Menu
What's new
By:
Filters Better Search

Skynet Skynet - Router Firewall & Security Enhancements

  • SNBForums Code of Conduct

    SNBForums is a community for everyone, no matter what their level of experience.

    Please be tolerant and patient of others, especially newcomers. We are all here to share and learn!

    The rules are simple: Be patient, be nice, be helpful or be gone!

Great! Thanks Adamm!

Now another small issue - after running for while, script stopped showing one of the counters (number of connections blocked):

Code: 
May  8 14:00:05 Firewall: [Complete] 112244 IPs / 16927 Ranges banned. 33 New IPs / 0 New Ranges Banned. 82003 Connections Blocked! [5s]
May  8 15:00:05 Firewall: [Complete] 112265 IPs / 16927 Ranges banned. 21 New IPs / 0 New Ranges Banned. 87118 Connections Blocked! [5s]
May  8 16:00:05 Firewall: [Complete] 112298 IPs / 16927 Ranges banned. 33 New IPs / 0 New Ranges Banned. 92182 Connections Blocked! [5s]
May  8 17:00:05 Firewall: [Complete] 112323 IPs / 16927 Ranges banned. 25 New IPs / 0 New Ranges Banned. 97124 Connections Blocked! [5s]
May  8 18:00:05 Firewall: [Complete] 112342 IPs / 16927 Ranges banned. 19 New IPs / 0 New Ranges Banned. 102622 Connections Blocked! [5s]
May  8 19:00:05 Firewall: [Complete] 112367 IPs / 16927 Ranges banned. 25 New IPs / 0 New Ranges Banned.  Connections Blocked! [5s]
May  8 20:00:05 Firewall: [Complete] 112393 IPs / 16927 Ranges banned. 26 New IPs / 0 New Ranges Banned.  Connections Blocked! [5s]
 
Ah, I think I see the problem:

Code: 
admin@RT-AC88U:/jffs/scripts# iptables --line -nvL FORWARD | grep -E "set.*Blacklist" | awk '{print $2}'
115K

It seems that once you get above certain number, you get back an abbreviation that script chokes on while trying to add-up values in the 'HITS=' line of logging routine. The actual error thrown is "expr: non-numeric argument"
 
yk101 said:
Ah, I think I see the problem:

Code: 
admin@RT-AC88U:/jffs/scripts# iptables --line -nvL FORWARD | grep -E "set.*Blacklist" | awk '{print $2}'
115K

It seems that once you get above certain number, you get back an abbreviation that script chokes on while trying to add-up values in the 'HITS=' line of logging routine. The actual error thrown is "expr: non-numeric argument"
Click to expand...

Thanks, I play with my firewall too much to let the counter get that high so never noticed it :p

I pushed a fix and also a change to when packets are blocked. From now on the blacklists are added to the "raw" table over filter table and should use less CPU/Memory, that way the packets are handled sooner, without the need to go though conntrack+mangle+nat+routing.

After updating please reset the firewall to flush iptables rules (or reboot)

Code: 
service restart_firewall
 
I've also added two new commands;

bandomain & unbandomain - As the name suggests, is looks up any associated IP's (via nslookup) and bans them (and anything else hosted on the same IP).
 
@Adamm, I ran /jffs/scripts/firewall update and recieved the following error:

Code: 
Firewall: [New Version Detected - Updating]... ... ...
Firewall: [Complete] 111980 IPs / 30541 Ranges banned. 0 New IPs / 0 New Ranges Banned.  IP /  Range Connections Blocked! [2s]
./firewall: line 297: s: not found
./firewall: line 299: syntax error: unexpected ";;"
 
HardCat said:
@Adamm, I ran /jffs/scripts/firewall update and recieved the following error:

Code: 
Firewall: [New Version Detected - Updating]... ... ...
Firewall: [Complete] 111980 IPs / 30541 Ranges banned. 0 New IPs / 0 New Ranges Banned.  IP /  Range Connections Blocked! [2s]
./firewall: line 297: s: not found
./firewall: line 299: syntax error: unexpected ";;"
Click to expand...

That can be safely ignored. I added a cleaner exit after updating in the newest version just now.

Also it looks like you haven't got your IPTables rules active (possibly because you updated from the version prior to switching to the raw table) Run the following;

Code: 
service restart_firewall

Also make sure you have the newest version of firewall-start applied (but based on your output I assume you do)
 
Last edited:
Adamm said:
Thanks, I play with my firewall too much to let the counter get that high so never noticed it :p

I pushed a fix and also a change to when packets are blocked. From now on the blacklists are added to the "raw" table over filter table and should use less CPU/Memory, that way the packets are handled sooner, without the need to go though conntrack+mangle+nat+routing.

