firewall-blocklist

#! /bin/sh

SC_NAME="firewall-blocklist"
SC_ABR="FwBl"
IPTBL_NAME="${SC_ABR}_DROP"
[ "$(nvram get log_firewall_blocklist)" = "1" ] && IPTBL_LOGGING='y' || IPTBL_LOGGING=''
IPSET_NAME="${SC_ABR}_BL"
IPSET_WL_NAME="${SC_ABR}_WL"
ROOT_DIR="/opt/bolemo"
IP_LIST="$ROOT_DIR/etc/${SC_NAME}-bl.netset"
WL_FILE="$ROOT_DIR/etc/${SC_NAME}-wl.netset"
INFO_FILE="/tmp/${SC_ABR}_status"
WAN_GATEWAY="$(nvram get wan_gateway)"
WAN_NETMASK="$(nvram get wan_netmask)"
INFO_IPS_BL_LOAD='1'
INFO_IPS_BL_NEW='2'
INFO_IPS_BL_KEEP='3'
INFO_IPS_BL_WGW='4'
INFO_IPS_WL_LOAD='5'
INFO_IPS_WL_NEW='6'
INFO_IPS_WL_KEEP='7'
INFO_IPS_WL_WGW_ADD='8'
INFO_IPS_WL_WGW_KEEP='9'
INFO_IPT_KEEP='a'
INFO_IPT_LOG='b'
INFO_IPT_BL='c'
INFO_IPT_WL='d'
INFO_IPT_PBM='e'

_fws() {
  :> "$INFO_FILE"

  # creating ipset blocklist if needed
  if ! ipset -q -n list "$IPSET_NAME">/dev/null; then
    if [ -r "$IP_LIST" ]; then
    # netset file exists, so creating blocklist ipset from it
      echo -e "create $IPSET_NAME hash:net family inet maxelem $(wc -l < "$IP_LIST")\n$(sed "s/^/add $IPSET_NAME /" "$IP_LIST")" | ipset restore
      echo "$INFO_IPS_BL_LOAD" >> "$INFO_FILE"
    else
    # no netset file, creating empty blocklist ipset
      ipset -q create "$IPSET_NAME" hash:net family inet
      echo "$INFO_IPS_BL_NEW" >> "$INFO_FILE"
    fi
  else echo "$INFO_IPS_BL_KEEP" >> "$INFO_FILE"
  fi
  
  # checking if WAN gateway is in blocklist
  if [ "$WAN_GATEWAY" != '0.0.0.0' ] && ipset -q test "$IPSET_NAME" "$WAN_GATEWAY"
    then
      WGW_IN_BL='y'
      echo "$INFO_IPS_BL_WGW" >> "$INFO_FILE"
      if ipset -q test "$IPSET_WL_NAME" "$WAN_GATEWAY"
        then WGW_IN_WL='y'
        else WGW_IN_WL=''
      fi
    else
      WGW_IN_BL=''
  fi
  
  NO_WL=''
  # creating ipset whitelist if needed
  if ! ipset -q -n list "$IPSET_WL_NAME">/dev/null; then
    if [ -r "$WL_FILE" ]; then
    # netset file exists, so creating whitelist ipset from it
      echo -e "create $IPSET_WL_NAME hash:net family inet\n$(sed "s/^/add $IPSET_WL_NAME /" "$WL_FILE")" | ipset restore
      echo "$INFO_IPS_WL_LOAD" >> "$INFO_FILE"
    elif [ "$WGW_IN_BL" ]; then
    # no netset file, creating empty whitelist ipset because needed for WAN gateway
      ipset -q create "$IPSET_WL_NAME" hash:net family inet
      echo "$INFO_IPS_WL_NEW" >> "$INFO_FILE"
    else
      # no need for whitelist, just destroy if exists
      ipset -q destroy "$IPSET_WL_NAME"
      NO_WL='y'
    fi
  else echo "$INFO_IPS_WL_KEEP" >> "$INFO_FILE"
  fi
  
  # if needed, adding WAN gateway to whitelist
  [ "$WGW_IN_BL" ] && if [ "$WGW_IN_WL" ]; then
    echo "$INFO_IPS_WL_WGW_KEEP" >> "$INFO_FILE"
  else
    # Calculate WAN_RANGE (IP & CIDR)
    _CIDR=0
    for _OCTET in $(echo "$WAN_NETMASK"| sed 's/\./ /g'); do
      _BINBITS=$(echo "obase=2; ibase=10; ${_OCTET}"| bc | sed 's/0//g')
      let _CIDR+=${#_BINBITS}
    done
    WAN_RANGE="$WAN_GATEWAY/$_CIDR"
    ipset -q add "$IPSET_WL_NAME" "$WAN_RANGE"
    echo "$INFO_IPS_WL_WGW_ADD" >> "$INFO_FILE"
  fi

  #checking if IPTBL_NAME is already set
  if iptables -L "$IPTBL_NAME" >/dev/null 2>/dev/null; then
    REFERENCES=$(iptables -L "$IPTBL_NAME" | sed "s/Chain $IPTBL_NAME (\([[0-9]]*\) references)/\1/ ; 1q")
    #checking if IPTBL_NAME is correctly referenced; if it is, exit
    [ $REFERENCES = 4 ] && { echo "$INFO_IPT_KEEP" >> "$INFO_FILE"; exit 0; }
    [ $REFERENCES = 0 ] || { echo "$INFO_IPT_PBM" >> "$INFO_FILE"; exit 1; }
  else
    # creating the filtering (blocking) iptables chain
    iptables -N "$IPTBL_NAME"
    [ "$IPTBL_LOGGING" ] && { iptables -A "$IPTBL_NAME" -j LOG --log-prefix "[$SC_NAME] "; echo "$INFO_IPT_LOG" >> "$INFO_FILE"; }
    iptables -A "$IPTBL_NAME" -j DROP
  fi
  
