Hi folks,
I have set the firewall to block IPs and subnets, but after blocking, the settings are not taking effect and connections from those supnets and IPs are stillbeing let in. Hope someone can help please.
What information do you need to know?
We need more information. /etc/config/firewall
The default install of openwrt already rejects traffic on input and forward.
Let's actually review the complete config so that we understand the context of your setup. Also, please indicate what your intended firewall restrictions/allowances should be.
Please connect to your OpenWrt device using ssh and copy the output of the following commands and post it here using the "Preformatted text </> " button (red circle; this works best in the 'Markdown' composer view in the blue oval):
Remember to redact passwords, VPN keys, MAC addresses and any public IP addresses you may have:
ubus call system board
cat /etc/config/network
cat /etc/config/wireless
cat /etc/config/dhcp
cat /etc/config/firewall
Okay, here are them all...
SYSTEM BOARD DETAILS
{
"kernel": "6.6.119",
"hostname": "WANSYS",
"system": "{VIRTUALISED}",
"model": "{VIRTUALISED}",
"board_name": "{VIRTUALISED}",
"rootfs_type": "squashfs",
"release": {
"distribution": "OpenWrt",
"version": "24.10.5",
"revision": "r29087-d9c5716d1d",
"target": "x86/64",
"description": "OpenWrt 24.10.5 r29087-d9c5716d1d",
"builddate": "1766005702"
}
}
NETWORK DETAIL
config interface 'loopback'
option device 'lo'
option proto 'static'
option ipaddr '127.0.0.1'
option netmask '255.0.0.0'
config globals 'globals'
option ula_prefix '{IPV6REDACT}/48'
option packet_steering '1'
config interface 'int_lan'
option proto 'static'
option device 'eth1'
option ipaddr '{NET1}.1'
option netmask '255.255.255.0'
option delegate '0'
config interface 'int_msc'
option proto 'static'
option device 'eth3'
option ipaddr '{NET3}.1'
option netmask '255.255.255.0'
config device
option name 'eth0'
option sendredirects '0'
option arp_accept '0'
option drop_gratuitous_arp '1'
option multicast '0'
option learning '0'
option unicast_flood '0'
option ipv6 '0'
option rpfilter 'strict'
config device
option name 'eth1'
option ipv6 '0'
option sendredirects '0'
option arp_accept '0'
option drop_gratuitous_arp '1'
option multicast '0'
config device
option name 'eth2'
option ipv6 '0'
option sendredirects '0'
option arp_accept '0'
option drop_gratuitous_arp '1'
option multicast '0'
config device
option name 'eth3'
option ipv6 '0'
option acceptlocal '1'
option sendredirects '0'
option arp_accept '0'
option drop_gratuitous_arp '1'
option multicast '0'
config device
option name 'eth4'
option ipv6 '0'
option acceptlocal '1'
option sendredirects '0'
option arp_accept '0'
option drop_gratuitous_arp '1'
option multicast '0'
config interface 'int_wan'
option proto 'dhcp'
option device 'eth0'
config interface 'int_REDACT'
option proto 'static'
option device 'eth4'
option ipaddr '{NET4}.1'
option netmask '255.255.255.0'
option delegate '0'
config interface 'int_servers'
option proto 'static'
option device 'eth2'
option ipaddr '{NET2}.1'
option netmask '255.255.255.0'
option delegate '0'
config device
option name 'eth5'
option sendredirects '0'
option drop_gratuitous_arp '1'
option multicast '0'
config interface 'int_dev'
option proto 'static'
option device 'eth5'
option ipaddr '{NET5}.1'
option netmask '255.255.255.0'
option delegate '0'
There is no DHCP or DNS on this service, and it isn't active for use.
