Archiv
-
02.07.16MVPS HOSTS in MikroTik RouterOS
References:
https://github.com/aziraphale/routeros-dns-adblock
http://winhelp2002.mvps.org/hosts.htmPrerequisities:
– any box running PHP, i used centos server
– the access to the MikroTik console123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287[root@7s1 ~]#[root@7s1 ~]# #download RouterOS DNS Server AdBlock Configuration[root@7s1 ~]# wget https://github.com/aziraphale/routeros-dns-adblock/archive/master.zip--2016-02-07 15:02:03-- https://github.com/aziraphale/routeros-dns-adblock/archive/master.zipResolving github.com (github.com)... 192.30.252.131Connecting to github.com (github.com)|192.30.252.131|:443... connected.HTTP request sent, awaiting response... 302 FoundLocation: https://codeload.github.com/aziraphale/routeros-dns-adblock/zip/master [following]--2016-02-07 15:02:04-- https://codeload.github.com/aziraphale/routeros-dns-adblock/zip/masterResolving codeload.github.com (codeload.github.com)... 192.30.252.162Connecting to codeload.github.com (codeload.github.com)|192.30.252.162|:443... connected.HTTP request sent, awaiting response... 200 OKLength: 457551 (447K) [application/zip]Saving to: ‘master.zip’100%[====================================================================================>] 457,551 467KB/s in 1.0s2016-02-07 15:02:05 (467 KB/s) - ‘master.zip’ saved [457551/457551][root@7s1 ~]# #move it in a proper folder[root@7s1 ~]# mkdir blocking[root@7s1 ~]# mv master.zip blocking/[root@7s1 ~]# cd blocking/[root@7s1 blocking]#[root@7s1 blocking]# lltotal 448-rw-r--r--. 1 root root 457551 Feb 7 15:02 master.zip[root@7s1 blocking]#[root@7s1 blocking]# unzip master.zipArchive: master.zip8bd97572d1b8d99b3780c26ce98f25e1262db2dfcreating: routeros-dns-adblock-master/extracting: routeros-dns-adblock-master/.gitignoreinflating: routeros-dns-adblock-master/README.mdinflating: routeros-dns-adblock-master/process.custom.phpinflating: routeros-dns-adblock-master/process.dan-pollock.phpinflating: routeros-dns-adblock-master/process.hphosts.phpinflating: routeros-dns-adblock-master/process.malwaredomainlist.com.phpinflating: routeros-dns-adblock-master/process.malwaredomains.com.phpinflating: routeros-dns-adblock-master/process.mvps.phpinflating: routeros-dns-adblock-master/process.peter-lowe.phpinflating: routeros-dns-adblock-master/process.phpinflating: routeros-dns-adblock-master/process.spam404.phpinflating: routeros-dns-adblock-master/source.custom.txtinflating: routeros-dns-adblock-master/source.dan-pollock.txtinflating: routeros-dns-adblock-master/source.hphosts.txtinflating: routeros-dns-adblock-master/source.malwaredomainlist.com.txtinflating: routeros-dns-adblock-master/source.malwaredomains.com.txtinflating: routeros-dns-adblock-master/source.mvps.txtinflating: routeros-dns-adblock-master/source.peter-lowe.txtinflating: routeros-dns-adblock-master/source.spam404.txt[root@7s1 blocking]#[root@7s1 blocking]#[root@7s1 blocking]# lltotal 452-rw-r--r--. 1 root root 457551 Feb 7 15:02 master.zipdrwxr-xr-x. 2 root root 4096 Oct 25 15:53 routeros-dns-adblock-master[root@7s1 blocking]#[root@7s1 blocking]# cd routeros-dns-adblock-master/[root@7s1 routeros-dns-adblock-master]# lltotal 1892-rw-r--r--. 1 root root 900 Oct 25 15:53 process.custom.php-rw-r--r--. 1 root root 1256 Oct 25 15:53 process.dan-pollock.php-rw-r--r--. 1 root root 1007 Oct 25 15:53 process.hphosts.php-rw-r--r--. 1 root root 1000 Oct 25 15:53 process.malwaredomainlist.com.php-rw-r--r--. 1 root root 1002 Oct 25 15:53 process.malwaredomains.com.php-rw-r--r--. 1 root root 913 Oct 25 15:53 process.mvps.php-rw-r--r--. 1 root root 913 Oct 25 15:53 process.peter-lowe.php-rw-r--r--. 1 root root 3986 Oct 25 15:53 process.php-rw-r--r--. 1 root root 940 Oct 25 15:53 process.spam404.php-rw-r--r--. 