Menu
What's new
By:
Filters Better Search

Skynet Skynet - Router Firewall & Security Enhancements

  • SNBForums Code of Conduct

    SNBForums is a community for everyone, no matter what their level of experience.

    Please be tolerant and patient of others, especially newcomers. We are all here to share and learn!

    The rules are simple: Be patient, be nice, be helpful or be gone!

RMerlin said:
I just ran 35 parallel curl sessions here, without any problem.

You might want to limit the number of concurrent sessions however - firing 32 parallel connections at that one single server might eventually get you blacklisted for abuse. 4 is considered more polite, 8 would be the absolute limit.
Click to expand...

I actually limited this on the AC86U to single downloads and still run into the error . It also seems curl is the only thing triggering it, whereas other CPU/Ram intensive commands execute just fine.
 
SeaConn said:
I get this:
Click to expand...

I can't replicate this, is there any out of the ordinary conditions which led to this?

Andy1932 said:
Thanks for the tip. That worked, but I'm still getting this:
Click to expand...

Does this show after you run the following and wait about 20s?;

Code: 
sh /jffs/scripts/firewall restart

During the firewall-restart event IPTables rules get flushed multiple times, on previous models I overcome this via waiting a mandatory 20s before loading in the new rules, on the AC86U we may need to extend this timer.
 
Just retested, this time with 50 parallels curl sessions all aimed at a jpeg file on a remote site, not a single error.
 
@.TT. @SeaConn I've pushed another :rolleyes: fix. This time I've tried limiting the ipset processes earlier in the script. Let me know if this makes any difference
 
.TT. said:
Updated and ran banmalware without issue.
Note that i still have swap enabled and i am using 0-5Mb of it.
Click to expand...

Mind giving it a try without the swap file to see if we can track down how to fix this without one? Thanks
 
Did another test with ipv6 disabled in ab. Did free up some memory but still not enough. (fork error)
Installed beta 3 and enabled swap again.
 
Adamm said:
I can't replicate this, is there any out of the ordinary conditions which led to this?



Does this show after you run the following and wait about 20s?;

Code: 
sh /jffs/scripts/firewall restart

During the firewall-restart event IPTables rules get flushed multiple times, on previous models I overcome this via waiting a mandatory 20s before loading in the new rules, on the AC86U we may need to extend this timer.
Click to expand...
Same result. Still failing.
 
.TT. said:
Did another test with ipv6 disabled in ab. Did free up some memory but still not enough. (fork error)
Installed beta 3 and enabled swap again.
Click to expand...

Crazy that the AC86U has such little left over resources that it can't preform basic tasks even though it has twice the ram of previous models. Not sure there's anything left I can do at this point besides get people to use a swap file :rolleyes:. Lets hope Asus work on this in future updates.

Andy1932 said:
Same result. Still failing.
Click to expand...

Strange.. Can you give me the output of;

Code: 
sh /jffs/scripts/firewall debug info
 
Adamm said:
Crazy that the AC86U has such little left over resources that it can't preform basic tasks even though it has twice the ram of previous models. Not sure there's anything left I can do at this point besides get people to use a swap file :rolleyes:. Lets hope Asus work on this in future updates.



Strange.. Can you give me the output of;

Code: 
sh /jffs/scripts/firewall debug info
Click to expand...
Code: 
Router Model; RT-AC86U
Skynet Version; v5.4.5 (2/11/2017)
iptables v1.4.14 - (eth0 @ 192.168.1.1)
ipset v6.32, protocol version: 6
FW Version; 382.1_beta2-gc21d7dd (Oct 24 2017) (4.1.27)
Install Dir; /tmp/mnt/disk/skynet (14.3G Space Available)
Boot Args; /jffs/scripts/firewall start banmalware autoupdate usb=/tmp/mnt/disk
No Lock File Found

Checking Install Directory Write Permissions...         [Passed]
Checking Firewall-Start Entry...                        [Passed]
Checking OpenVPN-Event Entry...                         [Passed]
Checking CronJobs...                                    [Passed]
Checking IPSet Comment Support...                       [Passed]
Checking Log Level 5 Settings...                        [Passed]
Checking Autobanning Status...                          [Passed]
Checking Debug Mode Status...                           [Failed]
Checking For Duplicate Rules In RAW...                  [Passed]
Checking For Duplicate Rules In Filter...               [Passed]
Checking Skynet IPTable...                              [Failed]
Checking Whitelist IPSet...                             [Passed]
Checking BlockedRanges IPSet...                         [Passed]
Checking Blacklist IPSet...                             [Passed]
Checking Skynet IPSet...                                [Passed]