FIREWALL ================ Long one.
config defaults
option input 'REJECT'
option output 'ACCEPT'
option forward 'REJECT'
option synflood_protect '1'
option drop_invalid '1'
config zone
option name 'zone_lan'
option input 'ACCEPT'
option output 'ACCEPT'
option forward 'ACCEPT'
list network 'int_lan'
config zone
option name 'wan'
option input 'REJECT'
option output 'ACCEPT'
option forward 'REJECT'
option masq '1'
option mtu_fix '1'
list network 'int_wan'
config forwarding
option src 'zone_lan'
option dest 'wan'
config zone
option name 'zone_{REDACTED}'
option input 'ACCEPT'
option output 'ACCEPT'
option forward 'ACCEPT'
list network 'int_{REDACTED}'
config forwarding
option src 'zone_{REDACTED}'
option dest 'wan'
config zone
option name 'zone_servers'
option input 'ACCEPT'
option output 'ACCEPT'
option forward 'ACCEPT'
list network 'int_servers'
config forwarding
option src 'zone_servers'
option dest 'wan'
config redirect
option dest 'zone_servers'
option target 'DNAT'
option name 'web-in-443'
option src 'wan'
option src_dport '443'
option dest_ip '{NET2}.131'
option dest_port '443'
list proto 'tcp'
option reflection_src 'external'
list reflection_zone 'zone_lan'
list reflection_zone 'zone_{REDACTED}'
list reflection_zone 'zone_servers'
option enabled '0'
config redirect
option dest 'zone_servers'
option target 'DNAT'
option name 'web-in-443'
option src 'wan'
option src_dport '80'
option dest_ip '{NET2}.131'
option dest_port '80'
list proto 'tcp'
option reflection_src 'external'
list reflection_zone 'zone_lan'
list reflection_zone 'zone_{REDACTED}'
list reflection_zone 'zone_servers'
option enabled '0'
config redirect
option dest 'zone_servers'
option target 'DNAT'
option name 'web-in-7790'
option src 'wan'
option src_dport '7790'
option dest_ip '{NET2}.131'
option dest_port '7790'
list proto 'tcp'
option reflection_src 'external'
list reflection_zone 'zone_lan'
list reflection_zone 'zone_{REDACTED}'
list reflection_zone 'zone_servers'
option enabled '0'
config rule
option src 'wan'
option name 'ICMP Drop'
option direction 'in'
option device 'eth0'
list proto 'icmp'
option target 'DROP'
config rule
option src 'zone_{REDACTED}'
option name 'ICMP Drop'
option direction 'in'
option device 'eth0'
list proto 'icmp'
option target 'DROP'
option dest '*'
config rule
option dest '*'
list src_ip '0.0.0.0'
list dest_ip '255.255.255.255'
option target 'DROP'
option name 'UDP pump'
option direction 'out'
option device 'eth0'
list proto 'all'
option src '*'
config rule
option src 'wan'
option name 'blockin_8s'
option target 'DROP'
option direction 'in'
option device 'eth0'
list src_ip '4.0.0.0/8'
list src_ip '13.0.0.0/8'
list src_ip '17.0.0.0/8'
list src_ip '18.0.0.0/8'
list src_ip '20.0.0.0/8'
list src_ip '23.0.0.0/8'
list src_ip '35.0.0.0/8'
list src_ip '38.0.0.0/8'
list src_ip '40.0.0.0/8'
list src_ip '43.0.0.0/8'
list src_ip '45.0.0.0/8'
list src_ip '52.146.0.0/8'
list src_ip '65.0.0.0/8'
list src_ip '72.0.0.0/8'
list src_ip '104.0.0.0/8'
list src_ip '141.0.0.0/8'
list src_ip '142.250.0.0/8'
list src_ip '150.0.0.0/8'
list src_ip '151.0.0.0/8'
list src_ip '162.158.0.0/8'
list src_ip '172.0.0.0/8'
list src_ip '178.0.0.0/8'
