2. Fórumok
  3. Hálózat, szolgáltatók
  4. TP-Link WR1043ND router
  • Téma összefoglaló
    Utoljára frissítve: 2023-12-13 05:20

    Fototrend

    TP-Link WR1043ND - N450 router

Új hozzászólás Aktív témák

  • #25902 vargalex Topikgazda sto1911 #25900
    Új Válasz #25902
    Új hozzászólás
    Összes hozzászólása itt Válaszok az összes hozzászólására itt Válaszok erre a hozzászólásra
    Privát üzenet küldése

    vargalex

    Topikgazda

    válasz sto1911 #25900 üzenetére

    Hi!

    Ja, hogy leszedted a dropbear-t. Akkor a remove törölte, ugyanis az scp a dropbear csomag része:

    root@OpenWrt:~# opkg files dropbear
    Package dropbear (2011.54-2) is installed on root and has the following files:
    /usr/bin/dbclient
    /usr/bin/scp
    /etc/dropbear/dropbear_rsa_host_key
    /etc/init.d/dropbear
    /usr/bin/dropbearkey
    /etc/config/dropbear
    /etc/dropbear/dropbear_dss_host_key
    /usr/sbin/dropbear
    /usr/bin/ssh

    iptables-save nincs. A /etc/config/firewall-ban tudod config-olni a tűzfalat, illetve a /etc/firewall.user-ben tudsz saját iptables parancsokat írni. Az 1.1-es build-emben így néz ki:

    /etc/config/firewall:

    config defaults
    option syn_flood 1
    option input ACCEPT
    option output ACCEPT
    option forward REJECT
    # Uncomment this line to disable ipv6 rules
    # option disable_ipv6 1

    config zone
    option name lan
    option network 'lan'
    option input ACCEPT
    option output ACCEPT
    option forward REJECT

    config zone
    option name wan
    option network 'wan'
    option input DROP
    option output ACCEPT
    option forward REJECT
    option masq 1
    option mtu_fix 1

    config forwarding
    option src lan
    option dest wan

    # We need to accept udp packets on port 68,
    # see https://dev.openwrt.org/ticket/4108
    config rule
    option src wan
    option proto udp
    option dest_port 68
    option target ACCEPT
    option family ipv4

    # Allow IPv4 ping
    config rule
    option src wan
    option proto icmp
    option icmp_type echo-request
    option family ipv4
    option target ACCEPT

    # Allow DHCPv6 replies
    # see https://dev.openwrt.org/ticket/10381
    config rule
    option src wan
    option proto udp
    option src_ip fe80::/10
    option src_port 547
    option dest_ip fe80::/10
    option dest_port 546
    option family ipv6
    option target ACCEPT

    # Allow essential incoming IPv6 ICMP traffic
    config rule
    option src wan
    option proto icmp
    list icmp_type echo-request
    list icmp_type destination-unreachable
    list icmp_type packet-too-big
    list icmp_type time-exceeded
    list icmp_type bad-header
    list icmp_type unknown-header-type
    list icmp_type router-solicitation
    list icmp_type neighbour-solicitation
    option limit 1000/sec
    option family ipv6
    option target ACCEPT

    # Allow essential forwarded IPv6 ICMP traffic
    config rule
    option src wan
    option dest *
    option proto icmp
    list icmp_type echo-request
    list icmp_type destination-unreachable
    list icmp_type packet-too-big
    list icmp_type time-exceeded
    list icmp_type bad-header
    list icmp_type unknown-header-type
    option limit 1000/sec
    option family ipv6
    option target ACCEPT

    # include a file with users custom iptables rules
    config include
    option path /etc/firewall.user

    config 'rule' 'transmission_web'
    option 'target' 'ACCEPT'
    option '_name' 'transmission_web'
    option 'src' 'wan'
    option 'proto' 'tcp'
    option 'dest_port' '9091'

    config 'rule'
    option 'target' 'ACCEPT'
    option '_name' 'ssh_WAN'
    option 'src' 'wan'
    option 'proto' 'tcp'
    option 'dest_ip' '192.168.1.1'
    option 'dest_port' '22'

    config 'rule'
    option 'target' 'ACCEPT'
    option '_name' 'ftp_WAN'
    option 'src' 'wan'
    option 'proto' 'tcp'
    option 'dest_ip' '192.168.1.1'
    option 'dest_port' '21'

