Skip to content

Commit 8e6814b

Browse files
bolemobolemo
authored
Merge pull request #12 from bolemo/dev
Dev
2 parents 1755552 + f9574e3 commit 8e6814b

File tree

3 files changed

+109
-59
lines changed

3 files changed

+109
-59
lines changed

‎README.md

Lines changed: 13 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -1,23 +1,23 @@
11
# Firewall Blocklist
2-
Firewall blocklist script for Netgear R7800 Router with Voxel firmware.
2+
Firewall blocklist script for Netgear R7800 & R9000 Routers with Voxel firmware.
33
Should work with several other Netgear routers as well.
44

55
## Version
6-
3.2.0
6+
3.2.1
77

88
## Prerequisite
99
* You need to have Voxel's Firmware: https://www.voxel-firmware.com
10-
* Although not mandatory for this script to work properly, it is recommanded to bave iprange installed (either on the internal flash `/usr/bin`, or through Entware [self compiled]). The install script will offer to install iprange on the internal flash. You can decide to install it separately or not at all. iprange allows great optimizations.
11-
* If it is possible to install the script on the system partition, this is not recommanded and this installation requires to be on an external (USB) drive (the one on which you may have installed Entware).
10+
* Although not mandatory for this script to work properly, it is recommanded to bave iprange installed (either on the internal flash `/usr/bin`, or through Entware). The install script will offer to install iprange on the internal flash (R7800 only for now, but Entware version works on R9000). You can decide to install it separately or not at all. iprange allows great optimizations and recommended.
11+
* If it is possible to install the script on the system partition, this is not recommended and this installation requires to be on an external (USB) drive (the one on which you may have installed Entware).
1212
* This script will be creating `firewall-start.sh` in `/opt/scripts`; that is a way to define custom iptables in Voxel's Firmwares. If you are already using your own `/opt/scripts/firewall-start.sh`, a line will be added to it to allow this script to work. The clean process will remove that line leaving the rest of `/opt/scripts/firewall-start.sh` in place.
1313

1414
## Install
1515
* Connect to router's terminal with ssh or telnet
1616
* Go to the attached drive (USB): `cd /mnt/optware/` (or change optware by the mountpoint of your drive)
17-
* Copy and paste the following command: `wget -qO- https://github.com/bolemo/firewall-blocklist/archive/v3.2.0.tar.gz | tar xzf - --one-top-level=fbl --strip-components 1`
17+
* Copy and paste the following command: `wget -qO- https://github.com/bolemo/firewall-blocklist/archive/v3.2.1.tar.gz | tar xzf - --one-top-level=fbl --strip-components 1`
1818
* Make install script executable: `chmod +x fbl/install.sh`
1919
* Run install script: `fbl/install.sh`
20-
* Answer `y` if you want to install iprange
20+
* Answer `y` if you want to install iprange (will only be asked on R7800)
2121
* Check if installation went fine: `/opt/bolemo/scripts/firewall-blocklist info`
2222
* Remove the install files and folder: `rm -r fbl` check then confirm each file to delete answering y
2323

@@ -61,13 +61,15 @@ The file `/opt/bolemo/etc/firewall-blocklist.sources` contains the list of serve
6161

6262
You can find a lot of lists on internet. One great source are the lists from FireHOL: http://iplists.firehol.org/
6363

64+
### Custom blocklist
6465
Since version 3.1, you can have your own custom blacklist of IPs or netsets (IPs with cidr netmask): just create a file named `firewall-blocklist.custom-bl.netset` in `/opt/bolemo/etc/` with your own list. Next tile you will perform a `firewall-blocklist update`, it will integrate your custom list to the master blocklist.
6566

66-
Since version 3.2, you can have your own custom whitelist of IPs or netsets (IPs with cidr netmask): just create a file named `firewall-blocklist.custom-wl.netset` in `/opt/bolemo/etc/` with your own list. Next tile you will perform a `firewall-blocklist update`, it will integrate your custom list to the master whitelist.
67+
### Custom whitelist
68+
Since version 3.2, you can have your own custom whitelist of IPs or netsets (IPs with cidr netmask): just create a file named `firewall-blocklist.custom-wl.netset` in `/opt/bolemo/etc/` with your own list. Next time you will perform a `firewall-blocklist update`, it will integrate your custom list to the master whitelist.
6769

