Can't access certain website due to Skynet

[TruongTieuPham]

I can't access catbox.moe due to Skynet, but the weird thing is Skynet not block it, I even added it to whitelist, here is the logs:

Warning: 108.181.20.35 is in set Skynet-Whitelist.
108.181.20.35 is NOT in set Skynet-Blacklist.
108.181.20.35 is NOT in set Skynet-BlockedRanges.

Whitelist Reason;
108.181.20.35 "ManualWlistD: catbox.moe"


Associated Domain(s);
catbox.moe
files.catbox.moe


IP Location - United States (AS40676 / AS40676)
--*
108.181.20.35 First Tracked On
108.181.20.35 Last Tracked On
0 Blocks Total

Event Log Entries From 108.181.20.35;
May 15 04:23:55 Skynet: [Manual Whitelist] TYPE=Domain SRC=108.181.20.35 Host=catbox.mo

I can access the website when restart Skynet, temporary disable Skynet won't work thou.
Hope someone can give me some answers about this problem.

 

[Adamm]

Skynet logs every IP it blocks if logging is enabled, there is never an exception to this rule. If there are no logs, Skynet isn't the cause of your issues.

Application.exe or Website.com Is Blocked​

Don't worry, tracking down false positive bans was at the core of design. Generally speaking you can follow these steps to find (and whitelist) anything incorrectly on your Blacklist!

1. Enable Logging;

sh /jffs/scripts/firewall settings logmode enable

1. Open the blocked application/website and use the command;

sh /jffs/scripts/firewall debug watch

1. Now look for a flood of [BLOCKED - OUTBOUND] coming from the same IP. This most likely will be the IP you are looking for if its being spammed in large numbers.

1. Copy the IP following "DST=" it should look something like this;

DST=175.115.37.52

1. Double check the IP is not actually something that should be banned, use a search tool like alienvault. If its related to a domain additional "Associated Domain" information should be printed beneath the log.

LevelBlue - Open Threat Exchange

Learn about the latest cyber threats. Research, collaborate, and share threat intelligence in real time. Protect yourself and the community against today's emerging threats.

otx.alienvault.com

1. Great we have confirmed we found the IP of the blocked website/application we are looking for, lets whitelist it!

sh /jffs/scripts/firewall whitelist ip 175.115.37.52

But it looks like another IP that this domain uses is blacklisted

skynet@GT-BE98-38A4:/tmp/home/root# firewall stats search ip 108.181.20.35
#!/bin/sh
#############################################################################################################
# #
# ███████╗██╗ ██╗██╗ ██╗███╗ ██╗███████╗████████╗ #
# ██╔════╝██║ ██╔╝╚██╗ ██╔╝████╗ ██║██╔════╝╚══██╔══╝ #
# ███████╗█████╔╝ ╚████╔╝ ██╔██╗ ██║█████╗ ██║ #
# ╚════██║██╔═██╗ ╚██╔╝ ██║╚██╗██║██╔══╝ ██║ #
# ███████║██║ ██╗ ██║ ██║ ╚████║███████╗ ██║ #
# ╚══════╝╚═╝ ╚═╝ ╚═╝ ╚═╝ ╚═══╝╚══════╝ ╚═╝ #
# #
# Router Firewall And Security Enhancements #
# By Adamm - https://github.com/Adamm00/IPSet_ASUS #
# 15/05/2025 - v8.0.0 BETA #
#############################################################################################################



=============================================================================================================


Logging Data Detected in /tmp/mnt/USB/skynet/skynet.log - 2.3M
Monitoring From May 14 19:00:04 To May 15 20:02:52
8262 Block Events Detected
2667 Unique IPs
0 Manual Bans Issued

108.181.20.35 is NOT in set Skynet-Whitelist.
Warning: 108.181.20.35 is in set Skynet-Blacklist.
108.181.20.35 is NOT in set Skynet-BlockedRanges.

Ban Reasons;
BanMalware: firehol_level3.netset

 

[TruongTieuPham]

I tried debug watch but catbox.moe does not appear.
When I tried to ping it, I got Request timed out. On browser, it's "This sited can't be reached, took too long to respond."

From logs, I don't think that Skynet is block the website but weirdly that I can access the website if I access it when I restart Skynet, but after Skynet completed loading the website can't be access again.

Maybe I will try to reinstall Skynet.

 

[Ripshod]

@TruongTieuPham which blocklist are you using?

 

[TruongTieuPham]

@TruongTieuPham which blocklist are you using?

Sr for late reply, was a little busy.

