W ustawieniach karty sieciowej tcpipv4.
uci show firewall
firewall.@defaults[0]=defaults
firewall.@defaults[0].syn_flood='1'
firewall.@defaults[0].input='REJECT'
firewall.@defaults[0].output='ACCEPT'
firewall.@defaults[0].forward='REJECT'
firewall.@zone[0]=zone
firewall.@zone[0].name='lan'
firewall.@zone[0].network='lan'
firewall.@zone[0].input='ACCEPT'
firewall.@zone[0].output='ACCEPT'
firewall.@zone[0].forward='ACCEPT'
firewall.@zone[1]=zone
firewall.@zone[1].name='wan'
firewall.@zone[1].network='wan' 'wan6'
firewall.@zone[1].input='REJECT'
firewall.@zone[1].output='ACCEPT'
firewall.@zone[1].forward='REJECT'
firewall.@zone[1].masq='1'
firewall.@zone[1].mtu_fix='1'
firewall.@forwarding[0]=forwarding
firewall.@forwarding[0].src='lan'
firewall.@forwarding[0].dest='wan'
firewall.@rule[0]=rule
firewall.@rule[0].name='Allow-DHCP-Renew'
firewall.@rule[0].src='wan'
firewall.@rule[0].proto='udp'
firewall.@rule[0].dest_port='68'
firewall.@rule[0].target='ACCEPT'
firewall.@rule[0].family='ipv4'
firewall.@rule[1]=rule
firewall.@rule[1].name='Allow-Ping'
firewall.@rule[1].src='wan'
firewall.@rule[1].proto='icmp'
firewall.@rule[1].icmp_type='echo-request'
firewall.@rule[1].family='ipv4'
firewall.@rule[1].target='ACCEPT'
firewall.@rule[2]=rule
firewall.@rule[2].name='Allow-IGMP'
firewall.@rule[2].src='wan'
firewall.@rule[2].proto='igmp'
firewall.@rule[2].family='ipv4'
firewall.@rule[2].target='ACCEPT'
firewall.@rule[3]=rule
firewall.@rule[3].name='Allow-DHCPv6'
firewall.@rule[3].src='wan'
firewall.@rule[3].proto='udp'
firewall.@rule[3].dest_port='546'
firewall.@rule[3].family='ipv6'
firewall.@rule[3].target='ACCEPT'
firewall.@rule[4]=rule
firewall.@rule[4].name='Allow-MLD'
firewall.@rule[4].src='wan'
firewall.@rule[4].proto='icmp'
firewall.@rule[4].src_ip='fe80::/10'
firewall.@rule[4].icmp_type='130/0' '131/0' '132/0' '143/0'
firewall.@rule[4].family='ipv6'
firewall.@rule[4].target='ACCEPT'
firewall.@rule[5]=rule
firewall.@rule[5].name='Allow-ICMPv6-Input'
firewall.@rule[5].src='wan'
firewall.@rule[5].proto='icmp'
firewall.@rule[5].icmp_type='echo-request' 'echo-reply' 'destination-unreachable' 'packet-too-big' 'time-exceeded' 'bad-header' 'unknown-header-type' 'router-solicitation' 'neighbour-solicitation' 'router-advertisement' 'neighbour-advertisement'
firewall.@rule[5].limit='1000/sec'
firewall.@rule[5].family='ipv6'
firewall.@rule[5].target='ACCEPT'
firewall.@rule[6]=rule
firewall.@rule[6].name='Allow-ICMPv6-Forward'
firewall.@rule[6].src='wan'
firewall.@rule[6].dest='*'
firewall.@rule[6].proto='icmp'
firewall.@rule[6].icmp_type='echo-request' 'echo-reply' 'destination-unreachable' 'packet-too-big' 'time-exceeded' 'bad-header' 'unknown-header-type'
firewall.@rule[6].limit='1000/sec'
firewall.@rule[6].family='ipv6'
firewall.@rule[6].target='ACCEPT'
firewall.@rule[7]=rule
firewall.@rule[7].name='Allow-IPSec-ESP'
firewall.@rule[7].src='wan'
firewall.@rule[7].dest='lan'
firewall.@rule[7].proto='esp'
firewall.@rule[7].target='ACCEPT'
firewall.@rule[8]=rule
firewall.@rule[8].name='Allow-ISAKMP'
firewall.@rule[8].src='wan'
firewall.@rule[8].dest='lan'
firewall.@rule[8].dest_port='500'
firewall.@rule[8].proto='udp'
firewall.@rule[8].target='ACCEPT'
firewall.@ipset[0]=ipset
firewall.@ipset[0].name='dohipv4'
firewall.@ipset[0].match='dest_ip'
firewall.@ipset[0].loadfile='/root/DOHipv4.txt'
firewall.@ipset[0].family='ipv4'
firewall.@rule[9]=rule
firewall.@rule[9].name='Disable'
firewall.@rule[9].src='lan'
firewall.@rule[9].ipset='dohipv4'
firewall.@rule[9].target='REJECT'
firewall.@rule[9].proto='all'
firewall.@ipset[1]=ipset
firewall.@ipset[1].name='dohipv4'
firewall.@ipset[1].match='dest_ip'
firewall.@ipset[1].loadfile='/root/DOHipv4.txt'
firewall.@ipset[1].family='ipv4'
firewall.@rule[10]=rule
firewall.@rule[10].name='Disable'
firewall.@rule[10].src='lan'
firewall.@rule[10].dest='lan'
firewall.@rule[10].ipset='dohipv4'
firewall.@rule[10].target='REJECT'
