Skynet SKyNet blocking traceroute

[sbsnb]

Been using Skynet for years, but this morning it started blocking outgoing traceroute packets. Not sure how to fix that. There used to be a way to see which list or rule was responsible for blocking something, but now I can't find any reference to that command.

 

[sbsnb]

I think it's a bad CIDR for private IP addresses somewhere in Skynet. Traceroute works for most domains, but if it's a domain that resolves to the 192.124.249.0/24 IP block Skynet blocks it even though it's a valid public IP range.

 

[sbsnb]

IP is whitelisted in Alien Vault.

LevelBlue - Open Threat Exchange

Learn about the latest cyber threats. Research, collaborate, and share threat intelligence in real time. Protect yourself and the community against today's emerging threats.

otx.alienvault.com

 

[dave14305]

That doesn’t matter, it’s explicitly blacklisted in firehol_level3, at least as of today:

https://github.com/firehol/blocklist-ipsets/blob/23f52ef8eadd0ce729018647c328f65406fa5c7b/firehol_level3.netset#L15139

 

[sbsnb]

I used to be able to find out from a Skynet command which blocklist was responsible for blocking an IP, but I can't seem to find that anymore. How does one go figuring that out these days?

 

[sbsnb]

Found it. firewall stats search malware 192.124.249.68

 

[EmeraldDeer]

As I just posted in another thread, I removed firehol_level3 from my Skynet and have never looked back because of false positives.

firewall banmalware exclude firehol_level3.netset