dd-wrt firewall—can the firewall script run shell programs

Post new topic   Reply to topic    DD-WRT Forum Index -> Marvell MVEBU based Hardware (WRT1900AC etc.)
Author Message
davidmoore
DD-WRT Novice


Joined: 05 Mar 2018
Posts: 8
Location: Internet

PostPosted: Sat Oct 16, 2021 3:25    Post subject: dd-wrt firewall—can the firewall script run shell programs Reply with quote
I took my iptables commands and put them into a shell script in a flashdrive mounted to /opt/. I set my firewall to that file via ddwrt>Administration>Commands
and rebooted. Nothing happened. So I thought maybe I need to directly call /bin/sh to get it to work. Still no dice.

The script is indeed committed:
Code:

root@ddwrt:/# nvram get rc_firewall
/bin/sh /opt/bin/myWall.sh
/bin/sh /opt/ddwrt-bwmon/firewall.sh
root@ddwrt:/tmp/var/log#




So, do scripts work in there? Would I do better to flip this to a startup script?

_________________
Linksys WRT1900ACSv2 (v3.0-r47510) | Netgear WNDR3700v4 (DD-WRT v3.0-r34777) | Linksys WRT54Gv1 (DD-WRT v24 SP1)
Sponsor
dTX
DD-WRT User


Joined: 28 Dec 2018
Posts: 83

PostPosted: Sat Oct 16, 2021 4:18    Post subject: Reply with quote
@davidmoore in ddwrt>Administration>Commands scroll down until you see field USB Script.
Place your commands there(don't change anything,leave them as they are).
Remove them from the Firewall field though.
Save and reboot. If still no joy that's mean that there is something wrong with your scripts that will need your attention.

_________________
Router: ASUS AC1900(RT-AC68U)
kernel-panic69
DD-WRT Guru


Joined: 08 May 2018
Posts: 14125
Location: Texas, USA

PostPosted: Sat Oct 16, 2021 4:33    Post subject: Reply with quote
You're going to have to actually copy and paste the actual script(s), if I am not mistaken. USB script is the same as the startup, shutdown, and firewall scripts. You have to input the actual script. USB might be one that runs on mount; I would have to verify that to be 100% sure, but AFAIK, you can't run a shell file from the scripts.
_________________
"Life is but a fleeting moment, a vapor that vanishes quickly; All is vanity"
Contribute To DD-WRT
Pogo - A minimal level of ability is expected and needed...
DD-WRT Releases 2023 (PolitePol)
DD-WRT Releases 2023 (RSS Everything)

----------------------
Linux User #377467 counter.li.org / linuxcounter.net
egc
DD-WRT Guru


Joined: 18 Mar 2014
Posts: 12837
Location: Netherlands

PostPosted: Sat Oct 16, 2021 6:24    Post subject: Reply with quote
The general questions forum is not the place to ask for router help see the announcement in that forum:
STOP!-READ FIRST: This area is NOT for router help! READ!

A lot of useful information about how and where to post and a lot of other helpful pointers are in the forum guidelines:
https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=324087

I will move this thread to your routers forum Smile

It looks like you have actually saved it to Administration/Commands Save as Firewall.

But the script is not executed because the drive is not ready yet so you can do one of three things:
1. Add: Sleep 20
2. use a script to wait for the drive to be ready , there are several circulating on the forum.
3. Use the built-in script to wait, the script is /usr/bin/is-mounted.sh:
# wait until directory is mounted and writable
# usage: is-mounted.sh /name-of directory
# default is /jffs
So in your case in the Administration/Command Save as Firewall start with:
Code:
# wait for usb to come on line
is-mounted.sh /opt
# now start the script
/opt/myscript.sh

_________________
Routers:Netgear R7000, R6400v1, R6400v2, EA6900 (XvortexCFE), E2000, E1200v1, WRT54GS v1.
Install guide R6400v2, R6700v3,XR300:https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=316399
Install guide R7800/XR500: https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=320614
Forum Guide Lines (important read):https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=324087
kernel-panic69
DD-WRT Guru


Joined: 08 May 2018
Posts: 14125
Location: Texas, USA

PostPosted: Sat Oct 16, 2021 11:15    Post subject: Reply with quote
Save USB should account for that, but I was not aware that you could execute shell script (*.sh) files from any of those, or had forgotten you could since I normally only call those from cron.
_________________
"Life is but a fleeting moment, a vapor that vanishes quickly; All is vanity"
Contribute To DD-WRT
Pogo - A minimal level of ability is expected and needed...
DD-WRT Releases 2023 (PolitePol)
DD-WRT Releases 2023 (RSS Everything)