6870
## Logging
6971
### Enabling
70-
To log activity of firewall-blocklist and see what is blocked, you can use the `-log=on` option with the parameter `restart`, `load_set` or `update` using this script.
72+
To log activity of firewall-blocklist and see what is blocked, you can use the `-log=on` option with the parameter `restart`, `load_set` or `update` using this script (for example: `/opt/bolemo/scripts/firewall-blocklist restart -log=on`).
7173
You can also use the following command: `nvram set log_firewall_blocklist=1`; the next time the firewall-blocklist will be restarted, logging will be active until next reboot of the router.
7274
If you want logging to stay on after a reboot, after using the `-log=on` option or the command `nvram set log_firewall_blocklist=1` do `nvram commit`.
7375

@@ -83,9 +85,9 @@ If you used `nvram commit` after enabling logging, then you need to use `nvram c
8385
iprange is a great little utility dealing that is now part of the FireHOL project.
8486
firewall-blocklist works fine without iprange installed, but it is recommanded to install it as it allows great optimizations.
8587

86-
The install script offers to install a version of it on the router (rootfs in /usr/bin). It has been kindly compiled by Voxel and does not require Entware or an external drive.
88+
The install script offers to install a version of it on the router (rootfs in /usr/bin). It has been kindly compiled (R7800 only at this time) by Voxel and does not require Entware or an external drive.
8789
You can also install it separately:
88-
* directly from Voxel's website here: https://voxel-firmware.com/Downloads/iprange_1.0.4-1_ipq806x.ipk and install it using the command `/bin/opkg install iprange_1.0.4-1_ipq806x.ipk`.
89-
* using Entware: `/opt/bin/opkg install iprange`.
90+
* [R7800 only] directly from Voxel's website here: https://voxel-firmware.com/Downloads/iprange_1.0.4-1_ipq806x.ipk and install it using the command `/bin/opkg install iprange_1.0.4-1_ipq806x.ipk`.
91+
* using Entware: `/opt/bin/opkg install iprange` (ok with R9000 and others).
9092

9193
The source is here: https://github.com/firehol/iprange

‎firewall-blocklist

Lines changed: 94 additions & 47 deletions
Original file line numberDiff line numberDiff line change
@@ -12,31 +12,43 @@ WL_FILE="$ROOT_DIR/etc/${SC_NAME}-wl.netset"
1212
INFO_FILE="/tmp/${SC_ABR}_status"
1313
WAN_GATEWAY="$(nvram get wan_gateway)"
1414
WAN_NETMASK="$(nvram get wan_netmask)"
15+
INFO_IPS_BL_LOAD='1'
16+
INFO_IPS_BL_NEW='2'
17+
INFO_IPS_BL_KEEP='3'
18+
INFO_IPS_BL_WGW='4'
19+
INFO_IPS_WL_LOAD='5'
20+
INFO_IPS_WL_NEW='6'
21+
INFO_IPS_WL_KEEP='7'
22+
INFO_IPS_WL_WGW_ADD='8'
23+
INFO_IPS_WL_WGW_KEEP='9'
24+
INFO_IPT_KEEP='a'
25+
INFO_IPT_LOG='b'
26+
INFO_IPT_BL='c'
27+
INFO_IPT_WL='d'
1528