  # creating the required iptables
  if [ "$NO_WL" ]; then
  # creating iptables without whitelist
    iptables -I INPUT 1 -i brwan -m set --match-set "$IPSET_NAME" src -j "$IPTBL_NAME"
    iptables -I OUTPUT 1 -o brwan -m set --match-set "$IPSET_NAME" dst -j "$IPTBL_NAME"
    iptables -I FORWARD 1 -i brwan -m set --match-set "$IPSET_NAME" src -j "$IPTBL_NAME"
    iptables -I FORWARD 2 -o brwan -m set --match-set "$IPSET_NAME" dst -j "$IPTBL_NAME"
    echo "$INFO_IPT_BL" >> "$INFO_FILE"
  else
  # creating iptables with whitelist
    iptables -I INPUT 1 -i brwan -m set --match-set "$IPSET_WL_NAME" src -j ACCEPT
    iptables -I INPUT 2 -i brwan -m set --match-set "$IPSET_NAME" src -j "$IPTBL_NAME"
    iptables -I OUTPUT 1 -o brwan -m set --match-set "$IPSET_WL_NAME" dst -j ACCEPT
    iptables -I OUTPUT 2 -o brwan -m set --match-set "$IPSET_NAME" dst -j "$IPTBL_NAME"
    iptables -I FORWARD 1 -i brwan -m set --match-set "$IPSET_WL_NAME" src -j ACCEPT
    iptables -I FORWARD 2 -i brwan -m set --match-set "$IPSET_NAME" src -j "$IPTBL_NAME"
    iptables -I FORWARD 3 -o brwan -m set --match-set "$IPSET_WL_NAME" dst -j ACCEPT
    iptables -I FORWARD 4 -o brwan -m set --match-set "$IPSET_NAME" dst -j "$IPTBL_NAME"
    echo -e "$INFO_IPT_BL\n$INFO_IPT_WL" >> "$INFO_FILE"
  fi
}

#we are called from firewall_start.sh
if [ "$1" ] && [ "$1" = "_fws" ]; then
  _fws
  exit 0
fi

#when called from post-mount.sh
_pm() {
#  sleep 1
  [ -e /opt/bolemo ] || /bin/ln -sf /tmp/mnt/$2/bolemo /opt/bolemo
  init
  _fws
  exit 0
}

SC_VERS="v3.3.2"
SC_PATH="$(cd "$(dirname "$0")" >/dev/null 2>&1 ; pwd -P)"
IPR_BIN="$(command -v iprange)"
# IPT_MD5 & IPT_MD5_NO_WL depends on IPTBL_NAME, IPSET_NAME and IPSET_WL_NAME
IPT_MD5="2ad1475a410bd55d4afac0b7a36e65e1  -"
IPT_MD5_NO_WL="9b7ed183ae8e4d418c957c16fca26939  -"
IPSET_TMP="${IPSET_NAME}_tmp"
SC_NICEPATH="$ROOT_DIR/scripts/$SC_NAME"
SRC_LIST="$ROOT_DIR/etc/$SC_NAME.sources"
CUST_BL_FILE="$ROOT_DIR/etc/$SC_NAME.custom-bl.netset"
CUST_WL_FILE="$ROOT_DIR/etc/$SC_NAME.custom-wl.netset"
TMP_FILE="/tmp/$SC_NAME.tmp"
FWS_DIR="/opt/scripts"
FWS_FILE="$FWS_DIR/firewall-start.sh"
#RC_FILE="/etc/rc.d/S99$SC_NAME"
#RC_MD5="f3da3fae0a61497e3979aa35e123b319"
# Check if scriot is installed on USB
if echo "$SC_PATH" | grep -q '^/tmp/mnt/'; then
  PM_DIR="$(echo "$SC_PATH" | sed "s|\(/tmp/mnt/[[:alnum:]]*\)/.*|\1|")/autorun/scripts"
  PM_FILE="$PM_DIR/post-mount.sh"
  EXT_DRIVE='y'
else
  EXT_DRIVE=''
fi

upgrade() {
  echo -e "\033[1;36mUpgrading:\033[0m"
  echo "- Version installed: $SC_VERS"
  if [ "$DEVMODE" ]; then
    echo "- Devmode on, force downloading dev version..."
    UPGRADE_URL="https://raw.githubusercontent.com/bolemo/firewall-blocklist/dev/firewall-blocklist"
  else
    echo -ne "- Checking latest available version...\r"
    SC_LAST_VERS="$(last_avail_version)";
    if [ "$SC_LAST_VERS" ]
      then if [ "$SC_VERS" = "$SC_LAST_VERS" ]
        then echo "- This is already the last version.         "; exit 0
        else echo "- Version found: $SC_LAST_VERS                    "
      fi
      else
        >&2 echo -e "\033[31m! Could not check what is the last version online!\033[0m"
        exit 1
    fi
    UPGRADE_URL="https://raw.githubusercontent.com/bolemo/firewall-blocklist/master/firewall-blocklist"
  fi
  if [ ! "$DEVMODE" ]; then
    echo -n "? Do you want to upgrade from $SC_VERS to $SC_LAST_VERS (y/n)? "
    case "$(i=0;while [ $i -lt 2 ];do i=$((i+1));read -p "" yn </dev/tty;[ -n "$yn" ] && echo "$yn" && break;done)" in Y|y|yes|Yes|YES) : ;; *) exit 0 ;; esac
  fi
  echo "- Downloading:"

