Skynet Is default firewall good enough?

[Quoc Huynh]

Hello! Can anybody help me please? I faced this issue after installing Skynet and cant find any working solution or understand what caused it. Do you have any ideas or solutions how to fix that?

[1-5]: 2

Input Custom Filter List URL:
[URL]: https://raw.githubusercontent.com/ViktorJp/Skynet/main/filter.list

[$] /jffs/scripts/firewall banmalware https://raw.githubusercontent.com/ViktorJp/Skynet/main/filter.


=====================================================================================================


killall: syslog-ng: no process killed
[i] Custom Filter Detected: https://raw.githubusercontent.com/ViktorJp/Skynet/main/filter.list
[i] Downloading filter.list         | [0s]
[i] Refreshing Whitelists           | [8s]
[i] Consolidating Blacklist         | [0s]
[*] List Content Error Detected - Stopping Banmalware


=====================================================================================================


[#] 1 IPs (+0) -- 0 Ranges Banned (+0) || 0 Inbound -- 0 Outbound Connections Blocked! [banmalware] ]



[i] Press Enter To Continue...

I encountered this when re-installing Skynet 7.5.8 after a long time of using AiProtection. I think there maybe either website-file-content issue with Github, or Skynet itself. Because I got this issue when either:
1/ Importing ViktorJp list
2/ Creating my own "filter.list" on Github because I had wanted to customize my own firewall rules. This issue had happened again, until I recognised that I had to use the Raw file format. However, when modifying the file, sometimes Skynet warned me of "invalid file date format" and refused to use it. I tried removing and reinstalling Skynet with no luck, until it resolved automatically and "magically" after I imported Somewhere Over The Raibow list below

https://raw.githubusercontent.com/jumpsmm7/GeneratedAdblock/master/filter.list

Although Skynet did show the "List content error", it still imported the file. Futhermore, a mysterical thing was that when modifying my file on Github and importing it in Skynet again the day after, there was no error at all.

P/s: I have an AX-88U with Asuswrt-Merlin 3004.388.6_2, and using latest of Diversion, Skynet, ntpMerlin, CakeQoS, MerlinAU and BackupMON.

 

[sfx2000]

Do you think the default AX86U firewall, combined with the usual windows firewall is good enough, and is there any real advantage in using Skynet?

There is zero advantage...

 

[ukrainer]

I encountered this when re-installing Skynet 7.5.8 after a long time of using AiProtection. I think there maybe either website-file-content issue with Github, or Skynet itself. Because I got this issue when either:
1/ Importing ViktorJp list
2/ Creating my own "filter.list" on Github because I had wanted to customize my own firewall rules. This issue had happened again, until I recognised that I had to use the Raw file format. However, when modifying the file, sometimes Skynet warned me of "invalid file date format" and refused to use it. I tried removing and reinstalling Skynet with no luck, until it resolved automatically and "magically" after I imported Somewhere Over The Raibow list below

https://raw.githubusercontent.com/jumpsmm7/GeneratedAdblock/master/filter.list

Although Skynet did show the "List content error", it still imported the file. Futhermore, a mysterical thing was that when modifying my file on Github and importing it in Skynet again the day after, there was no error at all.

P/s: I have an AX-88U with Asuswrt-Merlin 3004.388.6_2, and using latest of Diversion, Skynet, ntpMerlin, CakeQoS, MerlinAU and BackupMON.

I have the same router and very similar apps (all updated), but problem is persistent. And i tried the second link too - result the same:

[1-5]: 2

Input Custom Filter List URL:
[URL]: https://raw.githubusercontent.com/jumpsmm7/GeneratedAdblock/master/filter.list

[$] /jffs/scripts/firewall banmalware https://raw.githubusercontent.com/jumpsmm7/GeneratedAdblock/ma


=====================================================================================================


killall: syslog-ng: no process killed
[i] Custom Filter Detected: https://raw.githubusercontent.com/jumpsmm7/GeneratedAdblock/master/filtet
[i] Downloading filter.list         | [0s]
[i] Refreshing Whitelists           | [7s]
[i] Consolidating Blacklist         | [0s]
[*] List Content Error Detected - Stopping Banmalware


=====================================================================================================


[#] 1 IPs (+0) -- 0 Ranges Banned (+0) || 0 Inbound -- 0 Outbound Connections Blocked! [banmalware] ]



[i] Press Enter To Continue...

It seems the problem is in Skynet or conflicting apps. But where to dig and how to fix it? Do anybody have an idea?

