Skynet Is default firewall good enough?

[Viktor Jaep]

Do you think it would be ok to just run trend and forget skynet? Or are you saying it's a false speed check reading on the router side, just due to cpu usage.

Depends on your mission? Not sure how AIprotect stacks up against the multitudes of malware blacklists out there that skynet is able to make use of... but this is one of the biggest reasons I use skynet exactly for that reason. Outbound blacklists, and also outbound country blacklists to prevent data leakage to foreign nation states that don't need more of our data.

 

[John Fitzgerald]

Do you think it would be ok to just run trend and forget skynet? Or are you saying it's a false speed check reading on the router side, just due to cpu usage.

FYI do not update Skynet, stay on 7.2.8.

 

[Tech9]

Do you think it would be ok to just run trend and forget skynet?

My opinion is still unchanged - very few home router users need Skynet and it does very little in most cases. Very small fraction of what it shows blocked inbound is actually blocked because Skynet was installed. If you want it running - run outbound as well. At least it will be doing something more.

FYI do not update Skynet, stay on 7.2.8.

Relying on community blocklists and maintenance needs/issues on top. Quote above for an example.

 

[SomeWhereOverTheRainBow]

Do you think it would be ok to just run trend and forget skynet? Or are you saying it's a false speed check reading on the router side, just due to cpu usage.

It's a bad read relying on speed test done via the router when trend micro engine is active in combination with skynet outbound traffic blocked. It is due to the fact trendmicro is making the router local traffic pass through cpu versus if it were traversing via hardware acceleration. Client speed test result should be close to unaffected.

 

[SomeWhereOverTheRainBow]

My opinion is still unchanged - very few home router users need Skynet and it does very little in most cases. Very small fraction of what it shows blocked inbound is actually blocked because Skynet was installed. If you want it running - run outbound as well. At least it will be doing something more.



Relying on community blocklists and maintenance needs/issues on top. Quote above for an example.

I would only use it if I was considering opening ports on the router or if I had a heavy amount of outbound traffic I couldn't easily monitor.

 

[Mogsy]

FYI do not update Skynet, stay on 7.2.8.

It is 7.3.4 now. 2nd update for today? What was wrong with it

 

[XIII]

It is 7.3.4 now. 2nd update for today? What was wrong with it

Maybe experts can tell from this?

v7.3.4 · Adamm00/IPSet_ASUS@b37b2fe

Reduce /jffs/configs/dnsmasq.conf.add size for edge cases

github.com

(Something with quotes and a number argument?)

 

[BreakingDad]

Decided to leave it on, the speed "loss" (if any as explained above) is negligible for the peace of mind offered, and the ruleset I have in place.

Thank you team, keep up the good work

 

[Mogsy]

Maybe experts can tell from this?

v7.3.4 · Adamm00/IPSet_ASUS@b37b2fe

Reduce /jffs/configs/dnsmasq.conf.add size for edge cases

github.com

(Something with quotes and a number argument?)

Not a clue Will wait for changelog

 

[dave14305]

Maybe experts can tell from this?

v7.3.4 · Adamm00/IPSet_ASUS@b37b2fe

Reduce /jffs/configs/dnsmasq.conf.add size for edge cases

github.com

(Something with quotes and a number argument?)

Extra large whitelists with longer than average domain names were breaking dnsmasq.

 

[SomeWhereOverTheRainBow]

Maybe experts can tell from this?

v7.3.4 · Adamm00/IPSet_ASUS@b37b2fe

Reduce /jffs/configs/dnsmasq.conf.add size for edge cases

github.com

(Something with quotes and a number argument?)

Sounds like you should request for an expert more often!

Extra large whitelists with longer than average domain names were breaking dnsmasq.

@dave14305 will respond. (still retired?)

 

[SomeWhereOverTheRainBow]

Decided to leave it on, the speed "loss" (if any as explained above) is negligible for the peace of mind offered, and the ruleset I have in place.

Thank you team, keep up the good work

I use to feel the same way until I switched to gig-speed tried out RTRMON.

 

[Viktor Jaep]

I use to feel the same way until I switched to gig-speed tried out RTRMON.

Lol! Definitely not the same as Gig speed!

 

[BreakingDad]

I use to feel the same way until I switched to gig-speed tried out RTRMON.