After updating please reset the firewall to flush iptables rules (or reboot)

Code: 
service restart_firewall
Click to expand...

Hmm... I've done it this morning as I was leaving from work. Now I find that I can't access the router anymore from outside. Traffic seems to be passing through, and my VPN to/from other devices works properly, so I assume that my router just needs a reboot, but thought I'd bring it up just in case...
 
yk101 said:
Hmm... I've done it this morning as I was leaving from work. Now I find that I can't access the router anymore from outside. Traffic seems to be passing through, and my VPN to/from other devices works properly, so I assume that my router just needs a reboot, but thought I'd bring it up just in case...
Click to expand...

Try reboot first, its always easier to debug something on a fresh slate. By access the router I assume you mean the gui?

After rebooting (if the problem still persists) first issue;

Code: 
sh /jffs/scripts/firewall disable

Let me know if that allows you to once again access the router, that way we can narrow it down to an IP being blacklisted that shouldn't be.
 
I have pushed another recommended update, this helps with private IP's being banned by mistake by either the SPI firewall or Malware lists.
 
Adamm said:
I have pushed another recommended update, this helps with private IP's being banned by mistake by either the SPI firewall or Malware lists.
Click to expand...

Running the latest v3.5.2 here, looks to me like I am getting some hits.:)

Code: 
admin@RT-AC3100:/jffs/scripts# iptables -vL -nt raw
Chain PREROUTING (policy ACCEPT 460K packets, 89M bytes)
 pkts bytes target     prot opt in     out     source               destination         
 126K   16M ACCEPT     all  --  *      *       0.0.0.0/0            0.0.0.0/0            match-set Whitelist src
   84  3974 DROP       all  --  *      *       0.0.0.0/0            0.0.0.0/0            match-set BlockedRanges src
  276 34258 DROP       all  --  *      *       0.0.0.0/0            0.0.0.0/0            match-set Blacklist src

Nice script, Thanks!;)
 
OK, attempted to use update:

Code: 
irewall: [New Version Detected - Updating]... ... ...
Firewall: [Complete] 114104 IPs / 16927 Ranges banned. 1 New IPs / 0 New Ranges Banned. 111K IP / 1487 Range Connections Blocked! [2s]
./firewall: line 342: syntax error: unterminated quoted string
admin@RT-AC88U:/jffs/scripts#

Rebooting now.
 
yk101 said:
OK, attempted to use update:

Code: 
irewall: [New Version Detected - Updating]... ... ...
Firewall: [Complete] 114104 IPs / 16927 Ranges banned. 1 New IPs / 0 New Ranges Banned. 111K IP / 1487 Range Connections Blocked! [2s]
./firewall: line 342: syntax error: unterminated quoted string
admin@RT-AC88U:/jffs/scripts#

Rebooting now.
Click to expand...

That error can be ignored, like the one @HardCat posted earlier it was due to a dirty exit (which has now been fixed)
 
Ok, rebooted with the latest version (skynet is a nice touch!). Also whitelisted /16 for my work domain. Will see tomorrow if that part works.
 
@Adamm, I love your script, and hope you don't mind, if I make a few suggestions:

1. Please remove hardcoded whitelist /32 address - I'm sure it is important to you, but makes no sense for the rest of us to have it as an exception (call me paranoid?);
2. When checking for the update, instead of cat and check the whole file, just grep for and check version label. This will prevent unnecessary overriding whatever custom changes we make to adjust the script to individual requirements.

Those are not principal, but mostly for convenience of the general population of your users.
 
yk101 said:
@Adamm, I love your script, and hope you don't mind, if I make a few suggestions:

1. Please remove hardcoded whitelist /32 address - I'm sure it is important to you, but makes no sense for the rest of us to have it as an exception (call me paranoid?);
2. When checking for the update, instead of cat and check the whole file, just grep for and check version label. This will prevent unnecessary overriding whatever custom changes we make to adjust the script to individual requirements.

Those are not principal, but mostly for convenience of the general population of your users.
Click to expand...

1.) I must have removed the comment I originally had in-front of it at some point. That IP is for github so the update server doesn't get banned by accident.

admin@RT-AC68U-EE20:/tmp/mnt/Main/entware/tmp# nslookup raw.githubusercontent.com
Server: 127.0.0.1
Address 1: 127.0.0.1 localhost.localdomain

Name: raw.githubusercontent.com
Address 1: 151.101.96.133


2.) I agree with this (and will add it anyway), but I don't think this will help your situation regardless. If you did have custom changes, upon detecting a new version string, it would overwrite them with the update. Maybe I should add a check arg (that doesn't update) so users like yourself can see if there's an update and make the necessary adjustments manually?
 
And done.

The update command now supports the following arguments;

sh /jffs/scripts/firewall update check (Check for updates only)
sh /jffs/scripts/firewall update -f (Force Update)

Update checking is now also based on the version, not the contents of the file as per request.
 
