Problems setting up banIP

Installing and Using OpenWrt
1

Hello everyone,

I've moved my NanoPi R5S with OpenWRT back from the network bridge (with nftables filtering) to the router and wanted to try out the banIP plugin. So I'm starting a new thread.

I installed the plugin, activated banIP, and selected two lists for it to use, but it doesn't seem to be creating anything.

After a reboot, the spinning wheel on the overview page just keeps spinning.

If I change anything in banIP in LuCI and save it, it results in an error.

Can you tell me what I'm doing wrong? What else do I need to adapt?

Thanks and regards,
Mic.

image
image2169×608 181 KB

root@OpenWrt:~# nft list ruleset | grep -i ban
root@OpenWrt:~# nft list sets
table inet fw4 {
}
root@OpenWrt:~# logread -f | grep banIP
^C
root@OpenWrt:~#
2

Please connect to your OpenWrt device using ssh and copy the output of the following commands and post it here using the "Preformatted text </> " button (red circle; this works best in the 'Markdown' composer view in the blue oval):

Screenshot 2025-10-20 at 8.14.14 PM

Remember to redact passwords, VPN keys, MAC addresses and any public IP addresses you may have:

ubus call system board
cat /etc/config/network
cat /etc/config/dhcp
cat /etc/config/firewall
nft -t list ruleset
logread | grep -i banip | tail
3

Here we are:

root@OpenWrt:~# ubus call system board
{
        "kernel": "6.12.71",
        "hostname": "OpenWrt",
        "system": "ARMv8 Processor rev 0",
        "model": "FriendlyElec NanoPi R5S",
        "board_name": "friendlyarm,nanopi-r5s",
        "rootfs_type": "squashfs",
        "release": {
                "distribution": "OpenWrt",
                "version": "25.12.0-rc5",
                "firmware_url": "https://downloads.openwrt.org/",
                "revision": "r32673-482ba7230a",
                "target": "rockchip/armv8",
                "description": "OpenWrt 25.12.0-rc5 r32673-482ba7230a",
                "builddate": "1771363837"
        }
}

root@OpenWrt:~# cat /etc/config/network

config interface 'loopback'
        option device 'lo'
        option proto 'static'
        list ipaddr '127.0.0.1/8'

config globals 'globals'
        option dhcp_default_duid '************************************'		
        option ula_prefix '****:****:****::/48'
        option packet_steering '1'

config device
        option name 'br-lan'
        option type 'bridge'
        list ports 'eth1'
        list ports 'eth2'

config device
        option name 'eth1'
        option macaddr 'aa:aa:aa:aa:aa:aa'

config device
        option name 'eth2'
        option macaddr '4aa:aa:aa:aa:aa:aa'

config interface 'lan'
        option device 'br-lan'
        option proto 'static'
        list ipaddr '192.168.1.1/24'
        option ip6assign '60'

config device
        option name 'eth0'
        option macaddr 'aa:aa:aa:aa:aa:bb'

config interface 'wan'
        option device 'eth0'
        option proto 'dhcp'

config interface 'wan6'
        option device 'eth0'
        option proto 'dhcpv6'

root@OpenWrt:~# cat /etc/config/dhcp

config dnsmasq
        option domainneeded '1'
        option localise_queries '1'
        option rebind_protection '1'
        option rebind_localhost '1'
        option local '/lan/'
        option domain 'lan'
        option expandhosts '1'
        option cachesize '1000'
        option authoritative '1'
        option readethers '1'
        option leasefile '/tmp/dhcp.leases'
        option resolvfile '/tmp/resolv.conf.d/resolv.conf.auto'
        option localservice '1'
        option ednspacket_max '1232'
        list server '/#/192.168.178.60'

config dhcp 'lan'
        option interface 'lan'
        option start '100'
        option limit '150'
        option leasetime '12h'
        option dhcpv4 'server'
        option dhcpv6 'server'
        option ra 'server'
        option ra_slaac '1'
        list ra_flags 'managed-config'
        list ra_flags 'other-config'

config dhcp 'wan'
        option interface 'wan'
        option ignore '1'

config odhcpd 'odhcpd'
        option maindhcp '0'
        option leasefile '/tmp/odhcpd.leases'
        option leasetrigger '/usr/sbin/odhcpd-update'
        option loglevel '4'
        option piodir '/tmp/odhcpd-piodir'
        option hostsdir '/tmp/hosts'

root@OpenWrt:~# cat /etc/config/firewall

config defaults
        option input 'DROP'
        option output 'ACCEPT'
        option forward 'DROP'
        option synflood_protect '1'
        option drop_invalid '1'