  DL_PATH="/tmp/$SC_NAME.dl"
  _PROG='--show-progress';
  [ "$DEVMODE" ] && _PROG="--no-cache $_PROG"
  echo -ne "\033[35m"
  if wget -qO "$DL_PATH" $_PROG "$UPGRADE_URL"; then
    \mv "$DL_PATH" "$SC_NICEPATH"
    chmod +x "$SC_NICEPATH"
    echo -e "\033[0m- Script installed to $SC_NICEPATH"
  else
    echo -ne "\033[0m"
    >&2 echo -e "\033[31m! Wget error code $?! Could not download $DL_PATH\033[0m"
    rm -f "$DL_PATH"
    exit 1
  fi

  exit 0
}

check_firewall_start() {
  [ -x $FWS_FILE ] || return 1
  [ "$(sed 's/[[:space:]]\+/ /g' $FWS_FILE | grep -c -- "\[ -x $SC_NICEPATH \] && $SC_NICEPATH _fws")" = 1 ] || return 1
  return 0
}

create_firewall_start() {
  [ -d "$FWS_DIR" ] || mkdir -p "$FWS_DIR"
  [ -e "$FWS_FILE" ] && sed -i "/$SC_NAME/d" "$FWS_FILE"
  echo -e "# Bolemo firewall-blocklist\n[ -x $SC_NICEPATH ] && $SC_NICEPATH _fws" >> "$FWS_FILE"
  [ -x "$FWS_FILE" ] || chmod +x "$FWS_FILE"
}

check_postmount() {
  [ -x "$PM_FILE" ] || return 1
  [ "$(sed 's/[[:space:]]\+/ /g' $PM_FILE | grep -c -- "\[ -x $SC_NICEPATH \] && $SC_NICEPATH _pm \$1")" = 1 ] || return 1
  return 0
}

create_postmount() {
  [ "$EXT_DRIVE" ] || return 1
  [ -d "$PM_DIR" ] || mkdir -p "$PM_DIR"
  [ -e "$PM_FILE" ] && sed -i "/$SC_NAME/d" "$PM_FILE"
  echo -e "# Bolemo firewall-blocklist\n[ -x $SC_NICEPATH ] && $SC_NICEPATH _pm \$1" >> "$PM_FILE"
  [ -x "$PM_FILE" ] || chmod +x "$PM_FILE"
}

#check_rc_file () {
#  [ -x $RC_FILE ] || return 1
#  md5sum "$RC_FILE" | grep -qF "$RC_MD5" || return 1
#  return 0
#}

#create_rc_file() {
#  echo -e "#!/bin/sh /etc/rc.common\nSTART=99\nstart() {\nsleep 5 && [ -x $SC_NICEPATH ] && $SC_NICEPATH _fws\n}\nstop() {\n:\n}" > "$RC_FILE"
#  [ -x "$RC_FILE" ] || chmod +x "$RC_FILE"
#}

last_avail_version() {
  wget -qO- "https://api.github.com/repos/bolemo/firewall-blocklist/releases/latest" | jq -r .tag_name
}

count_ip_in_file() {
  if [ -x "$IPR_BIN" ]
    then $IPR_BIN -C "$1" | sed -n 's/.*,//p'
    else grep -oE '(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\/([0-9]{1,2})' "$1" | awk -F / '{ count[$2]++ } END { for (mask in count) total+=count[mask]*2^(32-mask); print total }'
  fi
}

count_ip_in_ipset() {
  if [ -x "$IPR_BIN" ]
    then ipset list "$1" | sed -n '/Members:/,$p' | tail -n +2 | $IPR_BIN -C | sed -n 's/.*,//p'
    else ipset list "$1" | sed -n '/Members:/,$p' | tail -n +2 | grep -oE '(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\/([0-9]{1,2})' | awk -F / '{ count[$2]++ } END { for (mask in count) total+=count[mask]*2^(32-mask); print total }'
  fi
}

info() {
  echo -e "\033[1;36mInfo:\033[0m"
  if [ -r "$SRC_LIST" ] && [ -d $(dirname "$IP_LIST") ] && [ -d $(dirname "$TMP_FILE") ];
    then echo "- The script is properly installed."
    else echo -e "\033[31m! Something is wrong with installation!\033[0m"
  fi
  echo "- $SC_NAME version: $SC_VERS"
  echo -ne "- Checking latest available version...\r"
  SC_LAST_VERS="$(last_avail_version)";
  if [ "$SC_LAST_VERS" ]
    then if [ "$SC_VERS" = "$SC_LAST_VERS" ]
      then echo "- This is the last version.            "
      else echo -e "\033[35m- Lastest version available: $SC_LAST_VERS       \033[0m"
    fi
    else echo -e "\033[31m! Could not check what is the last version online!\033[0m"
  fi
  [ "$IPR_BIN" ] && echo "- iprange is installed: $($IPR_BIN --version | head -n 1)" || echo "- iprange is not installed."
}

