Skynet Skynet - Simple way to ban all countries?

[F-4Phantom]

I generally have a long list of countries that I ban via the option in Skynet. But it's a hassle to have to re-enter those if I have to re-install or otherwise clear the config.

Is there a way to ban all country codes and then just whitelist the one or two I want to allow?

 

[Viktor Jaep]

I generally have a long list of countries that I ban via the option in Skynet. But it's a hassle to have to re-enter those if I have to re-install or otherwise clear the config.

Is there a way to ban all country codes and then just whitelist the one or two I want to allow?

I just save a text file with this command in it... when I need to redo my router (or Skynet), I just run this command. Just keep this one up-to-date. How long is YOUR country list...

sh /jffs/scripts/firewall ban country "ru cn kp ir iq sa ae pk af az ba bg hr cu cz eg ee ge va hu id in il kz kw kg lv md om qa ro rs sk si sy tr ua uz"

BTW... F-4 Phantoms are probably one of my favorite fighter jets. Nice choice!

 

[Tech9]

then just whitelist the one or two I want to allow?

You are only hurting yourself by cutting off large international Internet hubs. Why? The result is not Internet anymore.

 

[F-4Phantom]

I just save a text file with this command in it... when I need to redo my router (or Skynet), I just run this command. Just keep this one up-to-date. How long is YOUR country list...

sh /jffs/scripts/firewall ban country "ru cn kp ir iq sa ae pk af az ba bg hr cu cz eg ee ge va hu id in il kz kw kg lv md om qa ro rs sk si sy tr ua uz"

BTW... F-4 Phantoms are probably one of my favorite fighter jets. Nice choice!

Thanks! I have a long list like yours. And I too had it saved to a text file that I copy/paste. But I like your script much better.

The Phantom is my favorite as well!

 

[F-4Phantom]

You are only hurting yourself by cutting off large international Internet hubs. Why? The result is not Internet anymore.

I've had zero issues with a lengthy list of banned country IP ranges for over a year. I allow connections from within my country only and that has been more than adequate.

 

[thelonelycoder]

I've had zero issues with a lengthy list of banned country IP ranges for over a year. I allow connections from within my country only and that has been more than adequate.

ch is the TLD for Switzerland, make sure to not block it or amtm and/or Diversion will have a problem.

 

[BreakingDad]

I just save a text file with this command in it... when I need to redo my router (or Skynet), I just run this command. Just keep this one up-to-date. How long is YOUR country list...

sh /jffs/scripts/firewall ban country "ru cn kp ir iq sa ae pk af az ba bg hr cu cz eg ee ge va hu id in il kz kw kg lv md om qa ro rs sk si sy tr ua uz"

BTW... F-4 Phantoms are probably one of my favorite fighter jets. Nice choice!

I also have a text file with all my skynet settings on. great minds think alike

Whitelist

37.244.54.10 roblox
23.227.38.74 govee
128.116.119.3 battlenet
37.244.28.102 battlenet
91.199.81.1/24 phasmophobia
9.9.9.9 Quad 9 dns
1.1.1.1 Cloud dns
8.8.8.8 Gooogle dns
http://mirror.ossplanet.net (rpi/linux update)
ncs.roblox.com roblox
www.roblox.com roblox
23.48.23.45 roblox
128.116.121.3 roblox
128.116.119.4 roblox
23.196.236.42 roblox

Blacklist

https://incoming.telemetry.mozilla.org

cn br ir ua ar iq tw th lv ru ro cl sa pk sg bg in by er sy kp pk iq dz ao am bd bo bi cf cg cu sv gq kz kg la mg ml mn mz
tr tm it af al dz sv il na sd ae zw sd kw qa tj bt cu ke mw mx ni ne ps rw so

 

[F-4Phantom]

This is my country ban-list. I've used it for over a year.

I started out blocking Russia, China, N Korea. Then based upon what I was seeing in Skynet, I started blocking a lot more. At some point I decided that I had already blocked a lot of countries with no noticeable downside. So I started banning a whole lot more.

