptables.

The versions used in this article are ipset v4.3 and iptables v1.4.9."

At this stage in my education (or rather, lack thereof), attempting this would be a bit above my pay grade, if you will. I am not knowledgeable enough to try to recompile tomato's kernel or iptables in order to implement this. Also, since I don't wish to run a separate linux box as a stand-alone firewall, I am not sure how applicable this would be to my situation. Perhaps there is something I am missing in your suggestion?

@mstombs

Thank you for your quick reply.

I have looked up several pages about Asiablock, but am having a little trouble finding anything applicable to Tomato. It looks like EXACTLY what I would need, though. I did find a few threads in this forum dating back to 2010 on the subject, but it seems no one has messed with it since then. I find it hard to believe that this isn't basic functionality, or at the very least, that more people aren't interested in this sort of security for their systems.

"I think you could use Tomato GUI access restriction for remote IP ranges, but I think the lists are so big they need to be in scripts not nvram!"

Are there any tutorials that you could point me towards on how to implement this? Any further help you could lend would be greatly appreciated.

OTRW take 2 is in development by basmaf, for evidence see
http://svn.basmaf.com/browser/trunk/tomato-dev

guess it should now be helping use of Entware, not Optware, but the Asia block is jump scripts that build the iptables rules for links into the firewall scripts

Just checked tomato restriction, it does seem just to be only for outgoing blocks, I guess you could use port forwarding to a dummy IP address?. So it should be script I guess, I suggest the most appropriate iptables target would be the WANPREROUTING chain so you need to add to the firewall script lines like the following,

BAD=xxx.xxx.xxx.xxx
iptables -t nat -I WANPREROUTING -s $BAD -j DROP

But watch out firewall script is stored in nvram. It would be easy to read a list of BAD IP addresses from a file on /jffs

I also remember discussion on the net that connections should be rejected or reset, silently dropping leads to multiple retries

@mstombs,

Thank you for the reply.

I'll give this a try. Sadly, it won't last long, though. I reboot the router once a week automatically.

Happy holidays to you and yours,

Block all of China or any other country
These are the source lists I get the ISO code from and use.

http://www.ipdeny.com/ipblocks/data/countries/
http://www.ipdeny.com/ipblocks/

Save this to a file with a .sh extension on a usb stick and plug it in,
or run from the router in jffs. I like the usb as it's easier during upgrades.
The run in cron weekly like this "sh myfilename.sh"

#!/bin/bash
### Block all traffic from ISO code ###
ISO="cn"

### Set PATH ###
IPT=/usr/sbin/iptables
WGET=/usr/bin/wget
EGREP=/bin/egrep

### No editing below ###
SPAMLIST="countrydrop"
ZONEROOT="/root/iptables"
DLROOT="http://www.ipdeny.com/ipblocks/data/countries"

cleanOldRules(){
$IPT -F $SPAMLIST
}

# create a dir
[ ! -d $ZONEROOT ] && /bin/mkdir -p $ZONEROOT

# clean old rules
cleanOldRules

# create a new iptables list
$IPT -N $SPAMLIST

for c  in $ISO
do
    # local zone file
    tDB=$ZONEROOT/$c.zone

    # get fresh zone file
    $WGET -O $tDB $DLROOT/$c.zone

    # country specific log message
    SPAMDROPMSG="$c Country Drop"

    # get 
    BADIPS=$(egrep -v "^#|^$" $tDB)
    for ipblock in $BADIPS
    do
       $IPT -A $SPAMLIST -s $ipblock -j LOG --log-prefix "$SPAMDROPMSG"
       $IPT -A $SPAMLIST -s $ipblock -j DROP
    done
done

# Drop everything 
$IPT -I INPUT -j $SPAMLIST
$IPT -I OUTPUT -j $SPAMLIST
$IPT -I FORWARD -j $SPAMLIST

exit 0

@KillerTomato,

First of all, thank you so much for your post.

I did as you said, although I put mine in /jffs/.

I created a cron job to run once a week.

Then I ran it in Tools>System and, after several minutes, got the following as a result:

iptables: No chain/target/match by that name 
Connecting to www.ipdeny.com (108.61.30.158:80) 

cn.zone              100% |*******************************| 44966  --:--:-- ETA

Is this correct?

Thanks again. This looks like it will be perfect for my needs.

It takes a good 10 minutes for the ip tables to write, China is HUGE !!
I first ran it via ssh to test, try a telnet or ssh next time, or the cron job.
My usb cron job is ran like this:

[[/code]]
sh /tmp/mnt/sda1/Storage/countryblock/countryblock.sh
[[/code]]

Then check in 10 minutes or so.
iptables -L countrydrop

The script also might need a modification or two for your router, not sure, I'm running Asus RT-N16.

I would LOVE to see a GUI with this script built into the next release.
Also would love to see a Sorbs, Spamcop, Spamhaus blocking done the same way.
via script, no optware. in the GUI.
Optware takes too long to rebuild after a upgrade or failure.

I don't know why the [[/code]] brackets were included in the last post, weird.