I have OpenWrt 23.05.2 x86/64 running as a Proxmox VM with pass-through NICs. There are no firewall rules defined. Input/Output/Forward are all 'accept'.
WAN is eth2 aka GE1_up. WAN IP is 192.168.1.201/24.
I have a PC connected to eth5 (MAC 22:6d:2a:8f:69:32) with client IP 10.5.20.9/24.
My test IP is 1.1.1.1 which is included in the DoH blocklist.
My goal is to selectively apply the DoH blocklist. The selective part is not working. As long as banIP is active, curl 1.1.1.1 fails to connect from the PC.
banip
config banip 'global'
option ban_enabled '1'
option ban_debug '0'
option ban_autodetect '0'
list ban_logterm 'Exit before auth from'
list ban_logterm 'luci: failed login'
list ban_logterm 'error: maximum authentication attempts exceeded'
list ban_logterm 'sshd.*Connection closed by.*\[preauth\]'
list ban_logterm 'SecurityEvent=\"InvalidAccountID\".*RemoteAddress='
list ban_logterm 'received a suspicious remote IP '\''.*'\'''
option ban_deduplicate '1'
list ban_blockforwardlan 'doh'
option ban_loginput '1'
option ban_logforwardwan '1'
option ban_logforwardlan '0'
list ban_feed 'doh'
option ban_autoallowlist '1'
option ban_autoblocklist '1'
option ban_allowlistonly '0'
option ban_fetchcmd 'curl'
option ban_protov4 '1'
option ban_blocktype 'reject'
option ban_blockpolicy 'forwardlan'
list ban_ifv4 'GE1_up'
list ban_dev 'eth2'
option ban_nftpriority '-200'
banip.allowlist
192.168.1.201/24 # uplink added on 2024-04-28 17:27:26
22:6d:2a:8f:69:32
root@OpenWrt-VM:~# /etc/init.d/banip survey allowlistv4MAC
:::
::: banIP Survey
:::
List of elements in the Set 'allowlistv4MAC' on 2024-04-28 20:59:30
---
{ "concat": [ "22:6d:2a:8f:69:32", { "prefix": { "addr": "0.0.0.0", "len": 0 } } ] }
I disable IPv6 whenever possible, but it's a losing battle.
Auto Detection makes no difference. I was trying to simplify.
The input interface is 'virtual' via SR-IOV pass-through. Could that make a technical difference?
Since the MAC is currently randomly-assigned, I'm going to make some config changes on the host to assign a permanent MAC and then reboot. Maybe some magic will happen.
I don't know if it is a bug or not but with latest two builds I had two hangs when I changed blocklist feeds. I added some new feeds and then hit save&apply and after one or two minutes all network traffic was interrupted, router could not be accessed and I had to reboot it disconnecting power.
Just tried it for the third time and it hanged again. Looks like OOM.
Here it is. After reboot it doesn't hang but takes over 8 minutes to start.
config banip 'global'
option ban_enabled '1'
option ban_debug '0'
option ban_autodetect '1'
list ban_logterm 'Exit before auth from'
list ban_logterm 'luci: failed login'
list ban_logterm 'error: maximum authentication attempts exceeded'
list ban_logterm 'sshd.*Connection closed by.*\[preauth\]'
list ban_logterm 'SecurityEvent=\"InvalidAccountID\".*RemoteAddress='
option ban_deduplicate '1'
option ban_loginput '0'
option ban_logforwardwan '0'
option ban_logforwardlan '0'
option ban_autoallowlist '1'
option ban_autoblocklist '1'
option ban_allowlistonly '0'
list ban_trigger 'wan'
option ban_triggeraction 'start'
option ban_fetchretry '5'
option ban_fetchcmd 'curl'
option ban_protov4 '1'
list ban_ifv4 'wan'
list ban_ifv6 'wan6'
option ban_nicelimit '0'
option ban_filelimit '1024'
option ban_cores '4'
option ban_splitsize '4096'
option ban_nftpolicy 'memory'
option ban_nftpriority '-200'
option ban_loglimit '100'
option ban_nftloglevel 'warn'
option ban_autoallowuplink 'subnet'
option ban_nftexpiry '2h'
list ban_blockforwardlan 'adaway'
list ban_blockforwardlan 'adguard'
list ban_blockforwardlan 'antipopads'
list ban_blockforwardlan 'iblockads'
list ban_blockforwardlan 'iblockspy'
list ban_blockforwardlan 'oisdsmall'
option ban_icmplimit '10'
option ban_synlimit '10'
option ban_udplimit '100'
option ban_logprerouting '0'
option ban_blocktype 'drop'
list ban_dev '10g-1'
list ban_blockinput 'backscatterer'
list ban_blockinput 'becyber'
list ban_blockinput 'binarydefense'
list ban_blockinput 'bogon'
list ban_blockinput 'bruteforceblock'
list ban_blockinput 'cinsscore'
list ban_blockinput 'debl'
list ban_blockinput 'etcompromised'
list ban_blockinput 'feodo'
list ban_blockinput 'firehol1'
list ban_blockinput 'ipsum'
list ban_blockinput 'ipthreat'
list ban_blockinput 'pallebone'
list ban_blockinput 'threat'
list ban_blockinput 'threatview'
list ban_blockinput 'turris'
list ban_blockinput 'urlvir'
list ban_blockinput 'voip'
list ban_blockinput 'webclient'
list ban_blockforwardwan 'backscatterer'
list ban_blockforwardwan 'becyber'
list ban_blockforwardwan 'binarydefense'
list ban_blockforwardwan 'bogon'
list ban_blockforwardwan 'bruteforceblock'
list ban_blockforwardwan 'cinsscore'
list ban_blockforwardwan 'debl'
list ban_blockforwardwan 'etcompromised'
list ban_blockforwardwan 'feodo'
list ban_blockforwardwan 'firehol1'
list ban_blockforwardwan 'ipsum'
list ban_blockforwardwan 'ipthreat'
list ban_blockforwardwan 'pallebone'
list ban_blockforwardwan 'threat'
list ban_blockforwardwan 'threatview'
list ban_blockforwardwan 'turris'
list ban_blockforwardwan 'urlvir'
list ban_blockforwardwan 'voip'
list ban_blockforwardwan 'webclient'
list ban_feed 'backscatterer'
list ban_feed 'becyber'
list ban_feed 'binarydefense'
list ban_feed 'bogon'
list ban_feed 'bruteforceblock'
list ban_feed 'cinsscore'
list ban_feed 'debl'
list ban_feed 'etcompromised'
list ban_feed 'firehol1'
list ban_feed 'ipsum'
list ban_feed 'ipthreat'
list ban_feed 'pallebone'
list ban_feed 'sslbl'
list ban_feed 'threat'
list ban_feed 'threatview'
list ban_feed 'turris'
list ban_feed 'urlvir'
list ban_feed 'voip'
list ban_feed 'webclient'
edit:
Clear all Firefox cache(keep cookeis), now no errors. I only remove 192.168.1.1 cache first.
But after test on Chrome(no error), I clear all Firefox cache.
