How to block IPv4 ranges with OpenWrt 25.12.2?

sysx · April 6, 2026, 6:26pm

I want to block all ip ranges announced by AS8866 on OpenWrt 25.12.2.
What I have to change on current firewall rules?


config interface 'loopback'
        option device 'lo'
        option proto 'static'
        option ipaddr '127.0.0.1'
        option netmask '255.0.0.0'

config globals 'globals'
        option ula_prefix 'fd1b:a70f:c20d::/48'
        option packet_steering '1'
        option dhcp_default_duid '0004f5e128e4fb6d4ab1a477063b97032c1d'

config device
        option name 'br-lan'
        option type 'bridge'
        option ipv6 '0'
        option bridge_empty '1'
        list ports 'lan1'

config interface 'lan'
        option device 'br-lan'
        option proto 'static'
        option ipaddr '192.168.3.1'
        option netmask '255.255.255.240'
        option ip6assign '60'
        option delegate '0'
        option multipath 'off'

config interface 'wan'
        option device 'wan'
        option proto 'dhcp'
        option delegate '0'
        option multipath 'off'
        option peerdns '0'
        list dns '8.8.8.8'
        list dns '8.8.4.4'

config device
        option name 'wan'
        option macaddr ''
        option ipv6 '0'

config device
        option name 'eth0'
        option mtu '1500'
        option ipv6 '0'

config device
        option name 'lan1'
        option ipv6 '0'

config device
        option name 'lan2'
        option ipv6 '0'

config device
        option name 'lan3'
        option ipv6 '0'

config device
        option name 'lan4'
        option ipv6 '0'

config device
        option name 'phy0-ap0'
        option ipv6 '0'

config device
        option name 'phy1-ap0'
        option ipv6 '0'


config wifi-device 'radio0'
        option type 'mac80211'
        option path '1e140000.pcie/pci0000:00/0000:00:00.0/0000:01:00.0'
        option band '2g'
        option channel '1'
        option htmode 'HT20'
        option country 'BG'
        option cell_density '0'

config wifi-iface 'default_radio0'
        option device 'radio0'
        option network 'lan'
        option mode 'ap'
        option ssid '2.4Ghz'
        option encryption 'sae-mixed'
        option key ''
        option ocv '0'

config wifi-device 'radio1'
        option type 'mac80211'
        option path '1e140000.pcie/pci0000:00/0000:00:01.0/0000:02:00.0'
        option band '5g'
        option channel '36'
        option htmode 'VHT80'
        option country 'BG'
        option cell_density '0'

config wifi-iface 'default_radio1'
        option device 'radio1'
        option network 'lan'
        option mode 'ap'
        option ssid '5Ghz'
        option encryption 'sae-mixed'
        option key ''
        option ocv '0'


config defaults
        option input 'ACCEPT'
        option output 'ACCEPT'
        option forward 'REJECT'
        option synflood_protect '1'

config zone
        option name 'lan'
        option input 'ACCEPT'
        option output 'ACCEPT'
        option forward 'ACCEPT'
        list network 'lan'

config zone
        option name 'wan'
        option input 'REJECT'
        option output 'ACCEPT'
        option forward 'REJECT'
        option masq '1'
        option mtu_fix '1'
        list network 'wan'

config forwarding
        option src 'lan'
        option dest 'wan'

config rule
        option name 'Allow-DHCP-Renew'
        option src 'wan'
        option proto 'udp'
        option dest_port '68'
        option target 'ACCEPT'
        option family 'ipv4'

config rule
        option name 'Allow-Ping'
        option src 'wan'
        option proto 'icmp'
        option family 'ipv4'
        option target 'REJECT'
        list icmp_type 'echo-reply'

config rule
        option name 'Allow-IGMP'
        option src 'wan'
        option proto 'igmp'
        option family 'ipv4'
        option target 'ACCEPT'
        option enabled '0'