firewall.@rule[10].proto='all'
root@OpenWrt:~# fw4 print | grep 53
103.28.53.16,
103.69.149.253,
104.21.10.53,
104.21.45.153,
104.21.48.253,
104.21.53.52,
104.21.80.53,
104.21.8.153,
104.21.85.253,
108.181.69.153,
109.123.253.27,
117.53.144.157,
120.53.53.53,
128.139.197.53,
129.153.112.204,
129.153.174.221,
129.153.224.48,
129.153.9.127,
129.154.217.53,
130.162.230.253,
139.162.153.123,
139.84.153.198,
140.83.53.18,
144.21.35.153,
144.22.53.207,
146.56.160.153,
152.53.0.31,
152.53.15.127,
153.127.67.108,
153.194.45.201,
153.31.113.36,
160.119.253.209,
162.159.140.153,
162.55.56.53,
167.253.158.187,
167.253.159.160,
17.253.14.115,
17.253.14.117,
17.253.52.119,
17.253.52.247,
172.67.153.158,
172.67.153.19,
172.67.153.48,
172.67.164.53,
172.67.167.53,
172.67.202.53,
176.165.111.253,
176.96.137.53,
178.162.228.53,
178.253.23.166,
178.253.43.231,
185.194.53.22,
185.199.108.153,
185.199.109.153,
185.199.110.153,
185.199.111.153,
185.223.163.153,
185.253.212.22,
188.165.53.130,
191.96.153.75,
192.53.175.62,
193.122.103.253,
193.122.96.153,
193.190.182.53,
193.238.153.17,
194.87.43.53,
203.153.116.132,
217.197.91.153,
23.137.253.24,
23.230.253.98,
2.58.53.236,
37.80.134.153,
38.242.153.19,
43.153.248.120,
45.138.53.244,
45.153.130.235,
45.154.109.53,
45.32.53.133,
45.77.25.253,
45.79.104.153,
47.79.20.153,
51.15.220.253,
5.161.118.253,
5.250.191.53,
5.53.124.108,
5.75.153.75,
61.153.200.30,
61.240.220.53,
65.21.253.73,
65.29.228.253,
66.118.244.253,
68.183.253.200,
70.253.80.157,
70.253.80.158,
74.48.0.53,
78.142.193.53,
85.214.72.153,
85.215.153.54,
85.215.53.142,
89.45.227.53,
92.53.116.105,
95.179.152.253,
95.215.19.53,
103.28.53.16,
103.69.149.253,
104.21.10.53,
104.21.45.153,
104.21.48.253,
104.21.53.52,
104.21.80.53,
104.21.8.153,
104.21.85.253,
108.181.69.153,
109.123.253.27,
117.53.144.157,
120.53.53.53,
128.139.197.53,
129.153.112.204,
129.153.174.221,
129.153.224.48,
129.153.9.127,
129.154.217.53,
130.162.230.253,
139.162.153.123,
139.84.153.198,
140.83.53.18,
144.21.35.153,
144.22.53.207,
146.56.160.153,
152.53.0.31,
152.53.15.127,
153.127.67.108,
153.194.45.201,
153.31.113.36,
160.119.253.209,
162.159.140.153,
162.55.56.53,
167.253.158.187,
167.253.159.160,
17.253.14.115,
17.253.14.117,
17.253.52.119,
17.253.52.247,
172.67.153.158,
172.67.153.19,
172.67.153.48,
172.67.164.53,
172.67.167.53,
172.67.202.53,
176.165.111.253,
176.96.137.53,
178.162.228.53,
178.253.23.166,
178.253.43.231,
185.194.53.22,
185.199.108.153,
185.199.109.153,
185.199.110.153,
185.199.111.153,
185.223.163.153,
185.253.212.22,
188.165.53.130,
191.96.153.75,
192.53.175.62,
193.122.103.253,
193.122.96.153,
193.190.182.53,
193.238.153.17,
194.87.43.53,
203.153.116.132,
217.197.91.153,
23.137.253.24,
23.230.253.98,
2.58.53.236,
37.80.134.153,
38.242.153.19,
43.153.248.120,
45.138.53.244,
45.153.130.235,
45.154.109.53,
45.32.53.133,
45.77.25.253,
45.79.104.153,
47.79.20.153,
51.15.220.253,
5.161.118.253,
5.250.191.53,
5.53.124.108,
5.75.153.75,
61.153.200.30,
61.240.220.53,
65.21.253.73,
65.29.228.253,
66.118.244.253,
68.183.253.200,
70.253.80.157,
70.253.80.158,
74.48.0.53,
78.142.193.53,
85.214.72.153,
85.215.153.54,
85.215.53.142,
89.45.227.53,
92.53.116.105,
95.179.152.253,
95.215.19.53,
Wcześniej używałem twoich komend do blokowania DOH ip V4, ale sprawwdzałem ping IP 1.0.0.1 i zwraca wyniki, czyli nie jest zablokowany.
cd /root
wget https://raw.githubusercontent.com/jpgpi … OHipv4.txt
uci add firewall ipset
uci set firewall.@ipset[-1].name=dohipv4
uci set firewall.@ipset[-1].match=dest_ip
uci set firewall.@ipset[-1].loadfile=/root/DOHipv4.txt
uci set firewall.@ipset[-1].family='ipv4'
uci add firewall rule
uci set firewall.@rule[-1].name='Disable'
uci set firewall.@rule[-1].src='lan'
uci set firewall.@rule[-1].dest='lan'
uci set firewall.@rule[-1].ipset='dohipv4'
uci set firewall.@rule[-1].target='REJECT'
uci set firewall.@rule[-1].proto=all
uci commit firewall
/etc/init.d/firewall restart