Importing Ausus router and YazFi plugin clients with ASUSWRT and DHCPLSS

[EinKantHolz]

My ASUS router has different WLAN guest networks beside my private network like this:
private network: 192.168.1.0/24 with LAN/WLAN
2.4 GHz guest WiFi: 192.168.11.0/24
5 GHz guest WiFi: 192.168.2.0/24
6 GHz guest WiFi: 192.168.8.0/24

I use the YazFi plugin and allow unidirectional communication from my private network to the guest networks:

So I can talk to them but they cant talk to me or to each other in the guest networks.
Every guest network is using my PiHole in the private network - like mentioned here https://www.snbforums.com/threads/yazfi-guest-network-unable-to-access-pi-hole-dns-server.88722/

But NetAlertX on Docker (IP 192.168.1.31:20211) cant detect the guests. I set the networks to scan:

What am I missing?

[EinKantHolz]

I only see my clients, the docker-Netalertx container and the internet with no IP

Additonal: PiAlert was able to see the WAN IP, Why not NetAlertX

Here you can see that the guests use my PiHole

[jokob-sk]

Hi there,

Please make sure you have the network interfaces configured correctly. See below docs for details:

https://github.com/jokob-sk/NetAlertX/blob/main/docs/SUBNETS.md#network-interface-adapter

Use the System Info section to identify the interfaces. You can verify the accessibility and interfaces in the container as well.

To find interfaces:

ip -o link show | awk -F': ' '!/lo|vir|docker/ {print $2}'

To check accessibility:

sudo arp-scan --interface=eth0 192.168.1.0/24

Here are tips if above doesn't work:

https://github.com/jokob-sk/NetAlertX/blob/main/docs/REMOTE_NETWORKS.md

You can adjust your internet IP discovery in the Internet IP plugin.

Hope this helps,
J

[jokob-sk]

Oh also, the next release will come with a Asus WRT import plugin. You could test it by using the netalertx-dev image

[EinKantHolz]

So using 192.168.2.0/24 gives only my router back but not the "guest" client in this subnet.
My router sees the client and one-way-communication from private to guest is allowed (ping works):

My PiHole sees the guest client as well because DNS, ping and similar are allowed to go from guest into the private network.
But NetAlert won't show anything:

CT_NetAlertX:/# ip -o link show | awk -F': ' '!/lo|vir|docker/ {print $2}' 
eth0@if241
br-0125921a24db
br-4f445beff2a8
br-57397dcf57d9
br-ca640682fff8
veth393a07f@if8
veth1fe6686@if10
veth808de63@if14
CT_NetAlertX:/# sudo arp-scan --interface=eth0 192.168.1.0/24
Interface: eth0, type: EN10MB, MAC: bc:24:11:e4:89:7b, IPv4: 192.168.1.31
Starting arp-scan 1.10.0 with 256 hosts (https://github.com/royhills/arp-scan)
192.168.1.1     c8:7f:54:47:2b:58       ASUSTek COMPUTER INC.
192.168.1.11    00:08:9b:f8:f1:cb       ICP Electronics Inc.
192.168.1.20    88:a4:c2:cc:77:d3       LCFC(Hefei) Electronics Technology Co., Ltd
192.168.1.21    64:da:a0:40:1e:dd       Robert Bosch Smart Home GmbH
192.168.1.41    82:11:f4:5b:d5:98       (Unknown: locally administered)
192.168.1.42    bc:24:11:95:3e:89       (Unknown)
192.168.1.43    bc:24:11:ae:fa:11       (Unknown)
192.168.1.47    bc:24:11:1c:70:60       (Unknown)
192.168.1.48    bc:24:11:4c:05:76       (Unknown)
192.168.1.49    bc:24:11:ec:44:f0       (Unknown)
192.168.1.50    bc:24:11:29:46:e9       (Unknown)
192.168.1.81    14:c9:13:f5:3a:f4       LG Electronics
192.168.1.82    3c:a0:67:f4:83:96       Liteon Technology Corporation
192.168.1.84    48:b0:2d:b2:ee:b4       NVIDIA Corporation
192.168.1.141   bc:24:11:76:40:36       (Unknown)
192.168.1.62    28:c6:3f:08:25:41       Intel Corporate
192.168.1.61    bc:09:1b:f4:02:cc       Intel Corporate
192.168.1.112   6c:99:9d:6c:84:32       Amazon Technologies Inc.
192.168.1.113   c0:91:b9:8d:23:c2       Amazon Technologies Inc.
192.168.1.72    d0:1b:49:98:2c:3c       Samsung Electronics Co.,Ltd

