So traffic control is running. But the commands in Administration commands firewall starts to early. So they have no chance to run.
This is my firewall:
Code:
#Time Control
sleep10
#tc qdisc add dev eth0 root netem delay 113ms
tc qdisc del dev br0 root
tc qdisc add dev br0 root handle 1: prio
tc qdisc add dev br0 parent 1:3 handle 30: netem delay 145ms
tc filter add dev br0 protocol ip parent 1:0 prio 3 u32 match ip dst 192.168.6.11 flowid 1:3
tc filter add dev br0 protocol ip parent 1:0 prio 3 u32 match ip dst 192.168.6.12 flowid 1:3
tc filter add dev br0 protocol ip parent 1:0 prio 3 u32 match ip dst 192.168.6.13 flowid 1:3
tc filter add dev br0 protocol ip parent 1:0 prio 3 u32 match ip dst 192.168.6.14 flowid 1:3
tc filter add dev br0 protocol ip parent 1:0 prio 3 u32 match ip dst 192.168.6.15 flowid 1:3
tc filter add dev br0 protocol ip parent 1:0 prio 3 u32 match ip dst 192.168.6.16 flowid 1:3
tc filter add dev br0 protocol ip parent 1:0 prio 3 u32 match ip dst 192.168.6.17 flowid 1:3
tc filter add dev br0 protocol ip parent 1:0 prio 3 u32 match ip dst 192.168.6.18 flowid 1:3
tc filter add dev br0 protocol ip parent 1:0 prio 3 u32 match ip dst 192.168.6.19 flowid 1:3
tc filter add dev br0 protocol ip parent 1:0 prio 3 u32 match ip dst 192.168.6.33 flowid 1:3
tc filter add dev br0 protocol ip parent 1:0 prio 3 u32 match ip dst 192.168.6.34 flowid 1:3
tc filter add dev br0 protocol ip parent 1:0 prio 3 u32 match ip dst 192.168.6.20 flowid 1:3
#tc filter add dev br0 protocol ip parent 1:0 prio 3 u32 match ip dst 192.168.6.21 flowid 1:3
iptables -A INPUT -s 193.238.60.65 -j DROP
iptables -A INPUT -s 139.129.188.227 -j DROP
#iptables -A INPUT -s 185.102.219.107 -j DROP
iptables -A OUTPUT -s 193.238.60.65 -j DROP
iptables -A OUTPUT -s 139.129.188.227 -j DROP
#iptables -A OUTPUT -s 185.102.219.107 -j DROP
iptables -A FORWARD -s 203.205.0.0/16 -j DROP
iptables -A FORWARD -s 139.129.0.0/16 -j DROP
#Akzeptieren eingehende Anfragen am Port TCP 990 VPN TAP über RemoteProxy
iptables -I INPUT 1 -p tcp --dport 990 -j ACCEPT
#Akzeptieren eingehende Anfragen am Port TCP 993 VPN TAP über Tunnel
iptables -I INPUT 1 -p tcp --dport 993 -j ACCEPT
#Akzeptieren eingehende Anfragen am Port TCP 994 Shadowsocks Router über Tunnel
iptables -I INPUT 1 -p tcp --dport 994 -j ACCEPT
#Akzeptieren eingehende Anfragen am Port TCP 995 Shadowsocks Router direkt
iptables -I INPUT 1 -p tcp --dport 995 -j ACCEPT
#Akzeptieren eingehende Anfragen am Port TCP 996 VPN TUN über Tunnel an Router 2
iptables -I INPUT 1 -p tcp --dport 996 -j ACCEPT
#Erlaubt den VPN Clients den Zugriff auf routerinterne Prozesse
iptables -I INPUT 3 -i tap2 -j ACCEPT
When I run the commands in ssh terminal it runs perfect.
How can I change this that my firewall will start after the path from myStartup.sh is active ?
Joined: 18 Mar 2014 Posts: 11701 Location: Netherlands
Posted: Mon Jun 07, 2021 16:36 Post subject:
First some remarks, I would use -I instead of -A for the DROP rules.
You are running an OpenVPN TAP server presumably, OpenVPN should make the necessary firewall rules for TAP2 so those should not be necessary on recent builds.
The INPUT rules for shadowsocks etc are missing in in interface maybe you do want it on all interfaces but if not consider adding the interface.
The problem, I think, is that the firewall rules are executed before the rules in startup so adding sleep does not help.
What you can do is spawn a process e.g. put the firewall rules in a script (including the necessary sleep).
Call that script from the Firewall and add &
The & behind the script means start in own process so the firewall will continue and then the startup will be executed while the spawned process is still waiting.
Of course you can make it somewhat more sophisticated e.g. let the startup script make a file when done and have your spawned process sleeping until that file is made
Joined: 08 May 2018 Posts: 13435 Location: Texas, USA
Posted: Mon Jun 07, 2021 17:32 Post subject:
I'm failing to see why none of this is entered in the box and "Add Firewall" is not clicked versus "Add startup". Perhaps putting things in the proper place might help? Not sure QoS (tc) lines can be added to the firewall, so that may need to be put in the startup...