list src_ip '207.0.0.0/8'
config rule
option src 'wan'
option name 'blockin_9s'
option target 'DROP'
option direction 'in'
option device 'eth0'
list src_ip '3.0.0.0/9'
list src_ip '3.128.0.0/9'
config rule
option src 'wan'
option name 'blockin_10s'
option target 'DROP'
option direction 'in'
option device 'eth0'
list src_ip '20.64.0.0/10'
list src_ip '20.192.0.0/10'
list src_ip '34.64.0.0/10'
list src_ip '34.128.0.0/10'
list src_ip '34.192.0.0/10'
list src_ip '116.128.0.0/10'
config rule
option src 'wan'
option name 'blockin_11s'
option target 'DROP'
option direction 'in'
option device 'eth0'
list src_ip '8.220.219.161/11'
list src_ip '13.64.0.0/11'
list src_ip '23.32.0.0/11'
list src_ip '27.192.0.0/11'
list src_ip '34.32.0.0/11'
list src_ip '44.192.0.0/11'
list src_ip '44.224.0.0/11'
list src_ip '54.160.0.0/11'
config rule
option src 'wan'
option name 'blockin_12s'
option target 'DROP'
option direction 'in'
option device 'eth0'
list src_ip '3.80.0.0/12'
list src_ip '4.208.0.0/12'
list src_ip '4.224.0.0/12'
list src_ip '14.16.0.0/12'
list src_ip '20.48.0.0/12'
list src_ip '32.192.0.0/12'
list src_ip '34.16.0.0/12'
list src_ip '35.192.0.0/12'
list src_ip '35.208.0.0/12'
list src_ip '35.224.0.0/12'
list src_ip '40.80.0.0/12'
list src_ip '40.96.0.0/12'
list src_ip '52.96.0.0/12'
list src_ip '54.144.0.0/12'
list src_ip '54.192.0.0/12'
list src_ip '104.16.0.0/12'
list src_ip '119.176.0.0/12'
list src_ip '136.112.0.0/12'
config rule
option src 'wan'
option name 'blockin_13s'
option target 'DROP'
option direction 'in'
option device 'eth0'
list src_ip '13.96.0.0/13'
list src_ip '20.40.0.0/13'
list src_ip '20.184.0.0/13'
list src_ip '32.184.0.0/13'
list src_ip '34.8.0.0/13'
list src_ip '35.240.0.0/13'
list src_ip '40.112.0.0/13'
list src_ip '54.208.0.0/13'
list src_ip '172.64.0.0/13'
list src_ip '172.200.0.0/13'
list src_ip '172.232.0.0/13'
config rule
option src 'wan'
option name 'blockin_14s'
option target 'DROP'
option direction 'in'
option device 'eth0'
list src_ip '1.12.0.0/14'
list src_ip '13.104.0.0/14'
list src_ip '13.224.0.0/14'
list src_ip '20.36.0.0/14'
list src_ip '20.180.0.0/14'
list src_ip '23.64.0.0/14'
list src_ip '40.76.0.0/14'
list src_ip '40.120.0.0/14'
list src_ip '52.112.0.0/14'
list src_ip '52.120.0.0/14'
list src_ip '54.216.0.0/14'
list src_ip '123.4.0.0/14'
list src_ip '136.108.0.0/14'
list src_ip '35.252.0.0/14'
list src_ip '23.20.0.0/14'
config rule
option src 'wan'
option name 'blockin_15s'
option target 'DROP'
option direction 'in'
option device 'eth0'
list src_ip '13.126.0.0/15'
list src_ip '16.144.0.0/15'
list src_ip '20.34.0.0/15'
list src_ip '23.94.0.0/15'
list src_ip '34.6.0.0/15'
list src_ip '40.74.0.0/15'
list src_ip '54.90.0.0/15'
list src_ip '54.220.0.0/15'
list src_ip '60.165.0.0/15'
list src_ip '101.42.0.0/15'
list src_ip '139.226.0.0/15'
list src_ip '192.178.0.0/15'
list src_ip '202.112.0.0/15'
list src_ip '162.158.0.0/15'
config rule
option src 'wan'
option name 'blockin_16s'
option target 'DROP'
option direction 'in'
option device 'eth0'
list src_ip '5.9.0.0/16'
list src_ip '5.188.0.0/16'
list src_ip '9.234.0.0/16'
list src_ip '16.146.0.0/16'
list src_ip '20.33.0.0/16'