 

[SomeWhereOverTheRainBow]

I have the same router and very similar apps (all updated), but problem is persistent. And i tried the second link too - result the same:

[1-5]: 2

Input Custom Filter List URL:
[URL]: https://raw.githubusercontent.com/jumpsmm7/GeneratedAdblock/master/filter.list

[$] /jffs/scripts/firewall banmalware https://raw.githubusercontent.com/jumpsmm7/GeneratedAdblock/ma


=====================================================================================================


killall: syslog-ng: no process killed
[i] Custom Filter Detected: https://raw.githubusercontent.com/jumpsmm7/GeneratedAdblock/master/filtet
[i] Downloading filter.list         | [0s]
[i] Refreshing Whitelists           | [7s]
[i] Consolidating Blacklist         | [0s]
[*] List Content Error Detected - Stopping Banmalware


=====================================================================================================


[#] 1 IPs (+0) -- 0 Ranges Banned (+0) || 0 Inbound -- 0 Outbound Connections Blocked! [banmalware] ]



[i] Press Enter To Continue...

It seems the problem is in Skynet or conflicting apps. But where to dig and how to fix it? Do anybody have an idea?

Okay, from the SSH command line connected to the router, run this command nslookup raw.githubusercontent.com.

Also, from the SSH command line connected to the router, run this command ping raw.githubusercontent.com .

Here is an example of what you might expect to see if both DNS and connection to the IP address's for the domain are working correctly:

admin@RT-AX88U_Pro-27C8:/tmp/home/root# nslookup raw.githubusercontent.com
Server:    192.168.1.1
Address 1: 192.168.1.1 brother.lan

Name:      raw.githubusercontent.com
Address 1: 185.199.111.133 cdn-185-199-111-133.github.com
Address 2: 185.199.108.133 cdn-185-199-108-133.github.com
Address 3: 185.199.109.133 cdn-185-199-109-133.github.com
Address 4: 185.199.110.133 cdn-185-199-110-133.github.com
Address 5: 2606:50c0:8001::154
Address 6: 2606:50c0:8000::154
Address 7: 2606:50c0:8003::154
Address 8: 2606:50c0:8002::154
admin@RT-AX88U_Pro-27C8:/tmp/home/root# ping raw.githubusercontent.com
PING raw.githubusercontent.com (185.199.108.133): 56 data bytes
64 bytes from 185.199.108.133: seq=0 ttl=58 time=13.131 ms
64 bytes from 185.199.108.133: seq=1 ttl=58 time=10.085 ms
64 bytes from 185.199.108.133: seq=2 ttl=58 time=14.524 ms
64 bytes from 185.199.108.133: seq=3 ttl=58 time=9.956 ms
64 bytes from 185.199.108.133: seq=4 ttl=58 time=9.386 ms
64 bytes from 185.199.108.133: seq=5 ttl=58 time=9.319 ms
64 bytes from 185.199.108.133: seq=6 ttl=58 time=12.775 ms
64 bytes from 185.199.108.133: seq=7 ttl=58 time=16.718 ms
64 bytes from 185.199.108.133: seq=8 ttl=58 time=17.677 ms
64 bytes from 185.199.108.133: seq=9 ttl=58 time=11.613 ms
^C
--- raw.githubusercontent.com ping statistics ---
10 packets transmitted, 10 packets received, 0% packet loss
round-trip min/avg/max = 9.319/12.518/17.677 ms

 

[Diablo99]

If anyone's interested, I've been using my own custom filter list for Skynet... plug this URL into Skynet and profit:

https://raw.githubusercontent.com/ViktorJp/Skynet/main/filter.list

And yes, it contains all 3 Firehol lists as well.

Maybe this is asked before.

Where (in which option of Skynet 3 or 5) to put it?
Should I replace the Blacklist?

 

[ukrainer]

It seems the list https://github.com/firehol/blocklist-ipsets/ really corrupted my Skynet. But I found the second reason of my issue too - I used DNS-over-TLS and one of choosen DNS servers worker improper. So I totally uninstalled Skynet, reseted WAN DNS settings and setted them again in a proper way. Now two custom lists as the original one are working and updating correctly. Thank you for support!

 

[Quoc Huynh]

Maybe this is asked before.

Where (in which option of Skynet 3 or 5) to put it?
Should I replace the Blacklist?

You can select option 3 - Malware blacklist, then select option 3 - Change filter list, and paste the URL of your chosen one. Once doing that, Adamm default filter list will be replaced with yours.

 

[Diablo99]

You can select option 3 - Malware blacklist, then select option 3 - Change filter list, and paste the URL of your chosen one. Once doing that, Adamm default filter list will be replaced with yours.

Is a big difference between the lists?
Or are the almost the same?
Do I need to update the custom list?

 

[Quoc Huynh]

Since being a normal user, not a cybersecurity expert, I think differences among the lists are the amount of sub-lists, and number of blocking IPs. Because each list owner tends to customize their list to their firewall rules, they would add or remove some sub-lists inside.
In terms of updating the custom list, I think you do not need to because most of the sub-lists are updated automatically. Furthermore, as using other users' list, you cannot modify it, unless you create your own one on Github.

 

[laracroftonline]

My piece of advice whitelist these domains:
raw.githubusercontent.com
githubusercontent.com
github.com