init() {
  [ "$VERBOSE" ] && echo -e "\033[1;36mInitializing...\033[0m"
  ipset -q destroy $IPSET_TMP
  if check_firewall_start; then
    [ "$VERBOSE" ] && echo "- $FWS_FILE is in place and ok."
  else
    create_firewall_start
    check_firewall_start || { >&2 echo -e "\033[31m! Problem with $FWS_FILE!\033[0m"; exit 1; }
    [ "$VERBOSE" ] && echo "- $FWS_FILE was edited and is now ok."
  fi
  if [ "$EXT_DRIVE" ]; then
    [ "$VERBOSE" ] && echo "- Script is installed on external drive."
    if check_postmount; then
      [ "$VERBOSE" ] && echo "- $PM_FILE is in place and ok."
    else
      create_postmount
      check_postmount || { >&2 echo -e "\033[31m! Problem with $PM_FILE!\033[0m"; exit 1; }
      [ "$VERBOSE" ] && echo "- $PM_FILE was edited and is now ok."
    fi
  else
    [ "$VERBOSE" ] && echo "- Script is installed on internal drive."
  fi
#  if check_rc_file; then
#    [ "$VERBOSE" ] && echo "- $RC_FILE is in place and ok"
#  else
#    create_rc_file
#    check_rc_file || { >&2 echo -e "\033[31m! Problem with $RC_FILE!\033[0m"; exit 1; }
#    [ "$VERBOSE" ] && echo "- $RC_FILE was (re)created."
#  fi
}

fw_restart() {
  [ "$VERBOSE" ] && echo -e "\033[1;36mRestarting firewall...\033[0m"
  if [ "$LOG_ACT" ]; then
    if [ "$LOG_ACT" = 'ON' ]; then
      [ "$VERBOSE" ] && echo "- Enabling logging."
      nvram set log_firewall_blocklist=1
    else
      [ "$VERBOSE" ] && echo "- Disabling logging."
      nvram unset log_firewall_blocklist
    fi
  fi
  /usr/sbin/net-wall restart > /dev/null
  [ "$VERBOSE" ] && echo "- Built-in firewall restarted."
}

fw_needs_restart() {
  if [ "$LOG_ACT" ]; then
    LOG_IS_ON="$(iptables -S $IPTBL_NAME 2>/dev/null | grep -F -- "-A $IPTBL_NAME -j LOG --log-prefix")"
    if [ "$LOG_ACT" = 'ON' ]
      then [ "$LOG_IS_ON" ] || return 0
      else [ "$LOG_IS_ON" ] && return 0
    fi
  fi
  case "$(/usr/sbin/iptables -S 2>/dev/null | grep -F "$SC_ABR" | grep -Fv 'LOG' | sed 's/ $//g' | md5sum -)" in
    "$IPT_MD5")
      if [ -r "$WL_FILE" ]; then return 1
      elif [ "$WAN_GATEWAY" != '0.0.0.0' ] && ipset -q test "$IPSET_NAME" "$WAN_GATEWAY"; then return 1
      else return 0
      fi ;;
    "$IPT_MD5_NO_WL")
      if ipset -q list -n "$IPSET_WL_NAME">/dev/null; then return 0
      elif [ "$WAN_GATEWAY" != '0.0.0.0' ] && ipset -q test "$IPSET_NAME" "$WAN_GATEWAY"; then return 0
      else return 1
      fi ;;
    *) return 0 ;;
  esac
}

fw_restart_if_needed() {
  if fw_needs_restart; then
    [ "$VERBOSE" ] && echo "- Internal firewall needs to be restarted..."
    fw_restart
  else
    [ "$VERBOSE" ] && echo "- Internal firewall does not need to be restarted."
  fi
}

print_log() {
  echo -e "\033[1;36mLog:\033[0m"
  echo -e "\033[35mIf the log is empty, to be sure it is enabled, use the \033[1mstatus\033[0;35m parameter.\033[0m"
  dmesg | grep -F "$SC_NAME"
}

clean() {
  [ "$VERBOSE" ] && echo -e "\033[1;36mCleaning...\033[0m"
  if [ -e "$FWS_FILE" ]; then
    if [ "$(grep -Fv "$SC_NAME" "$FWS_FILE" | sed '/^[[:space:]]*$/d')" ]; then
      sed -i "/$SC_NAME/d" "$FWS_FILE"
      [ "$VERBOSE" ] && echo "- $FWS_FILE has some other rules; removed only our rules."
    else
      rm "$FWS_FILE" 2>/dev/null
      [ "$VERBOSE" ] && echo "- $FWS_FILE had no other rules; removed it."
    fi
  fi
  if [ "$EXT_DRIVE" ] && [ -e "$PM_FILE" ]; then
    if [ "$(grep -Fv "$SC_NAME" "$PM_FILE" | sed '/^[[:space:]]*$/d')" ]; then
      sed -i "/$SC_NAME/d" "$PM_FILE"
      [ "$VERBOSE" ] && echo "- $PM_FILE has some other code; removed only our code."
    else
      rm "$PM_FILE" 2>/dev/null
      [ "$VERBOSE" ] && echo "- $PM_FILE had no other code; removed it."
    fi
  fi
#  if [ -e "$RC_FILE" ]; then
#    rm "$RC_FILE" 2>/dev/null
#    [ "$VERBOSE" ] && echo "- Removed $RC_FILE."
#  fi
  rm "$INFO_FILE" 2>/dev/null
  /usr/sbin/net-wall restart > /dev/null
  [ "$VERBOSE" ] && echo "- Built-in firewall restarted."
  ipset -q destroy "$IPSET_NAME"
  ipset -q destroy "$IPSET_WL_NAME"
  ipset -q destroy "$IPSET_TMP"
  [ "$VERBOSE" ] && echo "- Cleaned ipsets."
  [ -e "$TMP_FILE" ] && rm "$TMP_FILE"
  nvram unset log_firewall_blocklist
  [ "$VERBOSE" ] && echo -e "- Removed temporary files.\n- Cleaning done."
}

