06 Lug 18 How to setup xtables GeoIP for iptables on OpenWRT
I’m not racist, but sometimes you may need to keep some people out of your network based on its geographical region… in reality I’m referring to its public source IP address.
Requests are coming from the big internet, so you can check if the source IP of the peers that are trying to connect to your powerful OpenWRT Linux router are coming from a particular region and you may want to stop all those requests accordingly.
If you are using iptables and ip6tables (if you are on linux this is the standard) you can setup GeoIP based packet filtering with iptables: it’s an iptables extension that make use of the glorious and free MaxMind GeoLite Legacy Downloadable Database (that is now dying…).
On OpenWRT this is supported automatically, but generally your router does not have all the disk space to host the entire GeoLite GeoIP database. So, you need to prepare all the records of the geographical regions that you want to block on your firewall.
Take a linux workstation or server (your notebook, a raspberry pi you own always on, one of your client’s server… better not IMHO…) and run those commands:
root@firegate2:~# mkdir /tmp/temp
root@firegate2:~# cd /tmp/temp
root@firegate2:/tmp/temp# /usr/share/xt_geoip/xt_geoip_dl
–2018-07-05 23:54:40– http://geolite.maxmind.com/download/geoip/database/GeoIPv6.csv.gz
Risoluzione di geolite.maxmind.com (geolite.maxmind.com)… 104.16.37.47, 104.16.38.47, 2400:cb00:2048:1::6810:262f, …
Connessione a geolite.maxmind.com (geolite.maxmind.com)|104.16.37.47|:80… connesso.
Richiesta HTTP inviata, in attesa di risposta… 200 OK
Lunghezza: 1715246 (1,6M) [application/octet-stream]
Salvataggio in: “GeoIPv6.csv.gz”GeoIPv6.csv.gz 100%[================================================================>] 1,64M –.-KB/s in 0,1s
2018-07-05 23:54:40 (10,9 MB/s) – “GeoIPv6.csv.gz” salvato [1715246/1715246]
–2018-07-05 23:54:40– http://geolite.maxmind.com/download/geoip/database/GeoIPCountryCSV.zip
Riutilizzo della connessione esistente a geolite.maxmind.com:80.
Richiesta HTTP inviata, in attesa di risposta… 200 OK
Lunghezza: 2540312 (2,4M) [application/zip]
Salvataggio in: “GeoIPCountryCSV.zip”GeoIPCountryCSV.zip 100%[================================================================>] 2,42M 11,3MB/s in 0,2s
2018-07-05 23:54:40 (11,3 MB/s) – “GeoIPCountryCSV.zip” salvato [2540312/2540312]
TERMINATO –2018-07-05 23:54:40–
Tempo totale: 0,4s
Scaricati: 2 file, 4,1M in 0,4s (11,1 MB/s)
Archive: GeoIPCountryCSV.zip
inflating: GeoIPCountryWhois.csv
root@firegate2:/tmp/temp#
root@firegate2:/tmp/temp# /usr/share/xt_geoip/xt_geoip_build -D . *.csv
209370 entries total
0 IPv6 ranges for A1 Anonymous Proxy
32 IPv4 ranges for A1 Anonymous Proxy
0 IPv6 ranges for A2 Satellite Provider
36 IPv4 ranges for A2 Satellite Provider
3 IPv6 ranges for AD Andorra
26 IPv4 ranges for AD Andorra
51 IPv6 ranges for AE United Arab Emirates
302 IPv4 ranges for AE United Arab Emirates
… and continues …
11 IPv6 ranges for ZM Zambia
64 IPv4 ranges for ZM Zambia
14 IPv6 ranges for ZW Zimbabwe
59 IPv4 ranges for ZW Zimbabwe
root@firegate2:/tmp/temp#
The script /usr/share/xt_geoip/xt_geoip_build it’s part of xtables-addons package that you may or may not find on your distribution. Search on google for that.
This will create LE and BE directories. Now you want to extract only the geo regions that you need (ex: CN,UA,TW,VN,VG,KP,VI,KR), like that:
root@firegate2:/tmp/temp# du -csh BE/CN.iv? BE/UA.iv? BE/TW.iv? BE/VN.iv? BE/VG.iv? BE/KP.iv? BE/VI.iv? BE/KR.iv? LE/CN.iv? LE/UA.iv? LE/TW.iv? LE/VN.iv? LE/VG.iv? LE/KP.iv? LE/VI.iv? LE/KR.iv?
