Skynet Skynet does not fully enforce stealth mode on WAN (ports 80 & 443 show as CLOSED)

[BeachGuy]

I’m running ASUS GT-AX6000 with latest MerlinWRT, and have Skynet, Diversion, and Unbound installed.

I ran a GRC ShieldsUP! scan on ports 0–1055 and noticed the following:

0 Ports Open
2 Ports Closed (80, 443)
1054 Ports Stealth
TruStealth: FAILED (because not all ports are stealth)

Full report:

• All ports except 80 and 443 are stealth.
• No unsolicited packets.
• No ping reply (ICMP blocked).

This means the router is replying TCP RST (closed) on ports 80 and 443 to WAN scans, instead of dropping silently. Remote web GUI is disabled for WAN (I only access the UI from LAN on HTTPS port 8443).

---

Question:
Should Skynet enforce DROP (stealth) on WAN for all unused ports (including 80 and 443) when remote access is off? Or is this behavior coming from the stock ASUS firewall?


Would it make sense to add an option in Skynet to ensure full TruStealth mode by default?


Thanks!

 

[dave14305]

GRC ShieldsUp would not be considered a malware site or IP for Skynet to block. I would expect your ISP is blocking those 2 ports before they reach your router.

 

[BeachGuy]

Tcpdump capture while running ShieldsUP:

tcpdump -i eth0 port 80 or port 443
...
# only outgoing connections captured, examples:
16:07:08.423191 IP www.grc.com.https > MY_ROUTER: Flags [S.] ...
16:07:08.423763 IP MY_ROUTER > www.grc.com.https: Flags [.]
# no incoming SYN packets from GRC IPs on port 80/443

Interpretation:

• No incoming ShieldsUP SYNs captured → packets never reach the router.
• Outgoing connections are normal HTTPS traffic.
• Suggests ISP is filtering ports 80/443 upstream.

Request:
Can Skynet/Diversion confirm that no internal rules would block ShieldsUP?
Or is this fully due to ISP-level filtering?

Thanks for any guidance.

 

[dave14305]

For comparison, I ran this capture and saw plenty of 80 and 443 attempts to my public IP. My ISP doesn't block it, so it came up Stealth.

tcpdump -nvpi eth0 src net 4.79.142.192/28 and \( dst port 80 or dst port 443 \)

Can Skynet/Diversion confirm that no internal rules would block ShieldsUP?

What do you mean?

 

[BeachGuy]

ISP must be blocking. Thanks!