set_ipset() {
  [ -r "$IP_LIST" ] || { >&2 echo -e "\033[31m! $IP_LIST not readable!\033[0m"; exit 1; }

  MAX="$(wc -l < $IP_LIST)"
  
  if [ "$VERBOSE" ]; then
    NUM_IP="$(count_ip_in_file $IP_LIST)"
    echo -e "\033[1;36mBuilding ipset blocklist ($MAX entries blocking $NUM_IP ips)...\033[0m"
  fi

  if ipset -q list -n "$IPSET_NAME">/dev/null; then
    echo -e "create $IPSET_TMP hash:net family inet maxelem $MAX\n$(sed "s/^/add $IPSET_TMP /" $IP_LIST)" | ipset restore
    [ "$VERBOSE" ] && echo "- Created blocklist, swapping it."
    ipset swap "$IPSET_NAME" "$IPSET_TMP"
    ipset destroy $IPSET_TMP
  else
    echo -e "create $IPSET_NAME hash:net family inet maxelem $MAX\n$(sed "s/^/add $IPSET_NAME /" $IP_LIST)" | ipset restore
    [ "$VERBOSE" ] && echo "- Created blocklist."
  fi
  [ "$VERBOSE" ] && echo "- Done."
  
  # whitelist
  if [ -s "$WL_FILE" ]; then
    if [ "$VERBOSE" ]; then
      MAX="$(wc -l < $WL_FILE)"
      NUM_IP="$(count_ip_in_file "$WL_FILE")"
      echo -e "\033[1;36mBuilding ipset whitelist ($MAX entries bypassing $NUM_IP ips)...\033[0m"
    fi

    if ipset -q list -n "$IPSET_WL_NAME">/dev/null; then
      echo -e "create $IPSET_TMP hash:net family inet\n$(sed "s/^/add $IPSET_TMP /" $WL_FILE)" | ipset restore
      [ "$VERBOSE" ] && echo "- Created whitelist, swapping it."
      ipset swap "$IPSET_WL_NAME" "$IPSET_TMP"
      ipset destroy "$IPSET_TMP"
    else
      echo -e "create $IPSET_WL_NAME hash:net family inet\n$(sed "s/^/add $IPSET_WL_NAME /" $WL_FILE)" | ipset restore
      [ "$VERBOSE" ] && echo "- Created whitelist."
    fi
    [ "$VERBOSE" ] && echo "- Done."
  else
    ipset -q destroy "$IPSET_WL_NAME"
  fi
}

update_iplist() {
  [ "$VERBOSE" ] && echo -e "\033[1;36mUpdating blocklist from sources...\033[0m"
  [ -r "$SRC_LIST" ] || { >&2 echo -e "\033[31m! $SRC_LIST not readable!\033[0m"; exit 1; }

  :>"$TMP_FILE"
  # Process each source url
  [ "$VERBOSE" ] && echo "- Downloading lists defined in $SRC_LIST"
  [ "$VERBOSE" ] && WGET_OPTS='-qO- --show-progress' || WGET_OPTS='-qO-'
  _NBOK=0; _TOT=0;
  grep -v "^[[:space:]*\#]" "$SRC_LIST" | \
  { while read -r URL; do
      _TOT=$((_TOT+1))
      [ "$VERBOSE" ] && echo -e "$_TOT) $URL\033[35m"
      { { { { wget $WGET_OPTS "$URL"; echo $? >&3; } | grep '^[0-9]' | sed 's/;.*//' >>"$TMP_FILE"; } 3>&1; } | { read _EC; exit $_EC; } } 4>&1
      _EC=$?
      [ "$VERBOSE" ] && echo -e "\033[0m"
      [ $_EC = 0 ] && _NBOK=$((_NBOK+1)) || >&2 echo -e "\033[31m! Wget error code $_EC! Could not download $URL\033[0m"
    done
    [ $_NBOK = 0 ] && { >&2 echo -e "\033[31m! Could not get any list!\033[0m"; rm "$TMP_FILE"; exit 1; }
    [ $_NBOK = $_TOT ] || >&2 echo -e "\033[31m! Downloaded only $_NBOK / $_TOT list(s)!\033[0m"
  }
  if [ -r "$CUST_BL_FILE" ]; then
    [ "$VERBOSE" ] && echo "- Adding netset from custom list ($CUST_BL_FILE)"
    grep '^[0-9]' "$CUST_BL_FILE" | sed 's/;.*//' >>"$TMP_FILE"
  fi
  if [ -x "$IPR_BIN" ]; then
    [ "$VERBOSE" ] && echo "- Optimizing and reducing netset (using iprange)..."
    $IPR_BIN --ipset-reduce 20 "$TMP_FILE" > "$IP_LIST"
  else
    [ "$VERBOSE" ] && echo -e "- iprange not installed, passing optimization and reduction process.\n- Removing duplicates..."
    sort "$TMP_FILE" | uniq > "$IP_LIST"
  fi
  rm "$TMP_FILE" 2>/dev/null
  [ "$VERBOSE" ] && echo "- Done."

