¶ banIP
¶ Introduction
banIP can block services using IP/CIDR lists including ASN and GeoIP lists.
¶ Command-line instructions
Install and enable banIP.
# Install packages
opkg update
opkg install banip
# Enable banIP
uci set banip.global.ban_enabled="1"
uci commit banip
service banip restart
¶ Extras
¶ Web interface
If you want to manage banIP settings using web interface. Install the necessary packages.
# Install packages
opkg update
opkg install luci-app-banip
service rpcd restart
¶ Blocking domains
Block domains by IP.
# Block domains
cat << EOF >> /etc/banip/banip.blocklist
example.com
example.net
EOF
service banip restart
¶ Blocking ASNs
Block Netflix by ASN.
# Block Netflix
uci add_list banip.global.ban_feed="asn"
uci add_list banip.global.ban_asn="2906"
uci add_list banip.global.ban_asn="40027"
uci commit banip
service banip restart
¶ Blocking countries
Block countries by GeoIP.
# Blocking countries
uci add_list banip.global.ban_feed="country"
uci add_list banip.global.ban_country="cn"
uci add_list banip.global.ban_country="ru"
uci commit banip
service banip restart
¶ Blocking DoH
Block DoH using a built-in list from dibdot/DoH-IP-blocklists.
# Block DoH
uci add_list banip.global.ban_feed="doh"
uci commit banip
service banip restart
¶ Blocking WhatsApp
Block WhatsApp using a custom list from HybridNetworks/whatsapp-cidr.
# Block WhatsApp
. /usr/share/libubox/jshn.sh
json_init
json_load_file /etc/banip/banip.custom.feeds 2> /dev/null
json_add_object "whatsapp"
json_add_string "descr" "WhatsApp CIDR"
json_add_string "url_4" "https://raw.githubusercontent.com/\
HybridNetworks/whatsapp-cidr/main/WhatsApp/whatsapp_cidr_ipv4.txt"
json_add_string "rule_4" "/^[^#]/{print \$1\",\"}"
json_close_object
json_dump > /etc/banip/banip.custom.feeds
uci add_list banip.global.ban_feed="whatsapp"
uci commit banip
service banip restart
¶ Blocking Facebook
Block Facebook using a custom list from SecOps-Institute/FacebookIPLists.
# Block Facebook
. /usr/share/libubox/jshn.sh
json_init
json_load_file /etc/banip/banip.custom.feeds 2> /dev/null
json_add_object "facebook"
json_add_string "descr" "Facebook CIDR"
json_add_string "url_4" "https://raw.githubusercontent.com/\
SecOps-Institute/FacebookIPLists/master/facebook_ipv4_cidr_blocks.lst"
json_add_string "rule_4" "/^[^#]/{print \$1\",\"}"
json_add_string "url_6" "https://raw.githubusercontent.com/\
SecOps-Institute/FacebookIPLists/master/facebook_ipv6_list.lst"
json_add_string "rule_6" "/^[^#]/{print \$1\",\"}"
json_close_object
json_dump > /etc/banip/banip.custom.feeds
uci add_list banip.global.ban_feed="facebook"
uci commit banip
service banip restart
¶ Whitelisting networks
Whitelist network interfaces.
# Whitelist interfaces
uci add_list banip.global.ban_vlanallow="br-lan"
uci add_list banip.global.ban_vlanallow="br-dmz"
uci commit banip
service banip restart
¶ Whitelisting clients
Whitelist client MACs.
# Whitelist MACs
cat << EOF >> /etc/banip/banip.allowlist
11:22:33:44:55:66
aa:bb:cc:dd:ee:ff
EOF
service banip restart
¶ Whitelisting domains
Whitelist domains.
# Whitelist domains
cat << EOF >> /etc/banip/banip.allowlist
example.com
example.net
EOF
service banip restart
¶ Whitelist only
Allow only whitelisted entries.
# Whitelist only
uci set banip.global.ban_allowlistonly="1"
uci commit banip
service banip restart