Posted by Gnomad on Sep 14, 2019; 6:38am
URL: https://itus.accessinnov.com/FIRMWARE-Itus-Networks-Shield-Firmware-Upgrade-WIP-tp1726p1880.html

PR up for a "safe" /etc/snort/hosts/updatehosts.sh
https://github.com/Grommish/Itus_Shield_v2/pull/2/files#diff-f363d9f8c5abce896b52b3f2a5df9b3e

But
1. although pinging from the Shield directly resolves to 127.0.0.1 as expected, browsing to these domains from a downstream client is not blocked.
I guess we need to change client DNS to the Shield?

2. local speedtest was then 60% slower than before.
I brought this back up to reasonable speeds by commenting out the larger https://hosts-file.net/emd.txt and psh.txt downloads.

I wonder if e2guardian might perform better, obviate the need to change client DNS entries?

root@OpenWrt:/# /etc/snort/hosts/updatehosts.sh

Preparing working directory for host list download and ingestion
/tmp/hosts
Downloading bad host list urls from https://v.firebog.net/hosts/lists.php?type=tick
...
908683 badhosts.all

Sorting bad hosts and removing duplicates
Cleaning up working files

Displaying host_counter.log

# Hosts  Url processed by etc/snort/hosts/updatehosts.sh
-------- -----------------------------------------------
    526 https://hosts-file.net/grm.txt
    713 https://reddestdream.github.io/Projects/MinimalHosts/etc/MinimalHostsBlocker/minimalhosts
   3619 https://raw.githubusercontent.com/StevenBlack/hosts/master/data/KADhosts/hosts
     73 https://raw.githubusercontent.com/StevenBlack/hosts/master/data/add.Spam/hosts
    753 https://v.firebog.net/hosts/static/w3kbl.txt
    411 https://adaway.org/hosts.txt
  29855 https://v.firebog.net/hosts/AdguardDNS.txt
  34374 https://raw.githubusercontent.com/anudeepND/blacklist/master/adservers.txt
   2703 https://s3.amazonaws.com/lists.disconnect.me/simple_ad.txt
  45739 https://hosts-file.net/ad_servers.txt
   1609 https://v.firebog.net/hosts/Easylist.txt
   3039 https://pgl.yoyo.org/adservers/serverlist.php?hostformat=hosts;showintro=0
     10 https://raw.githubusercontent.com/StevenBlack/hosts/master/data/UncheckyAds/hosts
   4315 https://www.squidblacklist.org/downloads/dg-ads.acl
   2766 https://v.firebog.net/hosts/Easyprivacy.txt
   3634 https://v.firebog.net/hosts/Prigent-Ads.txt
  14467 https://gitlab.com/quidsup/notrack-blocklists/raw/master/notrack-blocklist.txt
   1286 https://raw.githubusercontent.com/StevenBlack/hosts/master/data/add.2o7Net/hosts
    367 https://raw.githubusercontent.com/crazy-max/WindowsSpyBlocker/master/data/hosts/spy.txt
   2738 https://s3.amazonaws.com/lists.disconnect.me/simple_malvertising.txt
  26886 https://mirror1.malwaredomains.com/files/justdomains
   1158 https://hosts-file.net/exp.txt
 300351 https://hosts-file.net/emd.txt
 189142 https://hosts-file.net/psh.txt
   3202 https://mirror.cedia.org.ec/malwaredomains/immortal_domains.txt
   1106 https://www.malwaredomainlist.com/hostslist/hosts.txt
   2046 https://bitbucket.org/ethanr/dns-blacklists/raw/8575c9f96e5b4a1308f2f12394abd86d0927a4a0/bad_lists/Mandiant_APT1_Report_Appendix_D.txt
   6785 https://v.firebog.net/hosts/Prigent-Malware.txt
   6785 https://v.firebog.net/hosts/Prigent-Phishing.txt
   1533 https://phishing.army/download/phishing_army_blocklist_extended.txt
    155 https://gitlab.com/quidsup/notrack-blocklists/raw/master/notrack-malware.txt
   1902 https://ransomwaretracker.abuse.ch/downloads/RW_DOMBL.txt
    219 https://ransomwaretracker.abuse.ch/downloads/CW_C2_DOMBL.txt
    214 https://ransomwaretracker.abuse.ch/downloads/LY_C2_DOMBL.txt
    144 https://ransomwaretracker.abuse.ch/downloads/TC_C2_DOMBL.txt
     33 https://ransomwaretracker.abuse.ch/downloads/TL_C2_DOMBL.txt
  19570 https://v.firebog.net/hosts/Shalla-mal.txt
   2580 https://raw.githubusercontent.com/StevenBlack/hosts/master/data/add.Risk/hosts
 165519 https://www.squidblacklist.org/downloads/dg-malicious.acl
  26364 https://zerodot1.gitlab.io/CoinBlockerLists/hosts
-------- -----------------------------------------------
 745135 unique bad hosts

Using host template defined at /etc/snort/hosts/hosts
Appending badhosts
Replacing /etc/hosts
Restarting network