Skynet Is default firewall good enough?

[UoFruitE]

@Mister2088

I wrote a simple spamhaus_drop and dshield processing script using GitHub Actions that automatically updates roughly every 30 minutes.

Processed spamhaus_drop:

https://raw.githubusercontent.com/UoFruitE/ProcessedLists/main/processed_drop.txt

Processed dshield:

https://raw.githubusercontent.com/UoFruitE/ProcessedLists/main/processed_dshield.txt

They should work with Skynet.

Hopefully firehol can fix their problem soon.

 

[Mister2088]

@Mister2088

I wrote a simple spamhaus_drop and dshield processing script using GitHub Actions that automatically updates roughly every 30 minutes.

Processed spamhaus_drop:

https://raw.githubusercontent.com/UoFruitE/ProcessedLists/main/processed_drop.txt

Processed dshield:

https://raw.githubusercontent.com/UoFruitE/ProcessedLists/main/processed_dshield.txt

They should work with Skynet.

Hopefully firehol can fix their problem soon.

thanks

 

[Bogey]

If anyone's interested, I've been using my own custom filter list for Skynet... plug this URL into Skynet and profit:

https://raw.githubusercontent.com/ViktorJp/Skynet/main/filter.list

And yes, it contains all 3 Firehol lists as well.

I’ve been using this almost since the day you posted your link and it performed quite well.
Unfortunately, since the last two updates of Skynet (probably not the cause), Skynet is blocking these Google domains: android.l.google.com youtube-ui.l.google.com ytimg.l.google.com encrypted-tbn2.gstatic.com with the ban reason 1.txt
The result is that YouTube, but also Google account overview aren’t accessible anymore.
However, when I’m going through your list, I don’t see these entries.
What suggestions can you give on how to fix this?

thanks,
Eddie

p.s. after clearing skynet of the non-manual bans, youtube works again.

 

[Viktor Jaep]

I’ve been using this almost since the day you posted your link and it performed quite well.
Unfortunately, since the last two updates of Skynet (probably not the cause), Skynet is blocking these Google domains: android.l.google.com youtube-ui.l.google.com ytimg.l.google.com encrypted-tbn2.gstatic.com with the ban reason 1.txt
The result is that YouTube, but also Google account overview aren’t accessible anymore.
However, when I’m going through your list, I don’t see these entries.
What suggestions can you give on how to fix this?

thanks,
Eddie

p.s. after clearing skynet of the non-manual bans, youtube works again.

Thanks for the feedback, Eddie! I actually added a few more experimental lists just last week I believe, that both @SomeWhereOverTheRainBow and I were toying with. That 1.txt file is definitely one of them. Strange thing is, we use Android and YouTube religiously in our house, and have not run across any blocks as of yet. I will make some modifications in a few, and will let you know when to hit refresh on the blacklist in skynet. Okay?

 

[Viktor Jaep]

I’ve been using this almost since the day you posted your link and it performed quite well.
Unfortunately, since the last two updates of Skynet (probably not the cause), Skynet is blocking these Google domains: android.l.google.com youtube-ui.l.google.com ytimg.l.google.com encrypted-tbn2.gstatic.com with the ban reason 1.txt
The result is that YouTube, but also Google account overview aren’t accessible anymore.
However, when I’m going through your list, I don’t see these entries.
What suggestions can you give on how to fix this?

thanks,
Eddie

p.s. after clearing skynet of the non-manual bans, youtube works again.

@Bogey ... please go ahead and update the malware blacklist in skynet, and please let me know if you see any better results?

 

[chongnt]

@Bogey ... please go ahead and update the malware blacklist in skynet, and please let me know if you see any better results?

I been using your list for few months. Is this the current list? If I remember correctly it used to be around 170k. The IP list almost doubled?

328944 IPs (+0) -- 9095 Ranges Banned (+0) || 19740 Inbound -- 2098 Outbound Connections Blocked!

 

[Viktor Jaep]

I been using your list for few months. Is this the current list? If I remember correctly it used to be around 170k. The IP list almost doubled?

328944 IPs (+0) -- 9095 Ranges Banned (+0) || 19740 Inbound -- 2098 Outbound Connections Blocked!

Yeah, those new additions doubled it... but I took a few off to see if that removed some of the false positives, and now it's back down to the 180+K range when you update it next time...

 

[Bogey]

@Bogey ... please go ahead and update the malware blacklist in skynet, and please let me know if you see any better results?

Thank you Viktor, I will report back.
FYI, I have one Android device and haven’t noticed anything weird on there. The device I did have trouble with are iPhone and iPad. I haven’t tested my desktop yet.

 

[Viktor Jaep]

I been using your list for few months. Is this the current list? If I remember correctly it used to be around 170k. The IP list almost doubled?

