Posted: Mon Mar 04, 2019 9:26 Post subject: Re: ipset working on r7000
nahdude wrote:
Hello,
I managed to get ipset/iptables working on the r7000 kong builds with kernel 3.10.
The attached file contains the needed iptables v1.4.16.3 libraries, application, and xt_set module.
It also contains the ipset v6.21.1 application and libmnl v1.0.3 library.
The only module needed is xt_set since all needed kernel parts for ipset and iptables are already built-in.
To test, extract the tar in /jffs/usr, then
Code:
insmod /jffs/usr/lib/modules/xt_set.ko
ipset -N IPTEST hash:ip
ipset -A IPTEST 8.8.8.8
ipset -A IPTEST 8.8.4.4
ipset -N NETTEST hash:net
ipset -A NETTEST 4.2.2.0/24
Check that the new sets are correct with
Code:
ipset -L
then
Code:
cd /jffs/usr/sbin
./iptables -A OUTPUT -m set --match-set IPTEST dst -j DROP
./iptables -A OUTPUT -m set --match-set NETTEST dst -j DROP
Any attempts to ping
8.8.8.8
8.8.4.4
4.2.2.1 ... 4.2.2.4
should fail
Will this work on a Atheros AR7161 CPU with the Linux 3.10.108-d8 Kernel?
I have used ipset in combination with a script from @Eibgrad for advanced PBR routing
I now use a simpler implementation but that can only retrieve the first IP address of a domain, but works at the moment for my purpose.
the simpler PBR implementation can be found at: https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=318662
