Skynet Skynet v8 - Router Firewall & Security Enhancements

[Jack-Sparr0w]

To install on older routers such as AC68u use

/usr/sbin/curl -s "https://raw.githubusercontent.com/A...47a96d843dba8e33101b6644eb8205cee/firewall.sh" -o "/jffs/scripts/firewall"

 

[Jack-Sparr0w]

If you use vpn, try whitelist the vpn asn or all dynamic ips that vpn connects to. also whitelist the dns ip related to the vpn. seems to make it come together nice when thats done

 

[Viktor Jaep]

Way slower, not very efficient , failed to download is a common occurrence. go back to the quick and dirty build cause this sucks. can't even use a custom firewall without it throwing a fit. Isn't linux supposed to be fast. so wack

it was the best of times it was the blurst of times

@Jack-Sparr0w ... I don't think this was very necessary to comment on, and find it borderline rude. @Adamm has poured a ton of his own free time into this new version along with the recent fixes he has been faithfully publishing as he knocks out the various issues. You might want to find ways to express your frustrations in other ways, or elsewhere, so we don't have to see it.

 

[Blacklistedcard]

Having fun with v8.0.4. Working fine here but I don't have any custom configs or special setups on my BE98Pro.

 

[Kingp1n]

@Jack-Sparr0w ... I don't think this was very necessary to comment on, and find it borderline rude. @Adamm has poured a ton of his own free time into this new version along with the recent fixes he has been faithfully publishing as he knocks out the various issues. You might want to find ways to express your frustrations in other ways, or elsewhere, so we don't have to see it.

@Jack-Sparr0w can definitely express his frustration using this very superb & helpful thread below:


Thread 'Unbound Tuning for gaming' https://www.snbforums.com/threads/unbound-tuning-for-gaming.95021/

 

[XxUnkn0wnxX]

@Jack-Sparr0w ... I don't think this was very necessary to comment on, and find it borderline rude. @Adamm has poured a ton of his own free time into this new version along with the recent fixes he has been faithfully publishing as he knocks out the various issues. You might want to find ways to express your frustrations in other ways, or elsewhere, so we don't have to see it.

@Viktor Jaep I get where you’re coming from, and I agree that taking cheap shots at Adamm or the project doesn’t help anyone. He’s clearly put a huge amount of his own time and energy into v8, and you can see he’s been working hard to track reports and push out fixes quickly. That deserves a lot of appreciation.

At the same time, I also understand why some people are pretty wound up right now. For a number of us, updating to v8 hasn’t just been “a few rough edges” – it’s been lost access, broken configs, or having to scramble over SSH to recover the router. Most people don’t follow every post in these threads, they just update from amtm and expect “stable” to mean it’s safe for their setup. When that goes sideways, the natural reaction is “you broke my router”, and the frustration level jumps for both the user and the dev.

That’s where I think the process might have gone a bit off the rails. v8 is clearly a massive rewrite and a big step forward overall, but maybe it moved to the main/stable path a little too quickly. Right now, it feels like the community is being asked to be live beta testers on their production routers, whether they meant to volunteer or not. That’s not really fair to casual users, and it also piles even more pressure on Adamm to firefight urgent breakages.

One constructive way forward might be to revert the main branch back to 7.6.5 for the time being, and clearly label v8 as beta/dev again. That would give everyone a known-good baseline while still letting those of us who are willing to test v8 opt in and help shake out the remaining issues. With a bit more time and feedback across different routers, blocklists, and configs, v8 can reach the point where “stable” really means stable for the vast majority of setups.

None of this is meant as a knock on Adamm’s work – quite the opposite. He’s done a commendable job responding to reports and pushing out fixes at a pace that most commercial vendors would never match. It’s more about protecting his time and sanity, and setting expectations so people don’t feel like they got burned for just keeping their systems up to date.

So, in short: v8 looks very promising, and I’m sure it’ll be rock solid in time. But I think it would be healthier for everyone if 7.6.5 was restored as the default “safe” release, and v8 continued as an opt-in beta until it’s proven across a wider range of configurations.

 

[Adamm]

I've pushed v8.0.5

Domain_Lookup()
- Fix tmp file naming
- Scan all address fields for IPv4
#178 @dave14305
Check_Connection()
- Support multiple retries in scenarios like startup, eg 5 attempts, 10s apart;

Check_Connection 5 10

 

[Blacklistedcard]

I've pushed v8.0.5

Upgraded to v8.0.5 on my BE98Pro. No issue(s).

 

[Untried3868]

v8.0.5 loaded without issue.

Quick question, and apologies in advance if this is not the thread for it.

If I wanted to load @Viktor Jaep 's blocklist, do I simply import it as a blacklist? If I change my mind afterwards, how do I revert back to default list?

TIA

 

[visortgw]

v8.0.5 loaded without issue.

Quick question, and apologies in advance if this is not the thread for it.

If I wanted to load @Viktor Jaep 's blocklist, do I simply import it as a blacklist? If I change my mind afterwards, how do I revert back to default list?

TIA

Option 3, Change Filter List or Reset Filter List.

 

[Untried3868]

Option 3, Change Filter List or Reset Filter List.

Thank you.

