Sorry to jump in on this post but I have what I thought was a similar issue (may not be?) with what I know to be a safe site, that worked for days but just stopped working. If I check the site using my Phone (on LTE not on Wifi) it is fine, so it is definitely through the router.
The site is
https://reachback.builtintelligence.com/
If I add (whitelist) the site and variants and what I think is the IP, none work. See attachments.
If I disable both Diversion and SkyNet it still doesn't work (hence the "what I thought" comment).
I use Cloudflare, both 1.1.1.1, 1.0.0.1 and the IPv6 versions, i.e.
2606:4700:4700:0000:0000:0000:0000:1111
2606:4700:4700:0000:0000:0000:0000:1001
I mention this as oddly I am seeing these Cloudflare address entries in the logs, seemingly associated with the failed site:
Code:
Jun 12 11:14:36 dnsmasq[25306]: reply dub1.discourse-cdn.com is 2600:9000:2200:7e00:f:f8cd:8240:93a1
Jun 12 11:14:42 dnsmasq[25306]: query[A] reachback.builtintelligence.com from 192.168.9.10
Jun 12 11:14:42 dnsmasq[25306]: forwarded reachback.builtintelligence.com to 1.1.1.1
Jun 12 11:14:42 dnsmasq[25306]: query[AAAA] reachback.builtintelligence.com from 192.168.9.10
Jun 12 11:14:42 dnsmasq[25306]: forwarded reachback.builtintelligence.com to 1.1.1.1
Jun 12 11:14:42 dnsmasq[25306]: forwarded reachback.builtintelligence.com to 1.1.1.1
Jun 12 11:14:42 dnsmasq[25306]: forwarded reachback.builtintelligence.com to 1.0.0.1
Jun 12 11:14:42 dnsmasq[25306]: forwarded reachback.builtintelligence.com to 2606:4700:4700::1111
Jun 12 11:14:42 dnsmasq[25306]: forwarded reachback.builtintelligence.com to 2606:4700:4700::1001
Jun 12 11:14:42 dnsmasq[25306]: reply error is SERVFAIL
Jun 12 11:14:42 dnsmasq[25306]: query[AAAA] reachback.builtintelligence.com from 2404:xxxx:xxxx:xxxx:xxxx:
Jun 12 11:14:42 dnsmasq[25306]: forwarded reachback.builtintelligence.com to 1.1.1.1
Jun 12 11:14:42 dnsmasq[25306]: forwarded reachback.builtintelligence.com to 1.1.1.1
Jun 12 11:14:42 dnsmasq[25306]: forwarded reachback.builtintelligence.com to 1.0.0.1
Jun 12 11:14:42 dnsmasq[25306]: forwarded reachback.builtintelligence.com to 2606:4700:4700::1111
Jun 12 11:14:42 dnsmasq[25306]: forwarded reachback.builtintelligence.com to 2606:4700:4700::1001
Jun 12 11:14:42 dnsmasq[25306]: reply error is SERVFAIL
Jun 12 11:14:42 dnsmasq[25306]: query[A] reachback.builtintelligence.com from 2404:xxxx:xxxx:xxxx:xxxx:
Jun 12 11:14:43 dnsmasq[25306]: query[A] reachback.builtintelligence.com from 192.168.9.10
Jun 12 11:14:43 dnsmasq[25306]: forwarded reachback.builtintelligence.com to 1.1.1.1
Jun 12 11:14:43 dnsmasq[25306]: forwarded reachback.builtintelligence.com to 1.0.0.1
Jun 12 11:14:43 dnsmasq[25306]: forwarded reachback.builtintelligence.com to 2606:4700:4700::1111
Jun 12 11:14:43 dnsmasq[25306]: forwarded reachback.builtintelligence.com to 2606:4700:4700::1001
Jun 12 11:14:43 dnsmasq[25306]: reply error is SERVFAIL
Whenever I check the site with SkyNet and Diversion running I get this [BLOCKED - INBOUND] message repeated in the logs:
Code:
Jun 12 11:44:12 rc_service: service 10136:notify_rc restart_dnsmasq
Jun 12 11:44:12 custom_script: Running /jffs/scripts/service-event (args: restart dnsmasq)
Jun 12 11:44:12 custom_config: Appending content of /jffs/configs/dnsmasq.conf.add.