Another major update. I've consolidated the multiple "ban / unban / whitelist" commands (and previously un-added functionality) into single commands. Each now accepts multiple arguments and supports complete automation. In doing so I also rewrote the country banning code and is now x12 faster.

Example commands now accepted;

Code: 
Here Are Some Example Unban Commands;
"./jffs/scripts/firewall unban" This Requires Manual Input (Only IPs accepted)
"./jffs/scripts/firewall unban 8.8.8.8" his Unbans The IP Specified
"./jffs/scripts/firewall unban range 8.8.8.8/24" This Unbans the CIDR Block Specified
"./jffs/scripts/firewall unban domain" This Requires Manual Input (Only Domains Accepted)
"./jffs/scripts/firewall unban domain google.com" This Unbans the URL Specified
"./jffs/scripts/firewall unban all" This Unbans All Entries From Both Blacklists

Here Are Some Example Ban Commands;
"./jffs/scripts/firewall ban" This Requires Manual Input (Only IPs accepted)
"./jffs/scripts/firewall ban 8.8.8.8" This Bans The IP Specified
"./jffs/scripts/firewall ban range 8.8.8.8/24" This Bans the CIDR Block Specified
"./jffs/scripts/firewall ban domain" This Requires Manual Input (Only Domains Accepted)
"./jffs/scripts/firewall ban domain google.com" This Bans the URL Specified
"./jffs/scripts/firewall ban country pk" This Bans The Known IPs For The Specified Country http://www.ipdeny.com/ipblocks/data/countries/

Here Are Some Example Banmalware Commands;
"./jffs/scripts/firewall banmalware" This Bans IPs From The Predefined Filter List
"./jffs/scripts/firewall banmalware google.com/filter.list" This Uses The Fitler List From The Specified URL

Here Are Some Example Whitelist Commands;
"./jffs/scripts/firewall whitelist" This Requires Manual Input (Only IPs accepted)
"./jffs/scripts/firewall whitelist IP" This Bans The IP or Range Specified
"./jffs/scripts/firewall whitelist domain" This Requires Manual Input (Only Domains Accepted)
"./jffs/scripts/firewall whitelist domain google.com" This Bans the URL Specified

Here Are Some Example Debug Commands;
"./jffs/scripts/firewall debug enable" Enable Debugging To Syslog
"./jffs/scripts/firewall debug disable" Disable Debugging

Here Are Some Example Update Commands;
"./jffs/scripts/firewall update" Standard Update Check - If Nothing Detected Exit
"./jffs/scripts/firewall update check" Check For Updates Only - Wont Update If Detected
"./jffs/scripts/firewall update -f" Force Update Even If No Changes Detected
 
Last edited:
Adamm said:
Another major update. I've consolidated the multiple "ban / unban / whitelist" commands (and previously un-added functionality) into single commands. Each now accepts multiple arguments and supports complete automation. In doing so I also rewrote the country banning code and is now x12 faster.

Example commands now accepted;

Code: 
Here Are Some Example Unban Commands;
"./jffs/scripts/firewall unban" This Requires Manual Input (Only IPs accepted)
"./jffs/scripts/firewall unban 8.8.8.8" his Unbans The IP Specified
"./jffs/scripts/firewall unban range 8.8.8.8/24" This Unbans the CIDR Block Specified
"./jffs/scripts/firewall unban domain" This Requires Manual Input (Only Domains Accepted)
"./jffs/scripts/firewall unban domain google.com" This Unbans the URL Specified
"./jffs/scripts/firewall unban all" This Unbans All Entries From Both Blacklists

Here Are Some Example Ban Commands;
"./jffs/scripts/firewall ban" This Requires Manual Input (Only IPs accepted)
"./jffs/scripts/firewall unban 8.8.8.8" This Bans The IP Specified
"./jffs/scripts/firewall unban range 8.8.8.8/24" This Bans the CIDR Block Specified
"./jffs/scripts/firewall unban domain" This Requires Manual Input (Only Domains Accepted)
"./jffs/scripts/firewall unban domain google.com" This Bans the URL Specified
"./jffs/scripts/firewall country pk" This Bans The Known IPs For The Specified Country http://www.ipdeny.com/ipblocks/data/countries/

Here Are Some Example Banmalware Commands;
"./jffs/scripts/firewall banmalware" This Bans IPs From The Predefined Filter List
"./jffs/scripts/firewall banmalware google.com/filter.list" This Uses The Fitler List From The Specified URL

Here Are Some Example Whitelist Commands;
"./jffs/scripts/firewall unban" This Requires Manual Input (Only IPs accepted)
"./jffs/scripts/firewall unban IP" This Bans The IP or Range Specified
"./jffs/scripts/firewall unban domain" This Requires Manual Input (Only Domains Accepted)
"./jffs/scripts/firewall whitelist domain google.com" This Bans the URL Specified

Here Are Some Example Debug Commands;
"./jffs/scripts/firewall debug enable" Enable Debugging To Syslog
"./jffs/scripts/firewall debug disable" Disable Debugging

Here Are Some Example Update Commands;
"./jffs/scripts/firewall update" Standard Update Check - If Nothing Detected Exit
"./jffs/scripts/firewall update check" Check For Updates Only - Wont Update If Detected
"./jffs/scripts/firewall update -f" Force Update Even If No Changes Detected
Click to expand...