1 root root 3969 Oct 25 15:53 README.md-rw-r--r--. 1 root root 110 Oct 25 15:53 source.custom.txt-rw-r--r--. 1 root root 322418 Oct 25 15:53 source.dan-pollock.txt-rw-r--r--. 1 root root 802060 Oct 25 15:53 source.hphosts.txt-rw-r--r--. 1 root root 44736 Oct 25 15:53 source.malwaredomainlist.com.txt-rw-r--r--. 1 root root 42219 Oct 25 15:53 source.malwaredomains.com.txt-rw-r--r--. 1 root root 502790 Oct 25 15:53 source.mvps.txt-rw-r--r--. 1 root root 65456 Oct 25 15:53 source.peter-lowe.txt-rw-r--r--. 1 root root 103973 Oct 25 15:53 source.spam404.txt[root@7s1 routeros-dns-adblock-master]#[root@7s1 routeros-dns-adblock-master]# #download the current version of MVPS hosts file[root@7s1 routeros-dns-adblock-master]# wget -O source.mvps.txt winhelp2002.mvps.org/hosts.txt--2016-02-07 15:22:18-- http://winhelp2002.mvps.org/hosts.txtResolving winhelp2002.mvps.org (winhelp2002.mvps.org)... 216.155.126.40Connecting to winhelp2002.mvps.org (winhelp2002.mvps.org)|216.155.126.40|:80... connected.HTTP request sent, awaiting response... 200 OKLength: 508717 (497K) [text/plain]Saving to: ‘source.mvps.txt’100%[====================================================================================>] 508,717 347KB/s in 1.4s2016-02-07 15:22:20 (347 KB/s) - ‘source.mvps.txt’ saved [508717/508717][root@7s1 routeros-dns-adblock-master]#[root@7s1 routeros-dns-adblock-master]# #edit process.php 1) commenting-out the filter list files that you don't want to use[root@7s1 routeros-dns-adblock-master]# # 2) enable routeros script => define('BIND9_OUTPUT', false);[root@7s1 routeros-dns-adblock-master]# vim process.php[root@7s1 routeros-dns-adblock-master]#[root@7s1 routeros-dns-adblock-master]# #that's mine configuration[root@7s1 routeros-dns-adblock-master]# head -n 30 process.php<?php$files = [ // destination IPs only used in RouterOS mode# "peter-lowe" => ["240.0.0.1"],"mvps" => ["240.0.0.2"],# "hphosts" => ["240.0.0.3"],# "dan-pollock" => ["240.0.0.4"],# "spam404" => ["240.0.0.5"],# "malwaredomains.com" => ["240.0.0.6"],# "malwaredomainlist.com" => ["240.0.0.7"],# "custom" => ["240.0.0.255"],];// Might be a bit memory-intensive/slow... not strictly necessary, as RouterOS will just display a warning on duplicates. Only applicable in RouterOS modedefine('SKIP_DUPLICATES', true);// Seems to be faster - use integer (CRC32 hash) keys for matching duplicates, rather than stringsdefine('SKIP_DUPLICATES_CRC32', true);// Only applies to RouterOS outputdefine('PER_FILE_LIMIT', 3000);// Enables output of bind9 zone files instead of RouterOS scripts. Forces skip_duplicates to ONdefine('BIND9_OUTPUT', false);// Name of Bind9 "null" zone filedefine('BIND9_NULL_ZONEFILE_NAME', '/etc/bind/db.null');define('IN_PROCESS', 1);$totalTimeStart = microtime(true);[root@7s1 routeros-dns-adblock-master]#[root@7s1 routeros-dns-adblock-master]# #let's go...[root@7s1 routeros-dns-adblock-master]# php process.phpNOTE: Removing duplicate hosts is ENABLED (via crc32).mvps => 240.0.0.2 ... ..13574 hosts (18821.22ms) (5 files)Total duration: 18821.73msTotal hosts: 13574Total files: 5Peak RAM use: 2.00 MB[root@7s1 routeros-dns-adblock-master]#[root@7s1 routeros-dns-adblock-master]#[root@7s1 routeros-dns-adblock-master]#[root@7s1 routeros-dns-adblock-master]# #five rsc scripts have been created[root@7s1 routeros-dns-adblock-master]# ll *rsc-rw-r--r--. 1 root root 151791 Feb 7 15:42 script.mvps-0.rsc-rw-r--r--. 1 root root 153836 Feb 7 15:42 script.mvps-1.rsc-rw-r--r--. 1 root root 156486 Feb 7 15:42 script.mvps-2.rsc-rw-r--r--. 1 root root 156121 Feb 7 15:42 script.mvps-3.rsc-rw-r--r--. 