Skynet: [Complete] 63525 IPs / 1115 Ranges Banned. 0 New IPs / 0 New Ranges Bann                                                                                        ed.  Inbound /  Outbound Connections Blocked! [0s]
 
Andy1932 said:
Code: 
Router Model; RT-AC86U
Skynet Version; v5.4.5 (2/11/2017)
iptables v1.4.14 - (eth0 @ 192.168.1.1)
ipset v6.32, protocol version: 6
FW Version; 382.1_beta2-gc21d7dd (Oct 24 2017) (4.1.27)
Install Dir; /tmp/mnt/disk/skynet (14.3G Space Available)
Boot Args; /jffs/scripts/firewall start banmalware autoupdate usb=/tmp/mnt/disk
No Lock File Found

Checking Install Directory Write Permissions...         [Passed]
Checking Firewall-Start Entry...                        [Passed]
Checking OpenVPN-Event Entry...                         [Passed]
Checking CronJobs...                                    [Passed]
Checking IPSet Comment Support...                       [Passed]
Checking Log Level 5 Settings...                        [Passed]
Checking Autobanning Status...                          [Passed]
Checking Debug Mode Status...                           [Failed]
Checking For Duplicate Rules In RAW...                  [Passed]
Checking For Duplicate Rules In Filter...               [Passed]
Checking Skynet IPTable...                              [Failed]
Checking Whitelist IPSet...                             [Passed]
Checking BlockedRanges IPSet...                         [Passed]
Checking Blacklist IPSet...                             [Passed]
Checking Skynet IPSet...                                [Passed]

Skynet: [Complete] 63525 IPs / 1115 Ranges Banned. 0 New IPs / 0 New Ranges Bann                                                                                        ed.  Inbound /  Outbound Connections Blocked! [0s]
Click to expand...


Looks like everything installed correctly, my only guess is the IPTables rule is being flushed during the restart_firewall event, but its strange you are the only one to report it using the AC86U. Can you give me a snippet of the syslog where Skynet starts up? If there's nothing obvious I will extend the rule timer.
 
Adamm said:
Looks like everything installed correctly, my only guess is the IPTables rule is being flushed during the restart_firewall event, but its strange you are the only one to report it using the AC86U. Can you give me a snippet of the syslog where Skynet starts up? If there's nothing obvious I will extend the rule timer.
Click to expand...
This is all I see...
Code: 
Nov  2 07:04:33 Skynet: [INFO] Startup Initiated... ( banmalware autoupdate usb=/tmp/mnt/disk )
.
.
.
Nov  2 07:04:54 Skynet: [Complete] 63525 IPs / 1115 Ranges Banned. 63525 New IPs / 1115 New Ranges Banned.  Inbound /  Outbound Connections Blocked! [21s]
 
Andy1932 said:
This is all I see...
Code: 
Nov  2 07:04:33 Skynet: [INFO] Startup Initiated... ( banmalware autoupdate usb=/tmp/mnt/disk )
.
.
.
Nov  2 07:04:54 Skynet: [Complete] 63525 IPs / 1115 Ranges Banned. 63525 New IPs / 1115 New Ranges Banned.  Inbound /  Outbound Connections Blocked! [21s]
Click to expand...

Nothing after the second entry relating to services like miniupnp or similar services that may flush IPTables rules?

Also, do the following commands issue any errors;

Code: 
        iptables -t raw -I PREROUTING -i eth0 -m set ! --match-set Whitelist src -m set --match-set Skynet src -j DROP
        iptables -t raw -I PREROUTING -i br0 -m set ! --match-set Whitelist dst -m set --match-set Skynet dst -j DROP
 
Adamm said:
Nothing after the second entry relating to services like miniupnp or similar services that may flush IPTables rules?

Also, do the following commands issue any errors;

Code: 
        iptables -t raw -I PREROUTING -i eth0 -m set ! --match-set Whitelist src -m set --match-set Skynet src -j DROP
        iptables -t raw -I PREROUTING -i br0 -m set ! --match-set Whitelist dst -m set --match-set Skynet dst -j DROP
Click to expand...
Code: 
Nov  2 07:04:54 Skynet: [Complete] 63525 IPs / 1115 Ranges Banned. 63525 New IPs / 1115 New Ranges Banned.  Inbound /  Outbound Connections Blocked! [21s]
Nov  2 07:05:00 crond[787]: time disparity of 376504 minutes detected
Nov  2 07:17:48 kernel: nf_conntrack: automatic helper assignment is deprecated and it will be removed soon. Use the iptables CT target to attach helpers instead.



Code: 
iptables: No chain/target/match by that name.
 
Andy1932 said:
iptables: No chain/target/match by that name.
Click to expand...