@kernel-panic69
I use Optware for traffic Control.
The function for change the latency is not in qos.
And I had it in my old Router R7000 running with dd-wrt in this way. And ... Yes the iptables roules and so on are in Firewall not in startup.
@edc
thanks...
Yes I use a TAp Server. Ok So i will change the roules for it. I use this roules in my old Router R7000 with a older DD-wrt version. so I thought I use it in this too.
So I will test it with -I in my Drop rules.
I will use Shadowsocks. So I wrote inside. I will install it later. Was also running in my old Router R7000
Can you tell me how I must do it ?
You mean I wrote it in the gui ? Administration commands firewall ? like /opt/myFirewall.sh
And my script myFirewall.sh with all rules for this in /opt directory ?
In this script I use a sleep command.
Joined: 18 Mar 2014 Posts: 11701 Location: Netherlands
Posted: Tue Jun 08, 2021 9:08 Post subject:
drnorton wrote:
@kernel-panic69
You mean I wrote it in the gui ? Administration commands firewall ? like /opt/myFirewall.sh
And my script myFirewall.sh with all rules for this in /opt directory ?
In this script I use a sleep command.
thanks in advanced...
Yes exactly put all the commands (including the sleep) in /opt/myfirewall.sh and call that script from the firewall with:
Code:
/opt/myfirewall.sh &
one tip /opt is on your USB stick and that might not be up so use this to wait for the USB stick to be up:
Code:
is-mounted.sh /opt/myfirewall.sh #wait for file to become available
/opt/myfirewall.sh &
I have test it but the second script for the firewall will not start at right time. I think USB need to much time.Only when I start it by myself with then it will run.
#tc qdisc add dev eth0 root netem delay 113ms
tc qdisc del dev br0 root
tc qdisc add dev br0 root handle 1: prio
tc qdisc add dev br0 parent 1:3 handle 30: netem delay 145ms
tc filter add dev br0 protocol ip parent 1:0 prio 3 u32 match ip dst 192.168.6.11 flowid 1:3
tc filter add dev br0 protocol ip parent 1:0 prio 3 u32 match ip dst 192.168.6.12 flowid 1:3
tc filter add dev br0 protocol ip parent 1:0 prio 3 u32 match ip dst 192.168.6.13 flowid 1:3
tc filter add dev br0 protocol ip parent 1:0 prio 3 u32 match ip dst 192.168.6.14 flowid 1:3
tc filter add dev br0 protocol ip parent 1:0 prio 3 u32 match ip dst 192.168.6.15 flowid 1:3
tc filter add dev br0 protocol ip parent 1:0 prio 3 u32 match ip dst 192.168.6.16 flowid 1:3
tc filter add dev br0 protocol ip parent 1:0 prio 3 u32 match ip dst 192.168.6.17 flowid 1:3
tc filter add dev br0 protocol ip parent 1:0 prio 3 u32 match ip dst 192.168.6.18 flowid 1:3
tc filter add dev br0 protocol ip parent 1:0 prio 3 u32 match ip dst 192.168.6.19 flowid 1:3
tc filter add dev br0 protocol ip parent 1:0 prio 3 u32 match ip dst 192.168.6.20 flowid 1:3
tc filter add dev br0 protocol ip parent 1:0 prio 3 u32 match ip dst 192.168.6.36 flowid 1:3
iptables -I INPUT -s 193.238.60.65 -j DROP
iptables -I INPUT -s 139.129.188.227 -j DROP
iptables -I OUTPUT -s 193.238.60.65 -j DROP
iptables -I OUTPUT -s 139.129.188.227 -j DROP
iptables -I FORWARD -s 203.205.0.0/16 -j DROP
iptables -I FORWARD -s 139.129.0.0/16 -j DROP
#Akzeptieren eingehende Anfragen am Port TCP 990 VPN TAP über RemoteProxy
iptables -I INPUT 1 -p tcp --dport 990 -j ACCEPT
#Akzeptieren eingehende Anfragen am Port TCP 993 VPN TAP über Tunnel
iptables -I INPUT 1 -p tcp --dport 993 -j ACCEPT
#Akzeptieren eingehende Anfragen am Port TCP 994 Shadowsocks Router über Tunnel
iptables -I INPUT 1 -p tcp --dport 994 -j ACCEPT
#Akzeptieren eingehende Anfragen am Port TCP 995 Shadowsocks Router direkt
iptables -I INPUT 1 -p tcp --dport 995 -j ACCEPT
#Akzeptieren eingehende Anfragen am Port TCP 996 VPN TUN über Tunnel an Router 2
iptables -I INPUT 1 -p tcp --dport 996 -j ACCEPT
#Erlaubt den VPN Clients den Zugriff auf routerinterne Prozesse
iptables -I INPUT 3 -i tap2 -j ACCEPT