20 packets received by filter, 0 packets dropped by kernel
Ending arp-scan 1.10.0: 256 hosts scanned in 1.843 seconds (138.90 hosts/sec). 20 responded
CT_NetAlertX:/# sudo arp-scan --interface=eth0 192.168.2.0/24
Interface: eth0, type: EN10MB, MAC: bc:24:11:e4:89:7b, IPv4: 192.168.1.31
Starting arp-scan 1.10.0 with 256 hosts (https://github.com/royhills/arp-scan)
192.168.2.1     c8:7f:54:47:2b:58       ASUSTek COMPUTER INC.

7 packets received by filter, 0 packets dropped by kernel
Ending arp-scan 1.10.0: 256 hosts scanned in 1.859 seconds (137.71 hosts/sec). 1 responded
CT_NetAlertX:/# sudo arp-scan --interface=eth0 192.168.2.0/24
Interface: eth0, type: EN10MB, MAC: bc:24:11:e4:89:7b, IPv4: 192.168.1.31
Starting arp-scan 1.10.0 with 256 hosts (https://github.com/royhills/arp-scan)
192.168.2.1     c8:7f:54:47:2b:58       ASUSTek COMPUTER INC.

1 packets received by filter, 0 packets dropped by kernel
Ending arp-scan 1.10.0: 256 hosts scanned in 1.863 seconds (137.41 hosts/sec). 1 responded

It cant be a routing problem as well but do I have to set up something in docker?
Traceroute on my allmighty notebook:

Traceroute in the NetAlert's container :

NetAlert is in "host"-mode and accessible via the dockers IP (192.168.1.31:20211) and docker itself is a LXC on proxmox (192.168.1.20), like PiHole (192.168.1.50) > all on the same PC with static IPs and additionally manual set in the router's DHCP section. Everything works fine and until now I haven't set up nginx or similiar.

[jokob-sk]

Hi @EinKantHolz ,

Just FYI, the new release with the AsusWRT plugin is out. If you are using the host network mode in your docker compose, that's the only thing that's needed.

Please note that ping, traceroute and arpscan work on different network layers, so even if you can ping devices, arpscan might not have access to those.

Based on the below it seems like these networks are not accessible to arpscan from the NAX container:

20 packets received by filter, 0 packets dropped by kernel
Ending arp-scan 1.10.0: 256 hosts scanned in 1.843 seconds (138.90 hosts/sec). 20 responded
CT_NetAlertX:/# sudo arp-scan --interface=eth0 192.168.2.0/24
Interface: eth0, type: EN10MB, MAC: bc:24:11:e4:89:7b, IPv4: 192.168.1.31
Starting arp-scan 1.10.0 with 256 hosts (https://github.com/royhills/arp-scan)
192.168.2.1     c8:7f:54:47:2b:58       ASUSTek COMPUTER INC.

7 packets received by filter, 0 packets dropped by kernel
Ending arp-scan 1.10.0: 256 hosts scanned in 1.859 seconds (137.71 hosts/sec). 1 responded
CT_NetAlertX:/# sudo arp-scan --interface=eth0 192.168.2.0/24
Interface: eth0, type: EN10MB, MAC: bc:24:11:e4:89:7b, IPv4: 192.168.1.31
Starting arp-scan 1.10.0 with 256 hosts (https://github.com/royhills/arp-scan)
192.168.2.1     c8:7f:54:47:2b:58       ASUSTek COMPUTER INC.

