Question

Is there a way to disable the SSH security blocking feature? The default is 10 attempts. I've set it to 1.000.000, but would rather be able to whitelist a certain address or disable the feature. I'm having a partial source nat translation before the Rut, and I don't want the nat hide address to be blocked (by accident). When addresses get blacklisted, is that for a certain amount of time or just permanently until removed manually?

Answer 1

Hello,

Unfortunately, there is no way to completely disable this feature within current firmware. However, this functionality will be changed with the upcoming 7.2 version release. From this version any blocked IP will only lose access to the router, but its traffic will still be routed. 

When the address is blacklisted, the block is permanent until manually removed. The block can be removed in two ways:

• Via router's WebUI by going to System -> Administration -> Access control in Security tab under List of login attempts section by pressing the cross button.
• Via SSH. The block adds entries in the /etc/config/ip_blockd file and creates two iptables firewall rules in INPUT and FORWARD tables, which drop any traffic from the blocked IP. One way to remove the rules is by using the commands:

         iptables -D INPUT  <rule _number> 

         iptables _D FORWARD <rule_number>

      Rule numbers can be listed by command: 

         iptables -L --line-numbers.

      ip_blockd can be cleared by command: 

         uci delete [email protected][entry number].

Best regards,

Žygimantas