config rule
        option name 'Allow-DHCPv6'
        option src 'wan'
        option proto 'udp'
        option dest_port '546'
        option family 'ipv6'
        option target 'ACCEPT'
        option enabled '0'

config rule
        option name 'Allow-MLD'
        option src 'wan'
        option proto 'icmp'
        option src_ip 'fe80::/10'
        list icmp_type '130/0'
        list icmp_type '131/0'
        list icmp_type '132/0'
        list icmp_type '143/0'
        option family 'ipv6'
        option target 'ACCEPT'
        option enabled '0'

config rule
        option name 'Allow-ICMPv6-Input'
        option src 'wan'
        option proto 'icmp'
        list icmp_type 'echo-request'
        list icmp_type 'echo-reply'
        list icmp_type 'destination-unreachable'
        list icmp_type 'packet-too-big'
        list icmp_type 'time-exceeded'
        list icmp_type 'bad-header'
        list icmp_type 'unknown-header-type'
        list icmp_type 'router-solicitation'
        list icmp_type 'neighbour-solicitation'
        list icmp_type 'router-advertisement'
        list icmp_type 'neighbour-advertisement'
        option limit '1000/sec'
        option family 'ipv6'
        option target 'ACCEPT'
        option enabled '0'

config rule
        option name 'Allow-ICMPv6-Forward'
        option src 'wan'
        option dest '*'
        option proto 'icmp'
        list icmp_type 'echo-request'
        list icmp_type 'echo-reply'
        list icmp_type 'destination-unreachable'
        list icmp_type 'packet-too-big'
        list icmp_type 'time-exceeded'
        list icmp_type 'bad-header'
        list icmp_type 'unknown-header-type'
        option limit '1000/sec'
        option family 'ipv6'
        option target 'ACCEPT'
        option enabled '0'

config rule
        option name 'Allow-IPSec-ESP'
        option src 'wan'
        option dest 'lan'
        option proto 'esp'
        option target 'ACCEPT'

config rule
        option name 'Allow-ISAKMP'
        option src 'wan'
        option dest 'lan'
        option dest_port '500'
        option proto 'udp'
        option target 'ACCEPT'
        option enabled '0'

config rule
        option name 'AS8866Part1'
        option target 'REJECT'
        list dest_ip '37.157.136.0/21'
        list dest_ip '37.157.160.0/19'
        list dest_ip '46.10.0.0/17'
        list dest_ip '46.47.104.0/23'
        list dest_ip '46.249.64.0/19'
        list dest_ip '62.73.64.0/18'
        list dest_ip '62.176.64.0/19'
        list dest_ip '77.78.0.0/18'
        list dest_ip '77.85.0.0/16'
        list dest_ip '78.142.32.0/19'
        list dest_ip '78.154.0.0/19'
        list dest_ip '79.100.0.0/16'
        list dest_ip '82.137.64.0/18'
        list dest_ip '82.146.0.0/22'
        list dest_ip '83.148.64.0/18'
        list dest_ip '83.228.0.0/17'
        list dest_ip '84.40.64.0/18'
        list dest_ip '84.238.128.0/22'
        list dest_ip '84.238.134.0/23'
        list dest_ip '84.238.136.0/21'
        list dest_ip '84.238.144.0/21'
        list dest_ip '84.238.152.0/22'
        list dest_ip '84.238.156.0/22'
        list dest_ip '84.238.168.0/21'
        list dest_ip '84.238.178.0/23'
        list dest_ip '84.238.180.0/22'
        list dest_ip '84.238.204.0/22'
        list dest_ip '85.187.22.0/23'
        list dest_ip '85.187.24.0/21'
        list dest_ip '85.187.32.0/21'
        list dest_ip '85.187.46.0/23'
        list dest_ip '85.187.64.0/18'
        list dest_ip '87.119.127.0/24'
        list dest_ip '87.126.0.0/16'
        list dest_ip '87.243.80.0/20'
        list dest_ip '87.243.96.0/19'
        list dest_ip '87.254.160.0/19'
        list dest_ip '88.87.0.0/19'
        list dest_ip '90.154.128.0/17'
        list dest_ip '93.152.128.0/18'
        list dest_ip '94.236.144.0/20'
        list dest_ip '94.236.160.0/19'
        list dest_ip '94.236.204.0/23'
        list dest_ip '94.236.228.0/23'
        list dest_ip '94.236.234.0/23'
        list dest_ip '94.236.240.0/20'
        list dest_ip '95.42.0.0/15'
        list dest_ip '95.87.192.0/18'
        list dest_ip '109.120.192.0/18'
        list dest_ip '109.199.128.0/19'
        list dest_ip '151.237.140.0/23'
        list dest_ip '185.20.156.0/22'
        list dest_ip '185.211.200.0/22'
        list dest_ip '188.254.128.0/17'
        list dest_ip '195.182.41.0/24'
        list dest_ip '212.5.128.0/19'
        list dest_ip '212.25.32.0/19'
        list dest_ip '212.39.64.0/19'
        list dest_ip '212.50.64.0/19'
        list dest_ip '212.72.198.0/24'
        list dest_ip '212.72.202.0/23'
        list dest_ip '212.72.212.0/24'
        list dest_ip '213.16.32.0/19'
        list dest_ip '213.91.128.0/17'
        list dest_ip '213.130.64.0/22'
        list dest_ip '213.130.76.0/22'
        list dest_ip '213.130.92.0/23'
        list dest_ip '217.75.139.0/24'
        list dest_ip '2a01:5a8::/32'
        list dest_ip '2a00:e40::/32'
        option dest '*'
        list proto 'all'

