Does Banip work with 23.05 and FW4?

Installing and Using OpenWrt
1

Hi,

I've read that Banip was not compatible with FW4 when 22.03 came out. How about now with 23.05?

I tried to block DoH today by using Banip and it didn't work.

Here's my Banip config - followed the wiki directions for this:

config banip 'global'
        option ban_enabled '1'
        option ban_debug '0'
        option ban_autodetect '1'
        list ban_logterm 'Exit before auth from'
        list ban_logterm 'luci: failed login'
        list ban_logterm 'error: maximum authentication attempts exceeded'
        list ban_logterm 'sshd.*Connection closed by.*\[preauth\]'
        list ban_logterm 'SecurityEvent=\"InvalidAccountID\".*RemoteAddress='
        option ban_deduplicate '1'
        option ban_loginput '1'
        option ban_logforwardwan '1'
        option ban_logforwardlan '0'
        option ban_autoallowlist '1'
        option ban_autoblocklist '1'
        option ban_allowlistonly '0'
        option ban_fetchcmd 'uclient-fetch'
        option ban_protov4 '1'
        list ban_ifv4 'wan'
        option ban_protov6 '1'
        list ban_ifv6 'wan6'
        list ban_dev 'wan'
        list ban_feed 'doh'
        list ban_feed 'proxy'
        list ban_feed 'doh'

Here's my DNS Redirect (pre-existed my Banip setup):

config redirect 'redirect_lan53'
        option name 'Redirect DNS'
        option src 'lan'
        option proto 'tcp udp'
        option src_dport '53'
        option dest_port '53'
        option target 'DNAT'
        option src_ip '!10.11.12.1'
        option dest 'lan'
        option dest_ip '10.11.12.1'

Any suggestions?

2

checked banIP support thread ?

3

I prefer reading something without 1662 comments...anyone have a working setup on 23.05?

4

image
image1490×408 32.9 KB

isn't good enough ?

1 Like
5

I have the updated version for 23.05 and I don't run snapshot. The problem is it doesn't work using the directions in the wiki,and the amount of documentation that a layman can find and use is lacking. Meanwhile I have no way of blocking DoH on my network, which is what my kids are using to get past my DNS Redirect settings.

6

as a temp solution, you can create an IPset with the DoH server IPs, then create a rule pointing towards the IPset.

something like Ipset-extras, ipset storage and blocking DNS over HTTPS

7

That's something to try. Thanks!

8

I have BanIP working with 23.05.

I don't see anything in your config specifying what to actually do with the doh list. I think you need something like this?

list ban_blockforwardlan 'doh'

There's lots of info here:

And setting things up using the LuCI interface is fairly straightforward.

9

My goal is to block public DoH servers on my network. I installed Banip and chose
doh (public DoH-Provider) in the Blocklist Feed Selection. After restarting it seems to be ineffective. If I'm supposed to choose something else in the gui to make it block the list then I'm not sure what that would be.

10

did you also implement the rest of https://openwrt.org/docs/guide-user/firewall/fw3_configurations/intercept_dns ?

11

You've selected the doh feed to download, but you also have to tell BanIP which chains you want to use that block list on, by selecting it here in the GUI for the LAN-Forward chain (i.e. to block packets forwarded from the LAN):

image
image919×741 33.8 KB

This will add an option to config file like the one I mentioned above.

12

Yes that was already in place.

13

Thanks I hope that helps. I'll try that and mark it as the solution if it works. Thanks!

14

Well that didn't work either. I'll post my banip config later. Have to go to work now.

15

Interesting. The BanIP service does need to be restarted to pick up that change - I'm not sure if that happens automatically when you click "Save and Apply" in the LuCI interface?

16

Me either, but you can manually restart it from the Luci-Banip gui.

17

This topic was automatically closed 10 days after the last reply. New replies are no longer allowed.