In the file "README.md" I noticed unban is referenced where I think you meant to ban.

Code: 
Here Are Some Example Ban Commands;
"./jffs/scripts/firewall ban" This Requires Manual Input (Only IPs accepted)
"./jffs/scripts/firewall unban 8.8.8.8" This Bans The IP Specified
"./jffs/scripts/firewall unban range 8.8.8.8/24" This Bans the CIDR Block Specified
"./jffs/scripts/firewall unban domain" This Requires Manual Input (Only Domains Accepted)
"./jffs/scripts/firewall unban domain google.com" This Bans the URL Specified
"./jffs/scripts/firewall country pk" This Bans The Known IPs For The Specified Country http://www.ipdeny.com/ipblocks/data/countries/

Great Script BTW...
 
HardCat said:
In the file "README.md" I noticed unban is referenced where I think you meant to ban.

Code: 
Here Are Some Example Ban Commands;
"./jffs/scripts/firewall ban" This Requires Manual Input (Only IPs accepted)
"./jffs/scripts/firewall unban 8.8.8.8" This Bans The IP Specified
"./jffs/scripts/firewall unban range 8.8.8.8/24" This Bans the CIDR Block Specified
"./jffs/scripts/firewall unban domain" This Requires Manual Input (Only Domains Accepted)
"./jffs/scripts/firewall unban domain google.com" This Bans the URL Specified
"./jffs/scripts/firewall country pk" This Bans The Known IPs For The Specified Country http://www.ipdeny.com/ipblocks/data/countries/

Great Script BTW...
Click to expand...

Thanks, had a bit of free time lately so decided to put some effort into improving it, although I'm starting to run low on ideas :p
 
Does this work with dnscrypt? Been having some issues with Martineau's version, despite whitelisting the proxy IP, DNS would fail until I flushed the lists. So I'm guessing an IP was being banned that shouldn't have been. Too many IPs in the blacklist for me to reasonably find which though!
 
You must log in or register to reply here.

Similar threads

O
Skynet Installing Skynet causes router to crash and reboot
2
Replies
26
Views
2K
Quoc Huynh
Q
U
Skynet Skynet and dig resolving completely different set of IP's
Replies
2
Views
724
ColinTaylor
C
W
Looking for an add-on that does...
Replies
5
Views
897
JGrana
JGrana
Viktor Jaep
Skynet Filter Validator v0.7 - Skynet Firewall Filter List IPv4 Integrity Validator
3 4 5
Replies
83
Views
10K
SomeWhereOverTheRainBow
SomeWhereOverTheRainBow
topmusic
ddns ip whitelist with little script.
Replies
9
Views
985
topmusic
topmusic
Similar threads
Thread starter Title Forum Replies Date
O Skynet Installing Skynet causes router to crash and reboot Asuswrt-Merlin AddOns 26
cofetym Diversion Diversion & Skynet Missing on GUI after Router Reboot. Asuswrt-Merlin AddOns 7
Gary_Dexter Blocking “RO” country code in Skynet blocks Proton VPN UK connections Asuswrt-Merlin AddOns 2
P Any usefulness for Skynet + pfsense/opnsense in transparent bridge mode? Asuswrt-Merlin AddOns 12
John Fitzgerald Solved Skynet running slow with install/update issues from AMTM? Asuswrt-Merlin AddOns 10
B Skynet Source LAN IP for outbound IP blocked by SkyNet Asuswrt-Merlin AddOns 8
P Skynet Skynet errors Asuswrt-Merlin AddOns 8
ChickenheadOS Skynet Skynet 7.5.8 Firewall UI Issues Asuswrt-Merlin AddOns 18
P Send stats Division and Skynet to webhook or mqtt Asuswrt-Merlin AddOns 0
BATTLEPENCIL Skynet Unable to uninstall Skynet Asuswrt-Merlin AddOns 11

Similar threads

Latest threads

Sign Up For SNBForums Daily Digest

Get an update of what's new every day delivered to your mailbox. Sign up here!

Members online

Total: 1,002 (members: 20, guests: 982)
Top