  # processing whitelist if any
  if [ -r "$CUST_WL_FILE" ]; then
    [ "$VERBOSE" ] && echo -e "\033[1;36mGenerating whitelist from custom list...\033[0m"
    grep '^[0-9]' "$CUST_WL_FILE" | sed 's/;.*//' >"$TMP_FILE"
    
    if [ -s "$TMP_FILE" ]; then
      if [ -x "$IPR_BIN" ]; then
        if [ "$($IPR_BIN --common "$IP_LIST" "$TMP_FILE")" ]; then
          [ "$VERBOSE" ] && echo "- Optimizing and reducing netset (using iprange)..."
          $IPR_BIN --ipset-reduce 20 "$TMP_FILE"  > "$WL_FILE"
        else
          echo '- No IP in common with blocklist, skipping whitelist.'
        fi
      else
        [ "$VERBOSE" ] && echo -e "- iprange not installed, passing optimization and reduction process.\n- Removing duplicates..."
        sort "$TMP_FILE" | uniq > "$WL_FILE"
      fi
      else echo '- No IP set found, custom whitelist is empty.'
    fi
    rm "$TMP_FILE"
    [ "$VERBOSE" ] && echo "- Done."
  else
    rm "$WL_FILE" 2>/dev/null
  fi
}

status() {
  echo -e "\033[1;36mStatus:\033[0m\n- $SC_NAME version: $SC_VERS"
  
  # check iprange binary
  [ "$IPR_BIN" ] && echo "- iprange is installed: $($IPR_BIN --version | head -n 1)" || echo "- iprange is not installed."
  
  # check firewall-start.sh script
  check_firewall_start && STAT_FWS='ok' || STAT_FWS=''
  
  # check post-mount.sh script if script on external drive
  if [ "$EXT_DRIVE" ]; then check_postmount && STAT_PM='ok' || STAT_PM=''; else STAT_PM='na'; fi
  
  # check iptables
  STAT_IPT="$(iptables -S 2>/dev/null | grep -F "$SC_ABR" | grep -Fv 'LOG' | sed 's/ $//g')"
  case "$(echo "$STAT_IPT" | md5sum -)" in
    "$IPT_MD5") STAT_IPT_MATCH_WL='ok'; STAT_IPT_MATCH_NOWL='' ;;
      # iptables are set with whitelist
    "$IPT_MD5_NO_WL") STAT_IPT_MATCH_WL=''; STAT_IPT_MATCH_NOWL='ok' ;;
      # iptables are set without whitelist
    *) STAT_IPT_MATCH_WL=''; STAT_IPT_MATCH_NOWL='' ;;
      # iptables are not set
  esac
  
  # check log
  STAT_LOG="$(iptables -S $IPTBL_NAME 2>/dev/null | grep -F -- "-A $IPTBL_NAME -j LOG --log-prefix")"
  
  # check ipset blocklist
  STAT_IPS="$(ipset -q list $IPSET_NAME -t)"
  
  # check ipset whitelist
  STAT_IPS_WL="$(ipset -q list $IPSET_WL_NAME -t)"
  
  if [ "$WAN_GATEWAY" = '0.0.0.0' ]; then
    STAT_GW_IN_BL=''; STAT_GW_IN_WL=''
  else
    # check WAN gateway in ipset blocklist
    ipset -q test "$IPSET_NAME" "$WAN_GATEWAY" && STAT_GW_IN_BL='y' || STAT_GW_IN_BL=''

    # check WAN gatewan in ipset whitelist
    ipset -q test "$IPSET_WL_NAME" "$WAN_GATEWAY" && STAT_GW_IN_WL='y' || STAT_GW_IN_WL=''
  fi
  
  # master check
  if   [ "$STAT_IPT_MATCH_WL" -a "$STAT_IPS" -a "$STAT_IPS_WL" -a "$STAT_FWS" -a "$STAT_PM" ]; then
    if [ "$STAT_GW_IN_BL" -a "$STAT_GW_IN_WL" ]; then
      echo -e "- Firewall blocklist is set and active.\n- Filtering $(count_ip_in_ipset $IPSET_NAME) IP adresses.\n- Bypassing $(count_ip_in_ipset $IPSET_WL_NAME) IP adresses (including WAN gateway and its subnet)."
    elif [ -z "$STAT_GW_IN_BL$STAT_GW_IN_WL" ]; then
      echo -e "- Firewall blocklist is set and active.\n- Filtering $(count_ip_in_ipset $IPSET_NAME) IP adresses.\n- Bypassing $(count_ip_in_ipset $IPSET_WL_NAME) IP adresses."
    else
      echo -e "- \033[1;31mSomething is not right with the WAN gateway bypass!\033[0m Use $SC_NAME -v status for more details"
    fi
  elif [ "$STAT_IPT_MATCH_NOWL" -a "$STAT_IPS" -a "$STAT_FWS" -a "$STAT_PM" -a ! "$STAT_GW_IN_BL" ]; then
    echo -e "- Firewall blocklist is set and active.\n- Filtering $(count_ip_in_ipset $IPSET_NAME) IP adresses."
  elif [ -z "$STAT_IPT$STAT_IPS$STAT_IPS_WL$STAT_FWS$STAT_PM" ]; then
    echo "- Firewall blocklist is not active; Settings are clean."
  else
    echo -e "- \033[1;31mSomething is not right!\033[0m Use $SC_NAME -v status for more details"
  fi
  [ "$STAT_LOG" ] && echo "- Logging is on." || echo "- Logging is off."
  [ "$VERBOSE" ] || return 0
  
