Skynet Is default firewall good enough?

[Tech9]

or are they all completely different?

Seems like they are different (thanks @Viktor Jaep) and I used to run all 3 as well (plus other things), but reduced to level 1 only before getting to step 7 in post #10. Approximately around this time the suricates pack of 30 got reduced to an older couple with no kids.

 

[Viktor Jaep]

Thanks for taking the time to share with us. I highly appreciate it.

As a reward: I also want to share a list of IP's for highly elusive nasties

https://raw.githubusercontent.com/jumpsmm7/GeneratedAdblock/master/IPlist.list

Thanks @SomeWhereOverTheRainBow! Question... How did you come across this list, or what source did you use to compile it?

 

[Viktor Jaep]

Seems like they are different (thanks @Viktor Jaep) and I used to run all 3 as well (plus other things), but reduced to level 1 only before getting to step 7 in post #10. Approximately around this time the suricates pack of 30 got reduced to an older couple with no kids.

So, @Tech9 ... From personal experience, I've been able to use my custom filter list including those 3 firehol lists without setting off any alarms, pissing off the rest of my click-happy teens, or dealing with step #7 or beyond. It's gone relatively smooth!

 

[SomeWhereOverTheRainBow]

Thanks @SomeWhereOverTheRainBow! Question... How did you come across this list, or what source did you use to compile it?

On my github there, a few of the Ad list I use to generate my list from which also add some IP address's to the list, probably the firebog ones, but those IP addresses are compiled IP addresses of elusive servers (meaning the domains change frequently) that just do a combination of nasty such as trackers, cryptominers, malware , and other sorts of bad.

 

[L0nkFromPA]

I also have my own list that I maintain:

https://raw.githubusercontent.com/ibell63/lists/master/filter.list

It’s more paranoid but I don’t have any FPs. I feel like at least the lists inside will be useful to some people. In particular, https://threatview.io/Downloads/IP-High-Confidence-Feed.txt is very nice, and also https://raw.githubusercontent.com/stamparm/ipsum/master/levels/2.txt has virtually zero FPs because of the logic with which it’s generated.

I also make sure the lists I’m using are regularly updated. Some of the lists in the default filter.list haven’t been updated in years. My list also blocks TOR which some people might not want. I could make different versions with different policies if anybody wants.

I currently have 3 versions, “paranoid”, which is basically beta. The link I posted is for what I consider to be the stable list, and “level1” is well tested. They’re all identical as of now as I’m sure all the lists are good.

 

[Viktor Jaep]

I also have my own list that I maintain:

https://raw.githubusercontent.com/ibell63/lists/master/filter.list

It’s more paranoid but I don’t have any FPs. I feel like at least the lists inside will be useful to some people. In particular, https://threatview.io/Downloads/IP-High-Confidence-Feed.txt is very nice, and also https://raw.githubusercontent.com/stamparm/ipsum/master/levels/2.txt has virtually zero FPs because of the logic with which it’s generated.

I also make sure the lists I’m using are regularly updated. Some of the lists in the default filter.list haven’t been updated in years. My list also blocks TOR which some people might not want. I could make different versions with different policies if anybody wants.

I currently have 3 versions, “paranoid”, which is basically beta. The link I posted is for what I consider to be the stable list, and “level1” is well tested. They’re all identical as of now as I’m sure all the lists are good.

Thanks for the suggestion with threatview... I've added those now as well.

 

[L0nkFromPA]

Thanks for the suggestion with threatview... I've added those now as well.

Note: https://threatview.io/Downloads/Experimental-IOC-Tweets.txt has file hashes at the end. I don't know how Skynet / bash will handle that.

 

[Viktor Jaep]

Note: https://threatview.io/Downloads/Experimental-IOC-Tweets.txt has file hashes at the end. I don't know how Skynet / bash will handle that.

Thanks for the heads-up. It seemed to ingest it just fine... probably smart enough to kick out anything that doesn't look like an IP.

 

[SomeWhereOverTheRainBow]

Thanks for the heads-up. It seemed to ingest it just fine... probably smart enough to kick out anything that doesn't look like an IP.

can you say

echo 576747640bbc9e8922cb0c45c7357ccee4ccd36a | grep -oE "\b((25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.){3}(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\b"

or

 echo 192.168.1.1 | grep -oE "\b((25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.){3}(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\b"
192.168.1.1

or what if we want all none local ips only

echo 192.168.1.1 | grep -oE "\b((25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.){3}(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\b" | grep -vE '^(192\.168|10\.|172\.1[6789]\.|172\.2[0-9]\.|172\.3[01]\.)'

printf '14.1.98.226/n192.168.1.1' | grep -oE "\b((25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.){3}(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\b" | grep -vE '^(192\.168|10\.|172\.1[6789]\.|172\.2[0-9]\.|172\.3[01]\.)'
14.1.98.226

 

[Spud]

pfBlockerNG on pfSense in my case.