1 root root 87676 Feb 7 15:42 script.mvps-4.rsc[root@7s1 routeros-dns-adblock-master]#[root@7s1 routeros-dns-adblock-master]# #let's upload them to the router via ssh[root@7s1 routeros-dns-adblock-master]# scp *rsc olie1@192.168.0.1:/script.mvps-0.rsc 100% 148KB 148.2KB/s 00:00script.mvps-1.rsc 100% 150KB 150.2KB/s 00:00script.mvps-2.rsc 100% 153KB 152.8KB/s 00:00script.mvps-3.rsc 100% 152KB 152.5KB/s 00:00script.mvps-4.rsc 100% 86KB 85.6KB/s 00:00[root@7s1 routeros-dns-adblock-master]#[root@7s1 routeros-dns-adblock-master]#[olie1@MikroTik] > # on the router-side, print interfaces and firewall filters[olie1@MikroTik] > interface printFlags: D - dynamic, X - disabled, R - running, S - slave# NAME TYPE ACTUAL-MTU L2MTU MAX-L2MTU MAC-ADDRESS0 R ether1-gateway ether 1500 1598 2028 00:10:DC:4F:DD:8A1 S ether2-master-local ether 1500 1598 2028 E4:8D:8C:E9:C4:442 S ether3-slave-local ether 1500 1598 2028 E4:8D:8C:E9:C4:453 S ether4-slave-local ether 1500 1598 2028 E4:8D:8C:E9:C4:464 S ether5-slave-local ether 1500 1598 2028 E4:8D:8C:E9:C4:475 RS wlan1 wlan 1500 1600 E4:8D:8C:E9:C4:486 R bridge-local bridge 1500 1598 E4:8D:8C:E9:C4:44[olie1@MikroTik] >[olie1@MikroTik] > ip firewall filter printFlags: X - disabled, I - invalid, D - dynamic0 D ;;; special dummy rule to show fasttrack counterschain=forward1 ;;; Gigaserver watchdogchain=input action=accept protocol=tcp src-address=85.118.128.29 dst-port=80 log=no log-prefix=""2 XI ;;; default configurationchain=input action=accept protocol=icmp log=no log-prefix=""3 ;;; default configurationchain=input action=accept connection-state=established,related log=no log-prefix=""4 ;;; default configurationchain=input action=drop in-interface=ether1-gateway log=no log-prefix=""5 ;;; default configurationchain=forward action=fasttrack-connection connection-state=established,related log=no log-prefix=""6 ;;; default configurationchain=forward action=accept connection-state=established,related log=no log-prefix=""7 ;;; default configurationchain=forward action=drop connection-state=invalid log=no log-prefix=""8 ;;; default configurationchain=forward action=drop connection-state=new connection-nat-state=!dstnat in-interface=ether1-gateway log=nolog-prefix=""[olie1@MikroTik] >[olie1@MikroTik] > #add a firewall filter rule to block outbound access to the 240.0.0.0/4 IPv4 range and move it to the proper possion[olie1@MikroTik] > /ip firewall filter add chain=forward in-interface=ether1-gateway connection-state=new protocol=tcp dst-address=240.0.0.0/4 action=reject reject-with=tcp-reset[olie1@MikroTik] > ip firewall filter move 9 8[olie1@MikroTik] > ip firewall filter printFlags: X - disabled, I - invalid, D - dynamic0 D ;;; special dummy rule to show fasttrack counterschain=forward1 ;;; Gigaserver watchdogchain=input action=accept protocol=tcp src-address=85.118.128.29 dst-port=80 log=no log-prefix=""2 XI ;;; default configurationchain=input action=accept protocol=icmp log=no log-prefix=""3 ;;; default configurationchain=input action=accept connection-state=established,related log=no log-prefix=""4 ;;; default configurationchain=input action=drop in-interface=ether1-gateway log=no log-prefix=""5 ;;; default configurationchain=forward action=fasttrack-connection connection-state=established,related log=no log-prefix=""6 ;;; default configurationchain=forward action=accept connection-state=established,related log=no log-prefix=""7 chain=forward action=reject reject-with=tcp-reset connection-state=new protocol=tcp dst-address=240.0.0.0/4in-interface=ether1-gateway log=no log-prefix=""8 ;;; default configurationchain=forward action=drop connection-state=invalid log=no log-prefix=""9 ;;; default configurationchain=forward action=drop connection-state=new connection-nat-state=!dstnat in-interface=ether1-gateway log=nolog-prefix=""[olie1@MikroTik] > #check if we do have rsc scripts[olie1@MikroTik] > file print# NAME TYPE SIZE CREATION-TIME0 skins