Okay this gives us a better idea, for some reason you cant insert rules to the raw chain.

Please give me the output of the following, this should give me all I need to produce a fix;

Code: 
iptables --line -t raw -vnL

iptables -vnL
 
Adamm said:
Okay this gives us a better idea, for some reason you cant insert rules to the raw chain.

Please give me the output of the following, this should give me all I need to produce a fix;

Code: 
iptables --line -t raw -vnL

iptables -vnL
Click to expand...
Code: 
Chain PREROUTING (policy ACCEPT 106K packets, 37M bytes)
num   pkts bytes target     prot opt in     out     source               destination

Chain OUTPUT (policy ACCEPT 51047 packets, 18M bytes)
num   pkts bytes target     prot opt in     out     source               destination


Code: 
Chain INPUT (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination
    1    30 logdrop    icmp --  eth0   *       0.0.0.0/0            0.0.0.0/0            icmptype 8
30957 6715K ACCEPT     all  --  *      *       0.0.0.0/0            0.0.0.0/0            state RELATED,ESTABLISHED
  342 21573 logdrop    all  --  *      *       0.0.0.0/0            0.0.0.0/0            state INVALID
 9559 1807K PTCSRVWAN  all  --  !br0   *       0.0.0.0/0            0.0.0.0/0
 8287  680K PTCSRVLAN  all  --  br0    *       0.0.0.0/0            0.0.0.0/0
 8287  680K ACCEPT     all  --  br0    *       0.0.0.0/0            0.0.0.0/0            state NEW
 8934 1763K ACCEPT     all  --  lo     *       0.0.0.0/0            0.0.0.0/0            state NEW
    0     0 ACCEPT     udp  --  *      *       0.0.0.0/0            0.0.0.0/0            udp spt:67 dpt:68
    0     0 INPUT_ICMP  icmp --  *      *       0.0.0.0/0            0.0.0.0/0
  625 44029 logdrop    all  --  *      *       0.0.0.0/0            0.0.0.0/0

Chain FORWARD (policy DROP 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination
50593   27M ACCEPT     all  --  *      *       0.0.0.0/0            0.0.0.0/0            state RELATED,ESTABLISHED
    0     0 logdrop    all  --  !br0   eth0    0.0.0.0/0            0.0.0.0/0
  456 19579 logdrop    all  --  *      *       0.0.0.0/0            0.0.0.0/0            state INVALID
    0     0 ACCEPT     all  --  br0    br0     0.0.0.0/0            0.0.0.0/0
 2031  153K NSFW       all  --  *      *       0.0.0.0/0            0.0.0.0/0
    0     0 ACCEPT     all  --  *      *       0.0.0.0/0            0.0.0.0/0            ctstate DNAT
 2031  153K ACCEPT     all  --  br0    *       0.0.0.0/0            0.0.0.0/0

Chain OUTPUT (policy ACCEPT 43569 packets, 18M bytes)
 pkts bytes target     prot opt in     out     source               destination

Chain ACCESS_RESTRICTION (0 references)
 pkts bytes target     prot opt in     out     source               destination

Chain FUPNP (0 references)
 pkts bytes target     prot opt in     out     source               destination

Chain INPUT_ICMP (1 references)
 pkts bytes target     prot opt in     out     source               destination
    0     0 RETURN     icmp --  *      *       0.0.0.0/0            0.0.0.0/0            icmptype 8
    0     0 RETURN     icmp --  *      *       0.0.0.0/0            0.0.0.0/0            icmptype 13
    0     0 ACCEPT     icmp --  *      *       0.0.0.0/0            0.0.0.0/0

Chain NSFW (1 references)
 pkts bytes target     prot opt in     out     source               destination

Chain PControls (0 references)
 pkts bytes target     prot opt in     out     source               destination
    0     0 ACCEPT     all  --  *      *       0.0.0.0/0            0.0.0.0/0

Chain PTCSRVLAN (1 references)
 pkts bytes target     prot opt in     out     source               destination

Chain PTCSRVWAN (1 references)
 pkts bytes target     prot opt in     out     source               destination

Chain SECURITY (0 references)
 pkts bytes target     prot opt in     out     source               destination
    0     0 RETURN     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcpflags: 0x17/0x02 limit: avg 1/sec burst 5
    0     0 logdrop    tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcpflags: 0x17/0x02
    0     0 RETURN     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcpflags: 0x17/0x04 limit: avg 1/sec burst 5
    0     0 logdrop    tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcpflags: 0x17/0x04
    0     0 RETURN     icmp --  *      *       0.0.0.0/0            0.0.0.0/0            icmptype 8 limit: avg 1/sec burst 5
    0     0 logdrop    icmp --  *      *       0.0.0.0/0            0.0.0.0/0            icmptype 8
    0     0 RETURN     all  --  *      *       0.0.0.0/0            0.0.0.0/0