1629
#we are called from firewall_start.sh
1730
if [ "$1" ] && [ "$1" = "_fws" ]; then
18-
/bin/date > "$INFO_FILE"
19-
20-
echo -n 'ips: ' >> "$INFO_FILE"
31+
:> "$INFO_FILE"
32+
2133
# creating ipset blocklist if needed
2234
if ! ipset -q -n list "$IPSET_NAME">/dev/null; then
2335
if [ -r "$IP_LIST" ]; then
2436
# netset file exists, so creating blocklist ipset from it
2537
echo -e "create $IPSET_NAME hash:net family inet\n$(sed "s/^/add $IPSET_NAME /" "$IP_LIST")" | ipset restore
26-
echo -n 'BL(+load)' >> "$INFO_FILE"
38+
echo "$INFO_IPS_BL_LOAD" >> "$INFO_FILE"
2739
else
2840
# no netset file, creating empty blocklist ipset
2941
ipset -q create "$IPSET_NAME" hash:net family inet
30-
echo -n 'BL(+new)' >> "$INFO_FILE"
42+
echo "$INFO_IPS_BL_NEW" >> "$INFO_FILE"
3143
fi
32-
else echo -n 'BL(keep)' >> "$INFO_FILE"
44+
else echo "$INFO_IPS_BL_KEEP" >> "$INFO_FILE"
3345
fi
3446

3547
# checking if WAN gateway is in blocklist
3648
if [ "$WAN_GATEWAY" != '0.0.0.0' ] && ipset -q test "$IPSET_NAME" "$WAN_GATEWAY"
3749
then
3850
WGW_IN_BL='y'
39-
echo -n '(gw)' >> "$INFO_FILE"
51+
echo "$INFO_IPS_BL_WGW" >> "$INFO_FILE"
4052
if ipset -q test "$IPSET_WL_NAME" "$WAN_GATEWAY"
4153
then WGW_IN_WL='y'
4254
else WGW_IN_WL=''
@@ -51,22 +63,22 @@ if [ "$1" ] && [ "$1" = "_fws" ]; then
5163
if [ -r "$WL_FILE" ]; then
5264
# netset file exists, so creating whitelist ipset from it
5365
echo -e "create $IPSET_WL_NAME hash:net family inet\n$(sed "s/^/add $IPSET_WL_NAME /" "$WL_FILE")" | ipset restore
54-
echo -n '/WL(+load)' >> "$INFO_FILE"
66+
echo "$INFO_IPS_WL_LOAD" >> "$INFO_FILE"
5567
elif [ "$WGW_IN_BL" ]; then
5668
# no netset file, creating empty whitelist ipset because needed for WAN gateway
5769
ipset -q create "$IPSET_WL_NAME" hash:net family inet
58-
echo -n '/WL(+new)' >> "$INFO_FILE"
70+
echo "$INFO_IPS_WL_NEW" >> "$INFO_FILE"
5971
else
6072
# no need for whitelist, just destroy if exists
6173
ipset -q destroy "$IPSET_WL_NAME"
6274
NO_WL='y'
6375
fi
64-
else echo -n '/WL(keep)' >> "$INFO_FILE"
76+
else echo "$INFO_IPS_WL_KEEP" >> "$INFO_FILE"
6577
fi
6678

6779
# if needed, adding WAN gateway to whitelist
6880
[ "$WGW_IN_BL" ] && if [ "$WGW_IN_WL" ]; then
69-
echo -n '(gw)' >> "$INFO_FILE"
81+
echo "$INFO_IPS_WL_WGW_KEEP" >> "$INFO_FILE"
7082
else
7183
# Calculate WAN_RANGE (IP & CIDR)
7284
_CIDR=0
@@ -76,50 +88,47 @@ if [ "$1" ] && [ "$1" = "_fws" ]; then
7688
done
7789
WAN_RANGE="$WAN_GATEWAY/$_CIDR"
7890
ipset -q add "$IPSET_WL_NAME" "$WAN_RANGE"
79-
echo -n '(+gw)' >> "$INFO_FILE"
91+
echo "$INFO_IPS_WL_WGW_ADD" >> "$INFO_FILE"
8092
fi
81-
82-
echo '' >> "$INFO_FILE"
83-
84-
echo -n 'ipt: ' >> "$INFO_FILE"
93+
8594
#checking if IPTBL_NAME is already set (should not); if it is, exit
86-
iptables -L "$IPTBL_NAME" >/dev/null 2>/dev/null && { echo "keep!" >> "$INFO_FILE"; exit 1; }
95+
iptables -L "$IPTBL_NAME" >/dev/null 2>/dev/null && { echo "$INFO_IPT_KEEP" >> "$INFO_FILE"; exit 1; }
8796