36K BE/CN.iv4
48K BE/CN.iv6
24K BE/UA.iv4
16K BE/UA.iv6
8,0K BE/TW.iv4
4,0K BE/TW.iv6
4,0K BE/VN.iv4
4,0K BE/VN.iv6
4,0K BE/VG.iv4
4,0K BE/VG.iv6
4,0K BE/KP.iv4
0 BE/KP.iv6
4,0K BE/VI.iv4
4,0K BE/VI.iv6
8,0K BE/KR.iv4
4,0K BE/KR.iv6
36K LE/CN.iv4
48K LE/CN.iv6
24K LE/UA.iv4
16K LE/UA.iv6
8,0K LE/TW.iv4
4,0K LE/TW.iv6
4,0K LE/VN.iv4
4,0K LE/VN.iv6
4,0K LE/VG.iv4
4,0K LE/VG.iv6
4,0K LE/KP.iv4
0 LE/KP.iv6
4,0K LE/VI.iv4
4,0K LE/VI.iv6
8,0K LE/KR.iv4
4,0K LE/KR.iv6
352K totale
So, in this case we will need 352 Kb of router disk space. After we created the /usr/share/xt_geoip/BE/ and /usr/share/xt_geoip/LE/ directories on our router’s filesystem:
root@dam2ktplinkrouter:~# mkdir -p /usr/share/xt_geoip/BE /usr/share/xt_geoip/LE
We are going to copy those files on our OpenWRT router:
root@firegate2:/tmp/temp# scp LE/CN.iv? LE/UA.iv? LE/TW.iv? LE/VN.iv? LE/VG.iv? LE/KP.iv? LE/VI.iv? LE/KR.iv? root@192.168.10.1:/usr/share/xt_geoip/LE
root@192.168.10.1’s password:
CN.iv4 100% 35KB 109.8KB/s 00:00
CN.iv6 100% 47KB 76.0KB/s 00:00
UA.iv4 100% 23KB 108.4KB/s 00:00
UA.iv6 100% 15KB 87.9KB/s 00:00
TW.iv4 100% 4704 47.5KB/s 00:00
TW.iv6 100% 3104 77.8KB/s 00:00
VN.iv4 100% 3888 98.9KB/s 00:00
VN.iv6 100% 3584 87.9KB/s 00:00
VG.iv4 100% 536 40.1KB/s 00:00
VG.iv6 100% 224 20.0KB/s 00:00
KP.iv4 100% 40 3.9KB/s 00:00
KP.iv6 100% 0 0.0KB/s 00:00
VI.iv4 100% 392 30.6KB/s 00:00
VI.iv6 100% 160 14.4KB/s 00:00
KR.iv4 100% 8128 105.8KB/s 00:00
KR.iv6 100% 3616 87.0KB/s 00:00
root@firegate2:/tmp/temp# scp BE/CN.iv? BE/UA.iv? BE/TW.iv? BE/VN.iv? BE/VG.iv? BE/KP.iv? BE/VI.iv? BE/KR.iv? root@192.168.10.1:/usr/share/xt_geoip/BE/
root@192.168.10.1’s password:
CN.iv4 100% 35KB 114.4KB/s 00:00
CN.iv6 100% 47KB 66.0KB/s 00:00
UA.iv4 100% 23KB 115.2KB/s 00:00
UA.iv6 100% 15KB 74.9KB/s 00:00
TW.iv4 100% 4704 93.8KB/s 00:00
TW.iv6 100% 3104 75.7KB/s 00:00
VN.iv4 100% 3888 108.8KB/s 00:00
VN.iv6 100% 3584 76.2KB/s 00:00
VG.iv4 100% 536 40.3KB/s 00:00
VG.iv6 100% 224 20.0KB/s 00:00
KP.iv4 100% 40 4.1KB/s 00:00
KP.iv6 100% 0 0.0KB/s 00:00
VI.iv4 100% 392 33.1KB/s 00:00
VI.iv6 100% 160 15.4KB/s 00:00
KR.iv4 100% 8128 111.1KB/s 00:00
KR.iv6 100% 3616 71.8KB/s 00:00
root@firegate2:/tmp/temp#
OK, now we have our pieces of geo ip informations. We now need to install the iptables-mod-geoip from the LuCI web interface (or by hand if you like).