If you can't access your other networks from the NAX container, there are other alternatives:

1. You can use multiple NAX instances and the SYNC plugin
2. You can use suplementing plugins (e.g. the dhcp.leases or pihole plugin)

Se more detailed info here: https://github.com/jokob-sk/NetAlertX/blob/main/docs/REMOTE_NETWORKS.md

[EinKantHolz]

Thanks. Let me try the Asus plugin. Its not "finding" anything right yet. Can I specify a port for the router's url? I'm not using the standard values.
Like: 192.168.1.1:5511 or so

[EinKantHolz]

First: Thanks for your work. The plugin is great and working.
Second: The client list in ASUS routers seems to be a problem since the beginning and is badly coded. There are several issues with Home Assistant and other tools that rely on the client list. Maybe I can get some information from the YazFi support.

[EinKantHolz]

@labmonkey : I got a response from the devs of YazFi. Maybe a new feature for a new version?

Not seeing the YazFi Clients in the Network Map section is normal and expected behavior due to the nature of how that page information is generated. You will need to look at the YazFi Gui tab or look at the System Log > Wireless Log. Or use SSH and do a "cat /var/lib/misc/dnsmasq.leases" from the router. Or look at the YazFi CLI, option #2. If you want to see the connected YazFi clients.

So how about a SSH connection into the router and grabbing the dnsmasq.leases?
It works perfectly.

86400 28:c6:3f:08:25:41 192.168.1.62 PC-W_Julia 01:28:c6:3f:08:25:41
82134 64:da:a0:40:1e:dd 192.168.1.21 IS_BSHC2 ff:3a:70:bc:e3:00:02:00:00:ab:11:af:95:c1:13:8f:56:97:2d
77260 14:c9:13:f5:3a:f4 192.168.1.81 MM_LG-55UH625V 01:14:c9:13:f5:3a:f4
70605 3c:a0:67:f4:83:96 192.168.1.82 MM_SC-ALL70T *
50070 38:7a:cc:1a:2a:76 192.168.2.34 eufyCleanL60SES 01:38:7a:cc:1a:2a:76
48511 c0:91:b9:8d:23:c2 192.168.1.113 MM_Tablet-J 01:c0:91:b9:8d:23:c2
48470 fa:ca:70:d2:ba:1d 192.168.2.24 SP-Sebastian 01:fa:ca:70:d2:ba:1d
85450 d0:1b:49:98:2c:3c 192.168.1.72 SP_Julia 01:d0:1b:49:98:2c:3c
48422 9c:c8:e9:95:5b:09 192.168.2.79 * *
49048 e0:2e:0b:c7:79:f5 192.168.1.65 PC-W_ZEISS 01:e0:2e:0b:c7:79:f5
51498 bc:09:1b:f4:02:cc 192.168.1.61 PC-W_Sebastian 01:bc:09:1b:f4:02:cc
82417 f0:ee:7a:47:91:32 192.168.1.75 SP_ZEISS 01:f0:ee:7a:47:91:32

At this point, I could deactivate every other plugin and make NetAlertX fast and capacity saving.

[labmonkey]

There is a plugin for dnsmasq https://github.com/jokob-sk/NetAlertX/tree/main/front/plugins/dhcp_leases . I suppose you could have a separate cron job to grab the latest file and mount it just before the plugin triggers.

[EinKantHolz]

Man, I found a solution.
So for everyone who is struggling the same way I was > grab some beer and enjoy:

Requirements:

1. Only for ASUS routers
2. Your router needs the Merlin FW running
3. Your router needs Entware installed
4. You have guest networks modified with the YazFi plugin
5. There must be an unidirectional communication from the private network to the guest networks:
   

What is the problem?

