# Applying firewall rules **URL:** \ **Category:** Network and Wireless Configuration\ **Created:** [September 28, 2019, 11:57am UTC](https://forum.openwrt.org/t/applying-firewall-rules/45479 "2019-09-28T11:57:40Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![stynx](https://forum.openwrt.org/letter_avatar/stynx/32/5_5575768a8748004e209b776fc1b2916d.png) [@stynx](https://forum.openwrt.org/u/stynx)\ **Post date:** [September 28, 2019, 11:57am UTC](https://forum.openwrt.org/t/applying-firewall-rules/45479/1 "2019-09-28T11:57:40Z")
I've tried adding rules to the firewall to block some IP's/hosts but they don't get blocked. I pasted the rules from here: [https://github.com/crazy-max/WindowsSpyBlocker/tree/master/data/openwrt/spy](https://github.com/crazy-max/WindowsSpyBlocker/tree/master/data/openwrt/spy) Also, following the Wiki, I installed `iptables-mod-nat-extra` : [https://github.com/crazy-max/WindowsSpyBlocker/wiki/dataOpenWrt](https://github.com/crazy-max/WindowsSpyBlocker/wiki/dataOpenWrt) > DNS/IP block rules using dnsmasq / iptables are available in `data/openwrt` folder. > These rules are focused on latest OpenWrt release (Chaos Calmer 15.05.1). > > Requires package "iptables-mod-nat-extra" for port 53 (DNS) redirect rule from dnsmasq.conf. > dnsmasq.conf is bypassed if you use DNSCrypt on client machine (recommended) so use hosts before DNSCrypt exit point. > > DNSCrypt is also available in OpenWrt repo, but may be slow and CPU hungry on average routers, stay with the PC client as recommended. I then restarted the firewall `service firewall restart` but nothing gets blocked. I rebooted the router, but again - nothing gets blocked. So what am I doing wrong? ---
**Author:** ![lleachii](https://forum.openwrt.org/letter_avatar/lleachii/32/5_5575768a8748004e209b776fc1b2916d.png) [@lleachii](https://forum.openwrt.org/u/lleachii)\ **Post date:** [September 28, 2019, 12:22pm UTC](https://forum.openwrt.org/t/applying-firewall-rules/45479/2 "2019-09-28T12:22:58Z")
> [@stynx](#): > > So what am I doing wrong? A few notes: 1. The latest release (as of my posting) is 18.06.4, not 15.05.1 2. No clue what those IPs are 3. No clue why these IPs are not added using the normal method 4. No clue why you need `iptables-mod-nat-extra` (maybe it was needed in 15.05.1) 5. No clue why you believe these rules didn't work 6. No clue if you installed DNSCrypt - What are you actually trying to block...DNS...or something else? - Why do you think the rules didn't work (i.e. you expected something to stop, or you could actually still ping, browse, etc. - to the IPs)? Basically, describe how you know. - What version of OpenWrt are you running? I'm lost at why this script was updated a few days ago; but has information noting a version release 4+ years old, as recent... ---
**Author:** ![stynx](https://forum.openwrt.org/letter_avatar/stynx/32/5_5575768a8748004e209b776fc1b2916d.png) [@stynx](https://forum.openwrt.org/u/stynx)\ **Post date:** [September 28, 2019, 1:21pm UTC](https://forum.openwrt.org/t/applying-firewall-rules/45479/3 "2019-09-28T13:21:40Z")
Sorry for the confusion. I want to block the IP's and and domains from those two lists (dnsmasq.conf & firewall.user) so that Windows can't send telemetry data. I know they aren't being blocked because I can still ping. I'm using the latest snapshot for my device - GL-AR750S ([http://downloads.openwrt.org/snapshots/targets/ath79/generic/openwrt-ath79-generic-glinet\_gl-ar750s-squashfs-sysupgrade.bin](http://downloads.openwrt.org/snapshots/targets/ath79/generic/openwrt-ath79-generic-glinet_gl-ar750s-squashfs-sysupgrade.bin)). Is there any easier and straightforward way to block those IP's/domains, because that's all I really need. ---
**Author:** ![lleachii](https://forum.openwrt.org/letter_avatar/lleachii/32/5_5575768a8748004e209b776fc1b2916d.png) [@lleachii](https://forum.openwrt.org/u/lleachii)\ **Post date:** [September 28, 2019, 1:41pm UTC](https://forum.openwrt.org/t/applying-firewall-rules/45479/4 "2019-09-28T13:41:21Z")
> [@stynx](#): > > Is there any easier and straightforward way to block those IP's/domains, because that's all I really need. - For the domains, yes. I'd personally just install [Adblock](https://forum.openwrt.org/t/adblock-support-thread/507) and place them in the blacklist. This would allow me to block other domains/tracking later without a large fuss. - IPs...those `firewall.user` rules should have worked, if you tested from a client in LAN (FORWARD); and not the router itself (OUTPUT). You didn't mention if the DNS lookups are blocked when querying the OpenWrt's dnsmasq instance. If not, I believe that's because the [dnsmasq.conf additions are incorrect syntax](http://www.thekelleys.org.uk/dnsmasq/docs/dnsmasq-man.html)...or incomplete, rather. It's also not advisable to add raw configs and rules; but use OpenWrt's UCI/LuCI web GUI interfaces instead. The UCI file to edit for dnsmasq settings you desire is [`/etc/config/dhcp`](https://openwrt.org/docs/guide-user/base-system/dhcp). The firewall - [`/etc/config/firewall`](https://openwrt.org/docs/guide-user/firewall/firewall_configuration). BTW, snapshots update every ~24 hours, I'd also upgrade to the latest snapshot before installing more packages. ---
**Author:** ![stynx](https://forum.openwrt.org/letter_avatar/stynx/32/5_5575768a8748004e209b776fc1b2916d.png) [@stynx](https://forum.openwrt.org/u/stynx)\ **Post date:** [September 28, 2019, 5:58pm UTC](https://forum.openwrt.org/t/applying-firewall-rules/45479/5 "2019-09-28T17:58:19Z")
Tested again and IP's worked this time. No idea what was wrong the first time. As for Adblock - I've tried that a few days ago, but for some reason I was leaking DNS requests when enabled (my router is setup to connect to a VPN via Wireguard). I'll be playing with Adblock again. Thanks for the input! ---
**Author:** ![system](https://forum.openwrt.org/uploads/default/original/3X/7/4/740520c71f00039bbf001045c682f0ecb25e905a.png) [@system](https://forum.openwrt.org/u/system)\ **Post date:** [October 8, 2019, 6:09pm UTC](https://forum.openwrt.org/t/applying-firewall-rules/45479/6 "2019-10-08T18:09:42Z")
This topic was automatically closed 10 days after the last reply. New replies are no longer allowed.