How to Download and Upload Custom Script Firmware in UBNT AirOS 5 and AirOS 6

via IFTTT

I would like to share how to lock MAC address on LAN port and block other unwanted user traffic. Why to do that? I maintain wireless network where all stations are in bridge mode and users receive public IP address from "central" DHCP server. Sometimes we have difficulties when users connect switch and multiple PC on this switch or some unwanted devices to LAN port of station. They spend us a lot of public IP address. Second problem was users which accidentally connect CPE on LAN port and their DHCP start to deliver IP addresses to other users.

I solve this problem with custom script. I ASK a lot on forum but nobody give me right solution (I don't understand UBNT support but never mind...).

First connect to your station - use SSH

Then type

vi /etc/persistent/rc.poststart

press letter i (to insert text)

Copy this (before replace xx:xx:xx:xx:xx:xx with MAC address you would like to be locked on LAN port)

ebtables -F FORWARD

ebtables -A FORWARD -s xx:xx:xx:xx:xx:xx -i eth0 -j ACCEPT

ebtables -A FORWARD -i eth0 -j DROP

ebtables -t filter -A FORWARD -p IPv4 --out-interface ath0 --ip-proto udp --ip-dport 68 -j DROP

ebtables -t filter -A FORWARD -p IPv4 --ip-src 172.16.0.0/12 -j DROP

ebtables -t filter -A FORWARD -p IPv4 --ip-dst 172.16.0.0/12 -j DROP

ebtables -t filter -A FORWARD -p IPv4 --ip-src 192.168.0.0/16 -j DROP

ebtables -t filter -A FORWARD -p IPv4 --ip-dst 192.168.0.0/16 -j DROP

ebtables -t filter -A FORWARD -p IPv4 --ip-src 169.254.0.0/16 -j DROP

ebtables -t filter -A FORWARD -p IPv4 --ip-dst 169.254.0.0/16 -j DROP

ebtables -t filter -A FORWARD -j FIREWALL

and paste in editor . Next step , press Escape, then type w, then type q, then type ! and press ENTER. You should be in prompt where you start. Type SAVE (small letters) and reboot.

You should see something like that:

XM.v5.6.3# save

Found Active on[1] ...

Found Backup1 on[2] ...

Storing Active[2] ... [%100]

Active->Backup[1] ... [%100]

XM.v5.6.3#reboot

After reboot you can check if rules was inserted in your ebtables. Type in

ebtables -L

You should see something like that:

XM.v5.6.3# ebtables -LBridge table: filter

Bridge chain: INPUT, entries: 1, policy: ACCEPT-j FIREWALL

Bridge chain: FORWARD, entries: 10, policy: ACCEPT-s aa:bb:c:cc:e5:a1 -i eth0 -j ACCEPT-i eth0 -j DROP-p IPv4 -o ath0 --ip-proto udp --ip-dport 68 -j DROP-p IPv4 --ip-src 172.16.0.0/12 -j DROP-p IPv4 --ip-dst 172.16.0.0/12 -j DROP-p IPv4 --ip-src 192.168.0.0/16 -j DROP-p IPv4 --ip-dst 192.168.0.0/16 -j DROP-p IPv4 --ip-src 169.254.0.0/16 -j DROP-p IPv4 --ip-dst 169.254.0.0/16 -j DROP-j FIREWALL

Bridge chain: OUTPUT, entries: 0, policy: ACCEPT

Bridge chain: FIREWALL, entries: 0, policy: ACCEPTXM.v5.6.3#

You can also check if access list work like you expect. To check counters type in

ebtables -L --Lc

XM.v5.6.3# ebtables -L --LcBridge table: filter

Bridge chain: INPUT, entries: 1, policy: ACCEPT-j FIREWALL, pcnt = 1816356 -- bcnt = 106872059

Bridge chain: FORWARD, entries: 10, policy: ACCEPT-s aa:bb:c:cc:e5:a1 -i eth0 -j ACCEPT , pcnt = 222989 -- bcnt = 33630440-i eth0 -j DROP , pcnt = 0 -- bcnt = 0-p IPv4 -o ath0 --ip-proto udp --ip-dport 68 -j DROP , pcnt = 0 -- bcnt = 0-p IPv4 --ip-src 172.16.0.0/12 -j DROP , pcnt = 0 -- bcnt = 0-p IPv4 --ip-dst 172.16.0.0/12 -j DROP , pcnt = 0 -- bcnt = 0-p IPv4 --ip-src 192.168.0.0/16 -j DROP , pcnt = 809 -- bcnt = 37232-p IPv4 --ip-dst 192.168.0.0/16 -j DROP , pcnt = 0 -- bcnt = 0-p IPv4 --ip-src 169.254.0.0/16 -j DROP , pcnt = 40 -- bcnt = 4089-p IPv4 --ip-dst 169.254.0.0/16 -j DROP , pcnt = 0 -- bcnt = 0-j FIREWALL, pcnt = 2123462 -- bcnt = 436597110

Bridge chain: OUTPUT, entries: 0, policy: ACCEPT

Bridge chain: FIREWALL, entries: 0, policy: ACCEPT

I hope this will help for someone.

I would like to invite others if they also could share some usefull scripts.

Credit : Boris

_____________________________________________________________________________

You can find airOS M builds that support custom (rc) scripts here. Moving forward all builds with "cs" in the name (custom script) will have support for custom scripts. If using a previous with -CS support, you can upgrade via Check for update function and maintain -CS support.

Custom scripts allow for users to add functionality to airOS, but also allow for persistence of malicious software. "cs" versions of airOS should be considered slightly less secure vs non-cs releases found on https://download.ubnt.com.

6.3.2

TI.v6.3.2-cs.33267.200715.1557.bin

XM.v6.3.2-cs.33267.200715.1657.bin

XW.v6.3.2-cs.33267.200715.1627.bin

You can find airMAX AC custom script builds HERE.

Previous Versions:

6.3.0

TI.v6.3.0-cs.33226.200428.1749.bin

XM.v6.3.0-cs.33226.200428.1849.bin

XW.v6.3.0-cs.33226.200428.1819.bin

6.2.0

TI.v6.2.0-cs.33033.190703.1047.bin