Skynet Skynet - Router Firewall & Security Enhancements

pirx73 · Mar 28, 2020

L&LD said:
@pirx73
Did you flash an updated CFE to your RT-AC68U, or is that what it shipped with? Most CFE's I've seen on RT-AC68U's are 1.0.2 or close to it.

Definitely not. I bought it unused from internet shop and never touched CFE. If i would, i would not have a problem telling it here. Why my router has 1.0.3 CFE out of the box i have no idea. Screenshot of my router System Information screen:
https://drive.google.com/open?id=1WXclexDz-5t63_FhUBanwL-FbugDA3Hk

Removed Skynet, did a full reboot of router, reinstalled it back and it's working now. I will monitor it for a while.

heysoundude · Mar 30, 2020

I just installed Skynet a few days ago, and it's quite clear after a weekend of abuse by people in the house trying to stream netflix and use our kodi box that I've some learnin' up do do.
I suspect it's easier than I believe at this moment, and that it will be brilliant when I've made a space for it in my middle-aged nugget...
maybe some Obi-Wan Kenobi has posted some Jedi apprentice-level training for me here so I don't have to go all the way to the Dagobah system.

L&LD · Mar 30, 2020

@heysoundude what 'training' do you need for Skynet? Enable it and be protected.

-Not 'Obi-Wan Kenobi' but I can feel the force that @Adamm exerts on the bad guys! Actually, I just read it in the stats.

heysoundude · Mar 30, 2020

Netflix is a saviour around here, and he’s getting blocked or something (but only on the kodi box) since skynet started getting used, and same for the addons we use to stream other things. I’m sure I’m no unicorn in this regard - I just don’t know enough about config and troubleshooting it.

Adamm · Mar 30, 2020

heysoundude said:
Netflix is a saviour around here, and he’s getting blocked or something (but only on the kodi box) since skynet started getting used, and same for the addons we use to stream other things. I’m sure I’m no unicorn in this regard - I just don’t know enough about config and troubleshooting it.

As per the readme and second post of this thread;

Adamm said:
Halp - BestApp.exe or BestWebsite.com Is Being Blocked;

Don't worry, tracking down false positive bans was at the core of design. Generally speaking you can follow these steps to find (and whitelist) anything incorrectly on your Blacklist!

1.) Enable Logging

Code:

sh /jffs/scripts/firewall settings logmode enable

2.) Open the blocked application/website and use the command;

Code:

sh /jffs/scripts/firewall debug watch

Now look for a flood of [BLOCKED - OUTBOUND] coming from the same IP. This most likely will be the IP you are looking for if its being spammed in large numbers.

3.) Copy the IP following "DST=" it should look something like this;

Code:

DST=175.115.37.52

4.) Double check the IP is not actually something that should be banned, use a search tool like alienvault. If its related to a domain additional "Associated Domain" information should be printed beneath the log.

Code:

https://otx.alienvault.com/indicator/ip/175.115.37.52/

5.) Great we have confirmed we found the IP of the blocked website/application we are looking for, lets whitelist it!

Code:

sh /jffs/scripts/firewall whitelist ip 175.115.37.52

heysoundude · Mar 30, 2020

That’s another thing @Adamm - making the mental connections between terminal and Merlin GUI.
I’ll sort it out once I can focus on it tomorrow...
Thanks for responding. [emoji1303][emoji1303][emoji1308]

Sent from my iPhone using Tapatalk

heysoundude · Mar 30, 2020

what does "Element cannot be added to the set: it's already added" mean when whitelisting something? Shouldn't we be whitelisting SOURCES rather than destinations?

Also - is it worthwhile "reporting" to the abuse contacts in the WhoIs of the offending IPs that somehow they're hammering me?

Adamm · Mar 30, 2020

heysoundude said:
what does "Element cannot be added to the set: it's already added" mean when whitelisting something? Shouldn't we be whitelisting SOURCES rather than destinations?

Skynet works by whitelisting remote addresses

heysoundude · Mar 30, 2020

I must have something backwards in my brain...alienvault has the DST IP in question as my ISP...they seem to be doing what I pay them for, and so is Skynet when it comes to SRC IPs so far from what I have checked out...
Maybe there’s a problem with the Netflix addon coding, or something it relies on.

Should I be paying more attention to what ports are getting probed/blocked?

Sent from my iPhone using Tapatalk

Adamm · Mar 30, 2020

heysoundude said:
I must have something backwards in my brain...alienvault has the DST IP in question as my ISP...they seem to be doing what I pay them for, and so is Skynet when it comes to SRC IPs so far from what I have checked out...
Maybe there’s a problem with the Netflix addon coding, or something it relies on.

Should I be paying more attention to what ports are getting probed/blocked?

Sent from my iPhone using Tapatalk

The logs work like this, if its an inbound block, your IP will be the dst. If its an outbound block, your IP is the src.

heysoundude · Mar 30, 2020

Adamm said:
The logs work like this, if its an inbound block, your IP will be the dst. If its an outbound block, your IP is the src.