  # details
  echo -e "\033[1;36mDetailed status:\033[0m"
  if [ "$STAT_FWS" ]; then
    echo "- $FWS_FILE exists with correct settings."
  else
    echo "- $FWS_FILE does not exist or does not have firewall-blocklist settings."
  fi

  if [ "$STAT_PM" ]; then
    [ "$STAT_PM" = 'ok' ] && echo "- $PM_FILE exists with correct settings."
  else
    echo "- $PM_FILE does not exist or does not have firewall-blocklist settings."
  fi
  
  # dates
  echo "- Actual router time: $(/bin/date)"
  [ -e "$IP_LIST" ] && echo "- Blocklist generation time: $(/bin/date -r $IP_LIST)"
  [ -e "$WL_FILE" ] && echo "- Whitelist generation time: $(/bin/date -r $WL_FILE)"
  
  # Status file
  if [ -r "$INFO_FILE" ]; then
    echo -e "- Router firewall was last started $(/bin/date -r $INFO_FILE): \033[35m"
    /bin/grep -qF "$INFO_IPS_BL_LOAD" "$INFO_FILE" && echo '     ipset blocklist was loaded from blocklist file.'
    /bin/grep -qF "$INFO_IPS_BL_NEW" "$INFO_FILE" && echo '     ipset blocklist was created empty.'
    /bin/grep -qF "$INFO_IPS_BL_KEEP" "$INFO_FILE" && echo '     ipset blocklist was already loaded and was kept.'
    /bin/grep -qF "$INFO_IPS_BL_WGW" "$INFO_FILE" && echo '     WAN gateway was in ipset blocklist.'
    /bin/grep -qF "$INFO_IPS_WL_LOAD" "$INFO_FILE" && echo '     ipset whitelist was loaded from whitelist file.'
    /bin/grep -qF "$INFO_IPS_WL_NEW" "$INFO_FILE" && echo '     ipset whitelist was created empty.'
    /bin/grep -qF "$INFO_IPS_WL_KEEP" "$INFO_FILE" && echo '     ipset whitelist was already loaded and was kept.'
    /bin/grep -qF "$INFO_IPS_WL_WGW_ADD" "$INFO_FILE" && echo '     WAN gateway was added into ipset whitelist.'
    /bin/grep -qF "$INFO_IPS_WL_WGW_KEEP" "$INFO_FILE" && echo '     WAN gateway was already in ipset whitelist.'
    /bin/grep -qF "$INFO_IPT_KEEP" "$INFO_FILE" && echo '     iptables rules were already set!'
    /bin/grep -qF "$INFO_IPT_LOG" "$INFO_FILE" && echo '     logging rules were added to iptables.'
    /bin/grep -qF "$INFO_IPT_BL" "$INFO_FILE" && echo '     blocklist rules were added to iptables.'
    /bin/grep -qF "$INFO_IPT_WL" "$INFO_FILE" && echo '     whitelist rules were added to iptables.'
    /bin/grep -qF "$INFO_IPT_PBM" "$INFO_FILE" && echo '     problem encountered with iptables rules!'
    echo -ne "\033[0m"
  else
    echo '- No status file found.'
  fi
  
  if [ "$STAT_IPT" ]; then
    if [ "$STAT_IPT_MATCH_WL" ]; then
      echo "- iptables rules are set with bypass rules (whitelist):"
    elif [ "$STAT_IPT_MATCH_NOWL" ]; then
      echo "- iptables rules are set:"
    else
      echo -e "- \033[31miptables rules are not set properly\033[0m:"
    fi
    echo -ne "\033[35m"
    echo "$STAT_IPT" | sed -e 's/^/     iptables /g'
    echo -ne "\033[0m"
  else
    echo "- iptables rules are not set."
  fi
  if [ "$STAT_LOG" ];
    then echo -e "- Logging is active:\n\033[35m     iptables $STAT_LOG\033[0m"
    else echo "- Logging is inactive."
  fi
  if [ "$STAT_IPS" ]; then
    echo "- ipset filter (blocklist) is set:"
#    [ "$STAT_IPT_MATCH_WL$STAT_IPT_MATCH_NOWL" ] || echo -e "     \033[31mblocklist is not used by iptables\033[0m"
    if [ "$STAT_GW_IN_BL" ]
      then if [ "$STAT_GW_IN_WL" ]
        then echo -e "     \033[36mWAN gateway ($WAN_GATEWAY) is in blocklist\033[0m"
        else echo -e "     \033[31mWAN gateway ($WAN_GATEWAY) is in blocklist (but not in whitelist)!\033[0m"
      fi
    fi
    echo -e "\033[35m$STAT_IPS\033[0m" | sed -e 's/^/     /g'
  else
    echo "- ipset filter (blocklist) is not set."
  fi
  if [ "$STAT_IPS_WL" ]; then
    echo "- ipset bypass (whitelist) is set:"
#    [ "$STAT_IPT_MATCH_WL" ] || echo -e "     \033[31mwhitelist is not used by iptables\033[0m"
    if [ "$STAT_GW_IN_BL" ]
      then if [ "$STAT_GW_IN_WL" ]
        then echo -e "     \033[36mWAN gateway ($WAN_GATEWAY) is in whitelist\033[0m"
        else echo -e "     \033[31mWAN gateway ($WAN_GATEWAY) is NOT in whitelist!\033[0m"
      fi
    elif [ "$STAT_GW_IN_WL" ]; then
        echo -e "     \033[31mWAN gateway ($WAN_GATEWAY) is in whitelist (but not in blacklist)!\033[0m"
    fi
    echo -e "\033[35m$STAT_IPS_WL\033[0m" | sed -e 's/^/     /g'
  else
    [ "$STAT_GW_IN_BL" ] && _CLR='\033[31m' || _CLR='\033[0m'
    echo -e "${_CLR}- ipset bypass (whitelist) is not set.\033[0m"
  fi
}