8897
# creating the filtering (blocking) iptables chain
8998
iptables -N "$IPTBL_NAME"
90-
[ "$IPTBL_LOGGING" ] && { iptables -A "$IPTBL_NAME" -j LOG --log-prefix "[$SC_NAME] "; echo -n 'log+' >> "$INFO_FILE"; }
99+
[ "$IPTBL_LOGGING" ] && { iptables -A "$IPTBL_NAME" -j LOG --log-prefix "[$SC_NAME] "; echo "$INFO_IPT_LOG" >> "$INFO_FILE"; }
91100
iptables -A "$IPTBL_NAME" -j DROP
92101

93102
# creating the required iptables
94103
if [ "$NO_WL" ]; then
95104
# creating iptables without whitelist
96-
iptables -I INPUT 1 -i brwan -m set --match-set "$IPSET_NAME" src -j $IPTBL_NAME
97-
iptables -I OUTPUT 1 -o brwan -m set --match-set "$IPSET_NAME" dst -j $IPTBL_NAME
98-
iptables -I FORWARD 1 -i brwan -m set --match-set "$IPSET_NAME" src -j $IPTBL_NAME
99-
iptables -I FORWARD 2 -o brwan -m set --match-set "$IPSET_NAME" dst -j $IPTBL_NAME
100-
echo 'BL' >> "$INFO_FILE"
105+
iptables -I INPUT 1 -i brwan -m set --match-set "$IPSET_NAME" src -j "$IPTBL_NAME"
106+
iptables -I OUTPUT 1 -o brwan -m set --match-set "$IPSET_NAME" dst -j "$IPTBL_NAME"
107+
iptables -I FORWARD 1 -i brwan -m set --match-set "$IPSET_NAME" src -j "$IPTBL_NAME"
108+
iptables -I FORWARD 2 -o brwan -m set --match-set "$IPSET_NAME" dst -j "$IPTBL_NAME"
109+
echo "$INFO_IPT_BL" >> "$INFO_FILE"
101110
else
102111
# creating iptables with whitelist
103112
iptables -I INPUT 1 -i brwan -m set --match-set "$IPSET_WL_NAME" src -j ACCEPT
104-
iptables -I INPUT 2 -i brwan -m set --match-set "$IPSET_NAME" src -j $IPTBL_NAME
113+
iptables -I INPUT 2 -i brwan -m set --match-set "$IPSET_NAME" src -j "$IPTBL_NAME"
105114
iptables -I OUTPUT 1 -o brwan -m set --match-set "$IPSET_WL_NAME" dst -j ACCEPT
106-
iptables -I OUTPUT 2 -o brwan -m set --match-set "$IPSET_NAME" dst -j $IPTBL_NAME
115+
iptables -I OUTPUT 2 -o brwan -m set --match-set "$IPSET_NAME" dst -j "$IPTBL_NAME"
107116
iptables -I FORWARD 1 -i brwan -m set --match-set "$IPSET_WL_NAME" src -j ACCEPT
108-
iptables -I FORWARD 2 -i brwan -m set --match-set "$IPSET_NAME" src -j $IPTBL_NAME
117+
iptables -I FORWARD 2 -i brwan -m set --match-set "$IPSET_NAME" src -j "$IPTBL_NAME"
109118
iptables -I FORWARD 3 -o brwan -m set --match-set "$IPSET_WL_NAME" dst -j ACCEPT
110-
iptables -I FORWARD 4 -o brwan -m set --match-set "$IPSET_NAME" dst -j $IPTBL_NAME
111-
echo 'BL/WL' >> "$INFO_FILE"
119+
iptables -I FORWARD 4 -o brwan -m set --match-set "$IPSET_NAME" dst -j "$IPTBL_NAME"
120+
echo -e "$INFO_IPT_BL\n$INFO_IPT_WL" >> "$INFO_FILE"
112121
fi
113122

