Skynet Skynet - Router Firewall & Security Enhancements

[Dill]

Hi,

is there any possibility to check from which private LAN IP the OUTBOUND requests are coming?

edit: I found it under 'search'

But could somebody explain, what exactly this is meaning:

Apr 16 02:42:44 kernel: [BLOCKED - OUTBOUND] IN= OUT=eth0 SRC=192.168.0.2 DST=118.89.110.78 LEN=60 TOS=0x00 PREC=0x00 TTL=64 ID=41705 DF PROTO=TCP SPT=35931 DPT=443 SEQ=2511253707 ACK=0 WINDOW=5840 RES=0x00 SYN URGP=0 OPT


Is it right, if I think that something from the Host 192.168.0.2 is trying to contact the IP 118.89.110.78 over the port 443?

Thanks

 

[Wisiwyg]

118.89.110.78

Tencent Cloud Computing
Beijing, China

 

[Adamm]

is there any possibility to check from which private LAN IP the OUTBOUND requests are coming?

Yes, check the SRC field.

Is it right, if I think that something from the Host 192.168.0.2 is trying to contact the IP 118.89.110.78 over the port 443?

Correct, most likely a dodgy website that was blocked (port 443 is HTTPS traffic). You can find out all the information Skynet has gathered via;

sh /jffs/scripts/firewall stats search ip 118.89.110.78

 

[Swistheater]

so i wanted to turn on Respond ICMP Echo (ping) Request from WAN for a little bit, i rebooted my router and notice the internet was saying it was active but i could not load anything. i turned off skynet and internet started to work again. do these two features not play nicely with each other?

 

[EmeraldDeer]

so i wanted to turn on Respond ICMP Echo (ping) Request from WAN for a little bit, i rebooted my router and notice the internet was saying it was active but i could not load anything. i turned off skynet and internet started to work again. do these two features not play nicely with each other?

I enabled ICMPv4 via Firewall > General > "Respond ICMP Echo (ping) Request from WAN" and did not experience a problem with Skynet or anything else

 

[Swistheater]

I enabled ICMPv4 via Firewall > General > "Respond ICMP Echo (ping) Request from WAN" and did not experience a problem with Skynet or anything else

No issues after rebooting with it on?

 

[EmeraldDeer]

No issues after rebooting with it on?

Just rebooted now to be sure and everything's fine.

Well, except for having "1 Risk" from the "AiProtection Router Security Assessment"

"Disable PING from WAN to avoid cracker can connect to router from external network" Who you callin' cracker?

 

[Adamm]

so i wanted to turn on Respond ICMP Echo (ping) Request from WAN for a little bit, i rebooted my router and notice the internet was saying it was active but i could not load anything. i turned off skynet and internet started to work again. do these two features not play nicely with each other?

There's no reason this setting should effect Skynet at all. IIRC its just a simple iptables rule.

 

[paulad]

There's no reason this setting should effect Skynet at all. IIRC its just a simple iptables rule.

after skynet turn on. skynet blocked https://secure01b.chase.com

cant log in to online bank account.

after temp offline skynet. online bank is working

 

[Swistheater]

after skynet turn on. skynet blocked https://secure01b.chase.com

cant log in to online bank account.

after temp offline skynet. online bank is working

that is what white list is for

 

[paulad]

that is what white list is for

I tried whitelist www.chase.com but still not working

 

[Swistheater]

try the specific address https://secure01b.chase.com

 

[paulad]

try the specific address https://secure01b.chase.com

the specific address will change every time you login. like secure01b 02b 07b

 

[Swistheater]

you will also have to unban it too

 

[Swistheater]

you can look at your logs and see if you can find out the ip address that was used for the site when it got banned and whitelist the ip address

 

[paulad]

you can look at your logs and see if you can find out the ip address that was used for the site when it got banned and whitelist the ip address

why would they ban chase.com? it just happen today

 

[Swistheater]

yea i tested it myself too. it banned it lol

 

[Swistheater]

it is official it is blocking JP. Morgan.Chase i did an IP look up
159.53.232.19

 

[paulad]

it is official it is blocking JP. Morgan.Chase i did an IP look up
159.53.232.19

I did a unban : secure01b.chase.com

and it works. thx!

 

[Adamm]

after skynet turn on. skynet blocked https://secure01b.chase.com

cant log in to online bank account.

after temp offline skynet. online bank is working

https://www.snbforums.com/threads/r...wall-security-enhancements.16798/#post-115872