 

[ColDen]

I've pushed v8.0.5

This is the first time I am experiencing an issue while updating to the latest release (previously upgraded from 7.6.5 to 8.0.0 to 8.0.1 to 8.0.2 to 8.0.3 to 8.0.4 successfully). I am only using the default settings and no additional block list. Also never rebooted the rooter since last official 3006.102.5 release:

 

[BOFH]

Hi Guys,

After updating to the latest version of Syknet 8.0.5, wg_manager died. I tried to restart it but got errors:

wg_manager-serverwg21: Initialising WireGuard® VPN 'Server' Peer (wg21) on xx:xx:xx:xx:
wg_manager-serverwg21: ***ERROR Initialisation ABORTED

Already checked all the logs & archvied logs, system never had any error like that before.

Trying to restart wgm, I got this output:

# wgm restart

No WireGuard® VPN Peers ACTIVE for Termination request



Requesting WireGuard® VPN Peer start (wg21)

modprobe: module xt_set not found in modules.dep
wg_manager-serverwg21: Initialising WireGuard® VPN 'Server' Peer (wg21) on xx:xx:xx:xx: (# GT-AXE16000 #)
Invalid argument: fwmark
Line unrecognized: `Address=xxxxxx'
Configuration parsing error

***ERROR Initialisation ABORTED - 'wg setconf wg21 /tmp/wg21.2731786 (/opt/etc/wireguard.d/wg21.conf)' FAILED

P.S: I didn't change any config of Wireguard since years. So can't be from my side

 

[visortgw]

There is a massive Cloudflare outage this morning which might make you think that Skynet is blocking something that it shouldn't...

 

[ZebMcKayhan]

P.S: I didn't change any config of Wireguard since years. So can't be from my side

I dont see how this could be linked to skynet, sound likewgm fails to prepare the config file properly for some reason. I.e unexpected arguments like the interface address would make it fail to start.
Did you try to reboot to clear out possible remnants?

 

[BOFH]

I dont see how this could be linked to skynet, sound likewgm fails to prepare the config file properly for some reason. I.e unexpected arguments like the interface address would make it fail to start.
Did you try to reboot to clear out possible remnants?

Yep, tried the reboot but still the same issue.

I'm also asking my self what Skynet have to do with wgm. The only update done was Skynet
I was not able to find this error from logs from march 2025

Nov 18 17:12:00 925FD02-C Skynet: New Version Detected - Updating To v8.0.5 (8c55657b8a7b46c89bd211606606328c)

18:25 # zgrep "ERROR Initialisation ABORTED" router.log*
router.log:Nov 18 17:12:13 925FD02-C wg_manager-serverwg21: ***ERROR Initialisation ABORTED
router.log:Nov 18 17:23:18 925FD02-C wg_manager-serverwg21: ***ERROR Initialisation ABORTED
router.log:Nov 18 17:25:14 925FD02-C wg_manager-serverwg21: ***ERROR Initialisation ABORTED
router.log:Nov 18 17:31:21 925FD02-C wg_manager-serverwg21: ***ERROR Initialisation ABORTED
router.log:Nov 18 17:33:28 925FD02-C wg_manager-serverwg21: ***ERROR Initialisation ABORTED
router.log:Nov 18 17:34:59 925FD02-C wg_manager-serverwg21: ***ERROR Initialisation ABORTED
router.log:Nov 18 17:37:47 925FD02-C wg_manager-serverwg21: ***ERROR Initialisation ABORTED
router.log:Nov 18 17:44:21 925FD02-C wg_manager-serverwg21: ***ERROR Initialisation ABORTED
router.log:Nov 18 18:21:53 925FD02-C wg_manager-serverwg21: ***ERROR Initialisation ABORTED
router.log:Nov 18 18:23:05 925FD02-C wg_manager-serverwg21: ***ERROR Initialisation ABORTED
18:25 # ls router.log*
router.log router.log.10.gz router.log.12.gz router.log.14.gz router.log.16.gz router.log.18.gz router.log.20.gz router.log.22.gz router.log.24.gz router.log.26.gz router.log.28.gz router.log.2.gz router.log.31.gz router.log.33.gz router.log.35.gz router.log.4.gz router.log.6.gz router.log.8.gz
router.log.1 router.log.11.gz router.log.13.gz router.log.15.gz router.log.17.gz router.log.19.gz router.log.21.gz router.log.23.gz router.log.25.gz router.log.27.gz router.log.29.gz router.log.30.gz router.log.32.gz router.log.34.gz router.log.3.gz router.log.5.gz router.log.7.gz router.log.9.gz
18:25 # ll router.log.35.gz
-rw-r--r-- 1 syslog adm 290957 mar 23 2025 router.log.35.gz

 

[here1310]

...and yes, this version change is quite a challenge... I always make a backup of the jffs/scripts and usb/skynet directories beforehand using WinSCP (duplicating them). Then it's easy to restore the folders and reboot the router with the previous settings... 8.0.5 is working for me... @Adam, I do miss the "r" function for the menu a bit....
Web-Ergebnisse

 

[dave14305]

I do miss the "r" function for the menu a bit....

The r or reload function still works in the menu system.

 

[here1310]

I already noticed that

Many, many thanks to Adam for his hard work and his efforts!!

 

[here1310]

I recommend all users use WinSCP with SSH; it's very simple and efficient.
JFFS backup via duplicate;
Creating duplicates on the USB device, etc.
Simplifies a lot...