Skynet How to find all previously manually blacklisted domains

[jorgsmash]

Hi all. I have Skynet/Diversion installed and I have previously blacklisted around 11 or so domains associated with LG WebOS TV ads. For backstory I needed to block these domains to stop the TV from checking for Software updates and notifying me, because I rooted the TV. I wasn't actually getting ads on the TV.

I need to diagnose which of those domains I added blocks apple airplay on my local network, or blocks the TV from being able to detect it's connected to a network. The networking works, apps like netflix and other streaming apps still work, but the TV settings show it's not connected to a network. I assume the OS uses a connection to an LG domain to check connectivity. This has subsequently blocked Apple Airplay because it says the TV is not connected to a network. Samsung SmartShare still works lol.

I can't remember if I blocked the domains in Skynet or Diversion, and I can't find an easy way to search for domains that I have blocked previously. Are the domains stored in a file somewhere? I have tried the search function in Skynet and had no luck.

I need to go through one by one to see which of the domains I need to remove or whitelist. Should I just whitelist each domain one by one in skynet and test? A whitelist will override a blacklist (I think). But then how will I remove the domain from the whitelist if I can't find them. I don't understand if I would use the "unban/ban" options in the skynet menu, or the whitelist menu. I must have used the "ban" option to block the domains, as I don't see a "blacklist" option other than the "malware blacklist" option.

 

[Twiglets]

The 'events.log' file in the skynet directory should contain a line for each manual ban (See made up examples below):

Oct 18 19:29:33 Skynet: [Manual Ban] TYPE=Range SRC=10.14.0.0/16 COMMENT=made up stuff​

Oct 18 21:39:50 Skynet: [Manual Ban] TYPE=Single SRC=210.13.39.104 COMMENT=more made up stuff​

​

Search the 'events.log' for "[Manual Ban]"

Not the 'correct' way to do it BUT I can not work out where the data is saved and how to retrieve it otherwise.
Hope this is of some help !!!

P.S. Happy Christmas and all the best in the New Year to everyone !!!

​

 

[Adamm]

As per the readme;

Example Stats Commands:​

• firewall stats search manualbans: Search for all manual bans.

 

[jorgsmash]

As per the readme;

That returns nothing.

t# firewall stats search manualbans
#############################################################################################################
#                                                                                                           #
#                  ███████╗██╗  ██╗██╗   ██╗███╗   ██╗███████╗████████╗    ██╗   ██╗███████╗                #
#                  ██╔════╝██║ ██╔╝╚██╗ ██╔╝████╗  ██║██╔════╝╚══██╔══╝    ██║   ██║╚════██║                #
#                  ███████╗█████╔╝  ╚████╔╝ ██╔██╗ ██║█████╗     ██║       ██║   ██║    ██╔╝                #
#                  ╚════██║██╔═██╗   ╚██╔╝  ██║╚██╗██║██╔══╝     ██║       ╚██╗ ██╔╝   ██╔╝                 #
#                  ███████║██║  ██╗   ██║   ██║ ╚████║███████╗   ██║        ╚████╔╝    ██║                  #
#                  ╚══════╝╚═╝  ╚═╝   ╚═╝   ╚═╝  ╚═══╝╚══════╝   ╚═╝         ╚═══╝     ╚═╝                  #
#                                                                                                           #
#                                 Router Firewall And Security Enhancements                                 #
#                             By Adamm -  https://github.com/Adamm00/IPSet_ASUS                             #
#                                            27/07/2024 - v7.6.3                                            #
#############################################################################################################


=============================================================================================================


[i] Logging Data Detected in /tmp/mnt/sda1/skynet/skynet.log - 8.1M
[i] Monitoring From Dec 29 15:54:53 To Dec 30 09:32:28
[i] 33968 Block Events Detected
[i] 6431 Unique IPs
[i] 0 Manual Bans Issued

First Manual Ban Issued On
Last Manual Ban Issued On

First Manual Ban Issued;

10 Most Recent Manual Bans;


=============================================================================================================


[#] 390109 IPs (+0) -- 78842 Ranges Banned (+0) || 7033 Inbound -- 249489 Outbound Connections Blocked! [stats] [5s]

jorg@RT-AX88U-F610:/tmp/home/root#

I was able to see the blocked domain in the Diversion menu by tailing the Dnsmasq log blocked domains by device IP. After I whitelisted the domain it fixed the issue and Apple Airplay works now.

 

[Adamm]

That returns nothing.

t# firewall stats search manualbans
#############################################################################################################
#                                                                                                           #
#                  ███████╗██╗  ██╗██╗   ██╗███╗   ██╗███████╗████████╗    ██╗   ██╗███████╗                #
#                  ██╔════╝██║ ██╔╝╚██╗ ██╔╝████╗  ██║██╔════╝╚══██╔══╝    ██║   ██║╚════██║                #
#                  ███████╗█████╔╝  ╚████╔╝ ██╔██╗ ██║█████╗     ██║       ██║   ██║    ██╔╝                #
#                  ╚════██║██╔═██╗   ╚██╔╝  ██║╚██╗██║██╔══╝     ██║       ╚██╗ ██╔╝   ██╔╝                 #
#                  ███████║██║  ██╗   ██║   ██║ ╚████║███████╗   ██║        ╚████╔╝    ██║                  #
#                  ╚══════╝╚═╝  ╚═╝   ╚═╝   ╚═╝  ╚═══╝╚══════╝   ╚═╝         ╚═══╝     ╚═╝                  #
#                                                                                                           #
#                                 Router Firewall And Security Enhancements                                 #
#                             By Adamm -  https://github.com/Adamm00/IPSet_ASUS                             #
#                                            27/07/2024 - v7.6.3                                            #
#############################################################################################################


=============================================================================================================


[i] Logging Data Detected in /tmp/mnt/sda1/skynet/skynet.log - 8.1M
[i] Monitoring From Dec 29 15:54:53 To Dec 30 09:32:28
[i] 33968 Block Events Detected
[i] 6431 Unique IPs
[i] 0 Manual Bans Issued

First Manual Ban Issued On
Last Manual Ban Issued On

First Manual Ban Issued;

10 Most Recent Manual Bans;


=============================================================================================================


[#] 390109 IPs (+0) -- 78842 Ranges Banned (+0) || 7033 Inbound -- 249489 Outbound Connections Blocked! [stats] [5s]

jorg@RT-AX88U-F610:/tmp/home/root#

I was able to see the blocked domain in the Diversion menu by tailing the Dnsmasq log blocked domains by device IP. After I whitelisted the domain it fixed the issue and Apple Airplay works now.

So that implies you never manually banned the domains in Skynet, only the IP’s may have been banned.

 

[jorgsmash]

So that implies you never manually banned the domains in Skynet, only the IP’s may have been banned.

Would the ban action be logged somewhere? Is there a log file size limit where the log gets overwritten? I see the skynet log is 8.1 mb as shown above and I'm wondering if it gets overwritten after say 10 mb. I definitely blocked the domains... I saved the list of domains that I blocked in case I had issues:

snu.lge.com
su.lge.com
lgtvonline.lge.com
lgad.cjpowercast.com.edgesuite.net
ngfts.lge.com
us.ad.lgsmartad.com
us.info.lgsmartad.com
aic.rdl.lgtvcommon.com
us.lgtvsdp.com
aic.recommend.lgtvcommon.com
ueiwsp.com

lgtvonline.lge.com is the one I had to unban/whitelist. Can we check a log somewhere? Thanks.