[Jay461]

Hello All,

I have searched the forum but did not find a firewall script (iptables) that I can use to harden firewall security.
However, in my search I came across adblocking script posted by Alozaros that works well. Thanks Alozaros!
I have the SPI firewall with some of the options enabled.
R7000
Firmware: v3.0-r36070M Kong (05/31/2018)

If you'll can please share your firewall script and make suggestions to harden firewall protection. Thanks in advance.

[egc]

You can check your firewall by using shields up from Steve Gibson: https://www.grc.com/x/ne.dll?bh0bkyd2

If you are using DDWRT default options, all ports should be stealth/closed. That means the firewall is working

[Alozaros]

well, it depends what you want to cut off...
of course you can add some rules to harden your router
but in most of the cases you must know what is all about and what to block and what not to block..
for example yep there are few lines to make it more robust
and i ll not lie i do use quite a few extra rules to block this and that in terms of internal service or app wants to get an access to WAN service or trough WAN something to look for LAN for example my ISP is trying port 80 on INPUT chain or 8080 so im forced to have some extra rules to protect those in my case...

this few are quite standard you can use them with no harm
iptables -t mangle -I PREROUTING -m conntrack --ctstate INVALID -j DROP
iptables -t mangle -I PREROUTING -p tcp ! --syn -m conntrack --ctstate NEW -j DROP
iptables -t mangle -I PREROUTING -p tcp -m conntrack --ctstate NEW -m tcpmss ! --mss 536:65535 -j DROP
iptables -I INPUT -f -j DROP
iptables -I INPUT -p tcp --tcp-flags ALL ALL -j DROP
iptables -I INPUT -p tcp --tcp-flags ALL NONE -j DROP
iptables -I FORWARD -p tcp --tcp-flags ALL NONE -j DROP
iptables -I FORWARD -p tcp --tcp-flags ALL ALL -j DROP
iptables -I FORWARD -f -j DROP
iptables -I FORWARD -p tcp ! --syn -m state --state NEW -j DROP

unless you don't use those WAN ports you can fairly block them too

iptables -I FORWARD -p udp --dport 25 -j DROP
iptables -I FORWARD -p tcp -o `get_wanface` --dport 25 -j REJECT
iptables -I FORWARD -p tcp --dport 25 -j DROP
iptables -I FORWARD -p tcp --dport 137 -j DROP
iptables -I FORWARD -p tcp --dport 138 -j DROP
iptables -I FORWARD -p tcp --dport 139 -j DROP
iptables -I FORWARD -p tcp --dport 445 -j DROP
iptables -I FORWARD -p tcp --dport 502 -j DROP
iptables -I FORWARD -p tcp --dport 31337 -j DROP
iptables -I FORWARD -p udp --dport 137 -j DROP
iptables -I FORWARD -p udp --dport 138 -j DROP
iptables -I FORWARD -p udp --dport 139 -j DROP
iptables -I FORWARD -p udp --dport 445 -j DROP
iptables -I FORWARD -p udp --dport 31337 -j DROP


iptables -I OUTPUT -f -j DROP
iptables -A OUTPUT -m state --state INVALID -j DROP
iptables -A OUTPUT -p tcp --tcp-flags ALL ACK,RST,SYN,FIN -j REJECT
iptables -A OUTPUT -p tcp --tcp-flags SYN,FIN SYN,FIN -j REJECT
iptables -A OUTPUT -p tcp --tcp-flags SYN,RST SYN,RST -j REJECT
iptables -A OUTPUT -p tcp ! --syn -m state --state NEW -j DROP
iptables -A OUTPUT -p tcp --tcp-flags ALL ALL -j REJECT
iptables -A OUTPUT -p tcp --tcp-flags ALL NONE -j REJECT

[Jay461]

Thanks. Apologies for the delayed response. @Alozaros here is what I am using (stolen from you)

Save Start up:

wget -qO /tmp/mvps http://winhelp2002.mvps.org/hosts.txt
wget -qO /tmp/someonewhocares http://someonewhocares.org/hosts/zero/hosts
wget -qO /tmp/sbc http://sbc.io/hosts/hosts
stopservice dnsmasq && startservice dnsmasq

Additional DNSMasq Options:

addn-hosts=/tmp/mvps
addn-hosts=/tmp/someonewhocares
addn-hosts=/tmp/sbc

Additional Cron Jobs:

0 12 * * * root /tmp/.rc_startup

I must say it works pretty well. However, my voip (OBI200 with Google Voice) is not connecting.
The issue is with assigning IP address for obi200. So, I connected it directly to the router
(R700, firmware: v3.0-r36840M kongac (09/03/2018))and it started to work.
The moment I move the obi200 downstairs (where it was originally) it goes back to 'IP address unavailable'

Is this to do with the above script I am using? Preferable I would like to resolve
IP address issue before I try your new script. Any solutions you have in mind?

Once again thanks for your response and sharing firewall scripts- truly appreciated.

[Alozaros]

well this ad blocking script blocks a list of particular advert sites, as you stated when connected directly to the router it works so it must be a lack of signal issue...
those script are saved in start up script the other iptables rules above must be saved in firewall script (the other button)

[AKA_SK]

[Jay461]

[Per Yngve Berg]

Don't use auto channel.

Use 20 Mhz, unless you don't have any neighbours.

It all depends of what channel your neighbours are using.

[Jay461]

[Per Yngve Berg]

20 Mhz will give you 56Mbit/s. On channel 1, you will not interfere with none on channel 6 and 11.

With 40 Mhz, you will use channel 6 also. I believe troughput is lowered when there is traffic on channel 6.

Have you tried 100 UU on the 5Ghz?

[Jay461]

[Per Yngve Berg]

VHT80 is AC only. N type clients connect as VHT40.

[Alozaros]

[Jay461]

@Alozaros

The start up ad blocking script I mentioned at the top of the thread has some ad's coming through. Is that normal? I take it one cannot fully plug this as sacrifices in other areas will be made (?) Thanks

[Alozaros]