config rule
        option name 'AS8866Part2'
        option target 'REJECT'
        option src '*'
        list src_ip '37.157.136.0/21'
        list src_ip '37.157.160.0/19'
        list src_ip '46.10.0.0/17'
        list src_ip '46.47.104.0/23'
        list src_ip '46.249.64.0/19'
        list src_ip '62.73.64.0/18'
        list src_ip '62.176.64.0/19'
        list src_ip '77.78.0.0/18'
        list src_ip '77.85.0.0/16'
        list src_ip '78.142.32.0/19'
        list src_ip '78.154.0.0/19'
        list src_ip '79.100.0.0/16'
        list src_ip '82.137.64.0/18'
        list src_ip '82.146.0.0/22'
        list src_ip '83.148.64.0/18'
        list src_ip '83.228.0.0/17'
        list src_ip '84.40.64.0/18'
        list src_ip '84.238.128.0/22'
        list src_ip '84.238.134.0/23'
        list src_ip '84.238.136.0/21'
        list src_ip '84.238.144.0/21'
        list src_ip '84.238.152.0/22'
        list src_ip '84.238.156.0/22'
        list src_ip '84.238.168.0/21'
        list src_ip '84.238.178.0/23'
        list src_ip '84.238.180.0/22'
        list src_ip '84.238.204.0/22'
        list src_ip '85.187.22.0/23'
        list src_ip '85.187.24.0/21'
        list src_ip '85.187.32.0/21'
        list src_ip '85.187.46.0/23'
        list src_ip '85.187.64.0/18'
        list src_ip '87.119.127.0/24'
        list src_ip '87.126.0.0/16'
        list src_ip '87.243.80.0/20'
        list src_ip '87.243.96.0/19'
        list src_ip '87.254.160.0/19'
        list src_ip '88.87.0.0/19'
        list src_ip '90.154.128.0/17'
        list src_ip '93.152.128.0/18'
        list src_ip '94.236.144.0/20'
        list src_ip '94.236.160.0/19'
        list src_ip '94.236.204.0/23'
        list src_ip '94.236.228.0/23'
        list src_ip '94.236.234.0/23'
        list src_ip '94.236.240.0/20'
        list src_ip '95.42.0.0/15'
        list src_ip '95.87.192.0/18'
        list src_ip '109.120.192.0/18'
        list src_ip '109.199.128.0/19'
        list src_ip '151.237.140.0/23'
        list src_ip '185.20.156.0/22'
        list src_ip '185.211.200.0/22'
        list src_ip '188.254.128.0/17'
        list src_ip '195.182.41.0/24'
        list src_ip '212.5.128.0/19'
        list src_ip '212.25.32.0/19'
        list src_ip '212.39.64.0/19'
        list src_ip '212.50.64.0/19'
        list src_ip '212.72.198.0/24'
        list src_ip '212.72.202.0/23'
        list src_ip '212.72.212.0/24'
        list src_ip '213.16.32.0/19'
        list src_ip '213.91.128.0/17'
        list src_ip '213.130.64.0/22'
        list src_ip '213.130.76.0/22'
        list src_ip '213.130.92.0/23'
        list src_ip '217.75.139.0/24'
        list src_ip '2a01:5a8::/32'
        list src_ip '2a00:e40::/32'
        option direction 'in'
        option device 'wan'
        list proto 'all'
        option dest '*'