print_help() {
  echo -e "\033[1;36m$SC_NAME $SC_VERS\033[0m"
  echo -e "Usage: \033[1m$SC_NICEPATH \033[35mCOMMAND \033[36m[OPTION(S)]\033[0m"
  echo -e "\033[7mCOMMANDS (use only one):\033[0m"
  echo -e " \033[1;35mrestart\033[0m    - setup ipset and iptables then restarts internal firewall"
  echo -e " \033[1;35mupdate_set\033[0m - generates blocklist set from servers in $SRC_LIST"
  echo -e " \033[1;35mload_set\033[0m   - loads blocklist set into ipset then restarts internal firewall"
  echo -e " \033[1;35mupdate\033[0m     - update_set then load_set \033[1;36m[probably what you want to use]\033[0m"
  echo -e " \033[1;35mclean\033[0m      - clean ipset and iptables rules from setup created by this script"
  echo -e " \033[1;35mhelp\033[0m       - displays help (this)"
  echo -e " \033[1;35minfo\033[0m       - displays info on this script"
  echo -e " \033[1;35mstatus\033[0m     - displays status"
  echo -e " \033[1;35mlog\033[0m        - displays log"
  echo -e " \033[1;35mupgrade\033[0m    - download and install latest version"
  echo -e "\033[7mOPTIONS (none, one or more):\033[0m"
  echo -e " \033[1;36m-v\033[0m          - verbose mode"
  echo -e " \033[1;36m-log=on\033[0m/\033[1;36moff\033[0m - when used with restart, load_set or update, will enable/disable logging"
}

# Main routine
[ $# = 0 ] && { >&2 echo -e "\033[31m! No parameter!\033[0m"; print_help; exit 1; }
[ "$1" = "_pm" ] && [ "$2" ] && _pm

if [ "$1" != "_niced" ]; then
  OPTS=''
  if [ -z "${*##-v *}" ] || [ -z "${*##* -v *}" ] || [ -z "${*##* -v}" ]; then OPTS='_verbose'; fi
  if [ -z "${*##--devmode *}" ] || [ -z "${*##* --devmode *}" ] || [ -z "${*##* --devmode}" ]; then OPTS="${OPTS}_devmode"; fi
  if [ -z "${*##-log=on *}" ] || [ -z "${*##* -log=on *}" ] || [ -z "${*##* -log=on}" ]; then OPTS="${OPTS}_logon"; fi
  if [ -z "${*##-log=off *}" ] || [ -z "${*##* -log=off *}" ] || [ -z "${*##* -log=off}" ]; then OPTS="${OPTS}_logoff"; fi
  PARAM="$(echo "$*" | /bin/sed 's/-[[:alpha:]=]*//g' | sed 's/ //g')"
  [ "$PARAM" ] || { >&2 echo -e "\033[31m! No parameter!\033[0m"; print_help; exit 1; }

  nice -n 15 "$SC_PATH/$SC_NAME" _niced "$PARAM" "$OPTS"
  exit $?
fi

if [ "$3" ]; then
  [ -z "${3##*devmode*}" ] && DEVMODE='y'
  [ -z "${3##*verbose*}" ] && VERBOSE='y'
  [ -z "${3##*logon*}" ] && LOG_ACT='ON'
  [ -z "${3##*logoff*}" ] && LOG_ACT='OFF'
fi
if [ $DEVMODE ]; then echo -e "\033[7;31m$SC_NAME $SC_VERS - Developer mode\033[0m"; VERBOSE='y'
elif [ $VERBOSE ]; then echo -e "\033[7;31m$SC_NAME $SC_VERS - Verbose mode\033[0m"; fi

case "$2" in
  "restart") init; fw_restart; [ $VERBOSE ] && status ;;
  "clean") clean; [ $VERBOSE ] && status ;;
  "load_set") init; set_ipset; fw_restart_if_needed; [ $VERBOSE ] && status ;;
  "update_set") update_iplist ;;
  "update") init; update_iplist; set_ipset; fw_restart_if_needed; [ $VERBOSE ] && status ;;
  "status") status ;;
  "help") print_help ;;
  "info") info ;;
  "log") print_log ;;
  "upgrade") upgrade ;;
  *) >&2 echo -e "\033[31m! Unknown Parameter $2!\033[0m"; print_help; exit 1 ;;
esac

exit 0