config zone
        option name 'lan'
        list network 'lan'
        option input 'ACCEPT'
        option output 'ACCEPT'
        option forward 'ACCEPT'

config zone
        option name 'wan'
        list network 'wan'
        list network 'wan6'
        option input 'DROP'
        option output 'ACCEPT'
        option forward 'DROP'
        option masq '1'
        option mtu_fix '1'

config forwarding
        option src 'lan'
        option dest 'wan'

config rule
        option name 'Allow-DHCP-Renew'
        option src 'wan'
        option proto 'udp'
        option dest_port '68'
        option target 'ACCEPT'
        option family 'ipv4'

config rule
        option name 'Allow-Ping'
        option src 'wan'
        option proto 'icmp'
        option icmp_type 'echo-request'
        option family 'ipv4'
        option target 'ACCEPT'

config rule
        option name 'Allow-IGMP'
        option src 'wan'
        option proto 'igmp'
        option family 'ipv4'
        option target 'ACCEPT'

config rule
        option name 'Allow-DHCPv6'
        option src 'wan'
        option proto 'udp'
        option dest_port '546'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-MLD'
        option src 'wan'
        option proto 'icmp'
        option src_ip 'fe80::/10'
        list icmp_type '130/0'
        list icmp_type '131/0'
        list icmp_type '132/0'
        list icmp_type '143/0'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-ICMPv6-Input'
        option src 'wan'
        option proto 'icmp'
        list icmp_type 'echo-request'
        list icmp_type 'echo-reply'
        list icmp_type 'destination-unreachable'
        list icmp_type 'packet-too-big'
        list icmp_type 'time-exceeded'
        list icmp_type 'bad-header'
        list icmp_type 'unknown-header-type'
        list icmp_type 'router-solicitation'
        list icmp_type 'neighbour-solicitation'
        list icmp_type 'router-advertisement'
        list icmp_type 'neighbour-advertisement'
        option limit '1000/sec'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-ICMPv6-Forward'
        option src 'wan'
        option dest '*'
        option proto 'icmp'
        list icmp_type 'echo-request'
        list icmp_type 'echo-reply'
        list icmp_type 'destination-unreachable'
        list icmp_type 'packet-too-big'
        list icmp_type 'time-exceeded'
        list icmp_type 'bad-header'
        list icmp_type 'unknown-header-type'
        option limit '1000/sec'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-IPSec-ESP'
        option src 'wan'
        option dest 'lan'
        option proto 'esp'
        option target 'ACCEPT'

config rule
        option name 'Allow-ISAKMP'
        option src 'wan'
        option dest 'lan'
        option dest_port '500'
        option proto 'udp'
        option target 'ACCEPT'

root@OpenWrt:~# nft -t list ruleset
table inet fw4 {
        chain input {
                type filter hook input priority filter; policy drop;
                iif "lo" accept comment "!fw4: Accept traffic from loopback"
                ct state vmap { invalid : drop, established : accept, related : accept } comment "!fw4: Handle inbound flows"
                tcp flags & (fin | syn | rst | ack) == syn jump syn_flood comment "!fw4: Rate limit TCP syn packets"
                iifname "br-lan" jump input_lan comment "!fw4: Handle lan IPv4/IPv6 input traffic"
                iifname "eth0" jump input_wan comment "!fw4: Handle wan IPv4/IPv6 input traffic"
        }

        chain forward {
                type filter hook forward priority filter; policy drop;
                ct state vmap { invalid : drop, established : accept, related : accept } comment "!fw4: Handle forwarded flows"
                iifname "br-lan" jump forward_lan comment "!fw4: Handle lan IPv4/IPv6 forward traffic"
                iifname "eth0" jump forward_wan comment "!fw4: Handle wan IPv4/IPv6 forward traffic"
        }

        chain output {
                type filter hook output priority filter; policy accept;
                oif "lo" accept comment "!fw4: Accept traffic towards loopback"
                ct state vmap { invalid : drop, established : accept, related : accept } comment "!fw4: Handle outbound flows"
                oifname "br-lan" jump output_lan comment "!fw4: Handle lan IPv4/IPv6 output traffic"
                oifname "eth0" jump output_wan comment "!fw4: Handle wan IPv4/IPv6 output traffic"
        }

        chain prerouting {
                type filter hook prerouting priority filter; policy accept;
                iifname "br-lan" jump helper_lan comment "!fw4: Handle lan IPv4/IPv6 helper assignment"
        }

        chain handle_reject {
                meta l4proto tcp reject with tcp reset comment "!fw4: Reject TCP traffic"
                reject comment "!fw4: Reject any other traffic"
        }

        chain syn_flood {
                limit rate 25/second burst 50 packets return comment "!fw4: Accept SYN packets below rate-limit"
                drop comment "!fw4: Drop excess packets"
        }

