Skynet Skynet - Router Firewall & Security Enhancements

[timonoj]

Hi...How can you check the existing URLs in the blacklist? I"m trying to see which URLs I have blacklisted myself, to see if I need to remove any. Thanks!

 

[Adamm]

Hi...How can you check the existing URLs in the blacklist? I"m trying to see which URLs I have blacklisted myself, to see if I need to remove any. Thanks!

sh /jffs/scripts/firewall stats search manualbans

You can also add a number at the end of the command to change the top x output to a number of your choosing.

 

[timonoj]

Thanks! Just read a bit more, mentioning this is an addon to the official Asus firewall. This means that it also has the same lack of HTTPS site blocking, is this correct?

Thanks for your help!

 

[Adamm]

Thanks! Just read a bit more, mentioning this is an addon to the official Asus firewall. This means that it also has the same lack of HTTPS site blocking, is this correct?

Thanks for your help!

Negative. This is IP based blocking so it will catch traffic on any port.

 

[Adamm]

So an update for AC86U users:

The old fork() errors seem to have been corrected by Asus, but there's a new error which is proving frustrating to get around and debug, so I will be holding off on updates until we can get that resolved within the firmware.

In good news, the CPU performance on this thing is better then expected. x3 the speed on most functions compared to my old AC68U. Things like banmalware have dropped from 45s > 14s, saving from 7s > 2s.

So hopefully we can get this last issue resolved in the near future so I can push out the speed improvements accordingly, then potentially put this extra CPU power to use as "runtime" won't be a big factor in the decision making process anymore.

 

[DonnyJohnny]

So an update for AC86U users:

The old fork() errors seem to have been corrected by Asus, but there's a new error which is proving frustrating to get around and debug, so I will be holding off on updates until we can get that resolved within the firmware.

In good news, the CPU performance on this thing is better then expected. x3 the speed on most functions compared to my old AC68U. Things like banmalware have dropped from 45s > 14s, saving from 7s > 2s.

So hopefully we can get this last issue resolved in the near future so I can push out the speed improvements accordingly, then potentially put this extra CPU power to use as "runtime" won't be a big factor in the decision making process anymore.

Tempting...

 

[XIII]

SkyNet is blocking updates for my virus scanner, Emsisoft Anti-Malware.

Somehow 205.185.216.42, which is the IP of cdn.emsisoft.com, is in the BanMalware blacklist?

Why?

(Adding cdn.emsisoft.com to the whitelist enabled EAM updates)

 

[RMerlin]

Possibly because something else that's malicious shares either the sane subnet, or the same IP (that IP belongs to a CDN, it's not owned by Emsisoft themselves).

 

[XIII]

Ah. Does SkyNet support wildcards?

They asked me to whitelist *.emsisoft.com, but I don't see any entries with a "*" in the whitelist.

 

[Adamm]

Ah. Does SkyNet support wildcards?

They asked me to whitelist *.emsisoft.com, but I don't see any entries with a "*" in the whitelist.

Unfortunately not, as Skynet resolves addresses and blocks their IP's directly, the website ban/unban feature is simply Skynet doing the heavy lifting for the user. As Merlin said its probably something else on the same CDN which was the intention of the block, you can unban it via this guide

 

[XIII]

Hm. A lot more is being blocked (Netatmo Health Home Coach and Belkin Wemo cannot reach their servers to check for firmware updates; several local shops unreachable).

Need to investigate this after work...

 

[DonnyJohnny]

Some list may be old and obsolete. You may want to search the IP blocked in the bannalware. See which list contain those blocked IP.
Custom the filter list by removing that particular ipset list.

Alternatively is you can feedback to the maintainer of the ipset list. You can find them here. https://iplists.firehol.org/

 

[XIII]

you can unban it via this guide

As soon as I performed (only) the first 2 steps from that guide all sites open properly...

When I turn off debugging they fail; when I turn it on they work...

 

[DonnyJohnny]

As soon as I performed (only) the first 2 steps from that guide all sites open properly...

When I turn off debugging they fail; when I turn it on they work...

Did u wait a while when you are in vanilla mode? Coz the Skynet may not be loaded properly. Even if u switched off debug, the whitelist should still be there.. have u try listing out the whitelist in vanilla mode? Try adding the whitelist again?

However this could be a bug for Adamm to check.. if added in debug then switch back vanilla whitelist gone?

 

[XIII]

As I said I performed only the first 2 steps:

sh /jffs/scripts/firewall install
sh /jffs/scripts/firewall debug watch

So I did not even add anything to the whitelist...

 

[DonnyJohnny]

I suspect it work properly coz when u did the debug installation, while the Skynet will take around 1-2min to load you. You did your testing on those websites... it will go thru as Skynet not complete its loading.

The idea of debug is to see dropped ip . U should see those ip blocked log when u enter the website.

 

[XIII]

it will go thru as Skynet not complete its loading.

How do I know it did (not) finish loading?

 

[DonnyJohnny]

https://github.com/Adamm00/IPSet_ASUS/wiki#lock-file-detected
You will see file lock during enter into Skynet. But generally it should be done loading after 1 min or 2. So if u want to confirm again.. after each switch of installation mode, wait 1-2 min before testing

 

[XIII]

I tried. Sites are indeed blocked after a couple of minutes.

So far all the problematic sites seem to be (on) CDN's. I'm rather surprised to see that the local webshop is running on a Google CDN and has the same IP address 216.239.34.21 as virustotal.com (which is blocked by SkyNet):

add Blacklist 216.239.34.21 comment "BanMalware"

 

[XIII]

Alternatively is you can feedback to the maintainer of the ipset list. You can find them here. https://iplists.firehol.org/

I'm a bit overwhelmed by that site. How can I investigate IP 216.239.34.21 on it?