list src_ip '20.128.0.0/16'
list src_ip '34.5.0.0/16'
list src_ip '40.124.0.0/16'
list src_ip '41.41.0.0/16'
list src_ip '43.157.0.0/16'
list src_ip '45.79.0.0/16'
list src_ip '45.163.0.0/16'
list src_ip '45.186.0.0/16'
list src_ip '47.88.0.0/16'
list src_ip '47.243.0.0/16'
list src_ip '47.253.0.0/16'
list src_ip '48.217.0.0/16'
list src_ip '62.210.0.0/16'
list src_ip '68.183.0.0/16'
list src_ip '71.6.128.0/16'
list src_ip '72.167.0.0/16'
list src_ip '74.7.128.0/16'
list src_ip '74.125.0.0/16'
list src_ip '104.36.192.0/16'
list src_ip '104.238.0.0/16'
list src_ip '113.131.0.0/16'
list src_ip '122.51.0.0/16'
list src_ip '122.161.0.0/16'
list src_ip '124.156.0.0/16'
list src_ip '132.220.0.0/16'
list src_ip '134.209.0.0/16'
list src_ip '136.107.0.0/16'
list src_ip '138.255.0.0/16'
list src_ip '140.245.0.0/16'
list src_ip '141.76.0.0/16'
list src_ip '143.0.0.0/16'
list src_ip '143.202.0.0/16'
list src_ip '149.57.0.0/16'
list src_ip '149.78.0.0/16'
list src_ip '149.86.0.0/16'
list src_ip '154.7.0.0/16'
list src_ip '157.230.0.0/16'
list src_ip '158.23.0.0/16'
list src_ip '158.138.0.0/16'
list src_ip '159.65.0.0/16'
list src_ip '159.89.0.0/16'
list src_ip '159.223.0.0/16'
list src_ip '162.240.0.0/16'
list src_ip '162.241.0.0/16'
list src_ip '163.179.0.0/16'
list src_ip '165.22.0.0/16'
list src_ip '165.154.0.0/16'
list src_ip '167.71.0.0/16'
list src_ip '167.250.0.0/16'
list src_ip '168.90.0.0/16'
list src_ip '168.232.0.0/16'
list src_ip '170.106.0.0/16'
list src_ip '170.137.0.0/16'
list src_ip '170.233.0.0/16'
list src_ip '170.244.0.0/16'
list src_ip '179.108.0.0/16'
list src_ip '179.125.0.0/16'
list src_ip '179.189.0.0/16'
list src_ip '186.209.0.0/16'
list src_ip '189.36.0.0/16'
list src_ip '189.206.0.0/16'
list src_ip '191.5.0.0/16'
list src_ip '191.6.0.0/16'
list src_ip '199.232.0.0/16'
list src_ip '206.189.0.0/16'
list src_ip '209.38.0.0/16'
config rule
option src 'wan'
option name 'blockin_17s'
option target 'DROP'
option direction 'in'
option device 'eth0'
list src_ip '31.151.128.0/17'
list src_ip '34.4.128.0/17'
list src_ip '40.125.0.0/17'
list src_ip '45.33.0.0/17'
list src_ip '51.158.128.0/17'
list src_ip '61.137.128.0/17'
list src_ip '64.62.128.0/17'
list src_ip '64.225.0.0/17'
list src_ip '64.227.0.0/17'
list src_ip '65.49.0.0/17'
list src_ip '83.140.0.0/17'
list src_ip '104.168.128.0/17'
list src_ip '104.234.0.0/17'
list src_ip '122.243.0.0/17'
list src_ip '134.199.128.0/17'
list src_ip '138.118.128.0/17'
list src_ip '147.182.128.0/17'
list src_ip '165.245.128.0/17'
list src_ip '172.94.0.0/17'
list src_ip '174.138.0.0/17'
list src_ip '209.61.0.0/17'
config rule
option src 'wan'
option name 'blockin_18s'
option target 'DROP'
option direction 'in'
option device 'eth0'
list src_ip '34.4.64.0/18'
list src_ip '43.134.0.0/18'
list src_ip '64.226.64.0/18'
list src_ip '87.246.64.0/18'
list src_ip '93.158.64.0/18'
list src_ip '165.232.64.0/18'
list src_ip '165.232.128.0/18'
list src_ip '172.105.192.0/18'
list src_ip '178.73.192.0/18'
list src_ip '188.138.128.0/18'
list src_ip '192.119.64.0/18'
config rule
option src 'wan'
option name 'blockin_19s'
option target 'DROP'
option direction 'in'
option device 'eth0'
list src_ip '34.4.32.0/19'
