• Zarejestrowany: 2018-03-05
  • Posty: 135

Temat: Access control plugin

Czy na tutejszej dystrybucji LEDE z LuCI uda się zainstalować poprawnie ten pakiet?

https://github.com/k-szuster/luci-access-control

Potrzebuję czegoś do kontroli dostępu do komputera dla dzieciaka, to wydaje się odpowiednie, ale się nie znam, więc pytam.
A może ktoś tego już używa i się może podzielić doświadczeniami?

pozdrawiam

2 Odpowiedź przez Cezary

  • Skąd: Warszawa
  • Zarejestrowany: 2006-02-25
  • Posty: 116,669

Odp: Access control plugin

Ponoć działa poprawnie w LEDE, ktoś tu na forum pisał.

Masz niepotrzebny router, uszkodzony czy nie - chętnie przygarnę go.

Cezary's Strona

3 Odpowiedź przez b2g (edytowany przez b2g 2021-08-20 13:25:06)

  • b2g
  • Użytkownik
  • Nieaktywny
  • Skąd: Wrocław
  • Zarejestrowany: 2014-11-15
  • Posty: 169

Odp: Access control plugin

Czy u Was ten pakiecik działa poprawnie na LEDE OpenWrt 19.07-SNAPSHOT, r11225-14903d9d8c
lub nowszych?
U mnie niestety nie . Robi zapisy do firewall`a ale cos nie tak jest tam chyba ze składnią, formatem czasu itp
Moze coś zle zainstalowałem 

config defaults
    option syn_flood '1'
    option input 'ACCEPT'
    option output 'ACCEPT'
    option forward 'REJECT'

config zone
    option name 'lan'
    option input 'ACCEPT'
    option output 'ACCEPT'
    option forward 'ACCEPT'
    option network 'lan'

config zone
    option name 'wan'
    list network 'wan'
    list network 'wan6'
    option input 'REJECT'
    option output 'ACCEPT'
    option forward 'REJECT'
    option masq '1'
    option mtu_fix '1'

config forwarding
    option src 'lan'
    option dest 'wan'

config rule
    option name 'Allow-DHCP-Renew'
    option src 'wan'
    option proto 'udp'
    option dest_port '68'
    option target 'ACCEPT'
    option family 'ipv4'

config rule
    option name 'Allow-Ping'
    option src 'wan'
    option proto 'icmp'
    option icmp_type 'echo-request'
    option family 'ipv4'
    option target 'ACCEPT'

config rule
    option name 'Allow-IGMP'
    option src 'wan'
    option proto 'igmp'
    option family 'ipv4'
    option target 'ACCEPT'

config rule
    option name 'Allow-DHCPv6'
    option src 'wan'
    option proto 'udp'
    option src_ip 'fc00::/6'
    option dest_ip 'fc00::/6'
    option dest_port '546'
    option family 'ipv6'
    option target 'ACCEPT'

config rule
    option name 'Allow-MLD'
    option src 'wan'
    option proto 'icmp'
    option src_ip 'fe80::/10'
    list icmp_type '130/0'
    list icmp_type '131/0'
    list icmp_type '132/0'
    list icmp_type '143/0'
    option family 'ipv6'
    option target 'ACCEPT'

config rule
    option name 'Allow-ICMPv6-Input'
    option src 'wan'
    option proto 'icmp'
    list icmp_type 'echo-request'
    list icmp_type 'echo-reply'
    list icmp_type 'destination-unreachable'
    list icmp_type 'packet-too-big'
    list icmp_type 'time-exceeded'
    list icmp_type 'bad-header'
    list icmp_type 'unknown-header-type'
    list icmp_type 'router-solicitation'
    list icmp_type 'neighbour-solicitation'
    list icmp_type 'router-advertisement'
    list icmp_type 'neighbour-advertisement'
    option limit '1000/sec'
    option family 'ipv6'
    option target 'ACCEPT'

config rule
    option name 'Allow-ICMPv6-Forward'
    option src 'wan'
    option dest '*'
    option proto 'icmp'
    list icmp_type 'echo-request'
    list icmp_type 'echo-reply'
    list icmp_type 'destination-unreachable'
    list icmp_type 'packet-too-big'
    list icmp_type 'time-exceeded'
    list icmp_type 'bad-header'
    list icmp_type 'unknown-header-type'
    option limit '1000/sec'
    option family 'ipv6'
    option target 'ACCEPT'

config rule
    option name 'Allow-IPSec-ESP'
    option src 'wan'
    option dest 'lan'
    option proto 'esp'
    option target 'ACCEPT'

config rule
    option name 'Allow-ISAKMP'
    option src 'wan'
    option dest 'lan'
    option dest_port '500'
    option proto 'udp'
    option target 'ACCEPT'

config include
    option path '/etc/firewall.user'

config rule
    option target 'ACCEPT'
    list proto 'tcp'
    list proto 'udp'
    list proto 'icmp'
    list proto 'igmp'
    list proto 'esp'
    option name 'ping'
    option src 'wan'

config zone
    option name 'home'
    option input 'ACCEPT'
    option forward 'ACCEPT'
    option output 'ACCEPT'
    option masq '1'
    option network 'home,4300'

config forwarding
    option src 'home'
    option dest 'wan'

config forwarding
    option src 'home'
    option dest 'lan'

config forwarding
    option src 'lan'
    option dest 'home'

config rule
    option ac_enabled '1'
    option src '*'
    option dest 'wan'
    option extra '--kerneltz'
    option target 'REJECT'
    option name 'Max_tel'
    option start_time '22:00:00'
    option stop_time '08:00:00'
    list src_mac 'BC:E6:3F:10:AC:A2'