    config 'rule'
    option 'target' 'ACCEPT'
    option '_name' 'Transmission'
    option 'src' 'wan'
    option 'proto' 'tcpudp'
    option 'dest_port' '21234'

    config 'rule'
    option 'target' 'ACCEPT'
    option '_name' 'Luci_HTTPS'
    option 'src' 'wan'
    option 'proto' 'tcp'
    option 'dest_port' '443'

    config rule
    option src 'lan'
    option name 'block_internet_access_IP'
    option src_ip '192.168.1.181'
    option target 'DROP'
    option dest 'wan'
    option extra '-m time --weekdays Mon,Tue,Wed,Thu,Fri --timestart 10:00 --timestop 22:00'
    option enabled '0'

    Ebből az utolsó rule-t ne tedd be, mert 10.03.1 alatt enabled opció biztos nincs, és az extra opcióban sem vagyok biztos, hogy lenne.

    /etc/firewall.user:

    # This file is interpreted as shell script.
    # Put your custom iptables rules here, they will
    # be executed with each firewall (re-)start.

    BRUTEFORCE_PROTECTION_START=3
    BRUTEFORCE_DROPPORT=55555
    PROTO=tcp
    ROUTERIP=$(uci get network.lan.ipaddr)

    ########################################
    #SSH Brute Force protection on port 2222
    PROTECTEDPORT=2222
    SERVICEPORT=22
    SERVICE=SSH

    echo Enabling Brute Force protection for $SERVICE on port $SERVICEPORT
    iptables --table nat -I zone_wan_prerouting -p $PROTO --dport $PROTECTEDPORT -m state --state NEW -m recent --set --name $SERVICE -j DNAT --to-destination $ROUTERIP:$SERVICEPORT
    iptables --table nat -I zone_wan_prerouting -p $PROTO --dport $PROTECTEDPORT -m state --state NEW -m recent --update --seconds 60 --hitcount $BRUTEFORCE_PROTECTION_START --name $SERVICE -j DNAT --to-destination $ROUTERIP:$BRUTEFORCE_DROPPORT
    iptables --table nat -I zone_wan_prerouting -p $PROTO --dport $PROTECTEDPORT -m state --state NEW -m recent --rcheck --seconds 60 --hitcount $BRUTEFORCE_PROTECTION_START --name $SERVICE -j LOG --log-prefix "BruteForce-${SERVICE} "
    ########################################

    ########################################
    #FTP Brute Force protection on port 2221
    PROTECTEDPORT=2221
    SERVICEPORT=21
    SERVICE=FTP

    echo Enabling Brute Force protection for $SERVICE on port $SERVICEPORT
    iptables --table nat -I zone_wan_prerouting -p $PROTO --dport $PROTECTEDPORT -m state --state NEW -m recent --set --name $SERVICE -j DNAT --to-destination $ROUTERIP:$SERVICEPORT
    iptables --table nat -I zone_wan_prerouting -p $PROTO --dport $PROTECTEDPORT -m state --state NEW -m recent --update --seconds 60 --hitcount $BRUTEFORCE_PROTECTION_START --name $SERVICE -j DNAT --to-destination $ROUTERIP:$BRUTEFORCE_DROPPORT
    iptables --table nat -I zone_wan_prerouting -p $PROTO --dport $PROTECTEDPORT -m state --state NEW -m recent --rcheck --seconds 60 --hitcount $BRUTEFORCE_PROTECTION_START --name $SERVICE -j LOG --log-prefix "BruteForce-${SERVICE} "
    ########################################

    ########################################
    #Block URL on certain time for specified IP
    #
    #URL_STRING=facebook.com
    #LOCAL_IP=192.168.1.188
    #TIME_START=10:00
    #TIME_END=16:00
    #
    #echo Blocking $URL_STRING from $LOCAL_IP at time interval $TIME_START - $TIME_END
    #iptables -I FORWARD -s $LOCAL_IP -m string --string $URL_STRING --algo bm -m time --weekdays Mon,Tue,Wed,Thu,Fri --timestart $TIME_START --timestop $TIME_END -j DROP
    ########################################

    Az idő alapú szűréshez viszont kell az iptables-mod-ipopt csomag.

    (#25901): Igen, ez a régi megoldás.

Új hozzászólás Aktív témák