Skynet Quad 9 being blocked by Skynet

[BreakingDad]

Just an observation, quad 9 is suddenly blocked by skynet.

Anyone else got this?

I whitelisted it. Fixed

Don't really understand why DNS servers suddenly get blocked.

 

[Jack Yaz]

This is the danger of publicly updated blocklists, occasionally stuff is blacklisted by not so nice actors, or genuine mistakes.

 

[EmeraldDeer]

I did not experience this. If you are so inclined, identify which list the ban came from.

firewall stats search manualbans
firewall stats search {IP address}

 

[BreakingDad]

I did not experience this. If you are so inclined, identify which list the ban came from.

firewall stats search manualbans
firewall stats search {IP address}

Unfortunately I have re installed skynet since this happened and no longer have that info. It now seems to have been globally whitelisted however

 

[dave14305]

Skynet automatically whitelists WAN DNS.

 

[RMerlin]

I would try to track down which blacklist is blocking it. @Bill Woodcock might be interested to know.

 

[dave14305]

https://github.com/firehol/blocklist-ipsets/blob/f01ac3d247951c6093d0efe704943469c90ded0d/firehol_level3.netset#L873

 

[EmeraldDeer]

firewall banmalware exclude firehol_level3.netset

 

[chongnt]

firewall banmalware exclude firehol_level3.netset

Say I want to exclude this list. Do I have to rerun this command again after reboot?

 

[EmeraldDeer]

Say I want to exclude this list. Do I have to rerun this command again after reboot?

No, this setting will persist for the life of the Skynet installation. I can't find the external forum post, but firehol_level3 has been described as appropriate for a development environment but not a production environment.

 

[Therion87]

No, this setting will persist for the life of the Skynet installation. I can't find the external forum post, but firehol_level3 has been described as appropriate for a development environment but not a production environment.

Is level 2 stricter or more lax than level 3? Skynet uses level 2 as well. Or do they pull from completely different bases and aren't built on one another?

 

[EmeraldDeer]

Is level 2 stricter or more lax than level 3? Skynet uses level 2 as well. Or do they pull from completely different bases and aren't built on one another?

Level 2 and level3 are roughly the same size with 20% overlap. They are not composed of the same lists.

But it does not matter. The pattern of false positives, obvious ones like localhost or Quad9, have been consistent for years now. I don't think it should be in the default Skynet group.

If someone could find an alternative composed of similar lists minus the false positives, that would be be great.

firehol_level3

 

[AntonK]

Looks to have been whitelisted now: https://otx.alienvault.com/indicator/ip/9.9.9.9