Now you can create your Firewall Traffic Rules. Go to Network -> Firewall -> Traffic Rules on the router’s LuCI web interface and add a custom traffic rule. In my case I created 2 that I called “CinamerdaMuoriUDPeTCP” and “CinamerdaMuoriICMP”, the first to block TCP and UDP and the second to block ICMP traffic.
After that you can setup your custom rule setting your protocol and address families, set “source zone” to WAN, “destination zone” to “Any zone (forward)”, action to DROP, and the “Extra arguments” field like this:
-m geoip –source-country CN,UA,TW,VN,VG,KP,VI,KR
You can check the image below.
OpenWRT Firewall geoip example
Now you can say hello to most chinaspammers and something like that, but don’t abuse, this is not ethic if you set up this on a server that offers some sort of public service.
02 Apr 14 Adafruit 4-Digit 7-Segment Display Backpack on raspberry pi in C
In my previous blog post I published a TSL2561 light sensor driver in C for Raspberry PI. In this article I will publish a user space C driver for Adafruit 4-digit 7-segment display.
This is based on a HT16K33 led driver IC, that it’s a I2C driven RAM mapping 16*8 LED controller driver.
The driver I’m posting it’s valid for the adafruit circuit only, since it’s completely based on the electronic schematic they realized.
Don’t use the driver with other circuits, since the display could not function properly.
Basically the adafruit 7-segment backpack (http://www.adafruit.com/products/879) uses 8 (rows) * 5 (columns) HT16K33 lines to drive its leds. The column number 1 is dedicated to the first digit, the second column is dedicated to the second digit, the third column is attached to the colon sign in the middle of the 4 digits, the fourth column is attached to the third digit, and the fifth colum to the fourth display digit.
While each row drives a single led of the given column.
The display columns 0, 1, 3, 4 can show numbers and some letters (A-F, n, o, i, l, L, etc…) plus a decimal point, while the column 2 can only show a colon sign (:).
A number or a letter for each digit is composed by 7 led segments, so the possibilities are few… but not so few after all (check 7seg.txt file attachment for more details on letter composition).
So, now comes the fun. How can I access the led driver memory to light display digits in C? Adafruit releases proof of concept libraries in C and python, but they don’t seem to run on my raspberry pi.
Since I am too lazy to port their code with external dependencies, I decided to write my own library in C.
#include "7seg_bp_ada.h" /* prepare the backpack driver (the first parameter is the raspberry pi i2c master controller attached to the HT16K33, the second is the i2c selection jumper) The i2c selection address can be one of HT16K33_ADDR_01 to HT16K33_ADDR_08 */ HT16K33 led_backpack1 = HT16K33_INIT(1, HT16K33_ADDR_01); /* initialize the backpack */ rc = HT16K33_OPEN(&led_backpack1); /* power on the ht16k33 */ HT16K33_ON(&led_backpack1); /* make it shining bright */ HT16K33_BRIGHTNESS(&led_backpack1, 0x0F); /* make it not blinking */ HT16K33_BLINK(&led_backpack1, HT16K33_BLINK_OFF); /* power on the display */ HT16K33_DISPLAY(&led_backpack1, HT16K33_DISPLAY_ON); /* Say hello */ HT16K33_UPDATE_DIGIT(&led_backpack1, 0, 'H', 0); // first digit HT16K33_UPDATE_DIGIT(&led_backpack1, 1, 'E', 0); // second digit // turn off the colon sign in the middle of the 4 digits HT16K33_UPDATE_DIGIT(&led_backpack1, 2, HT16K33_COLON_OFF, 0); HT16K33_UPDATE_DIGIT(&led_backpack1, 3, '#', 0); // third digit HT16K33_UPDATE_DIGIT(&led_backpack1, 4, 'o', 0); // fourth digit HT16K33_COMMIT(&led_backpack1); // commit to the display memory // call this if you want to shut down the device (power saving mode) // HT16K33_OFF(&led_backpack1); /* close things (the display remains in the conditions left) */ HT16K33_CLOSE(&led_backpack1);
I decided to release the software with the liberal apache 2 license, so feel free to use this software inside your commercial, non free software / firmware.