list src_ip '66.249.64.0/19'
list src_ip '104.223.64.0/19'
list src_ip '113.161.32.0/19'
list src_ip '139.162.64.0/19'
list src_ip '165.232.32.0/19'
list src_ip '172.105.160.0/19'
list src_ip '176.74.224.0/19'
list src_ip '177.136.224.0/19'
config rule
option src 'wan'
option name 'blockin_20s'
option target 'DROP'
option direction 'in'
option device 'eth0'
list src_ip '34.4.16.0/20'
list src_ip '67.213.112.0/20'
list src_ip '79.137.144.0/20'
list src_ip '80.248.224.0/20'
list src_ip '104.143.80.0/20'
list src_ip '104.194.144.0/20'
list src_ip '104.223.96.0/20'
list src_ip '109.199.112.0/20'
list src_ip '139.177.192.0/20'
list src_ip '146.88.240.0/20'
list src_ip '167.88.160.0/20'
list src_ip '177.75.224.0/20'
list src_ip '187.108.192.0/20'
list src_ip '201.33.112.0/20'
list src_ip '201.55.64.0/20'
config rule
option src 'wan'
option name 'blockin_21s'
option target 'DROP'
option direction 'in'
option device 'eth0'
list src_ip '31.209.136.0/21'
list src_ip '34.4.8.0/21'
list src_ip '104.223.112.0/21'
list src_ip '138.118.120.0/21'
list src_ip '172.105.152.0/21'
list src_ip '176.74.192.0/21'
list src_ip '177.23.200.0/21'
list src_ip '177.73.48.0/21'
list src_ip '189.45.248.0/21'
list src_ip '191.36.168.0/21'
list src_ip '195.123.208.0/21'
list src_ip '195.123.216.0/21'
list src_ip '216.73.208.0/21'
list src_ip '216.180.240.0/21'
config rule
option src 'wan'
option name 'blockin_22s'
option target 'DROP'
option direction 'in'
option device 'eth0'
list src_ip '45.5.220.0/22'
list src_ip '45.225.160.0/22'
list src_ip '45.225.236.0/22'
list src_ip '45.229.176.0/22'
list src_ip '45.233.176.0/22'
list src_ip '77.95.116.0/22'
list src_ip '79.137.140.0/22'
list src_ip '79.137.160.0/22'
list src_ip '94.177.52.0/22'
list src_ip '95.214.52.0/22'
list src_ip '103.88.232.0/22'
list src_ip '104.223.60.0/22'
list src_ip '104.223.120.0/22'
list src_ip '131.100.40.0/22'
list src_ip '131.161.60.0/22'
list src_ip '131.221.128.0/22'
list src_ip '138.118.168.0/22'
list src_ip '138.121.44.0/22'
list src_ip '143.202.52.0/22'
list src_ip '162.216.148.0/22'
list src_ip '162.247.240.0/22'
list src_ip '168.195.0.0/22'
list src_ip '168.232.216.0/22'
list src_ip '168.232.220.0/22'
list src_ip '170.39.192.0/22'
list src_ip '170.80.208.0/22'
list src_ip '170.83.68.0/22'
list src_ip '172.105.148.0/22'
list src_ip '177.23.108.0/22'
list src_ip '177.53.148.0/22'
list src_ip '177.124.172.0/22'
list src_ip '177.152.96.0/22'
list src_ip '179.107.48.0/22'
list src_ip '181.189.8.0/22'
list src_ip '185.12.56.0/22'
list src_ip '186.249.216.0/22'
list src_ip '186.251.8.0/22'
list src_ip '187.94.12.0/22'
list src_ip '188.212.100.0/22'
list src_ip '195.123.232.0/22'
list src_ip '195.123.244.0/22'
list src_ip '199.30.228.0/22'
list src_ip '200.4.116.0/22'
list src_ip '200.229.88.0/22'
list src_ip '201.149.124.0/22'
list src_ip '206.168.32.0/22'
list src_ip '216.73.216.0/22'
list src_ip '216.226.76.0/22'
config rule
option src 'wan'
option name 'blockin_23s'
option target 'DROP'
option direction 'in'
option device 'eth0'
list src_ip '5.34.178.0/23'
list src_ip '31.14.236.0/23'
list src_ip '34.4.6.0/23'
list src_ip '45.90.56.0/23'
list src_ip '85.25.172.0/23'
