Skynet Am I blocking hacking attempts?

[cc666]

This is continuous on my GT-BE-98PRO log, every few seconds.

Jan 23 10:00:10 kernel: [BLOCKED - INBOUND] IN=vlan4094 OUT= (followed by a mac address)

Is this an external hack attempt being blocked?

CC

 

[ColinTaylor]

Is this an external hack attempt being blocked?

Impossible to say without seeing the source address(es) and knowing the port. Probably just port scanning.

Is vlan4094 your WAN interface?

 

[cc666]

Impossible to say without seeing the source address(es) and knowing the port. Probably just port scanning.

Is vlan4094 your WAN interface?

That VLAN is a hardwire to an LG TV with a firestick. I have another VLAN hardwired to another LG TV with a firestick that is clean, no blocks.

Here is more info:

Jan 23 10:00:09 kernel: [BLOCKED - INBOUND] IN=vlan4094 OUT= MAC=xxxxxxxxxxxxx SRC=78.128.114.130 DST=ROUTER IP ADDRESS)( LEN=40 TOS=0x00 PREC=0x00 TTL=241 ID=26759 PROTO=TCP SPT=57643 DPT=33333 SEQ=2660700893 ACK=0 WINDOW=1024 RES=0x00 SYN URGP=0

CC

 

[ColinTaylor]

Looks like normal port scanning. Do you see scans from other IP addresses? Perhaps you are you blocking Bulgaria in Skynet?

https://www.abuseipdb.com/check/78.128.114.130

 

[cc666]

Looks like normal port scanning. Do you see scans from other IP addresses? Perhaps you are you blocking Bulgaria in Skynet?

https://www.abuseipdb.com/check/78.128.114.130

When I check the ip address 78.128.114.130 I get this: Other search results also indicate as malicious.

CC

 

[ColinTaylor]

When I check the ip address 78.128.114.130 I get this: Other search results also indicate as malicious.


View attachment 70043

CC

Like I said, that's normal port scanning. Nothing that's specifically targeting you. If you didn't have Skynet installed your router's built-in firewall would have dropped the traffic.

 

[cc666]

Like I said, that's normal port scanning. Nothing that's specifically targeting you. If you didn't have Skynet installed your router's built-in firewall would have dropped the traffic.

Got it, I guess I can change the log level so it doen't flood the log?

CC

 

[ColinTaylor]

Got it, I guess I can change the log level so it doen't flood the log?

This is a Skynet message so that's where you should look for logging options. I don't use Skynet myself so don't know whether you can turn off specific types of message or whether you have to turn them all off.

 

[Tech9]

Got it, I guess I can change the log level so it doen't flood the log?

If you change the default log level Skynet logging won't work. What you see is "the Skynet effect". With firewall logging enabled you just see the noise. If you don't understand what is happening it makes you think you are under attack. If you don't run any open to Internet services you don't need Skynet. Even if you do run open to Internet services Skynet with community maintained blocklists is unlikely to prevent real attack.

 

[visortgw]

Got it, I guess I can change the log level so it doen't flood the log?

CC

Or, use scribe (available via amtm), which filters skynet messages to a separate log file.

 

[cc666]

If you change the default log level Skynet logging won't work. What you see is "the Skynet effect". With firewall logging enabled you just see the noise. If you don't understand what is happening it makes you think you are under attack. If you don't run any open to Internet services you don't need Skynet. Even if you do run open to Internet services Skynet with community maintained blocklists is unlikely to prevent real attack.

So Skynet is useless in my case? I do not run any services internet services.

CC

 

[ColinTaylor]

So Skynet is useless in my case? I do not run any services internet services.

Correct. Unless perhaps you don't trust devices/people on your LAN and want something that blocks outgoing connections. Personally (for my use case) I regard Skynet as a waste of time.

 

[Tech9]

So Skynet is useless in my case?

Useful in case you want to limit your own access to something. Skynet is an IP-blocker. The built-in firewall blocks all unsolicited connections by default. You are going to get the same noise in logs if you enable blocked packets logging in Firewall GUI section without Skynet. The reality - Skynet and AiPtotection did not stop any of the recent Asuswrt hacks. You understand community maintained blocklists are visible to hackers as well.

 

[cc666]

Correct. Unless perhaps you don't trust devices/people on your LAN and want something that blocks outgoing connections. Personally (for my use case) I regard Skynet as a waste of time.

Got it TY

CC

 

[Tech9]

You perhaps don't need any scripts and USB sticks at all. Your Diversion is DNS-blocker and upstream filtering DNS services like AdGuard DNS do exactly the same thing. You even have it as preset in Asuswrt.

 

[cc666]

You perhaps don't need any scripts and USB sticks at all. Your Diversion is DNS-blocker and upstream filtering DNS services like AdGuard DNS do exactly the same thing. You even have it as preset in Asuswrt.

With Adguard's ties to Russia I pass on that DNS. IMO not advisable.

CC

 

[Tech9]

If you want to make your tech related decisions based on politics - the developers of Entware are Russian. It's needed for your Diversion. You have it installed on your router voluntarily. Congratulations.

 

[cc666]

If you want to make your tech related decisions based on politics - the developers of Entware are Russian. It's needed for your Diversion. You have it installed on your router voluntarily. Congratulations.

I din't realize that! Now I have to reconsider. Is there any other way to get the results without dealing with the possibility of back doors from Russin programmers?

CC

 

[Tech9]

Well... you need to figure it out. You may want to remove Asuswrt-Merlin firmware as well since at least one Russian developer is involved and for years. Netgear with 3rd party firmware is also not an option for you as the developer is also Russian. And don't forget Google is watching you, Sergey Brin... born in Moscow.

 

[cc666]

Well... you need to figure it out. You may want to remove Asuswrt-Merlin firmware as well since at least one Russian developer is involved and for years. Netgear with 3rd party firmware is also not an option for you as the developer is also Russian. They are everywhere and even one was helping ASUS to fix the consequences of recent malware attack... so probably there is Russian link at ASUS as well. And don't forget Google is watching you, Sergey Brin... born in Moscow.

I get it, do you use these scripts with entware?

For the record, I fully trust Merlin Firmware.

CC