Below you will find the files .c and .h that you can embed into your project.
It’s helpful for me, and I hope it will be helpful for you.
Ciao, Dino.
Note: on Raspberry PI OS (and debian) you need libi2c-dev (apt install libi2c-dev) before compiling.
gcc -Wall -O2 -o 7seg_bp_ada.o -c 7seg_bp_ada.c
gcc -Wall -O2 -o 7seg_bp_ada_test.o -c 7seg_bp_ada_test.c
gcc -Wall -O2 -o 7seg_bp_ada_test 7seg_bp_ada.o -li2c 7seg_bp_ada_test.o
19 Mar 14 TSL2561 light sensor on Raspberry pi in C
After I bought a new TSL2561 digital light sensor from Adafruit, I found that the very cool and small device cannot be accessed directly from linux (rasbian doesn’t have it’s kernel module compiled). Since I didn’t want to cross recompile my whole raspberry pi kernel just to have the tsl2563.ko driver enabled, and since it seems that raspbian does not relase genuine kernel headers to just compile custom kernel modules, I decided to write a user space simple library driver in C.
I found out that Adafruit relases proof of concept libraries written in C++ and python to access its hardware devices, the problem is that the c++ version is ready for arduino but it was not so directly usable for my raspberry pi. It also makes use of an adafruit unified sensor library and other external stuff. Since I am too lazy I decided yesterday to write a new simple library in plain C without external dependencies, just ready for my raspberry pi.
This is the arduino version that inspired me: https://github.com/adafruit/TSL2561-Arduino-Library
This is another cool blog post that inspired me (it now seems dead!!): http://russelldavis.org/2013/03/23/raspberryhunt-part-2/
This is an example:
/* prepare the sensor (the first parameter is the raspberry pi i2c master controller attached to the TSL2561, the second is the i2c selection jumper) The i2c selection address can be one of: TSL2561_ADDR_LOW, TSL2561_ADDR_FLOAT or TSL2561_ADDR_HIGH */ TSL2561 light1 = TSL2561_INIT(1, TSL2561_ADDR_FLOAT); /* initialize the sensor */ rc = TSL2561_OPEN(&light1); /* sense the luminosity from the sensor (lux is the luminosity taken in "lux" measure units) the last parameter can be 1 to enable library auto gain, or 0 to disable it */ rc = TSL2561_SENSELIGHT(&light1, &broadband, &ir, &lux, 1); TSL2561_CLOSE(&light1);
Compile:
gcc -Wall -O2 -o TSL2561.o -c TSL2561.c
gcc -Wall -O2 -o TSL2561_test.o -c TSL2561_test.c
gcc -Wall -O2 -o TSL2561_test TSL2561.o TSL2561_test.o
The output is like this:
root@rasponi:~/test/gpio# ./TSL2561_test
Test. RC: 0(Success), broadband: 141, ir: 34, lux: 12
As you can see it’s very easy at this point to get the light measures in C. Just include TSL2561.c and TSL2561.h inside your project and use the public APIs to setup and sense the IC.
I decided to release the code with the liberal apache v2 license, so feel free to include it into your commercial projects if you like.
It’s useful for me, and I hope that it can be useful to you too. Obviously it comes with absolutely no warranty.
p.s.1: I left the hardware stuff out of this article (just attach +vcc, gnd and i2c bus to the sensor
p.s.2: you have to load two kernel modules to get i2c bus working on you Raspberry pi:
modprobe i2c_bcm2708
modprobe i2c_dev
Ciao, Dino.