list src_ip '115.190.230.0/23'
list src_ip '144.202.82.0/23'
list src_ip '167.86.116.0/23'
list src_ip '185.16.38.0/23'
list src_ip '185.122.114.0/23'
list src_ip '192.71.54.0/23'
list src_ip '194.88.98.0/23'
list src_ip '195.3.220.0/23'
list src_ip '195.211.96.0/23'
list src_ip '199.45.154.0/23'
list src_ip '202.70.132.0/23'
list src_ip '216.203.20.0/23'
config rule
option src 'wan'
option name 'blockin_24s'
option target 'DROP'
option direction 'in'
option device 'eth0'
list src_ip '5.61.209.0/24'
list src_ip '5.181.27.0/24'
list src_ip '31.13.213.0/24'
list src_ip '34.4.5.0/24'
list src_ip '43.130.37.0/24'
list src_ip '43.163.80.48/24'
list src_ip '45.61.133.0/24'
list src_ip '45.91.64.0/24'
list src_ip '45.92.1.0/24'
list src_ip '45.141.214.0/24'
list src_ip '45.148.10.0/24'
list src_ip '45.194.42.0/24'
list src_ip '45.194.67.0/24'
list src_ip '46.151.178.0/24'
list src_ip '49.185.185.0/24'
list src_ip '52.240.168.196/24'
list src_ip '58.65.241.0/24'
list src_ip '66.132.172.0/24'
list src_ip '66.132.186.0/24'
list src_ip '66.132.195.0/24'
list src_ip '66.132.224.0/24'
list src_ip '77.83.39.0/24'
list src_ip '77.90.185.0/24'
list src_ip '78.128.114.0/24'
list src_ip '79.124.62.0/24'
list src_ip '80.66.66.0/24'
list src_ip '82.24.34.0/24'
list src_ip '85.217.140.0/24'
list src_ip '85.217.149.0/24'
list src_ip '87.121.84.0/24'
list src_ip '87.236.176.0/24'
list src_ip '88.210.63.0/24'
list src_ip '89.42.231.0/24'
list src_ip '89.248.168.0/24'
list src_ip '91.224.92.0/24'
list src_ip '91.230.168.0/24'
list src_ip '91.231.89.0/24'
list src_ip '92.118.39.0/24'
list src_ip '92.246.89.0/24'
list src_ip '92.246.90.0/24'
list src_ip '92.246.91.0/24'
list src_ip '92.246.92.0/24'
list src_ip '93.114.82.0/24'
list src_ip '93.123.109.0/24'
list src_ip '93.174.93.0/24'
list src_ip '94.154.43.0/24'
list src_ip '94.183.174.0/24'
list src_ip '94.250.203.0/24'
list src_ip '95.215.0.0/24'
list src_ip '102.69.167.0/24'
list src_ip '103.176.4.0/24'
list src_ip '104.223.59.0/24'
list src_ip '104.234.119.0/24'
list src_ip '118.193.45.0/24'
list src_ip '138.246.253.24/24'
list src_ip '140.213.202.0/24'
list src_ip '141.98.83.0/24'
list src_ip '142.248.80.0/24'
list src_ip '143.202.247.0/24'
list src_ip '144.6.0.0/24'
list src_ip '144.6.4.0/24'
list src_ip '144.48.37.0/24'
list src_ip '145.131.90.0/24'
list src_ip '146.185.219.0/24'
list src_ip '148.59.129.0/24'
list src_ip '151.243.11.0/24'
list src_ip '152.32.133.0/24'
list src_ip '152.32.235.0/24'
list src_ip '152.32.247.0/24'
list src_ip '163.43.147.0/24'
list src_ip '165.154.6.0/24'
list src_ip '165.154.172.0/24'
list src_ip '165.154.173.0/24'
list src_ip '165.154.206.0/24'
list src_ip '167.94.138.0/24'
list src_ip '172.70.206.0/24'
list src_ip '172.84.94.0/24'
list src_ip '172.110.223.0/24'
list src_ip '176.65.139.0/24'
list src_ip '176.65.149.0/24'
list src_ip '176.65.151.0/24'
list src_ip '176.124.222.0/24'
list src_ip '179.43.150.26/24'
list src_ip '185.73.23.0/24'
list src_ip '185.177.72.0/24'
list src_ip '185.194.178.0/24'
list src_ip '185.218.86.0/24'
list src_ip '185.242.226.0/24'
list src_ip '186.2.165.0/24'
list src_ip '192.109.200.0/24'
list src_ip '193.32.204.0/24'