Yes, I'm getting floods of Inbound blocks, and the topmost blocked device is my HTPC/kodi machine.
is it trying to "phone home" for some reason? The top IP is in NL, and I believe the dev of my setup (xbian) is in that neck of the woods...

AntonK · Mar 30, 2020

Hi,
So what happens when the log file gets to 10MB? Does it reset to 0 and start over? How does Skynet handle that? Is there something the user has to do, like reset the statistics and empty the log file? How does Skynet keep its stats relevant once the 10MB limit has been reached?

Thanks,
Anton

Butterfly Bones · Mar 30, 2020

AntonK said:
Hi,
So what happens when the log file gets to 10MB? Does it reset to 0 and start over? How does Skynet handle that? Is there something the user has to do, like reset the statistics and empty the log file? How does Skynet keep its stats relevant once the 10MB limit has been reached?

Thanks,
Anton

I'm going to try to save Adamm answering this again.

https://www.snbforums.com/threads/r...urity-enhancements.16798/page-334#post-563779
https://www.snbforums.com/threads/r...urity-enhancements.16798/page-311#post-552454
https://www.snbforums.com/threads/r...urity-enhancements.16798/page-128#post-403366
https://www.snbforums.com/threads/r...urity-enhancements.16798/page-128#post-403384

AntonK · Mar 31, 2020

Butterfly Bones said:
I'm going to try to save Adamm answering this again.
https://www.snbforums.com/threads/r...urity-enhancements.16798/page-334#post-563779
https://www.snbforums.com/threads/r...urity-enhancements.16798/page-311#post-552454
https://www.snbforums.com/threads/r...urity-enhancements.16798/page-128#post-403366
https://www.snbforums.com/threads/r...urity-enhancements.16798/page-128#post-403384

Thanks!
Anton

TheLyppardMan · Mar 31, 2020

I'm not sure what benefits Skynet brings over the original setup and is my router/network potentially less secure if I don't have it installed?

dave14305 · Mar 31, 2020

TheLyppardMan said:
I'm not sure what benefits Skynet brings over the original setup and is my router/network potentially less secure if I don't have it installed?

Even with AiProtection enabled, your router may not block all outbound traffic to known bad guys. Skynet will do this. If you open external ports on your router for any purpose (gaming, remote access, openVPN), you are creating opportunities for hackers to pound away at those open ports. Skynet will block these attempt from known bad people.

Ubimo · Mar 31, 2020

I'm using these ipsets/lists:

That are ~330.000 blocked IPs and 2100 Ranges getting blocked.
Is this good? Bad? Stupid?
Why?

Edit:
Can I see, if any of these additional lists actually blocked some IPs?

Olivier L · Mar 31, 2020

What is Fast Switch List option ?

hervon · Mar 31, 2020

Did you the forums ?

https://www.snbforums.com/threads/r...firewall-security-enhancements.16798/page-170

Ubimo · Apr 1, 2020

I see Adamm just updated Skynet and removed the +hosts?
After updating Skynet, do we have to update anything else? (ban malwarelist, etc.)

Thread starter	Title	Forum	Replies	Date
O	Skynet Installing Skynet causes router to crash and reboot	Asuswrt-Merlin AddOns	26	Feb 17, 2024
	Diversion Diversion & Skynet Missing on GUI after Router Reboot.	Asuswrt-Merlin AddOns	7	Aug 21, 2023
P	Any usefulness for Skynet + pfsense/opnsense in transparent bridge mode?	Asuswrt-Merlin AddOns	12	Monday at 3:40 PM
	Solved Skynet running slow with install/update issues from AMTM?	Asuswrt-Merlin AddOns	10	Mar 21, 2024
B	Skynet Source LAN IP for outbound IP blocked by SkyNet	Asuswrt-Merlin AddOns	8	Feb 26, 2024
P	Skynet Skynet errors	Asuswrt-Merlin AddOns	8	Feb 15, 2024
	Skynet Skynet 7.5.8 Firewall UI Issues	Asuswrt-Merlin AddOns	18	Feb 9, 2024
P	Send stats Division and Skynet to webhook or mqtt	Asuswrt-Merlin AddOns	0	Feb 7, 2024
	Skynet Unable to uninstall Skynet	Asuswrt-Merlin AddOns	11	Feb 6, 2024
U	Skynet Unable to Install Skynet	Asuswrt-Merlin AddOns	31	Feb 1, 2024

Skynet Skynet - Router Firewall & Security Enhancements

Senior Member

Part of the Furniture

Part of the Furniture

Part of the Furniture

Part of the Furniture

Part of the Furniture

Part of the Furniture

Part of the Furniture

Part of the Furniture

Part of the Furniture

Part of the Furniture

Very Senior Member

Very Senior Member

Very Senior Member

Very Senior Member

Part of the Furniture

Very Senior Member

Regular Contributor

Regular Contributor

Very Senior Member

Similar threads

Similar threads

Sign Up For SNBForums Daily Digest