Most services I use have local servers in my country, so haven't seen an issue.

ae af al dz ao ar am aw at az bh bd by be bo ba bw br bn bg bf mm cf td cn co cd cg hr cu cy cz dk dj dm ae ec eg ee et fi gf ps ge gh gl gd hn hk hu in id ir iq il jo kz kp kr kw kg lv lb lr ly lt my mx mc mo np nl nz ni ne ng kp om pk ps pa py pe ph pl pt pw qa ro ru rw sa sn rs sc sl sg sk si so za gs kr ss tj tz th tr tm ug ua ae uz vn ye zw

 

[Tech9]

Most services I use have local servers in my country, so haven't seen an issue.

I don’t block any countries and haven’t seen an issue either. Go figure. My theory is the firewall blocks all unsolicited connections anyway, with or without Skynet.

 

[Jumpstarter]

I don’t block any countries and haven’t seen an issue either. Go figure. My theory is the firewall blocks all unsolicited connections anyway, with or without Skynet.

That depends on what your firewalling policies are. With no portforwards enabled, your theory should be correct. Also, remember outbound traffic also makes connections that could warrent related, but unwanted in bound connections. Firewalls are generally neutered when it comes to intelligent blocking. However, blocking by country is taking a stab in the dark and hoping your internet and services will still work as they should lest you rather just block everything and whitelist what traffic you want to allow.

ASN blocking can be rather fun. For example, block AS15169 and see what services break.

 

[Tech9]

With no portforwards enabled, your theory should be correct.

Even if you have open ports, you don’t know if real malicious IPs are in blocklists. Community support blocklists are usually slowly updated. You have to be ready to deal with false positives as well. They may be fatal for your connection, like your DNS servers in blocklists. It happened before. If you block country X and they want to get to you badly, they’ll simply use a server in your country. Not very hard to organize. I mean, everyone is free to make choices, but some of them don’t come with the benefits expected.

 

[Jumpstarter]

Even if you have open ports, you don’t know if real malicious IPs are in blocklists. Community support blocklists are usually slowly updated. You have to be ready to deal with false positives as well. They may be fatal for your connection, like your DNS servers in blocklists. It happened before. If you block country X and they want to get to you badly, they’ll simply use a server in your country. Not very hard to organize. I mean, everyone is free to make choices, but some of them don’t come with the benefits expected.

Honestly though, I think the head ache from what you mention in this post is definitely alot less from having to whitelist as a result of country blocks.

 

[Tech9]

@Jumpstarter, more about the process here:

Skynet - Is default firewall good enough?

Sorry if this has been asked before, I just wanted opinions. Do you think the default AX86U firewall, combined with the usual windows firewall is good enough, and is there any real advantage in using Skynet? We also all have malwarebytes premium installed, trendnet on and adguard with all...

www.snbforums.com

 

[Jumpstarter]

@Jumpstarter, more about the process here:

Skynet - Is default firewall good enough?

Sorry if this has been asked before, I just wanted opinions. Do you think the default AX86U firewall, combined with the usual windows firewall is good enough, and is there any real advantage in using Skynet? We also all have malwarebytes premium installed, trendnet on and adguard with all...

www.snbforums.com

That is some insight you have. It is like saying don't build a fence since we obviously know it won't 100 percent offer protection and sometimes might lead to disappointment when you and other members of the family can't see what's on the otherside.

 

[Tech9]

It’s a joke obviously, but some may recognize the stage they are at the moment. The less you know how blockers work the faster you move through the stages.

 

[Jumpstarter]

It’s a joke obviously, but some may recognize the stage they are at the moment. The less you know how blockers work the faster you move through the stages.

I get that. I was agreeing. Those who dive head first even when the obvious is in front of their face usually experience such.

 

[Tech9]

It came from personal experience, you know. I run pfSense and it has some really powerful tools available to play with.

 

[Jumpstarter]

It came from personal experience, you know. I run pfSense and it has some really powerful tools available to play with.

Let me guess, you figured out you shouldn't enable them all at once.

 

[Tech9]

This is correct. IP/DNS blocking is the junior team. IDS/IPS is the major league. No good team management - lost game and season.

 

[Jumpstarter]

This is correct. IP/DNS blocking is the junior team. IDS/IPS is the major league. No good team management - lost game and season.

I think BanIP on openwrt does pretty good.