list src_ip '193.46.0.0/24'
list src_ip '193.163.125.0/24'
list src_ip '193.176.31.0/24'
list src_ip '193.235.141.0/24'
list src_ip '194.15.36.0/24'
list src_ip '195.170.172.0/24'
list src_ip '195.178.110.0/24'
list src_ip '198.235.24.0/24'
list src_ip '198.251.69.71/24'
list src_ip '202.142.142.242/24'
list src_ip '203.55.131.0/24'
list src_ip '204.76.203.0/24'
list src_ip '205.169.39.0/24'
list src_ip '205.210.31.0/24'
list src_ip '213.55.85.0/24'
list src_ip '213.209.159.0/24'
list src_ip '185.224.128.0/24'
config rule
option src 'wan'
option name 'blockin_25s'
option target 'DROP'
option direction 'in'
option device 'eth0'
list src_ip '177.185.7.0/25'
config rule
option src 'wan'
option name 'blockin_29s'
option target 'DROP'
option direction 'in'
option device 'eth0'
list src_ip '60.191.125.32/29'
config rule
option src 'wan'
option name 'blockin_32s'
option target 'DROP'
option direction 'in'
option device 'eth0'
list src_ip '1.1.1.1'
list src_ip '8.8.8.8'
list src_ip '15.164.5.209'
list src_ip '18.64.50.101'
list src_ip '18.236.179.219'
list src_ip '47.236.227.106'
list src_ip '57.155.152.162'
list src_ip '78.128.112.74'
list src_ip '78.128.114.38'
list src_ip '85.11.183.25'
list src_ip '123.253.150.17'
list src_ip '194.187.178.179'
list src_ip '202.153.222.114'
list src_ip '212.87.212.154'
config rule
option src '*'
option dest '*'
option name 'BLOCK'
option target 'DROP'
list dest_ip '202.153.222.114'
list dest_ip '202.142.142.242/24'
config rule
option dest '*'
option name 'BLOCK'
option target 'DROP'
list dest_ip '202.153.222.114'
list dest_ip '202.142.142.242/24'
list dest_ip '162.247.240.0/22'
list dest_ip '168.194.164.0/22'
config rule
option src 'wan'
option name '169.254.84.179'
option target 'DROP'
option enabled '0'
config rule
option src '*'
option name 'BlockoutbountIPs'
option target 'DROP'
option dest 'wan'
list dest_ip '20.42.73.24'
list dest_ip '0.0.0.0'
list dest_ip '20.237.110.18'
list dest_ip '255.255.255.255'
config nat
list proto 'all'
option src 'wan'
option target 'SNAT'
option snat_ip '{EXTERNALIP}'
config zone
option name 'GAccess'
option input 'ACCEPT'
option output 'ACCEPT'
option forward 'ACCEPT'
option family 'ipv4'
option masq_allow_invalid '1'
option auto_helper '0'
list network 'int_msc'
config forwarding
option src 'GAccess'
option dest 'wan'
config rule
option src 'zone_lan'
option dest 'zone_servers'
option name 'SERVER1'
option direction 'in'
option device 'eth1'
list proto 'tcp'
option target 'ACCEPT'
list dest_ip '{NET2}.131'
config forwarding
option src 'zone_lan'
option dest 'zone_{REDACTED}'
config forwarding
option src 'zone_lan'
option dest 'zone_servers'
config zone
option name 'zone_developer'
option input 'REJECT'
option output 'ACCEPT'
option forward 'ACCEPT'
list network 'int_dev'
config zone
option name 'zone_wan_202'
option input 'REJECT'
option output 'REJECT'
option forward 'REJECT'
config forwarding
option src 'zone_developer'
option dest 'wan'
There is no need to redact RFC1918 addresses:
There is nothing private or sensitive about the internal addresses. Redacting them makes it harder for us to understand your config and help you debug.