        chain input_lan {
                jump accept_from_lan
        }

        chain output_lan {
                jump accept_to_lan
        }

        chain forward_lan {
                jump accept_to_wan comment "!fw4: Accept lan to wan forwarding"
                jump accept_to_lan
        }

        chain helper_lan {
        }

        chain accept_from_lan {
                iifname "br-lan" counter packets 85 bytes 6614 accept comment "!fw4: accept lan IPv4/IPv6 traffic"
        }

        chain accept_to_lan {
                oifname "br-lan" counter packets 1 bytes 136 accept comment "!fw4: accept lan IPv4/IPv6 traffic"
        }

        chain input_wan {
                meta nfproto ipv4 udp dport 68 counter packets 0 bytes 0 accept comment "!fw4: Allow-DHCP-Renew"
                icmp type echo-request counter packets 0 bytes 0 accept comment "!fw4: Allow-Ping"
                meta nfproto ipv4 meta l4proto igmp counter packets 3 bytes 108 accept comment "!fw4: Allow-IGMP"
                meta nfproto ipv6 udp dport 546 counter packets 0 bytes 0 accept comment "!fw4: Allow-DHCPv6"
                ip6 saddr fe80::/10 icmpv6 type . icmpv6 code { mld-listener-query . 0, mld-listener-report . 0, mld-listener-done . 0, mld2-listener-report . 0 } counter packets 0 bytes 0 accept comment "!fw4: Allow-MLD"
                icmpv6 type { destination-unreachable, time-exceeded, echo-request, echo-reply, nd-router-solicit, nd-router-advert } limit rate 1000/second burst 5 packets counter packets 0 bytes 0 accept comment "!fw4: Allow-ICMPv6-Input"
                icmpv6 type . icmpv6 code { packet-too-big . 0, parameter-problem . 0, nd-neighbor-solicit . 0, nd-neighbor-advert . 0, parameter-problem . 1 } limit rate 1000/second burst 5 packets counter packets 34 bytes 2312 accept comment "!fw4: Allow-ICMPv6-Input"
                jump drop_from_wan
        }

        chain output_wan {
                jump accept_to_wan
        }

        chain forward_wan {
                icmpv6 type { destination-unreachable, time-exceeded, echo-request, echo-reply } limit rate 1000/second burst 5 packets counter packets 0 bytes 0 accept comment "!fw4: Allow-ICMPv6-Forward"
                icmpv6 type . icmpv6 code { packet-too-big . 0, parameter-problem . 0, parameter-problem . 1 } limit rate 1000/second burst 5 packets counter packets 0 bytes 0 accept comment "!fw4: Allow-ICMPv6-Forward"
                meta l4proto esp counter packets 0 bytes 0 jump accept_to_lan comment "!fw4: Allow-IPSec-ESP"
                udp dport 500 counter packets 0 bytes 0 jump accept_to_lan comment "!fw4: Allow-ISAKMP"
                jump drop_to_wan
        }

        chain accept_to_wan {
                oifname "eth0" counter packets 438 bytes 52998 accept comment "!fw4: accept wan IPv4/IPv6 traffic"
        }

        chain drop_from_wan {
                iifname "eth0" counter packets 364 bytes 20400 drop comment "!fw4: drop wan IPv4/IPv6 traffic"
        }

        chain drop_to_wan {
                oifname "eth0" counter packets 0 bytes 0 drop comment "!fw4: drop wan IPv4/IPv6 traffic"
        }

        chain dstnat {
                type nat hook prerouting priority dstnat; policy accept;
        }

        chain srcnat {
                type nat hook postrouting priority srcnat; policy accept;
                oifname "eth0" jump srcnat_wan comment "!fw4: Handle wan IPv4/IPv6 srcnat traffic"
        }

        chain srcnat_wan {
                meta nfproto ipv4 masquerade comment "!fw4: Masquerade IPv4 wan traffic"
        }

        chain raw_prerouting {
                type filter hook prerouting priority raw; policy accept;
        }

        chain raw_output {
                type filter hook output priority raw; policy accept;
        }

        chain mangle_prerouting {
                type filter hook prerouting priority mangle; policy accept;
        }

        chain mangle_postrouting {
                type filter hook postrouting priority mangle; policy accept;
                oifname "eth0" tcp flags & (fin | syn | rst) == syn tcp option maxseg size set rt mtu comment "!fw4: Zone wan IPv4/IPv6 egress MTU fixing"
        }

        chain mangle_input {
                type filter hook input priority mangle; policy accept;
        }

        chain mangle_output {
                type route hook output priority mangle; policy accept;
        }

        chain mangle_forward {
                type filter hook forward priority mangle; policy accept;
                iifname "eth0" tcp flags & (fin | syn | rst) == syn tcp option maxseg size set rt mtu comment "!fw4: Zone wan IPv4/IPv6 ingress MTU fixing"
        }
}

root@OpenWrt:~# logread | grep -i banip | tail
root@OpenWrt:~#

I don't know if this is relevant but in LuCI banIP system protocol log I always see this single entry:

