Unable to block IP subs

[ramones]

Hi,

I’m trying to block two /24 ranges. To make it tidy I’ve created an IPset in the Firewall, including the 2 ranges and then created firewall rule to drop forwarding (and in the Advanced tab of the rule I’ve included the IPset).

But the problem is, that the changes don’t seem to do anything.

I want to eliminate (drop) any connection from or to those ranges - from or to any device on my network and regardless of what protocol is being used.

I’ve tried to make rules with unspecified device, or with inbound and outbound devices matching the wan or the bridge - but none seems to actually come into force.

I would be thankful for any hints.
Thank you.

[frollic]

default wan rule already rejects (can be changed to drop) all incoming connections from wan ?

[ramones]

correct, but does that interfere with this rule?

[frollic]

at least the 1st should overlap, IMHO.
the 2nd one, I'm not sure.

[ramones]

To clarify, I am testing outbound connection - which should also not be allowed per my rule - to these ranges, but I do have connection - I can ping or ssh to these ranges.

Perhaps, I need some trigger in my rule that is not there? Or too generic rules like in my case don’t work?

[ramones]

I’ve reworked it a bit, but still does not work.

I’m including screenshots to make it more clear how I set it up…

[ramones]

Perhaps, in the IPset I need to make two - one for src_net and one for dest_net? Or remove that at all?

[frollic]

what's the ipset supposed to do, does it contain RU IPs/ranges you don't want to allow access to?

[ramones]

to match these 2 ranges in the Firewall - Traffic rule, which should (supposedly) drop anything from/to the ranges.

[ramones]

Changed to dest_net or to net (sub) - neither seem to work

[ramones]

tried to change the Packet field match to ip - also didn’t work.

[frollic]

works for me...

you don't need any incoming rule.

[ramones]

so, the IPset does not seem to work?

OK I will make it without it.

[frollic]

check the ipset setup - https://openwrt.org/docs/guide-user/firewall/firewall_configuration#ip_sets

[ramones]

I can confirm now - with the standard way of doing it - WITHOUT the use of the IPset - like in this screenshot - finally it does work. Thank you.

[dave14305]

If you want to expand with an ipset later, this should work:

config ipset
        option name 'EvilGnome'
        option family 'ipv4'
        list match 'net'
        list entry '195.62.52.0/24'
        list entry '195.62.53.0/24'

config rule
        option name 'Deny-EvilGnome'
        option src 'lan'
        option dest 'wan'
        option family 'ipv4'
        option ipset 'EvilGnome dest'
        option target 'REJECT'
        list proto 'all'

Resulting firewall sections:

        set EvilGnome {
                type ipv4_addr
                auto-merge
                flags interval
                elements = {
                        195.62.52.0/24,
                        195.62.53.0/24,
                }
        }

        chain forward_lan {
                meta nfproto ipv4 ip daddr @EvilGnome counter jump reject_to_wan comment "!fw4: Deny-EvilGnome"

BTW, you can simplify your 2 subnets to 195.62.52.0/23 since they are adjacent.