amtm amtm step-by-step install guide - L&LD

[dave14305]

I hope there is someone here who can figure out why I have been unable to install Skynet.

Your issue has always seemed to be the inability to reach the github site. Run some tests from the router.

nslookup raw.githubusercontent.com
ping raw.githubusercontent.com
traceroute raw.githubusercontent.com
curl -v https://raw.githubusercontent.com/Adamm00/IPSet_ASUS/master/firewall.sh -o /dev/null

Don’t bother with USB replacement or double NAT. If you can’t reach the download site, none of it matters.

Do you live somewhere in the world where an ISP or government would want to block github? Or a country known for bad internet guys and so maybe github is blocking your country or ISP’s addresses?

Can you reach the normal github site from a PC (without a VPN)?

GitHub - Adamm00/IPSet_ASUS: Skynet - Advanced IP Blocking For ASUS Routers Using IPSet.

Skynet - Advanced IP Blocking For ASUS Routers Using IPSet. - Adamm00/IPSet_ASUS

github.com

 

[SomeWhereOverTheRainBow]

I will add screenshots of each steps and post again unless the double NAT issue is the culprit

The router is running in router mode, 192.168.2.9 is the IP address I assigned to it

Double NAT is likely as I have my router behind the ISP fiber router - unfortunately I am not able to switch that one to modem only as they only give you limited access to it. I was able to switch off UPnp on it, however DMZ is on and pointed toward my router at 192.168.2.9. So this might be the issue?

Hey as long as you know your router is in router mode, and your firewall is not disabled, I suspect Skynet would still work at filtering your outgoing packets only.

 

[SomeWhereOverTheRainBow]

Your issue has always seemed to be the inability to reach the github site. Run some tests from the router.

nslookup raw.githubusercontent.com
ping raw.githubusercontent.com
traceroute raw.githubusercontent.com
curl -v https://raw.githubusercontent.com/Adamm00/IPSet_ASUS/master/firewall.sh -o /dev/null

Don’t bother with USB replacement or double NAT. If you can’t reach the download site, none of it matters.

Do you live somewhere in the world where an ISP or government would want to block github? Or a country known for bad internet guys and so maybe github is blocking your country or ISP’s addresses?

Can you reach the normal github site from a PC (without a VPN)?

GitHub - Adamm00/IPSet_ASUS: Skynet - Advanced IP Blocking For ASUS Routers Using IPSet.

Skynet - Advanced IP Blocking For ASUS Routers Using IPSet. - Adamm00/IPSet_ASUS

github.com

It is interesting because he was able to install entware(unless that comes built within asuswrt merlin?) As his amtm image demonstrates he has both amtm and entware installed successfully.

 

[dave14305]

It is interesting because he was able to install entware(unless that comes built within asuswrt merlin?) As his amtm image demonstrates he has both amtm and entware installed successfully.

Neither relies on github.

 

[SomeWhereOverTheRainBow]

Neither relies on github.

Okay, I was suspicious of entware.

 

[SomeWhereOverTheRainBow]

I will add screenshots of each steps and post again unless the double NAT issue is the culprit

The router is running in router mode, 192.168.2.9 is the IP address I assigned to it

Double NAT is likely as I have my router behind the ISP fiber router - unfortunately I am not able to switch that one to modem only as they only give you limited access to it. I was able to switch off UPnp on it, however DMZ is on and pointed toward my router at 192.168.2.9. So this might be the issue?

One thing is for sure. Placing your router in the DMZ will expose all of its ports to the external network. So you would have the firewall of the router that is in double nat with internet hitting its firewall directly, however skynet will only filter be able to filter on the outgoing because skynet only filters outgoing traffic when the "wan-ip" is a private address. Skynet assumes that the ISP's modems firewall will be doing all the incoming filtering; however, it is not when you place the doublenat router in the DMZ.

 

[Smokey613]

My instance of Skynet looks to be filtering incoming traffic and I am in a triple NAT setup.

My AX86U Pro is in a DMZ on the ER605, which is in a DMZ on the ISP cable modem.

Skynet logs clearly show blocked incoming traffic.

 

[SomeWhereOverTheRainBow]

My instance of Skynet looks to be filtering incoming traffic and I am in a triple NAT setup.

My AX86U Pro is in a DMZ on the ER605, which is in a DMZ on the ISP cable modem.

Skynet logs clearly show blocked incoming traffic.

Hey I am just going off of what @Adamm has said in the past.

Skynet - Is default firewall good enough?

Starlink does things a bit differently: https://www.starlinkhardware.com/can-you-get-a-static-ip-from-starlink/ https://www.starlinkhardware.com/how-to-access-the-starlink-router-settings/ See Hacks section: https://hackaday.com/2021/05/24/starlink-a-review-and-some-hacks/...

www.snbforums.com

And as pointed out in the past, skynet logs any dropped traffic. Whether it is skynet doing the dropping is the actual question.