Similarly...
Redacting this information also makes it really hard for us to follow your configs...
Please re-post without these redactions.
the 'zone_{REDACTED}' on is all the same for the network identifier. And has nothing to do with this problem. The business name is redacted for requirements of the safety of that company and their information.
Well, {NET1} and the rest just mean that they are the network identifiers, and they have nothing to do with this problem either. But each network is set up as the networks respectively.
As last time I let my internal IP information out on here I had to completely redo my entire network structure.
If you want, just think of the IPs as 192.168.1 for {NET1}, and the same for the others.. just think of it as that with the .* as the net number.
My whole issue is the incomming are not being blocked when I block them.
I know I haven't and can't kill the connections because the LUCI system isn't powerful enoguh and doesn't have many features that a security concious person needs, but it should at least block a subnet when I tell it to block it and not allow that subnet into the network.
So the only thing that needs to be worried about is the external connection, as this is not an internal issue. So internal IPs really don't matter.
I find it significantly harder to read the configs when they are over-redacted.... many others probably do, too.
As I said, RFC1918 addresses do not need to be readcted.
And if you need to redact a company name in the firewall, just do a find/replace for and put some other placeholder name in there that is more useful for understanding the flow... so for example, if the company name is Rye Bread Industries, change it to "Mustard Co"
Luckily I have not over redacted anything then.
Ok. I guess I'll leave it for someone else to help out.
Give an example of one of the rules that isn’t working.
Flush the conntrack table with
echo f >/proc/net/nf_conntrack
in the /15 series...
I added this line..
list src_ip '162.158.0.0/15'
And then I still got requests coming in from that subnet. This isn't the only one, happenned with a few before that as well.
I would often add in subnets, and they were aparently already in the list from months ago, and it was still allowing in connections from those subnets.
In order to help you -
As others noted, OpenWrt already blocks connections by default. So, it may help if you explained what kind of connections you're observing as still allowed from these subnets.
Edit:
I hope you're not referring to the traffic you allowed in the rules preceding all your drop rules.
What rules are there that preceed the drops?
I have the reject all connections, but then allow the specific ports, that is the default. Only allow what you want.
I allow specific ports, but they are jsut the forwards, and that takes place after the blocks.
Can't find any other specific ordering. Everything is set up the same, most other rules work, just the odd one fails. Often the new ones added. I generally have to completely restart thr networking or the entire operating system to be able to make it take effect.
So the rules are only blocking the IPs for what connections are coming in. Or do I need to alter the setup to add more layers to protect?
I'll try again, using another approach:
What kind of requests?
TCP, UDP, pings?
What rule do you want to actually block this IP range?
(It may also help of you explain why you have firewall rules of overlapping validity/scope.)
Also, is there a reason you alter the SRC IP of traffic?
Are you trying to restrict the external IPs that are permitted to reach the forwarded port? These block rules won’t affect port forwards AFAIK, but you could add all these CIDRs to an ipset and then add the negated ipset to the port forward (e.g. !ipsetname) under “Use ipset” on the Advanced Settings tab.
They should, as long as they preceed any allow rule.
But given the user's example (and the fact there are no forwarded ports proceeding these IP block rules), I think clarity is needed.
The user also stated:
Since the WAN is configured to reject:
We really need the OP to describe the nature of these observed inbound connections.
As written in the config, these blocks would appear in the input_wan chain since no destination zone is specified. For the blocks to be effective lan or * should be specified as the dest zone so they appear in the forward_wan chain before the dnat accept rule.
Maybe this isn’t even what OP wants. Kreskin might be needed on this one.
The OP mentioned ports to me - the only such rules I see are disabled. To be clear, I was discussing in general.
I should have noted this in my reply, that this statement wasn't supported by the config provided. Also, it wasn't clear what "default" was being discussed - given these rules are unnecessary in a default OpenWrt setup.