• When using YazFi on an ASUS router, the guest clients will no longer be displayed in the regular client list
• The guests are logged somewhere else with YazFi and the networks are in an advanced mode (later more)
• The ASUS-WRT plugin by @labmonkey grabs only the clients from the client list but not the guests because they are somewhere else

Solution:

1. Enable SSH login on your asus router
2. Generate a pair of SSH keys and place them inside /root/.ssh/
3. In your router's admin-settings, paste the public key and disable "password login" for SSH
4. On your docker machine, create a script (I placed it in /home/root):

• Replace the IP if necessary
• Replace "ssh2_privateKey" and "asususer" with your keyfile and your routers login name.
• Replace /mnt/service-data/netalertx_dhcp.leases/ with your preffered save path inside the docker machine.

nano grabdnsmasq.sh

#!/bin/bash
rsync -avzh -e "ssh -i /root/.ssh/ssh2_privateKey" asususer@192.168.1.1:/var/lib/misc/dnsmasq.leases /mnt/service-data/netalertx_dhcp.leases/

5. Create a config file in /root/.ssh/:

• Again, replace the IP, the SSH key and the user and also the port if necessary

Host ASUS-GT-AXE16000
    HostName 192.168.1.1
    IdentityFile /root/.ssh/ssh2_privateKey
    IdentitiesOnly yes
    User asususer
    Port 22

6. Try a dry run with the command in step 4. If everything is fine, you should have a dnsmasq.leases file at your target point
7. Edit crontab for root:
   crontab -e

add your scheduled time and the path to your script file

*/2 * * * * /root/grabdnsmasq.sh

8. Save and reload the cron service:
   service cron reload

9. Edit the netalertx stack. I use a yaml file:

volumes:
      - /mnt/service-data/netalertx_db:/app/db
      - /mnt/service-data/netalertx/:/app/config/
      - /mnt/service-data/netalertx_dhcp.leases:/etc/dnsmasq

The third line is new and important for the next step.

10. Load the DHCPLSS plugin and add the search path: /etc/dnsmasq/dnsmasq.leases
    Configure the plugin, make a dry run and if its working, save everything.

Now grab another beer and a pizza and enjoy guest clients. I know, that the DHCP leasing time isn't a realtime tracking but its "something". I have set the DHCP leasing time for my guest networks to 1 hour (3600 seconds) whereas my DHCP leasing time for the private network is 24 hours (86400 seconds).
Everything inside the private network is an authorized device, needs a static IP or have to communicate with private clients. Inside the guest networks are my socalled "internet of shit" devices like the WiFi toilet, roomba, guest mobiles and everything that don't need access to the private clients.

fyi:
I have the file located on the Docker LXC
/mnt/service-data/netalertx_dhcp.leases/dnsmasq.leases

And the volumes are mapped into the NetAlert Container:

volumes:
      - /mnt/service-data/netalertx_db:/app/db
      - /mnt/service-data/netalertx/:/app/config/
      - /mnt/service-data/netalertx_dhcp.leases:/etc/dnsmasq

And the plugin is configured:

DHCPLSS_RUN: schedule
DHCPLSS_CMD: python3/app/front/plugins/dhcp_leases/script.py paths={paths}
DHCPLSS_paths_to_check: /etc/dnsmasq/dnsmasq.leases
DHCPLSS_RUN_SCHD: */5 * * * *
DHCPLSS_TUN_TIMEOUT: 5
DHCPLSS_WATCH: Watched_Value1, Watched_Value4
DHCPLSS_REPORT_ON: new, watched_changed

And inside the container the file can be found:

CT_NetAlertX:/# cd /etc/dnsmasq/
CT_NetAlertX:/etc/dnsmasq# ls
dnsmasq.leases
CT_NetAlertX:/etc/dnsmasq#

[jokob-sk]

Glad to hear you got it working.

Also, thank you very much for the detailed write up. I renamed the discussion as well to better reflect the use case.

I also updated teh docs for the ASUSWRT plugin and added the guide to the DHCPLSS plugin:

https://github.com/jokob-sk/NetAlertX/blob/main/front/plugins/dhcp_leases/ASUS_ROUTERS.md

[jokob-sk]

Also big thanks to @labmonkey for the tip :)