directory jan/01/1970 01:00:011 supout.rif .rif file 462.6KiB feb/05/2016 22:55:222 script.mvps-0.rsc script 148.2KiB feb/07/2016 15:44:523 script.mvps-1.rsc script 150.2KiB feb/07/2016 15:44:544 script.mvps-2.rsc script 152.8KiB feb/07/2016 15:44:545 script.mvps-3.rsc script 152.5KiB feb/07/2016 15:44:546 script.mvps-4.rsc script 85.6KiB feb/07/2016 15:44:547 2016--02-06.backup backup 30.2KiB feb/06/2016 01:21:498 2016-02-06.backup backup 29.7KiB feb/06/2016 00:42:269 auto-before-reset.backup backup 25.1KiB jan/02/1970 01:00:4710 pub directory feb/05/2016 21:06:2511 2016-02-07.backup backup 35.6KiB feb/07/2016 15:23:56[olie1@MikroTik] >[olie1@MikroTik] >[olie1@MikroTik] > #execute our rsc scripts with the root level command import[olie1@MikroTik] > import script.mvps-0.rscScript file loaded and executed successfully[olie1@MikroTik] >[olie1@MikroTik] > import script.mvps-1.rscScript file loaded and executed successfully[olie1@MikroTik] > import script.mvps-2.rscScript file loaded and executed successfully[olie1@MikroTik] > import script.mvps-3.rscScript file loaded and executed successfully[olie1@MikroTik] > import script.mvps-4.rscScript file loaded and executed successfully[olie1@MikroTik] >[olie1@MikroTik] > #check if DHCP server provides DNS settings that include using the router as clients main DNS resolver[olie1@MikroTik] > ip dhcp-server network print# ADDRESS GATEWAY DNS-SERVER WINS-SERVER DOMAIN0 ;;; default configuration192.168.0.0/24 192.168.0.1[olie1@MikroTik] >[olie1@MikroTik] > #check if we have enough memory[olie1@MikroTik] > system resource monitorcpu-used: 2%cpu-used-per-cpu: 2%free-memory: 93508KiB[olie1@MikroTik] > -
11.29.09Wake On LAN – probuzení stroje z Internetu
Pro „probouzení“ stroje v LAN je potřeba splnit několik požadavků, ale v podstatě se pracuje na 2. vrstvě ISO/OSI. Více zde. Při probouzení stroje z WAN do hry vstupuje další vrstva a po cestě musí magick paket překonat router, který ho pošle do správného subnetu.
Pokud máte veřejnou IP adresu (pro případ WOL musí být navíc i pevná) a vlastní router, nastavení na routeru bude vypadat následovně:
Na obrázku je screenshot z konfigurace routeru ASUS WL500g Premium. V nastavení „NAT Setting –> Virtual Server“ je otevřen port TCP/UDP 80 a směrován do LAN na rozhraní 192.168.1.10 port TCP/UDP 3389, což je port, který defaultně používá microsoftí vzdálená plocha (Remote Desktop Protokol).
Pro „probuzení“ stroje pak stačí zadat do nějaké online WOL aplikace na internetu (např. http://wake-on-lan.samuraj-cz.com) IP adresu na WAN rozhraní routeru, MAC adresu probouzeného stroje a port, v tomto případě port č. 80. I když je udáváno, že magick paket je posílán jako UDP datagram na port 0, 7 nebo 9, spolehlivě fungují i ostatní porty stejně jako v tomto případě UDP 3389 – což je nakonec výhodné z hlediska bezpečnosti a jednoduchosti konfigurace v tom, že pro dvě služby je otevřen jeden port. -
02.27.09Asus WL 520-gC jako switch
Pokud vlastníte tento SOHO router (postup by měl být funkční i u ostatních) a nechcete mít oddělenou síť, která je před routerem tzn., že stanice před routerem budou ve stejném subnetu (a „vidět“), lze toto vyřešit zcela triviálně tak, že v routeru:
- IP adresu routeru pro LAN nastavíte do JINÉHO libovolného subnetu. např. pokud subnet před routerem je 192.168.0.1/24 nastavíte mu 10.0.0.1/24.
- vypnete v routeru DHCP server
- spojíte stanice se segmentem před/za ním pomocí LAN portů (tedy ty bez WiFi) – WAN port NEPOUŽÍVEJTE! nakonec se připojte i pomocí WiFi
pozn. jelikož adresa routeru je nyní nastavena v jiném subnetu, není tedy možno se dostat do webové konfigurace routeru; pokud se potřebujete dostat do routeru, stačí na jednom PC nastavit stejný subnet jako má router, tedy 10.0.0.2/24 a připojit se