----------------------
Linux User #377467 counter.li.org / linuxcounter.net
egc
DD-WRT Guru


Joined: 18 Mar 2014
Posts: 12837
Location: Netherlands

PostPosted: Sat Oct 16, 2021 11:46    Post subject: Reply with quote
Calling it from Save USB should execute the code but does so only once when USB mounts, I think

If you have firewall rules you probably want to have those reapplied after restarting of the firewall.

_________________
Routers:Netgear R7000, R6400v1, R6400v2, EA6900 (XvortexCFE), E2000, E1200v1, WRT54GS v1.
Install guide R6400v2, R6700v3,XR300:https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=316399
Install guide R7800/XR500: https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=320614
Forum Guide Lines (important read):https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=324087
SurprisedItWorks
DD-WRT Guru


Joined: 04 Aug 2018
Posts: 1446
Location: Appalachian mountains, USA

PostPosted: Sat Oct 16, 2021 14:25    Post subject: Reply with quote
I see this hinted at here, but to be absolutely clear, yes, the shell code, whatever it is, in the Firewall window in the GUI is executed whenever the firewall is built. If you have it invoke a script, a script will be run. Even for firewall setup, it can be convenient to use more than just iptables commands. It's equivalent, for example, to have
Code:
iptables blah-i br0 blah
iptables blah-i wlan0 blah
iptables blah-i wlan1.1 blah
and
Code:
for if in br0 wlan0 wlan1.1; do
    iptables blah-i $if blah
done

in that GUI window. The difference between Startup and Firewall is that Startup is ordinarily run once only, at boot, but Firewall is run by various Apply steps and can even be run multiple times in the boot process, depending on your configuration. It's run anytime the firewall needs to be cleaned out and rebuilt.

_________________
2x Netgear XR500 and 3x Linksys WRT1900ACSv2 on 53544: VLANs, VAPs, NAS, station mode, OpenVPN client (AirVPN), wireguard server (AirVPN port forward) and clients (AzireVPN, AirVPN, private), 3 DNSCrypt providers via VPN.
davidmoore
DD-WRT Novice


Joined: 05 Mar 2018
Posts: 8
Location: Internet

PostPosted: Tue Oct 19, 2021 21:23    Post subject: Reply with quote
egc wrote:
The general questions forum is not the place to ask for router help see the announcement in that forum:
STOP!-READ FIRST: This area is NOT for router help! READ!

A lot of useful information about how and where to post and a lot of other helpful pointers are in the forum guidelines:
https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=324087

I will move this thread to your routers forum Smile


Sorry!

egc wrote:

It looks like you have actually saved it to Administration/Commands Save as Firewall.

But the script is not executed because the drive is not ready yet so you can do one of three things:
1. Add: Sleep 20

This did it! ⤴
egc wrote:

2. use a script to wait for the drive to be ready , there are several circulating on the forum.
3. Use the built-in script to wait, the script is /usr/bin/is-mounted.sh:
# wait until directory is mounted and writable
# usage: is-mounted.sh /name-of directory
# default is /jffs

This did it even better!⤴
egc wrote:
So in your case in the Administration/Command Save as Firewall start with:
Code:
# wait for usb to come on line
is-mounted.sh /opt
# now start the script
/opt/myscript.sh


Awesome. Thanks so much for your insight! I was scratching my head over this one for a bit. https://github.com/vortex-5/ddwrt-bwmon added a .sh file in the firewall script (without waiting for /opt to be mounted and overwriting my firewall script in the process) so I realized that if modifications I make run the risk of messing up my nvram savings, I better just keep them centralized for easy restoration.

Much appreciated!

_________________
Linksys WRT1900ACSv2 (v3.0-r47510) | Netgear WNDR3700v4 (DD-WRT v3.0-r34777) | Linksys WRT54Gv1 (DD-WRT v24 SP1)
Display posts from previous:    Page 1 of 1
Post new topic   Reply to topic    DD-WRT Forum Index -> Marvell MVEBU based Hardware (WRT1900AC etc.) All times are GMT

Navigation

 
Jump to:  
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You cannot attach files in this forum
You cannot download files in this forum