114123
exit 0
115124
fi
116125

117-
SC_VERS="v3.2.0"
126+
SC_VERS="v3.2.1"
118127
SC_PATH="$(cd "$(dirname "$0")" >/dev/null 2>&1 ; pwd -P)"
119128
IPR_BIN="$(command -v iprange)"
120129
# IPT_MD5 & IPT_MD5_NO_WL depends on IPTBL_NAME, IPSET_NAME and IPSET_WL_NAME
121-
IPT_MD5="770406b8f204a584178c61857075443e -"
122-
IPT_MD5_NO_WL="c0b6a9d32801426ed8daf3d936c1eefb -"
130+
IPT_MD5="2ad1475a410bd55d4afac0b7a36e65e1 -"
131+
IPT_MD5_NO_WL="9b7ed183ae8e4d418c957c16fca26939 -"
123132
IPSET_TMP="${IPSET_NAME}_tmp"
124133
SC_NICEPATH="$ROOT_DIR/scripts/$SC_NAME"
125134
SRC_LIST="$ROOT_DIR/etc/$SC_NAME.sources"
@@ -196,8 +205,8 @@ count_ip_in_file() {
196205

197206
count_ip_in_ipset() {
198207
if [ -x "$IPR_BIN" ]
199-
then ipset list "$1" | sed -n '/Members:/,$p' | tail -n +2 | $IPR_BIN -C | sed -n 's/.*,//p'
200-
else ipset list "$1" | sed -n '/Members:/,$p' | tail -n +2 | grep -oE '(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\/([0-9]{1,2})' | awk -F / '{ count[$2]++ } END { for (mask in count) total+=count[mask]*2^(32-mask); print total }'
208+
then ipset list "$1" | tail -n +8 | $IPR_BIN -C | sed -n 's/.*,//p'
209+
else ipset list "$1" | tail -n +8 | grep -oE '(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\/([0-9]{1,2})' | awk -F / '{ count[$2]++ } END { for (mask in count) total+=count[mask]*2^(32-mask); print total }'
201210
fi
202211
}
203212

@@ -346,7 +355,7 @@ update_iplist() {
346355
fi
347356
if [ -x "$IPR_BIN" ]; then
348357
[ "$VERBOSE" ] && echo "- Optimizing and reducing netset (using iprange)..."
349-
$IPR_BIN "$TMP_FILE" --ipset-reduce 20 > "$IP_LIST"
358+
$IPR_BIN --ipset-reduce 20 "$TMP_FILE" > "$IP_LIST"
350359
else
351360
[ "$VERBOSE" ] && echo -e "- iprange not installed, passing optimization and reduction process.\n- Removing duplicates..."
352361
sort "$TMP_FILE" | uniq > "$IP_LIST"
@@ -361,13 +370,17 @@ update_iplist() {
361370

362371
if [ -s "$TMP_FILE" ]; then
363372
if [ -x "$IPR_BIN" ]; then
364-
[ "$VERBOSE" ] && echo "- Optimizing and reducing netset (using iprange)..."
365-
$IPR_BIN "$TMP_FILE" --ipset-reduce 20 > "$WL_FILE"
373+
if [ "$($IPR_BIN --common $IP_LIST $TMP_FILE)" ]; then
374+
[ "$VERBOSE" ] && echo "- Optimizing and reducing netset (using iprange)..."
375+
$IPR_BIN --ipset-reduce 20 "$TMP_FILE" > "$WL_FILE"
376+
else
377+
echo '- No IP in common with blocklist, skipping whitelist.'
378+
fi
366379
else
367380
[ "$VERBOSE" ] && echo -e "- iprange not installed, passing optimization and reduction process.\n- Removing duplicates..."
368381
sort "$TMP_FILE" | uniq > "$WL_FILE"
369382
fi
370-
else echo '- No IP set found.'
383+
else echo '- No IP set found, custom whitelist is empty.'
371384
fi
372385
rm "$TMP_FILE"
373386
[ "$VERBOSE" ] && echo "- Done."
@@ -379,14 +392,14 @@ update_iplist() {
379392
status() {
380393
echo -e "\033[1;36mStatus:\033[0m\n- $SC_NAME version: $SC_VERS"
381394