Chain default_block (0 references)
 pkts bytes target     prot opt in     out     source               destination

Chain logaccept (0 references)
 pkts bytes target     prot opt in     out     source               destination
    0     0 LOG        all  --  *      *       0.0.0.0/0            0.0.0.0/0            state NEW LOG flags 7 level 4 prefix "--log-p"
    0     0 ACCEPT     all  --  *      *       0.0.0.0/0            0.0.0.0/0

Chain logdrop (8 references)
 pkts bytes target     prot opt in     out     source               destination
  305 18649 DROP       tcp  --  eth0   *       0.0.0.0/0            0.0.0.0/0            multiport sports 80,443,143,993,110,995,25,465 state INVALID
    0     0 ACCEPT     icmp --  *      *       0.0.0.0/0            0.0.0.0/0            icmptype 11
    0     0 ACCEPT     icmp --  *      *       0.0.0.0/0            0.0.0.0/0            icmptype 3
    6   555 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcpflags: 0x3F/0x19
  416 17396 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcpflags: 0x3F/0x11
    2    80 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcpflags: 0x3F/0x04
   27  1140 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcpflags: 0x3F/0x14
    1    44 LOG        all  --  eth0   *       0.0.0.0/0            0.0.0.0/0            state INVALID LOG flags 7 level 4 prefix "[BLOCKED - NEW BAN] "
  668 47391 DROP       all  --  *      *       0.0.0.0/0            0.0.0.0/0
 
Andy1932 said:
iptables snippet
Click to expand...

Found the issue, you are running the original Beta 2 firmware release which didn't have xt_set enabled. Update to Beta 3 (or the updated Beta 2) and this should be fixed.

Totally slipped my mind that RMerlin re-released it. :p
 
Adamm said:
Found the issue, you are running the original Beta 2 firmware release which didn't have xt_set enabled. Update to Beta 3 (or the updated Beta 2) and this should be fixed.

Totally slipped my mind that RMerlin re-released it. :p
Click to expand...
Ah, thank you. Didn't know there was a Beta3. Sorry about wasting your time with this!!!
 
Beta 3 was only soft released 12 hours ago (and it wasn't officially released at that time because of issues with Mediafire, so it would have gone unnoticed by most).

I should have a more formal release for it later today (assuming Mediafire really fixed their outage).
 
You must log in or register to reply here.

Similar threads

O
Skynet Installing Skynet causes router to crash and reboot
2
Replies
26
Views
2K
Quoc Huynh
Q
U
Skynet Skynet and dig resolving completely different set of IP's
Replies
2
Views
745
ColinTaylor
C
W
Looking for an add-on that does...
Replies
5
Views
937
JGrana
JGrana
Viktor Jaep
Skynet Filter Validator v0.7 - Skynet Firewall Filter List IPv4 Integrity Validator
3 4 5
Replies
83
Views
10K
SomeWhereOverTheRainBow
SomeWhereOverTheRainBow
topmusic
ddns ip whitelist with little script.
Replies
9
Views
998
topmusic
topmusic
Similar threads
Thread starter Title Forum Replies Date
J Skynet Skynet - Blocked outbounds coming from the router itself? Asuswrt-Merlin AddOns 12
O Skynet Installing Skynet causes router to crash and reboot Asuswrt-Merlin AddOns 26
cofetym Diversion Diversion & Skynet Missing on GUI after Router Reboot. Asuswrt-Merlin AddOns 7
R Skynet How to see which domains get blocked by Skynet? Asuswrt-Merlin AddOns 3
Gary_Dexter Blocking “RO” country code in Skynet blocks Proton VPN UK connections Asuswrt-Merlin AddOns 2
P Any usefulness for Skynet + pfsense/opnsense in transparent bridge mode? Asuswrt-Merlin AddOns 12
John Fitzgerald Solved Skynet running slow with install/update issues from AMTM? Asuswrt-Merlin AddOns 10
B Skynet Source LAN IP for outbound IP blocked by SkyNet Asuswrt-Merlin AddOns 8
P Skynet Skynet errors Asuswrt-Merlin AddOns 8
ChickenheadOS Skynet Skynet 7.5.8 Firewall UI Issues Asuswrt-Merlin AddOns 19

Similar threads

Latest threads

Sign Up For SNBForums Daily Digest

Get an update of what's new every day delivered to your mailbox. Sign up here!

Members online

Total: 722 (members: 20, guests: 702)
Top