Show pagesourceOld revisionsBacklinksBack to top × Table of Contents Filtering traffic with IP sets by DNS Introduction Goals Command-line instructions Testing Troubleshooting Extras Web interface Manage domains Source restriction Time restriction Established connections Filtering traffic with IP sets by DNS This article relies on the following: Accessing web interface / command-line interface Managing configs / packages / services / logs Introduction This how-to configures traffic filtering with IP sets by DNS on OpenWrt. It relies on resolveip and firewall with IP sets to resolve and filter domains. Goals Filter LAN client traffic with IP sets by DNS. Command-line instructions Install the required packages. Filter LAN client traffic with firewall and IP sets. Set up IP set extras and Hotplug extras to automatically populate IP sets. # Install packages opkg update opkg install resolveip # Configure IP sets uci -q delete dhcp.filter uci set dhcp.filter="ipset" uci add_list dhcp.filter.name="filter" uci add_list dhcp.filter.name="filter6" uci add_list dhcp.filter.domain="example.com" uci add_list dhcp.filter.domain="example.net" uci commit dhcp # Filter LAN client traffic with IP sets for IPV in 4 6 do uci -q delete firewall.filter${IPV%4}_fwd uci set firewall.filter${IPV%4}_fwd="rule" uci set firewall.filter${IPV%4}_fwd.name="Filter-IPset-DNS-Forward" uci set firewall.filter${IPV%4}_fwd.src="lan" uci set firewall.filter${IPV%4}_fwd.dest="wan" uci set firewall.filter${IPV%4}_fwd.proto="all" uci set firewall.filter${IPV%4}_fwd.family="ipv${IPV}" uci set firewall.filter${IPV%4}_fwd.ipset="filter${IPV%4} dest" uci set firewall.filter${IPV%4}_fwd.target="REJECT" done uci commit firewall # Populate IP sets ipset setup Testing Flush DNS cache on the clients and restart the client browser. Verify your client traffic is properly filtered on the router. Troubleshooting Collect and analyze the following information. # Restart services /etc/init.d/firewall restart # Runtime configuration nft list ruleset # Persistent configuration uci show firewall; crontab -l Extras Web interface If you want to manage the settings using web interface. Navigate to LuCI → Network → Firewall → Traffic Rules → Filter-IPset-DNS-Forward to manage firewall rules. Navigate to LuCI → Network → DHCP and DNS → IP sets to manage domains. Manage domains Add/remove domains to/from the filtering list. # Add domains uci add_list dhcp.filter.domain="example.com" uci add_list dhcp.filter.domain="example.net" # Remove domains uci del_list dhcp.filter.domain="example.com" uci del_list dhcp.filter.domain="example.net" # Save and apply uci commit dhcp ipset reset Source restriction Limit the restriction scope to a specific source MAC address. # Apply source restriction for IPV in 4 6 do uci add_list firewall.filter${IPV%4}_fwd.src_mac="11:22:33:44:55:66" uci add_list firewall.filter${IPV%4}_fwd.src_mac="aa:bb:cc:dd:ee:ff" done uci commit firewall /etc/init.d/firewall restart Time restriction Reorder firewall rules and enable time restriction to keep the rules active. Reload kernel timezone to properly apply DST. # Apply time restriction for IPV in 4 6 do uci set firewall.filter${IPV%4}_fwd.start_time="21:00:00" uci set firewall.filter${IPV%4}_fwd.stop_time="09:00:00" uci set firewall.filter${IPV%4}_fwd.weekdays="Mon Tue Wed Thu Fri" done uci commit firewall /etc/init.d/firewall restart Established connections Reorder firewall rules to properly apply time restrictions. # Reorder firewall rules cat << "EOF" > /etc/nftables.d/estab.sh nft list chain inet fw4 forward \ | sed -e "/\sestablished,related\saccept\s/d /^\s*jump\shandle_reject$/\ i $(nft list chain inet fw4 forward \ | sed -n -e "/\sestablished,related\saccept\s/p") 1i flush chain inet fw4 forward" \ | nft -f - EOF uci -q delete firewall.estab uci set firewall.estab="include" uci set firewall.estab.path="/etc/nftables.d/estab.sh" uci commit firewall /etc/init.d/firewall restart This website uses cookies. By using the website, you agree with storing cookies on your computer. Also you acknowledge that you have read and understand our Privacy Policy. If you do not agree leave the website.OKMore information about cookies Last modified: 2023/03/30 16:20by vgaetera