[04.03.2026-17:57:22] banIP-1.8.0-r3[3785]: banIP service autostart is disabled
4

You have to configure it to autostart either via luci app or editing /etc/config/banip
Rest looks fine (as in very close to the defaults)

5

Great. This seems to be the problem. Du you know why banIP is disabled by default after installation of the plugin?

Is it now working properly?

image
image2000×685 237 KB

6

Because it wildly alters your router's behavior.

7

I installed it specifically for this purpose. However, I can't detect any change in behavior – only the blocking of IPs from the activated blocklists. Otherwise, it routes normally, and so far very smoothly (unlike my idea with bridge filtering, which only happened temporarily). Or what else should I expect to notice regarding routing? I'll test it on my Windows laptop for a while first.

8

Yes, it seems to be working now. I tested it on my Windows PC after connecting the NanoPi using ping. I currently have the IPs from the aforementioned blocklists active. For testing purposes, I then used IPs from the IPv64 blocklist. I discovered something interesting: some of the IPs on that list are still pingable (but most are not).

Link to the list: https://ipv64.net/blocklists/ipv64_blocklist_blocklistde_all.txt

I randomly selected these IPs and was still able to ping them:

1.116.47.223         # Line 1 of the IPv64 list ignored
201.124.122.49       # First IPv4 line after the first IPv6 block
24.98.45.238         # Last IPv4 line before the second IPv6 block
27.110.176.222       # IPv4 somewhere after the second IPv6 block

Do you have any idea what the problem might be?

Thanks and regards,
Mic.

9

One more update. After some testing and tinkering, banIP suddenly stopped blocking anything. I could ping all the IPs that had previously been blocked. After rebooting the NanoPi, it started blocking again. How is that possible?

10

@dibdot may know?

11

I've now found the problem: why aren't all the IPs in the IPv64 list being used? The list isn't being loaded at all. It's a mixed list of IPv4 and IPv6 addresses.

image
image1073×683 31.4 KB

Link to the list: https://ipv64.net/blocklists/ipv64_blocklist_blocklistde_all.txt

However, in the banIP log, I'm now seeing the following:

[04.03.2026-20:44:30] banIP-1.8.0-r3[4701]: skip empty feed 'ipv64.v4'
[04.03.2026-20:44:30] banIP-1.8.0-r3[4701]: skip empty feed 'ipv64.v6'

What's causing this?

12

Ha... Found the error. Although the IPv64 list contains IP addresses with CIDR net masks, you only need to select the "IP address" rule in banIP. And then the aforementioned IP addresses will also be blocked.

It's always frightening: as soon as you do it right, it works. :rofl::rofl::rofl:

13

I habe a new issue now. Why do I get the message banIP cannot download the blocklists?

[04.03.2026-22:12:58] banIP-1.8.0-r3[4367]: start banIP download processes
[04.03.2026-22:13:01] banIP-1.8.0-r3[4367]: download for feed 'backscatterer.v4' failed, rc: 4
[04.03.2026-22:13:01] banIP-1.8.0-r3[4367]: download for feed 'cinsscore.v4' failed, rc: 4
[04.03.2026-22:13:01] banIP-1.8.0-r3[4367]: download for feed 'feodo.v4' failed, rc: 4
[04.03.2026-22:13:01] banIP-1.8.0-r3[4367]: download for feed 'greensnow.v4' failed, rc: 4
[04.03.2026-22:13:01] banIP-1.8.0-r3[4367]: download for feed 'threatview.v4' failed, rc: 4
[04.03.2026-22:13:01] banIP-1.8.0-r3[4367]: download for feed 'urlhaus.v4' failed, rc: 4
[04.03.2026-22:13:03] banIP-1.8.0-r3[4367]: start banIP domain lookup
[04.03.2026-22:13:03] banIP-1.8.0-r3[4367]: finish banIP processing
[04.03.2026-22:13:03] banIP-1.8.0-r3[4367]: start detached banIP log service (/sbin/logread)
14

Full log please, thanks.

15

I found the issue. I have set up a static IPv4 route from OpenWRT to my FritzBox and due to this I was not able to download anything by using curl from the web. I have deleted this static route and restarted the WAN interface in LuCI. Now it works again.