382-
# check iprang binary
395+
# check iprange binary
383396
[ "$IPR_BIN" ] && echo "- iprange is installed: $($IPR_BIN --version | head -n 1)" || echo "- iprange is not installed."
384397

385398
# check firewall-start.sh script
386399
check_firewall_start && STAT_FWS='ok' || STAT_FWS=''
387400

388401
# check iptables
389-
STAT_IPT="$(iptables -S 2>/dev/null | grep -F "$SC_ABR" | grep -Fv "LOG")"
402+
STAT_IPT="$(iptables -S 2>/dev/null | grep -F "$SC_ABR" | grep -Fv 'LOG' | sed 's/ $//g')"
390403
case "$(echo "$STAT_IPT" | md5sum -)" in
391404
"$IPT_MD5") STAT_IPT_MATCH_WL='ok'; STAT_IPT_MATCH_NOWL='' ;;
392405
# iptables are set with whitelist
@@ -441,6 +454,33 @@ status() {
441454
else
442455
echo "- $FWS_FILE does not exist or does not have firewall-blocklist settings."
443456
fi
457+
458+
# dates
459+
echo "- Actual router time: $(/bin/date)"
460+
[ -e "$IP_LIST" ] && echo "- Blocklist generation time: $(/bin/date -r $IP_LIST)"
461+
[ -e "$WL_FILE" ] && echo "- Whitelist generation time: $(/bin/date -r $WL_FILE)"
462+
463+
# Status file
464+
if [ -r "$INFO_FILE" ]; then
465+
echo -e "- Router firewall was last started $(/bin/date -r $INFO_FILE): \033[35m"
466+
/bin/grep -qF "$INFO_IPS_BL_LOAD" "$INFO_FILE" && echo ' ipset blocklist was loaded from blocklist file.'
467+
/bin/grep -qF "$INFO_IPS_BL_NEW" "$INFO_FILE" && echo ' ipset blocklist was created empty.'
468+
/bin/grep -qF "$INFO_IPS_BL_KEEP" "$INFO_FILE" && echo ' ipset blocklist was already loaded and was kept.'
469+
/bin/grep -qF "$INFO_IPS_BL_WGW" "$INFO_FILE" && echo ' WAN gateway was in ipset blocklist.'
470+
/bin/grep -qF "$INFO_IPS_WL_LOAD" "$INFO_FILE" && echo ' ipset whitelist was loaded from whitelist file.'
471+
/bin/grep -qF "$INFO_IPS_WL_NEW" "$INFO_FILE" && echo ' ipset whitelist was created empty.'
472+
/bin/grep -qF "$INFO_IPS_WL_KEEP" "$INFO_FILE" && echo ' ipset whitelist was already loaded and was kept.'
473+
/bin/grep -qF "$INFO_IPS_WL_WGW_ADD" "$INFO_FILE" && echo ' WAN gateway was added into ipset whitelist.'
474+
/bin/grep -qF "$INFO_IPS_WL_WGW_KEEP" "$INFO_FILE" && echo ' WAN gateway was already in ipset whitelist.'
475+
/bin/grep -qF "$INFO_IPT_KEEP" "$INFO_FILE" && echo ' iptables rules were already set!'
476+
/bin/grep -qF "$INFO_IPT_LOG" "$INFO_FILE" && echo ' logging rules were added to iptables.'
477+
/bin/grep -qF "$INFO_IPT_BL" "$INFO_FILE" && echo ' blocklist rules were added to iptables.'
478+
/bin/grep -qF "$INFO_IPT_WL" "$INFO_FILE" && echo ' whitelist rules were added to iptables.'
479+
echo -ne "\033[0m"
480+
else
481+
echo '- No status file found.'
482+
fi
483+
444484
if [ "$STAT_IPT" ]; then
445485
if [ "$STAT_IPT_MATCH_WL" ]; then
446486
echo "- iptables rules are set with bypass rules (whitelist):"