It was not an issue on 500 speed,always maxed out. I have tried RTRMON, I passed all the tests (after running a few bits of code suggested to get some of them working properley on the thread), might have another play. I tend to go for minimal addons as I think the more you add the router gets bloated.

 

[Mister2088]

Firstly, Happy New Year!
With this latest Skynet issue (stupid me upgraded), I lost all connections and did a router reset and restore (probably was due anyway).
Due to this and the fact that:
1. I have seen like 1 or 2 blocks (suspect mind you) outbound over the past 6 months
2. The firewall does a great job blocking unsolicited traffic
3. I am not sure if people have noticed or not, Firehol core lists (spamhaus, dshield, feodo) are not current any longer. e.g. spamhaus is almost 4 weeks old while source file is current. I had opened up an issue in firehol's github, but no response. Loks like Firehol probably has issues with their ingestion .sh code.

I have decided to do away with Skynet.

Perhaps I'll revisit one day. Thanks @Adamm for your code.

 

[L&LD]

None of the above would be reason enough for me to drop Skynet.

 

[SomeWhereOverTheRainBow]

Firstly, Happy New Year!
With this latest Skynet issue (stupid me upgraded), I lost all connections and did a router reset and restore (probably was due anyway).
Due to this and the fact that:
1. I have seen like 1 or 2 blocks (suspect mind you) outbound over the past 6 months
2. The firewall does a great job blocking unsolicited traffic
3. I am not sure if people have noticed or not, Firehol core lists (spamhaus, dshield, feodo) are not current any longer. e.g. spamhaus is almost 4 weeks old while source file is current. I had opened up an issue in firehol's github, but no response. Loks like Firehol probably has issues with their ingestion .sh code.

I have decided to do away with Skynet.

Perhaps I'll revisit one day. Thanks @Adamm for your code.

I guess that is why @Adamm added a feature to where you can change the filter lists you use.

I made my own filterlist on github and then uploaded it via skynet menu options. I took into consideration source files and what not for this specific reason

 

[Mister2088]

I guess that is why @Adamm added a feature to where you can change the filter lists you use.

I made my own filterlist on github and then uploaded it via skynet menu options. I took into consideration source files and what not for this specific reason

That is what I did. I used a conservative approach to only use actively maintained lists. They included (from firehol): bds_atif, dshield, greensnow, cybercrime, dyndns_ponmocup, spamhaus_drop and spamhaus_edrop. I also recently added in the feodo tracker C2 list (https://feodotracker.abuse.ch/downloads/ipblocklist_recommended.txt).

The issue is that dshield and spamhaus_drop lists have not been updated in firehol in several weeks. I have no desire to write my own code to translate the source files into useful formats.

Anyway, I would go back if I could get a good list (like above) that have low false-positives. I mainly want it for outbound (to perhaps catch things quad9 would not via gaming machines like Ps4/5) as inbound is handled by router's firewall.

Question: As I had uninstalled skynet, is 7.3.4 now fixed? Or can I force the installation to use 7.2.8?

Thanks in advance.

 

[Mister2088]

The source list of spamhaus_drop is directly compatible with Skynet so you can simply replace

https://iplists.firehol.org/files/spamhaus_drop.netset

with

https://www.spamhaus.org/drop/drop.txt

in your custom filter list.


To answer your other question, yes, Skynet 7.3.4 is now fixed and it's safe for installation again.

Thanks!
I did not know how skynet would handle commented texts using the semicolon, as I usually see # being used.

So by chance, when/if I reinstall and it breaks dnsmasq again, is it as easy as below to fix:
Remove the last couple of lines in dnsmasq.conf.add, that starts with 'ipset', then restart dnsmasq and reboot ? Is there anything else to change?

 

[UoFruitE]

Thanks!
I did not know how skynet would handle commented texts using the semicolon, as I usually see # being used.

So by chance, when/if I reinstall and it breaks dnsmasq again, is it as easy as below to fix:
Remove the last couple of lines in dnsmasq.conf.add, that starts with 'ipset', then restart dnsmasq and reboot ? Is there anything else to change?

You are correct that Skynet is unable to handle semicolon so my information is incorrect and I have deleted my previous post as a result.

As for your fix, I believe that should be all you need to do in case something goes wrong but I am pretty sure 7.3.4 already fixed the edge case of dnsmasq.