Here is my blocklists:

bds_atif.ipset
cybercrime.ipset
dyndns_ponmocup.ipset
et_block.netset
et_compromised.ipset
firehol_level2.netset
firehol_level3.netset
spamhaus_drop.netset

 

[TruongTieuPham]

So I tried uninstalling and reinstalling Skynet to see if it would fix the problem.
When Skynet was uninstalled, I could access catbox.moe normally.

After reinstalling, I confirmed that catbox.moe was on the blocklist, so I unbanned it.
Then I was able to access the website for a little while, but the issue came back.

I tried using tracert to see if I could figure something out, and I noticed that from the second hop, which usually goes to the ISP gateway, now continuously returns "Request timed out."

I don't know how Skynet is affecting my access to catbox.moe. It's also the only website I'm having trouble with.

 

[Adamm]

So I tried uninstalling and reinstalling Skynet to see if it would fix the problem.
When Skynet was uninstalled, I could access catbox.moe normally.

After reinstalling, I confirmed that catbox.moe was on the blocklist, so I unbanned it.
Then I was able to access the website for a little while, but the issue came back.

I tried using tracert to see if I could figure something out, and I noticed that from the second hop, which usually goes to the ISP gateway, now continuously returns "Request timed out."

I don't know how Skynet is affecting my access to catbox.moe. It's also the only website I'm having trouble with.

Your making this much harder then it needs to be, if you follow the logging steps provided skynet will show you exactly what is being blocked in a few simple commands.

 

[TruongTieuPham]

Your making this much harder then it needs to be, if you follow the logging steps provided skynet will show you exactly what is being blocked in a few simple commands.

I did follow logging steps.

After reinstall Skynet, there is indeed an outbound block for catbox.moe in the logs, I did copy the IP then unban it and can access the website for a few mins, then the problem come.

To make it more clear here is the video to show my problem: https://streamable.com/498oqd

 

[Adamm]

I did follow logging steps.

After reinstall Skynet, there is indeed an outbound block for catbox.moe in the logs, I did copy the IP then unban it and can access the website for a few mins, then the problem come.

To make it more clear here is the video to show my problem: https://streamable.com/498oqd

Skynet logs every packet it blocks, there is no exception to this rule or way to get around it. I think there is a coincidence in timing as the firewall service gets restarted when Skynet is uninstalled. Does the same occur when you simply disable skynet or unban all IP's?

 

[dave14305]

VPN Routing Addon was visible in amtm in your video. How is that configured?

 

[Lexx007]

Skynet logs every IP it blocks if logging is enabled, there is never an exception to this rule. If there are no logs, Skynet isn't the cause of your issues.





But it looks like another IP that this domain uses is blacklisted

Is the beta version of skynet public?

 

[TruongTieuPham]

Skynet logs every packet it blocks, there is no exception to this rule or way to get around it. I think there is a coincidence in timing as the firewall service gets restarted when Skynet is uninstalled. Does the same occur when you simply disable skynet or unban all IP's?

I tried Temporary disable skynet and Unban all IP sadly still can't fix the problem. When I restarted Skynet I can access catbox.moe for around 10 mins then the problem comeback.

VPN Routing Addon was visible in amtm in your video. How is that configured?

It was configured for two opvn clients, but catbox.moe was not added to any policy.

 

[Adamm]

I tried Temporary disable skynet and Unban all IP sadly still can't fix the problem. When I restarted Skynet I can access catbox.moe for around 10 mins then the problem comeback.



It was configured for two opvn clients, but catbox.moe was not added to any policy.

Based on this I can confirm Skynet isn’t causing your issues, it’s one of the other addons you have installed or a misconfiguration elsewhere.

Is the beta version of skynet public?

I was wondering if anyone would pick up on that … Skynet is currently undergoing a major refactor, all functions are being rewritten and evaluated where applicable. There will be an announcement in the coming weeks/months once I am happy with the progress.

 

[thelonelycoder]

Based on this I can confirm Skynet isn’t causing your issues, it’s one of the other addons you have installed or a misconfiguration elsewhere.



I was wondering if anyone would pick up on that … Skynet is currently undergoing a major refactor, all functions are being rewritten and evaluated where applicable. There will be an announcement in the coming weeks/months once I am happy with the progress.

Does that include the simplification of detecting the swap file I suggested years ago?

[ -f "$1/myswap.swp" ] && swapon $1/myswap.swp # Swap file created by ....

 

[BreakingDad]

Has anyone else ever wondered if @Adamm really looks like his Avatar? (or am I weird? - no don't answer that, we're all weird here right?)