@@ -461,20 +501,27 @@ status() {
461501
fi
462502
if [ "$STAT_IPS" ]; then
463503
echo "- ipset filter (blocklist) is set:"
464-
[ "$STAT_IPT_MATCH_WL$STAT_IPT_MATCH_NOWL" ] || echo -e " \033[31mblocklist is not used by iptables\033[0m"
465-
[ "$STAT_GW_IN_WL" ] && _CLR='\033[36m' || _CLR='\033[31m'
466-
[ "$STAT_GW_IN_BL" ] && echo -e " ${_CLR}WAN gateway ($WAN_GATEWAY) is in blocklist\033[0m"
504+
# [ "$STAT_IPT_MATCH_WL$STAT_IPT_MATCH_NOWL" ] || echo -e " \033[31mblocklist is not used by iptables\033[0m"
505+
if [ "$STAT_GW_IN_BL" ]
506+
then if [ "$STAT_GW_IN_WL" ]
507+
then echo -e " \033[36mWAN gateway ($WAN_GATEWAY) is in blocklist\033[0m"
508+
else echo -e " \033[31mWAN gateway ($WAN_GATEWAY) is in blocklist (but not in whitelist)!\033[0m"
509+
fi
510+
fi
467511
echo -e "\033[35m$STAT_IPS\033[0m" | sed -e 's/^/ /g'
468512
else
469513
echo "- ipset filter (blocklist) does not exist."
470514
fi
471515
if [ "$STAT_IPS_WL" ]; then
472516
echo "- ipset bypass (whitelist) is set:"
473-
[ "$STAT_IPT_MATCH_WL" ] || echo -e " \033[31mwhitelist is not used by iptables\033[0m"
474-
[ "$STAT_GW_IN_BL" ] && _CLR='\033[36m' || _CLR='\033[31m'
475-
if [ "$STAT_GW_IN_WL" ]
476-
then echo -e " ${_CLR}WAN gateway ($WAN_GATEWAY) is in whitelist\033[0m"
477-
elif [ "$STAT_GW_IN_BL" ]; then echo -e " \033[31mWAN gateway ($WAN_GATEWAY) is NOT in whitelist!\033[0m"
517+
# [ "$STAT_IPT_MATCH_WL" ] || echo -e " \033[31mwhitelist is not used by iptables\033[0m"
518+
if [ "$STAT_GW_IN_BL" ]
519+
then if [ "$STAT_GW_IN_WL" ]
520+
then echo -e " \033[36mWAN gateway ($WAN_GATEWAY) is in whitelist\033[0m"
521+
else echo -e " \033[31mWAN gateway ($WAN_GATEWAY) is NOT in whitelist!\033[0m"
522+
fi
523+
elif [ "$STAT_GW_IN_WL" ]; then
524+
echo -e " \033[31mWAN gateway ($WAN_GATEWAY) is in whitelist (but not in blacklist)!\033[0m"
478525
fi
479526
echo -e "\033[35m$STAT_IPS_WL\033[0m" | sed -e 's/^/ /g'
480527
else

‎install.sh

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -15,7 +15,8 @@ echo "Installing firewall-blocklist files"
1515
cp -i "$SELF_PATH/firewall-blocklist.sources" "$BASE_DIR/bolemo/etc/"
1616
chmod +x "$BASE_DIR/bolemo/scripts/firewall-blocklist"
1717
echo "Done!"
18-
if command -v iprange; then exit 0; fi
18+
if command -v iprange; then echo 'iprange is installed.'; exit 0; fi
19+
[ "$(/bin/uname -p)" = 'IPQ8065' ] || { echo 'This is not a R7800, if you want to install iprange, you need to do it through Entware.'; exit 0; }
1920
echo -ne "iprange does not seem to be installed.\nDo you want to install iprange into internal flash (/usr/bin)? [y/n] -"
2021
read ANSWER
2122
[ "$ANSWER" = 'y' ] || { echo 'Skipping installation of iprange'; exit 0; }

0 commit comments

Comments
 (0)