You have to use custom blocking list in Skynet. The default is this one:

IPSet_ASUS/filter.list at master · Adamm00/IPSet_ASUS

Skynet - Advanced IP Blocking For ASUS Routers Using IPSet. - Adamm00/IPSet_ASUS

github.com

What we use is this one only:

https://iplists.firehol.org/files/firehol_level1.netset

And a description what it is here:

FireHOL IP Lists | IP Blacklists | IP Reputation Feeds

350+ IP blacklists, IP blocklists and IP Reputation feeds, about Cybercrime, Fraud, Botnets, Μalware, Virus, Abuse, Attacks, Open Proxies, Anonymizers. See their changes and updates, size over time, retention policy, geographic coverage, comparisons and overlaps.

iplists.firehol.org

I gave this a go in Skynet. The 33K IP blocks with default lists dropped to a mere 250 (although Firehol 1 contains over 600 million IPs). Do you see something similar?

 

[Viktor Jaep]

I gave this a go in Skynet. The 33K IP blocks with default lists dropped to a mere 250 (although Firehol 1 contains over 600 million IPs). Do you see something similar?

Haven't used default in quite a while... still using my own custom list. In fact, I had added Firehol 4 and the Firehol_Webserver lists to my blocklist yesterday, and wow... some major blockage going on there. Guess it's not safe for production/family use. I had to back off when it stopped loading regular standard websites, and made my Google Home malfunction, and then the screaming started.

 

[SomeWhereOverTheRainBow]

Haven't used default in quite a while... still using my own custom list. In fact, I had added Firehol 4 and the Firehol_Webserver lists to my blocklist yesterday, and wow... some major blockage going on there. Guess it's not safe for production/family use. I had to back off when it stopped loading regular standard websites, and made my Google Home malfunction, and then the screaming started.

Here is the filter list i am currently rocking, (and yes any one is welcome to try it.)

https://raw.githubusercontent.com/jumpsmm7/GeneratedAdblock/master/filter.list

And I have yet to have a false positive.

 

[cptnoblivious]

@SomeWhereOverTheRainBow do you regularly look into the outbound blocks?

 

[SomeWhereOverTheRainBow]

@SomeWhereOverTheRainBow do you regularly look into the outbound blocks?

Sometimes. Haven't noticed any breaking or connection concerns if that is what your question is aiming at. What actual concerns do you have?

 

[cptnoblivious]

Sometimes. Haven't noticed any breaking or connection concerns if that is what your question is aiming at. What actual concerns do you have?

If I had 300+ outbound blocks I'd check on what was causing it. At worst, something is wrong on my network, but I'd just be concerned about blocking legitimate traffic.

 

[SomeWhereOverTheRainBow]

If I had 300+ outbound blocks I'd check on what was causing it. At worst, something is wrong on my network, but I'd just be concerned about blocking legitimate traffic.

Yea majority of the outbound blocks are from Chatty IoT devices. I have multiple IoT devices that like to constantly call home. For no other particular reason than just doing what IoT devices do. However, it has not broke their actual functionality, so I am not concerned.

 

[Viktor Jaep]

If I had 300+ outbound blocks I'd check on what was causing it. At worst, something is wrong on my network, but I'd just be concerned about blocking legitimate traffic.

I typically run a check against it's IP on AlienVault if something looks suspicious or just to spot check...

LevelBlue - Open Threat Exchange

Learn about the latest cyber threats. Research, collaborate, and share threat intelligence in real time. Protect yourself and the community against today's emerging threats.

otx.alienvault.com

 

[Kingp1n]

What's the deal with using Unbound along side w/skynet? Does skynet some how messes with the performance? I'm using both with default settings but just wondering what issues may be encounter when using both?

 

[dave14305]

What's the deal with using Unbound along side w/skynet? Does skynet some how messes with the performance? I'm using both with default settings but just wondering what issues may be encounter when using both?

Some nameservers might be blocked by the Skynet lists, especially if using country blocking.

 

[Kingp1n]

Some nameservers might be blocked by the Skynet lists, especially if using country blocking.

Dumb question...if I don't use country blocking this would not apply or mess with the performance, correct?