TSL2561.c
TSL2561.h
TSL2561_test.c
This is an example on how to use all 3 sensors on the same i2c bus:
#include <stdio.h>
#include <string.h>
#include "TSL2561.h"
int main() {
int i;
int rc;
uint16_t broadband, ir;
uint32_t lux=0;
TSL2561 lights[3]; // we can handle 3 sensors
// prepare the sensors
// (the first parameter is the raspberry pi i2c master controller attached to the TSL2561, the second is the i2c selection jumper)
// The i2c selection address can be one of: TSL2561_ADDR_LOW, TSL2561_ADDR_FLOAT or TSL2561_ADDR_HIGH
// prepare all sensors
/* cannot assign that way
lights[0] = TSL2561_INIT(1, TSL2561_ADDR_LOW);
lights[1] = TSL2561_INIT(1, TSL2561_ADDR_FLOAT);
lights[2] = TSL2561_INIT(1, TSL2561_ADDR_HIGH);
*/
// initialize at runtime instead
// FIRST SENSOR --> TSL2561_ADDR_LOW
lights[0].adapter_nr=1; // change this according to your i2c bus
lights[0].sensor_addr=TSL2561_ADDR_LOW; // don't change this
lights[0].integration_time=TSL2561_INTEGRATIONTIME_402MS; // don't change this
lights[0].gain=TSL2561_GAIN_16X; // don't change this
lights[0].adapter_fd=-1; // don't change this
lights[0].lasterr=0; // don't change this
bzero(&lights[0].buf, sizeof(lights[0].buf)); // don't change this
// SECOND SENSOR --> TSL2561_ADDR_FLOAT
lights[1].adapter_nr=1; // change this according to your i2c bus
lights[1].sensor_addr=TSL2561_ADDR_FLOAT; // don't change this
lights[1].integration_time=TSL2561_INTEGRATIONTIME_402MS; // don't change this
lights[1].gain=TSL2561_GAIN_16X; // don't change this
lights[1].adapter_fd=-1; // don't change this
lights[1].lasterr=0; // don't change this
bzero(&lights[1].buf, sizeof(lights[1].buf)); // don't change this
// THIRD SENSOR --> TSL2561_ADDR_HIGH
lights[2].adapter_nr=1; // change this according to your i2c bus
lights[2].sensor_addr=TSL2561_ADDR_HIGH; // don't change this
lights[2].integration_time=TSL2561_INTEGRATIONTIME_402MS; // don't change this
lights[2].gain=TSL2561_GAIN_16X; // don't change this
lights[2].adapter_fd=-1; // don't change this
lights[2].lasterr=0; // don't change this
bzero(&lights[2].buf, sizeof(lights[2].buf)); // don't change this
// initialize the sensors
for(i=0; i<3; i++) {
rc = TSL2561_OPEN(&lights[i]);
if(rc != 0) {
fprintf(stderr, "Error initializing TSL2561 sensor %i (%s). Check your i2c bus (es. i2cdetect)\n", i+1, strerror(lights[i].lasterr));
return 1;
}
// set the gain to 1X (it can be TSL2561_GAIN_1X or TSL2561_GAIN_16X)
// use 16X gain to get more precision in dark ambients, or enable auto gain below
rc = TSL2561_SETGAIN(&lights[i], TSL2561_GAIN_1X);
// set the integration time
// (TSL2561_INTEGRATIONTIME_402MS or TSL2561_INTEGRATIONTIME_101MS or TSL2561_INTEGRATIONTIME_13MS)
// TSL2561_INTEGRATIONTIME_402MS is slower but more precise, TSL2561_INTEGRATIONTIME_13MS is very fast but not so precise
rc = TSL2561_SETINTEGRATIONTIME(&lights[i], TSL2561_INTEGRATIONTIME_101MS);
}
// you can now sense each sensor when you like
for(i=0; i<3; i++) {
// sense the luminosity from the sensors (lux is the luminosity taken in "lux" measure units)
// the last parameter can be 1 to enable library auto gain, or 0 to disable it
rc = TSL2561_SENSELIGHT(&lights[i], &broadband, &ir, &lux, 1);
printf("Test sensor %i. RC: %i(%s), broadband: %i, ir: %i, lux: %i\n", i+1, rc, strerror(lights[i].lasterr), broadband, ir, lux);
}
// when you have finisched, you can close things
for(i=0; i<3; i++) {
TSL2561_CLOSE(&lights[i]);
}
return 0;
}
Follow me!
Stack Overflow
IPv6 Certified (he.net)