328944 IPs (+0) -- 9095 Ranges Banned (+0) || 19740 Inbound -- 2098 Outbound Connections Blocked!

BTW... these are the additions I made @chongnt @Bogey ... seems like an interesting project. I removed the first 2 levels, hoping that levels 3 - 7 will yield less false positives since those IPs would find themselves on more blacklists.

GitHub - stamparm/ipsum: Daily feed of bad IPs (with blacklist hit scores)

Daily feed of bad IPs (with blacklist hit scores). Contribute to stamparm/ipsum development by creating an account on GitHub.

github.com

 

[chongnt]

BTW... these are the additions I made @chongnt @Bogey ... seems like an interesting project. I removed the first 2 levels, hoping that levels 3 - 7 will yield less false positives since those IPs would find themselves on more blacklists.

GitHub - stamparm/ipsum: Daily feed of bad IPs (with blacklist hit scores)

Daily feed of bad IPs (with blacklist hit scores). Contribute to stamparm/ipsum development by creating an account on GitHub.

github.com

Thanks @Viktor Jaep . Everything is still working fine. Only thing I noticed there is over 2k outbound blocked. Usually I don't get many outbound hit in the previous list.

 

[Viktor Jaep]

Thanks @Viktor Jaep . Everything is still working fine. Only thing I noticed there is over 2k outbound blocked. Usually I don't get many outbound hit in the previous list.

Most likely some kind of false positive... or you have an unwanted visitor on your network. Lol. Any idea where its trying to reach out to?

 

[Mogsy]

Thanks @Viktor Jaep . Everything is still working fine. Only thing I noticed there is over 2k outbound blocked. Usually I don't get many outbound hit in the previous list.

I've never seem to retain in/outbound block stats in syslog post reboot.

BTW... these are the additions I made @chongnt @Bogey ... seems like an interesting project. I removed the first 2 levels, hoping that levels 3 - 7 will yield less false positives since those IPs would find themselves on more blacklists.

I have been unashamedly copying your list to mine (as I dont know how github works/forks). I copy just because there is one list I wanted to include that I obtained permission from Bambenek

 

[Viktor Jaep]

I've never seem to retain in/outbound block stats in syslog post reboot.

My syslog starts over on reboot as well. I think that's normal. Hopefully some of those stats will have translated over into the skynet UI or web UI?

I have been unashamedly copying your list to mine (as I dont know how github works/forks). I copy just because there is one list I wanted to include that I obtained permission from Bambenek

Don't apologize! Please use whatever works for you! Curious about your other list... is that a paid/private list?

 

[Mogsy]

My syslog starts over on reboot as well. I think that's normal. Hopefully some of those stats will have translated over into the skynet UI or web UI?

Don't apologize! Please use whatever works for you! Curious about your other list... is that a paid/private list?

Free home use only list haha. Your list works well for me. I added a few that was suggested here. I just updated/copied your list now. Will dm

 

[chongnt]

Most likely some kind of false positive... or you have an unwanted visitor on your network. Lol. Any idea where its trying to reach out to?

It is from 1.txt list
My laptop keep looking for it. I have update your list to remove it.

admin@RT-AC86U-DBA8:/tmp/mnt/amtm/entware/var/log# cat skynet-0.log | grep -a DST=34.117.59.81 | wc -l
2013

 

[Viktor Jaep]

It is from 1.txt list
My laptop keep looking for it. I have update your list to remove it.

admin@RT-AC86U-DBA8:/tmp/mnt/amtm/entware/var/log# cat skynet-0.log | grep -a DST=34.117.59.81 | wc -l
2013

Looks like there is some malicious behavior happening with that host though... did you see this?

LevelBlue - Open Threat Exchange

Learn about the latest cyber threats. Research, collaborate, and share threat intelligence in real time. Protect yourself and the community against today's emerging threats.

otx.alienvault.com

 

[chongnt]

Looks like there is some malicious behavior happening with that host though... did you see this?

LevelBlue - Open Threat Exchange

Learn about the latest cyber threats. Research, collaborate, and share threat intelligence in real time. Protect yourself and the community against today's emerging threats.

otx.alienvault.com

Looks like ipinfo.io is the culprit.
I temporarily block this domain.

 

[Skeptical.me]

Are there any tutorials or a wiki for Skynet, I’m only new to using it (as I just put my ISPs modem into bridge mode and can now use Skynet), and I was interested in learning more about the ban feature.

 

[Skeptical.me]

Free home use only list haha. Your list works well for me. I added a few that was suggested here. I just updated/copied your list now. Will dm

Can I borrow your list for free home use?

 

[Viktor Jaep]

Are there any tutorials or a wiki for Skynet, I’m only new to using it (as I just put my ISPs modem into bridge mode and can now use Skynet), and I was interested in learning more about the ban feature.

Other than the main skynet thread, you might have some luck with this?

Home

Skynet - Advanced IP Blocking For ASUS Routers Using IPSet. - Adamm00/IPSet_ASUS

github.com