 

[SomeWhereOverTheRainBow]

My instance of Skynet looks to be filtering incoming traffic and I am in a triple NAT setup.

My AX86U Pro is in a DMZ on the ER605, which is in a DMZ on the ISP cable modem.

Skynet logs clearly show blocked incoming traffic.

Yes, but skynet logs all blocked incoming traffic. If there is no skynet blocklists associated with the blocks, then that is just the default firewall blocking those packets.

 

[Smokey613]

Hey I am just going off of what @Adamm has said in the past.

Skynet - Is default firewall good enough?

Starlink does things a bit differently: https://www.starlinkhardware.com/can-you-get-a-static-ip-from-starlink/ https://www.starlinkhardware.com/how-to-access-the-starlink-router-settings/ See Hacks section: https://hackaday.com/2021/05/24/starlink-a-review-and-some-hacks/...

www.snbforums.com

And as pointed out in the past, skynet logs any dropped traffic. Whether it is skynet doing the dropping is the actual question.

That would make sense. At least it logs the drops regardless if it’s Skynet or the default settings of the firewall itself doing the dropping.

 

[SomeWhereOverTheRainBow]

That would make sense. At least it logs the drops regardless if it’s Skynet or the firewall itself doing the dropping.

However, it shows skynets blocklists are not being used on incoming blocks. That is the picture I am painting. If you look at the other tables on skynets statistics of incoming traffic, look at the ban reason.

You can see which lists were used to determine the block. If it is a star, that means it was blocked by the firewall in general.

 

[Smokey613]

Here is my listing

 

[SomeWhereOverTheRainBow]

Here is my listing

Is your wanip address a public or private address?

 

[Smokey613]

Is your wanip address a public or private address?

Skynet shows it private when it loads.

More info…

 

[Smokey613]

More info….

 

[SomeWhereOverTheRainBow]

More info….

That's interesting, I wonder if @Adamm can explain why he says inbound traffic is not filtered by skynet if wanip is private when clearly it is.

 

[dave14305]

Yes, but skynet logs all blocked incoming traffic. If there is no skynet blocklists associated with the blocks, then that is just the default firewall blocking those packets.

Skynet only logs what’s in its blocklists.

You can see which lists were used to determine the block. If it is a star, that means it was blocked by the firewall in general.

If it’s an asterisk only, it likely means the IP range being blocked was using a larger CIDR than the 3 octets Skynet checks for in case an exact match is not found. Look at line 1000 in the code.

That's interesting, I wonder if @Adamm can explain why he says inbound traffic is not filtered by skynet if wanip is private when clearly it is.

In most lazy double-NAT configuractions, the unsolicited WAN traffic will never reach the second router. If the second router is in the DMZ of the first router, then that changes things.

Nothing to do with amtm, so this whole discussion should move elsewhere.

 

[SomeWhereOverTheRainBow]

Skynet only logs what’s in its blocklists.

If it’s an asterisk only, it likely means the IP range being blocked was using a larger CIDR than the 3 octets Skynet checks for in case an exact match is not found. Look at line 1000 in the code.

In most lazy double-NAT configuractions, the unsolicited WAN traffic will never reach the second router. If the second router is in the DMZ of the first router, then that changes things.

Nothing to do with amtm, so this whole discussion should move elsewhere.

Agreed the whole, I can install amtm, but cannot install skynet convo should have been in its own thread to begin with. Not on the list for steps of installing amtm. And we still have yet to see screenshots of the concerned users step by step installation process for skynet, or any confirmation on whether it is because their country blocks github.

 

[CaptainSTX]

But would skynet install in accesspoint mode is the real question here.

I have an AC1900P (386.11) which I am using as an AP. AMTM runs, I was able to format an USB drive, create a swap file, get scMerlin working including showing up on the addons tab, however I am unable to get Entware to install and without Entware most other scripts can not be added.

I suppose if someone had a need for the scripts on an AP they first could set it up as a router and then install the wanted scripts and then see if after it was switched back to an AP if they would continue to work.

 

[SomeWhereOverTheRainBow]

I have an AC1900P (386.11) which I am using as an AP. AMTM runs, I was able to format an USB drive, create a swap file, get scMerlin working including showing up on the addons tab, however I am unable to get Entware to install and without Entware most other scripts can not be added.

I suppose if someone had a need for the scripts on an AP they first could set it up as a router and then install the wanted scripts and then see if after it was switched back to an AP if they would continue to work.

That is an interesting thought, supposedly in AP mode the firewall is disabled, so would firewall-start scripts in jffs continue to run?