Skynet How to see which domains get blocked by Skynet?

[Rici]

Hi,

What is the option I have to select in Skynet (when connected to my router via SSH) to get a live view of outcoming traffic - including which domains get blocked?
IIRC there was an option for getting such a view, but I can't find that anymore.

Any hints?

Thank you!

 

[SomeWhereOverTheRainBow]

Hi,

What is the option I have to select in Skynet (when connected to my router via SSH) to get a live view of outcoming traffic - including which domains get blocked?
IIRC there was an option for getting such a view, but I can't find that anymore.

Any hints?

Thank you!

That's a tough one because Skynet blocks the IP address associated with a domain. Sometimes an IP address can be associated with more than one domain. So it is hard to say whether skynet can truely reverse engineer the IP back to domain properly. Not unless skynet has archived it somewhere for later use and diagnostics.

 

[Adamm]

Us

Hi,

What is the option I have to select in Skynet (when connected to my router via SSH) to get a live view of outcoming traffic - including which domains get blocked?
IIRC there was an option for getting such a view, but I can't find that anymore.

Any hints?

Thank you!

Use the command

firewall debug watch


If you have diversion installed, we use the dnsmasq log to identify blocks to domains.

 

[Rici]

That's a tough one because Skynet blocks the IP address associated with a domain. Sometimes an IP address can be associated with more than one domain. So it is hard to say whether skynet can truely reverse engineer the IP back to domain properly. Not unless skynet has archived it somewhere for later use and diagnostics.

Understand, it's all about IP addresses.

Unfortunately, as I experienced a couple of times, all of a sudden certain domains are blocked, and it's caused by Skynet.

That's what I a interested in to see: A client likes to access a web site and Skynet blocks that.

If there any way to get a live view of it (besides checking what is on blocklists)?

 

[vibroverbus]

Understand, it's all about IP addresses.

Unfortunately, as I experienced a couple of times, all of a sudden certain domains are blocked, and it's caused by Skynet.

That's what I a interested in to see: A client likes to access a web site and Skynet blocks that.

If there any way to get a live view of it (besides checking what is on blocklists)?

Found this checking to see if anything new had been done here but I guess not.

So the official way is to resolve to IP and use "Stats - Search - Malware" function.

From a shell this is pretty easy:

use bind or dig to get IP address x.x.x.x then...
firewall stats search malware x.x.x.x

Can also do in the Skynet menus but you have to lookup the IP first so its really 'harder'.

I wrote a tiny shell script years ago to automate, it seems to have gotten lost in router upgrades so I'm back to manual....

But yes IMO this has long been a gap in the UI. Would be great if there was a spot on the GUI where you could enter a domain and get some answers. Not sure why there's resistance to this its pretty handy. FWIW the end user use case for this is virtually always "is this server down or is it on a blocklist on the router". That should be something somebody can get an answer to super fast.

All it needs to do is the say "domain X resolves to IP Y (Z, etc.) which is on lists: A, B, C" (or "not found").

Yes you have to decide what to do if the domain resolves to multiple IP addresses. Not hard to just parse that and iterate, tho I think my script just used the first response which was adequate for 99% of my use cases.

Its too bad this isn't a simple function on the web GUI. I'd love to write it but I'm not really a great web coder.