BanIP does not read logs correctly when Storage is enabled

ndrosis · October 2, 2026, 4:34pm

Hi,

I noticed a possible issue with BanIP in NethSecurity.

When Storage is enabled, BanIP does not seem to read the log file correctly, and therefore the expected bans/log processing do not work.

I found that I have to manually set the log file path from the CLI:

uci set banip.global.ban_logreadfile='/mnt/data/log/messages'
uci commit banip
/etc/init.d/banip restart

After applying the above configuration and restarting BanIP, it works as expected.

It seems that when Storage is enabled, BanIP does not automatically detect/use the correct /mnt/data/log/messages path.

Could you please confirm whether this is expected behavior or a bug?

Environment:

NethSecurity: 8.8.0
BanIP: 1.8.10
Storage: Enabled

Thanks!

Tbaile · October 5, 2026, 6:04am

Just a question, before changing the value, what was the previous one?

It should be /var/log/messages, if it is, BanIP correctly reads off the same file you have on persistent storage.

If it doesn’t work properly, maybe there’s something inside the BanIP package that needs to be adjusted

mark_nl · October 5, 2026, 6:55am

Over here think it works as expected: (anonymized output)

# grep -E 'banIP.*drop' /var/log/messages | tail -2
Oct  5 08:27:13 rt kernel: banIP/fwd-wan/drop/cinsscorev4: IN=eth0 OUT=br-lan MAC=<:::> SRC=185.218.86.25 DST=<INTERNAL_IP> LEN=52 TOS=0x00 PREC=0x20 TTL=54 ID=11378 PROTO=TCP SPT=20001 DPT=443 WINDOW=65535 RES=0x00 SYN URGP=0 MARK=0x3f00
Oct  5 08:40:24 rt kernel: banIP/fwd-wan/drop/dropv4: IN=eth0 OUT=br-lan MAC=<:::> SRC=94.154.43.100 DST=<INTERNAL_IP> LEN=44 TOS=0x00 PREC=0x00 TTL=244 ID=54321 PROTO=TCP SPT=37736 DPT=80 WINDOW=65535 RES=0x00 SYN URGP=0 MARK=0x3f00

BANip read logs with logread utility, see read me:

github.com/openwrt/packages

net/banip/README.md

master

<!-- markdownlint-disable -->

# banIP - ban incoming and outgoing IP addresses/subnets via Sets in nftables

## Table of Contents
* [Description](#description)
* [Quick Start](#quick-start)
* [Main Features](#main-features)
* [Prerequisites](#prerequisites)
* [Installation and Usage](#installation-and-usage)
* [banIP CLI interface](#banip-cli-interface)
* [banIP config options](#banip-config-options)
* [Examples](#examples)
* [Best practise and tweaks](#best-practise-and-tweaks)
* [Troubleshooting & debug options](#troubleshooting-and-debug-options)
* [Support](#support)
* [Removal](#removal)
* [Donations](#donations)

<a id="description"></a>

This file has been truncated. show original

mark_nl · October 5, 2026, 5:03pm

@ndrosis

Just because BanIP seems to work over here; does not mean there is no issue!
So don’t be discouraged to give your feedback and observations ;
they are valuable to improve Nethsecurity!

ndrosis · October 5, 2026, 5:45pm

Hi

uci show banip | grep ban_logreadfile

and there was no output.

So the UI does not create/set the ban_logreadfile option in /etc/config/banip.

Tbaile · October 6, 2026, 6:43am

I am a bit confused about this, from 1.8.0 we know we set in the file 96-nethsec-banip-extra the /var/log/messages.

This happens by uci-default so either image flash or package update doesn’t matter

Only thing I can say is to fix it and restore the correct behaviour you can either set /var/log/messages in the ban_logreadfile variable, or simply run apk add --force-reinstall ns-threat_shield so all the uci-defaults run again, addressing the issue

mark_nl · October 6, 2026, 5:33pm

This script is part of ns-threat_shield > 1.03;

To my understanding 8.8.0 was released with ns-threat_shield = 1.01 ; which does not include this script; Hope the does not add to the confusion

ndrosis · October 6, 2026, 5:43pm

I tested this on another firewall as well, running NethSecurity 8.8.0, and I can reproduce the exact same issue.

So it looks like the issue is not specific to one firewall or installation, but can be reproduced on NethSecurity 8.8.0 as well.

With NethSecurity 8.7.2, I did not have this problem.

ndrosis · October 6, 2026, 5:49pm

Hi Tballe,

I also ran the following command as suggested:

apk add --force-reinstall ns-threat_shield

Unfortunately, I did not see any difference. The issue remains exactly the same.

mark_nl · October 6, 2026, 5:52pm

@ndrosis

I am on a completely custom (arch)install so can’t check the installed ns-threat_shield version on a default setup.

what is your version of ns-threat_shield (apk info -vv | grep ns-threat_shield)

ndrosis · October 6, 2026, 5:53pm

The difference is that on the first firewall I have:

ns-threat_shield-1.0.3-r1 - Download and apply block lists

I also checked another NethSecurity 8.8.0 installation, and there I have:

ns-threat_shield-1.0.1-r1

mark_nl · October 6, 2026, 5:56pm

that should be ok:
So the 96-nethsec-banip-extra script @Tbaile mentioned is available ?:

ls /rom/etc/uci-defaults/96*

ndrosis · October 6, 2026, 6:00pm

I also checked both NethSecurity 8.8.0 installations.

