Skynet Skynet + Diversion behind CG-Nat Address

[Tech9]

Not as expensive as post #18

What's expensive in post #18? You just need a valid credit card. The ISP will tell you how much. In your case they are asking for £5 a month. I don't know if it's expensive or not. None of my ISPs use CG-NAT.

 

[Mogsy]

What's expensive in post #18? You just need a valid credit card. The ISP will tell you how much. In your case they are asking for £5 a month. I don't know if it's expensive or not. None of my ISPs use CG-NAT.

Haha I imagined the joke the wrong way! £5 a month, yeah. Will do that maybe. Read about ipv6, on the fence about it.

 

[Mogsy]

Hi guys. Just trying to find out what INVALID PACKET means in firewall, both the standard one and Skynet. In Skynet (AX86U) there are many of these Microsoft and Apple and none of them are in malicious in AlienVault or AbuseIPDB. Examples

RT-AX86U Skynet - no indication and whitelisted on Alien vault (Enabled dropped packet logging just because curious)
Sep 30 12:47:16 kernel: [BLOCKED - INVALID] IN=eth0 OUT= MAC=7c:10:c9:b3:7f:b8:ac:75:1d:3e:66:8b:08:00 SRC=17.253.35.204 DST=100.6x.2.xx LEN=96 TOS=0x00 PREC=0x00 TTL=58 ID=59980 DF PROTO=TCP SPT=443 DPT=52948 SEQ=3676079787 ACK=3170485628 WINDOW=253 RES=0x00 ACK PSH URGP=0 OPT (0101080A90F1482024EA07D91E122005FECA315089BDD6D800002BCD00180101) MARK=0x800000

RT-AX86S stock beta firmware , some indication of abuse.
Sep 29 21:01:47 kernel: DROP IN=eth0 OUT= MAC=7c:10:c9:cd:97:68:ac:75:1d:3e:66:8b:08:00 SRC=20.90.153.243 DST=100.6x.2x.xx LEN=191 TOS=0x00 PREC=0x00 TTL=116 ID=4577 DF PROTO=TCP SPT=443 DPT=49474 SEQ=77550486 ACK=157105852 WINDOW=6961 RES=0x00 ACK PSH URGP=0 MARK=0x8000000

Any thoughts? @ColinTaylor @SomeWhereOverTheRainBow @Tech9

 

[SomeWhereOverTheRainBow]

Hi guys. Just trying to find out what INVALID PACKET means in firewall, both the standard one and Skynet. In Skynet (AX86U) there are many of these Microsoft and Apple and none of them are in malicious in AlienVault or AbuseIPDB. Examples

RT-AX86U Skynet - no indication and whitelisted on Alien vault (Enabled dropped packet logging just because curious)
Sep 30 12:47:16 kernel: [BLOCKED - INVALID] IN=eth0 OUT= MAC=7c:10:c9:b3:7f:b8:ac:75:1d:3e:66:8b:08:00 SRC=17.253.35.204 DST=100.6x.2.xx LEN=96 TOS=0x00 PREC=0x00 TTL=58 ID=59980 DF PROTO=TCP SPT=443 DPT=52948 SEQ=3676079787 ACK=3170485628 WINDOW=253 RES=0x00 ACK PSH URGP=0 OPT (0101080A90F1482024EA07D91E122005FECA315089BDD6D800002BCD00180101) MARK=0x800000

RT-AX86S stock beta firmware , some indication of abuse.
Sep 29 21:01:47 kernel: DROP IN=eth0 OUT= MAC=7c:10:c9:cd:97:68:ac:75:1d:3e:66:8b:08:00 SRC=20.90.153.243 DST=100.6x.2x.xx LEN=191 TOS=0x00 PREC=0x00 TTL=116 ID=4577 DF PROTO=TCP SPT=443 DPT=49474 SEQ=77550486 ACK=157105852 WINDOW=6961 RES=0x00 ACK PSH URGP=0 MARK=0x8000000

Any thoughts? @ColinTaylor @SomeWhereOverTheRainBow @Tech9

You have what they call "invalid" packets. Here is an example of a invalid packet drop rule

-A INPUT -m conntrack --ctstate INVALID -j DROP

Keep in mind invalid drops are normal. The fact that you are seeing them in system log just means they are getting logged. This is just another typical "the firewall is doing its job". Invalid packets can come from any source and the term invalid is not used in association with the reputation of the source. It just means the firewall didn't accept the packet as valid.