config rule
        option name 'AS57976'
        option target 'DROP'
        option family 'ipv4'
        option src 'lan'
        option dest 'wan'
        list dest_ip '24.105.29.75'
        list dest_ip '137.221.105.136'
        list dest_ip '137.221.104.171'
        list dest_ip '137.221.105.232'
        option enabled '0'
        list proto 'all'
        list src_ip '192.168.3.2'

config rule
        option name 'Miscellaneous'
        option target 'REJECT'
        option family 'ipv4'
        option src 'lan'
        option dest 'wan'
        list dest_ip '5.22.160.0/19'
        list dest_ip '87.245.208.0/20'
        list dest_ip '87.245.224.0/19'
        list dest_ip '139.45.192.0/19'
        list dest_ip '162.247.240.0/22'
        list dest_ip '178.18.224.0/20'
        list dest_ip '4.231.128.59'
        list dest_ip '20.73.194.208'
        list dest_ip '51.104.136.2'
        list dest_ip '51.124.78.146'
        list dest_ip '93.127.17.252'
        list dest_ip '93.127.0.0/17'
        list dest_ip '212.228.0.0/16'
        list dest_ip '90.240.0.0/12'
        list dest_ip '185.46.160.0/22'
        list dest_ip '185.46.163.0/24'
        list dest_ip '195.85.215.0/24'
        list proto 'all'

psherman · April 6, 2026, 6:40pm

Use ipsets.

lleachii · April 6, 2026, 7:10pm

IPsets can work, as suggested. But why do you want to block ~~Blizzard Entertainment~~ Vivacom?

Perhaps there's a better solution (e.g., placing kids in a network and blocking certain traffic, etc.).

reinerotto · April 6, 2026, 7:13pm

Hi from Burgas For a standard setup, use nft-sets for the IPs to be blocked. However, you might notice that nft-sets are quite slow. For much faster (?) ops you can use good old ipsets with iptables-zz-legacy, in parallel to nftables. Needs careful implementation, though. I.e. by using raw iptables, to avoid any possibility of conflicts.

pavelgl · April 6, 2026, 7:44pm

Just out of curiosity, what exactly is your problem with Vivacom (former Bulgarian Telecommunications Company)? My public IP is also on your blacklist (not taken personally).

sysx · April 6, 2026, 8:31pm

Systematic terror - internet connectivity drops every 10 minutes since 14th February 2026, whenever I watch an YouTube video I want to be connected to directly to AS15169 and nobody else. Often blocking outgoing connections towards web browser extension, such as Forecastfox. Initially I was an end customer of AS43205 for 5 years (with expired signed contract for internet standalone service), but I was moved at 28th April 2025 to AS8866 without signed contract for internet service.

lleachii · April 6, 2026, 9:14pm

You wanna block yourself?

Perhaps this sentence had a bad English translation, or maybe you want to block all other IPs while you use YouTube?

Blocking all IPs related to your ISP will not solve a YouTube viewing issue.

Browsing to YouTube on your new ISP stops your weather extension?