config rule
    option ac_enabled '1'
    option src '*'
    option dest 'wan'
    option extra '--kerneltz'
    option target 'REJECT'
    option name 'L'
    option proto '0'
    option stop_time '22:00'
    option start_time '10:00'
    list src_mac '00:24:D6:60:87:30'
    list proto 'all'

config rule
    option ac_enabled '1'
    option src '*'
    option dest 'wan'
    option extra '--kerneltz'
    option target 'REJECT'
    option name 'M'
    option proto '0'
    option start_time '10:00:00'
    option stop_time '22:00:00'
    list src_mac '00:21:6A:7A:53:3A'

config rule
    option src '*'
    option dest 'wan'
    option extra '--kerneltz'
    option target 'REJECT'
    option name 'BG'
    option proto '0'
    option ac_enabled '1'
    option start_time '13:00:00'
    option stop_time '22:00:00'
    list src_mac 'F8:2F:A8:C3:D8:95'

config rule
    option src '*'
    option dest 'wan'
    option target 'REJECT'
    option name 'BG2'
    option proto '0'
    option start_time '13:00:00'
    option stop_time '22:00:00'
    list src_mac 'F8:2F:A8:C3:D8:95'
    
/etc/init.d/firewall restart

Warning: Section @rule[10] (Max_tel) does not specify a protocol, assuming TCP+UDP
Warning: Option @rule[11].ac_enabled is unknown
Warning: Option @rule[12].ac_enabled is unknown
Warning: Option @rule[13].ac_enabled is unknown
Warning: Section @zone[2] (home) has no device, network, subnet or extra options
 * Flushing IPv4 filter table
 * Flushing IPv4 nat table
 * Flushing IPv4 mangle table
 * Flushing IPv4 raw table
 * Flushing IPv6 filter table
 * Flushing IPv6 mangle table
 * Flushing conntrack table ...
 * Populating IPv4 filter table
   * Rule 'Allow-DHCP-Renew'
   * Rule 'Allow-Ping'
   * Rule 'Allow-IGMP'
   * Rule 'Allow-IPSec-ESP'
   * Rule 'Allow-ISAKMP'
   * Rule 'ping'
   * Rule 'Max_tel'
     ! Exception: time: option "--kerneltz" can only be used once.
     ! Skipping due to previous exception (code 2)
     ! Exception: time: option "--kerneltz" can only be used once.
     ! Skipping due to previous exception (code 2)
   * Rule 'L'
     ! Exception: time: option "--kerneltz" can only be used once.
     ! Skipping due to previous exception (code 2)
     ! Exception: time: option "--kerneltz" can only be used once.
     ! Skipping due to previous exception (code 2)
   * Rule 'M'
     ! Exception: time: option "--kerneltz" can only be used once.
     ! Skipping due to previous exception (code 2)
   * Rule 'BG'
     ! Exception: time: option "--kerneltz" can only be used once.
     ! Skipping due to previous exception (code 2)
   * Rule 'BG2'
   * Forward 'lan' -> 'wan'
   * Forward 'home' -> 'wan'
   * Forward 'home' -> 'lan'
   * Forward 'lan' -> 'home'
   * Zone 'lan'
   * Zone 'wan'
   * Zone 'home'
 * Populating IPv4 nat table
   * Zone 'lan'
   * Zone 'wan'
   * Zone 'home'
 * Populating IPv4 mangle table
   * Zone 'lan'
   * Zone 'wan'
   * Zone 'home'
 * Populating IPv4 raw table
   * Zone 'lan'
     - Using automatic conntrack helper attachment
   * Zone 'wan'
   * Zone 'home'
 * Populating IPv6 filter table
   * Rule 'Allow-DHCPv6'
   * Rule 'Allow-MLD'
   * Rule 'Allow-ICMPv6-Input'
   * Rule 'Allow-ICMPv6-Forward'
   * Rule 'Allow-IPSec-ESP'
   * Rule 'Allow-ISAKMP'
   * Rule 'ping'
   * Rule 'Max_tel'
     ! Exception: time: option "--kerneltz" can only be used once.
     ! Skipping due to previous exception (code 2)
     ! Exception: time: option "--kerneltz" can only be used once.
     ! Skipping due to previous exception (code 2)
   * Rule 'L'
     ! Exception: time: option "--kerneltz" can only be used once.
     ! Skipping due to previous exception (code 2)
     ! Exception: time: option "--kerneltz" can only be used once.
     ! Skipping due to previous exception (code 2)
   * Rule 'M'
     ! Exception: time: option "--kerneltz" can only be used once.
     ! Skipping due to previous exception (code 2)
   * Rule 'BG'
     ! Exception: time: option "--kerneltz" can only be used once.
     ! Skipping due to previous exception (code 2)
   * Rule 'BG2'
   * Forward 'lan' -> 'wan'
   * Forward 'home' -> 'wan'
   * Forward 'home' -> 'lan'
   * Forward 'lan' -> 'home'
   * Zone 'lan'
   * Zone 'wan'
   * Zone 'home'
 * Populating IPv6 mangle table
   * Zone 'lan'
   * Zone 'wan'
   * Zone 'home'
 * Set tcp_ecn to off
 * Set tcp_syncookies to on
 * Set tcp_window_scaling to on
 * Running script '/etc/firewall.user'
WNDR 4300 | R6220 | Migracja na MF286*

4 Odpowiedź przez Cezary

  • Skąd: Warszawa
  • Zarejestrowany: 2006-02-25
  • Posty: 116,669

Odp: Access control plugin

Skasuj option extra '--kerneltz'

Masz niepotrzebny router, uszkodzony czy nie - chętnie przygarnę go.

Cezary's Strona