On both of them, running:

ls /rom/etc/uci-defaults/96*

returns:

ls: /rom/etc/uci-defaults/96*: No such file or directory

mark_nl · October 6, 2026, 6:04pm

Sorry: I am out of options/ideas..

last one : find / -name "9*banip*"

ndrosis · October 6, 2026, 6:10pm

With ns-threat_shield-1.0.3-r1, I get:

/overlay/upper/etc/uci-defaults/95-luci-app-banip-housekeeping
/overlay/upper/etc/uci-defaults/99-nethsec-banip
/rom/etc/uci-defaults/95-luci-app-banip-housekeeping
/rom/etc/uci-defaults/99-nethsec-banip

On this installation, I had already run your command:

apk add --force-reinstall ns-threat_shield

but I did not see any difference.

With ns-threat_shield-1.0.1-r1, I get:

/overlay/upper/etc/uci-defaults/95-luci-app-banip-housekeeping
/overlay/upper/etc/uci-defaults/99-nethsec-banip
find: '/proc/16444': No such file or directory
/rom/etc/uci-defaults/95-luci-app-banip-housekeeping
/rom/etc/uci-defaults/99-nethsec-banip

So both installations have the same uci-defaults files, and both are affected by the issue.

The only additional difference I noticed is the find: '/proc/16444': No such file or directory message on the 1.0.1-r1 installation.

mark_nl · October 6, 2026, 6:16pm

Most imported finding is the script that sets ban_logreadfile ( 96-nethsec-banip-extra) is not present so I think you narrowed it down enough the dev’s can sort this out.

Tbaile · October 7, 2026, 7:31am

The uci-defaults get deleted if the execution exits with error code 0.

~~Meanwhile you’re running an outdated version of banIP, probably this is an issue that has been already addressed, please update the packages and report back!~~

Read the threatshield version instead of the banIP one, sorry!

I’ll try to find if I can reproduce the issue, I’ll start with a fresh 8.7.2 VM then I’ll try and figure out what could go wrong during updates.

If you have any other feedback, please do not hold back since it can help narrow the issue.

ndrosis · October 7, 2026, 8:54am

Firewall 1
after apk add --force-reinstall ns-threat_shield

apk info -a ns-threat_shield
ns-threat_shield-1.0.3-r1 description:
Download and apply block lists

ns-threat_shield-1.0.3-r1 webpage:

ns-threat_shield-1.0.3-r1 installed size:
14 KiB

ns-threat_shield-1.0.3-r1 depends on:
adblock>=4.5.3
jq
libc
ns-api>=3.6.2
wget-ssl

ns-threat_shield-1.0.3-r1 provides:
ns-threat_shield-any

ns-threat_shield-1.0.3-r1 is required by:

ns-threat_shield-1.0.3-r1 contains:
etc/banip/banip.nethesis.feeds
etc/uci-defaults/20_threat_shield
etc/uci-defaults/35_ns-threat_shield
etc/uci-defaults/96-nethsec-banip-extra
etc/uci-defaults/96_ns-threat_shield
etc/uci-defaults/99-nethsec-banip
lib/apk/packages/ns-threat_shield.list
usr/libexec/ts-dns-migrate-devices
usr/libexec/ns-api/post-commit/adjust-banip.py
usr/libexec/ns-api/pre-commit/configure-adblock-devices.py
usr/libexec/ns-api/pre-commit/configure-banip-wans.py
usr/sbin/ts-dns
usr/sbin/ts-ip
usr/share/ns-plug/hooks/register/80ts-ip
usr/share/ns-plug/hooks/register/90ts-dns
usr/share/ns-plug/hooks/unregister/80ts-ip
usr/share/ns-plug/hooks/unregister/90ts-dns
usr/share/threat_shield/community-dns.sources.gz
usr/share/threat_shield/nethesis-dns.sources.gz

ns-threat_shield-1.0.3-r1 triggers:

ns-threat_shield-1.0.3-r1 has auto-install rule:

ns-threat_shield-1.0.3-r1 affects auto-installation of:

ns-threat_shield-1.0.3-r1 replaces:

ns-threat_shield-1.0.3-r1 license:
GPL-3.0-only

Firewall 2

apk info -a ns-threat_shield
ns-threat_shield-1.0.1-r1 description:
Download and apply block lists

ns-threat_shield-1.0.1-r1 webpage:

ns-threat_shield-1.0.1-r1 installed size:
10 KiB

ns-threat_shield-1.0.1-r1 depends on:
adblock>=4.5.3
jq
libc
ns-api>=3.6.2
wget-ssl

ns-threat_shield-1.0.1-r1 provides:
ns-threat_shield-any

ns-threat_shield-1.0.1-r1 is required by:

ns-threat_shield-1.0.1-r1 contains:
etc/banip/banip.nethesis.feeds
etc/uci-defaults/20_threat_shield
etc/uci-defaults/35_ns-threat_shield
etc/uci-defaults/99-nethsec-banip
lib/apk/packages/ns-threat_shield.list
usr/libexec/ns-api/post-commit/adjust-banip.py
usr/libexec/ns-api/pre-commit/configure-banip-wans.py
usr/sbin/ts-dns
usr/sbin/ts-ip
usr/share/ns-plug/hooks/register/80ts-ip
usr/share/ns-plug/hooks/register/90ts-dns
usr/share/ns-plug/hooks/unregister/80ts-ip
usr/share/ns-plug/hooks/unregister/90ts-dns
usr/share/threat_shield/community-dns.sources.gz
usr/share/threat_shield/nethesis-dns.sources.gz

ns-threat_shield-1.0.1-r1 triggers:

ns-threat_shield-1.0.1-r1 has auto-install rule:

ns-threat_shield-1.0.1-r1 affects auto-installation of:

ns-threat_shield-1.0.1-r1 replaces:

ns-threat_shield-1.0.1-r1 license:
GPL-3.0-only

ns-threat_shield-1.0.3-r1 description:
Download and apply block lists