Router lockdown, stuck

Post new topic   Reply to topic    DD-WRT Forum Forum Index -> Broadcom SoC based Hardware
Goto page Previous  1, 2
Author Message
RjG
DD-WRT User


Joined: 01 Jul 2007
Posts: 81

PostPosted: Wed Oct 09, 2019 7:28    Post subject: Reply with quote
Wildlion wrote:
Code:

#MAC Filter
#insmod ipt_mac
iptables -N CMACFILTER
#drop link local without logging
iptables -A CMACFILTER -s 169.254.0.0/16 -j DROP
iptables -A CMACFILTER -m mac --mac-source (allowed mac) -j RETURN
iptables -A CMACFILTER -m limit --limit 2/min -j LOG --log-prefix " MAC DROP: "
iptables -A CMACFILTER -j DROP
iptables -I FORWARD 1 -i `nvram get lan_ifname` -j CMACFILTER
iptables -I INPUT 1 -i `nvram get lan_ifname` -j CMACFILTER



It works, it's perfect, exactly what I needed. Thanks so much Wildlion Smile

There is logging too? nice! I already have syslog turned on, didn't see drop there, I turned on logging in security too,nope... where are MAC DROP logs going?

_________________
Firmware: DD-WRT v3.0-r39345M kongac (04/03/19) Netgear R7000
Sponsor
Wildlion
DD-WRT User


Joined: 24 May 2016
Posts: 492

PostPosted: Wed Oct 09, 2019 23:03    Post subject: Reply with quote
Welcome... Wait what logging is not working!?!

So I am not sure how confident you are with the command line, but for some reason the logging does not show up in the GUI Status->Syslog

But when I log into the router and do a dmesg it does show up.

MAC DROP: IN=br0 OUT= MAC=redacted SRC=192.168.1.15 DST=192.168.1.1 LEN=57 TOS=0x00 PREC=0x00 TTL=64 ID=18335 DF PROTO=UDP SPT=47485 DPT=53 LEN=37
MAC DROP: IN=br0 OUT= MAC=redacted SRC=192.168.1.15 DST=192.168.1.1 LEN=70 TOS=0x00 PREC=0x00 TTL=64 ID=18336 DF PROTO=UDP SPT=57323 DPT=53 LEN=50
MAC DROP: IN=br0 OUT= MAC=redacted SRC=192.168.1.15 DST=192.168.1.1 LEN=70 TOS=0x00 PREC=0x00 TTL=64 ID=18337 DF PROTO=UDP SPT=59555 DPT=53 LEN=50

This was me trying to do some dns lookups after I set a static ip address, since dhcp requests will be dropped as well. (I have syslog on)

To be honest, I think that the logging capabilities in DD-WRT have been reduced. (someone correct me if I am wrong)

you might need to take off the "-m limit --limit 2/min" on the logging line

It is also possible that since I am not using the proper DD-WRT method of jumping to the logdrop or logreject chain, something is not setup correctly (or it is not turned on)

So a thought would be change the lines to be:
Code:

#MAC Filter
#drop link local without logging
iptables -A CMACFILTER -s 169.254.0.0/16 -j DROP
iptables -A CMACFILTER -m mac --mac-source (allowed mac) -j RETURN
iptables -A CMACFILTER -j LOG --log-prefix " MAC DROP: "
iptables -A CMACFILTER -j logdrop
iptables -I FORWARD 1 -i `nvram get lan_ifname` -j CMACFILTER
iptables -I INPUT 1 -i `nvram get lan_ifname` -j CMACFILTER


I have not tried this but I think it should work. Then if you turn on logging for the firewall, I *think* it will show up.
RjG
DD-WRT User


Joined: 01 Jul 2007
Posts: 81

PostPosted: Fri Oct 11, 2019 3:16    Post subject: Reply with quote
yes, stuff did show in dmsg, SRC DEST and MAC. That did not show in dd-wrt syslog, or external syslog server.

I already changed it to logdrop... then you get a drop message in the outbound security log. But there's no MAC logged, so there's really no point logging that there, for me anyway.

That's ok, it does what it needs to do, logging was just a bonus I didn't see coming Smile I'll work on it a bit more on the weekend if I can, and try without "-m limit --limit 2/min"

Thanks !

_________________
Firmware: DD-WRT v3.0-r39345M kongac (04/03/19) Netgear R7000
Goto page Previous  1, 2 Display posts from previous:    Page 2 of 2
Post new topic   Reply to topic    DD-WRT Forum Forum Index -> Broadcom SoC based Hardware All times are GMT

Navigation

 
Jump to:  
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You can attach files in this forum
You can download files in this forum