Skynet Hundreds of Outbound Blocks from Pi-hole

phneeley · Dec 16, 2023

Hi all, I just got my Pi-hole up and running and noticed in Skynet hundreds of blocked outbound connections originating with the Pi-hole device. Is this normal?

dave14305 · Dec 16, 2023

Could be normal if you have Unbound installed on the Pi-Hole and you have excessive country blocking in Skynet. Are all the blocks for port 53?

bennor · Dec 16, 2023

phneeley said:
Hi all, I just got my Pi-hole up and running and noticed in Skynet hundreds of blocked outbound connections originating with the Pi-hole device. Is this normal?

WIthout more information there is no way to tell if normal. As the previous poster asked, are you using Unbound? How is Skynet configured? What specific addresses are the hundreds that are being blocked by Skynet? What devices on your network are you running, is Pi-Hole indicating a large number of requests from specific devices? Certain devices, like Roku's, may send hundreds of requests if it cannot reach certain telemetry sites.

SomeWhereOverTheRainBow · Dec 17, 2023

dave14305 said:
Could be normal if you have Unbound installed on the Pi-Hole and you have excessive country blocking in Skynet. Are all the blocks for port 53?

You don't even need country blocking to cause Skynet to block Pi-Hole(unbound), it could simply be one of the blocked rages or single IP's causing it.

A simple firewall rule Added to firewall-start can solve this.

Code:

/usr/sbin/iptables -t raw -I PREROUTING -p udp --sport 1024:65535 --dport 53 -s [replace with IPaddress of pihole] -j ACCEPT
/usr/sbin/iptables -t raw -I PREROUTING -p tcp --sport 1024:65535 --dport 53 -s [replace with IPaddress of pihole] -j ACCEPT

Obviously adjust the source port range to match whatever you allow for unbound port randomization, typically by default it is 1024:65535.

phneeley · Dec 17, 2023

bennor · Dec 17, 2023

What does the Pi-Hole Query Log show for those IP addresses (if anything), does it indicate which device is making the request that is being blocked by Skynet? If so check that device, could be normal requests or it could be the device might be compromised or infected.

Tech9 · Dec 17, 2023

Or some IoT device trying to communicate with the online server it depends on.

Viktor Jaep · Dec 17, 2023

Tech9 said:
Or some IoT device trying to communicate with the online server it depends on.

My chinese-built robovac, picture frame and wireless power outlets love to try to relentlessly communicate with their homebase in CN... nope, DENIED!

SomeWhereOverTheRainBow · Dec 22, 2023

Viktor Jaep said:
My chinese-built robovac, picture frame and wireless power outlets love to try to relentlessly communicate with their homebase in CN... nope, DENIED!

That's how they try to secretly gain knowledge of your usage data.. After-all, why did they need to know you were keeping that lil robovac busy at 3am while using the picture frame as your only light source since the wireless power outlet has been acting abit buggy lately missing out on all those bug checks and firmware updates.......

Weblee2407 · Dec 22, 2023

I noticed a few things in SkyNet I would like clarification on too. I have SkyNet installed and using ban list:
ban country "ru cn kp ir iq sa ae pk af az ba bg hr cu cz eg ee ge va hu id in il kz kw kg lv md om qa ro rs sk si sy tr ua uz" and also using Unbound with safe search enabled.

I expect to have at least one outbound device with blocks in addition to my WAN address because that person uses Kaspersky. Here is the header outbound block count

Here is the device outbound connection listing...the top is the router with 21 blocks and the bottom is my Kaspersky user with 10. So where does the "2" come from in KEY STATS?

SomeWhereOverTheRainBow · Dec 22, 2023

Weblee2407 said:
I noticed a few things in SkyNet I would like clarification on too. I have SkyNet installed and using ban list:
ban country "ru cn kp ir iq sa ae pk af az ba bg hr cu cz eg ee ge va hu id in il kz kw kg lv md om qa ro rs sk si sy tr ua uz" and also using Unbound with safe search enabled.

I expect to have at least one outbound device with blocks in addition to my WAN address because that person uses Kaspersky. Here is the header outbound block count

View attachment 55047

Here is the device outbound connection listing...the top is the router with 21 blocks and the bottom is my Kaspersky user with 10. So where does the "2" come from in KEY STATS? View attachment 55048

Do you have only one device connected to the internet or only one not traveling VIA VPN?

heres mine,

dave14305 · Dec 22, 2023

Weblee2407 said:
So where does the "2" come from in KEY STATS?

That number comes from the current state (and counters) of the firewall rules. So if the firewall has been restarted recently, the counters also get reset to zero. Other charts come from scanning the historical logs that Skynet keeps.

Weblee2407 · Dec 22, 2023

19 IOT devices on an isolated guest SSID and 15 other 5ghz phones iPads laptops tvs and Apple TV boxes. I have systematically reset anything that showed up in device connections until I have just wan and ms kaspersky listed. I had something in that IOT group calling home and the network was slooow because it was probing anything it could reach.

How could I find out what those devices were trying to connect to?

Thread starter	Title	Forum	Replies	Date
A	Skynet Outbound block notification mail	Asuswrt-Merlin AddOns	0	Sunday at 7:27 AM
K	Skynet No data to display for only outbound?	Asuswrt-Merlin AddOns	5	Sep 13, 2024
N	Skynet SkyNet/Firewall blocking all ping requests, including outbound	Asuswrt-Merlin AddOns	6	Jul 29, 2024
B	Skynet Outbound blocks	Asuswrt-Merlin AddOns	1	Jul 19, 2024
A	[SOLVED] Turned off outbound filtering and qos for upload still incredibly slow upload speeds?	Asuswrt-Merlin AddOns	24	Mar 29, 2024
B	Skynet Source LAN IP for outbound IP blocked by SkyNet	Asuswrt-Merlin AddOns	8	Feb 26, 2024
	Diversion Kids mode blocks normal dhcp function	Asuswrt-Merlin AddOns	4	Sep 3, 2024
	Blocking “RO” country code in Skynet blocks Proton VPN UK connections	Asuswrt-Merlin AddOns	2	Apr 28, 2024
A	Diversion apparently blocks domains not included in any list	Asuswrt-Merlin AddOns	9	Mar 21, 2024

Search

Search

Skynet Hundreds of Outbound Blocks from Pi-hole

phneeley

Occasional Visitor

dave14305

Part of the Furniture

bennor

Part of the Furniture

SomeWhereOverTheRainBow

Part of the Furniture

phneeley

Occasional Visitor

bennor

Part of the Furniture

Tech9

Part of the Furniture

Viktor Jaep

Part of the Furniture

SomeWhereOverTheRainBow

Part of the Furniture

Weblee2407

Regular Contributor

SomeWhereOverTheRainBow

Part of the Furniture

dave14305

Part of the Furniture

Weblee2407

Regular Contributor

Similar threads

Similar threads

Latest threads

Support SNBForums w/ Amazon

Sign Up For SNBForums Daily Digest

Members online