Jun 12 11:44:12 custom_script: Running /jffs/scripts/dnsmasq.postconf (args: /etc/dnsmasq.conf)
Jun 12 11:44:12 Diversion: restarted Dnsmasq to apply settings
Jun 12 11:44:38 Skynet: [i] Mounting Skynet Web Page As user2.asp
Jun 12 11:44:47 kernel: [BLOCKED - INBOUND] IN=eth0 OUT= MAC=xx:xx:xx:xx:xx:xx:00:00:5e:00:01:02:08:00 SRC=64.62.197.45 DST=219.77.172.76 LEN=40 TOS=0x00 PREC=0x00 TTL=244 ID=54321 PROTO=TCP SPT=54477 DPT=30005 SEQ=3984160058 ACK=0 WINDOW=65535 RES=0x00 SYN URGP=0 MARK=0x8000000
Jun 12 11:44:57 kernel: [BLOCKED - INBOUND] IN=eth0 OUT= MAC=xx:xx:xx:xx:xx:xx:00:00:5e:00:01:02:08:00 SRC=87.121.69.27 DST=219.77.172.76 LEN=40 TOS=0x00 PREC=0x00 TTL=240 ID=54321 PROTO=TCP SPT=36129 DPT=8080 SEQ=3907714210 ACK=0 WINDOW=65535 RES=0x00 SYN URGP=0 MARK=0x8000000
Jun 12 11:45:00 kernel: [BLOCKED - INBOUND] IN=eth0 OUT= MAC=xx:xx:xx:xx:xx:xx:00:00:5e:00:01:02:08:00 SRC=91.92.251.235 DST=219.77.172.76 LEN=44 TOS=0x00 PREC=0x00 TTL=245 ID=15209 PROTO=TCP SPT=43839 DPT=3306 SEQ=3608124367 ACK=0 WINDOW=1025 RES=0x00 SYN URGP=0 OPT (020405B4) MARK=0x8000000
Jun 12 11:45:24 kernel: [BLOCKED - INBOUND] IN=eth0 OUT= MAC=xx:xx:xx:xx:xx:xx:00:00:5e:00:01:02:08:00 SRC=80.66.83.47 DST=219.77.172.76 LEN=44 TOS=0x00 PREC=0x00 TTL=245 ID=41704 PROTO=TCP SPT=43048 DPT=2083 SEQ=805373575 ACK=0 WINDOW=1025 RES=0x00 SYN URGP=0 OPT (020405B4) MARK=0x8000000
Jun 12 11:45:29 kernel: [BLOCKED - INBOUND] IN=eth0 OUT= MAC=xx:xx:xx:xx:xx:xx:00:00:5e:00:01:02:08:00 SRC=89.248.163.201 DST=219.77.172.76 LEN=44 TOS=0x00 PREC=0x00 TTL=245 ID=6797 PROTO=TCP SPT=46594 DPT=557 SEQ=35370220 ACK=0 WINDOW=1025 RES=0x00 SYN URGP=0 OPT (020405B4) MARK=0x8000000
Jun 12 11:45:35 kernel: [BLOCKED - INBOUND] IN=eth0 OUT= MAC=xx:xx:xx:xx:xx:xx:00:00:5e:00:01:02:08:00 SRC=162.142.125.136 DST=219.77.172.76 LEN=60 TOS=0x00 PREC=0x00 TTL=54 ID=9576 PROTO=TCP SPT=36310 DPT=47478 SEQ=843732368 ACK=0 WINDOW=42340 RES=0x00 SYN URGP=0 OPT (020405B40402080A66635B8F000000000103030A) MARK=0x8000000
Jun 12 11:45:36 kernel: [BLOCKED - INBOUND] IN=eth0 OUT= MAC=xx:xx:xx:xx:xx:xx:00:00:5e:00:01:02:08:00 SRC=89.248.163.201 DST=219.77.172.76 LEN=44 TOS=0x00 PREC=0x00 TTL=245 ID=54885 PROTO=TCP SPT=46610 DPT=14649 SEQ=3640148752 ACK=0 WINDOW=1025 RES=0x00 SYN URGP=0 OPT (020405B4) MARK=0x8000000
Jun 12 11:45:37 kernel: [BLOCKED - INBOUND] IN=eth0 OUT= MAC=xx:xx:xx:xx:xx:xx:00:00:5e:00:01:02:08:00 SRC=199.45.154.185 DST=219.77.172.76 LEN=60 TOS=0x00 PREC=0x00 TTL=58 ID=28169 PROTO=TCP SPT=60500 DPT=5671 SEQ=1717815665 ACK=0 WINDOW=42340 RES=0x00 SYN URGP=0 OPT (020405B40402080A66635B00000000000103030A) MARK=0x8000000
I'm really not sure what I am looking at here, but just odd it started days after installing Skynet (which was working fine until today).
Rebooting the Router did not help.