Menu
What's new
By:
Filters Better Search

Skynet SkyNet/Firewall blocking all ping requests, including outbound

  • SNBForums Code of Conduct

    SNBForums is a community for everyone, no matter what their level of experience.

    Please be tolerant and patient of others, especially newcomers. We are all here to share and learn!

    The rules are simple: Be patient, be nice, be helpful or be gone!

N

nearlyheadlessarvie

New Around Here
Hi, in my RT-AX86U with latest firmware, 3004.388.8, SkyNet/firewall is blocking all ping requests, including outbound, resulting in Internet-Connectivity failure. Well, to be fair I don't think its because of SkyNet, because I can't ping anyting even when it's uninstalled (iptables virtually unchanged after removing skynet).

Is there any way to allow outbound PING in my firewall-start script?

Bash: 
iptables -vnL --line-number
(other chains removed for brevity)
Chain INPUT (policy ACCEPT 0 packets, 0 bytes)
num pkts bytes target prot opt in out source destination
1 86 4096 INPUT_PING icmp -- * * 0.0.0.0/0 0.0.0.0/0 icmptype 8
2 0 0 ACCEPT udp -- * * 0.0.0.0/0 0.0.0.0/0 multiport dports 500,4500
3 0 0 ACCEPT esp -- * * 0.0.0.0/0 0.0.0.0/0
4 0 0 ACCEPT ah -- * * 0.0.0.0/0 0.0.0.0/0
5 6351 1477K ACCEPT all -- * * 0.0.0.0/0 0.0.0.0/0 state RELATED,ESTABLISHED
6 279 24167 logdrop all -- * * 0.0.0.0/0 0.0.0.0/0 state INVALID
7 2053 496K PTCSRVWAN all -- !br0 * 0.0.0.0/0 0.0.0.0/0
8 5200 440K PTCSRVLAN all -- br0 * 0.0.0.0/0 0.0.0.0/0
9 0 0 logdrop tcp -- !lo * 0.0.0.0/0 0.0.0.0/0 tcp dpt:5152
10 5200 440K ACCEPT all -- br0 * 0.0.0.0/0 0.0.0.0/0 state NEW
11 0 0 ACCEPT all -- * * 0.0.0.0/0 0.0.0.0/0 policy match dir in pol ipsec state NEW
12 940 234K ACCEPT all -- lo * 0.0.0.0/0 0.0.0.0/0 state NEW
13 0 0 ACCEPT udp -- * * 0.0.0.0/0 0.0.0.0/0 udp spt:67 dpt:68
14 0 0 INPUT_ICMP icmp -- * * 0.0.0.0/0 0.0.0.0/0
15 1113 262K WGSI all -- * * 0.0.0.0/0 0.0.0.0/0
16 1113 262K WGCI all -- * * 0.0.0.0/0 0.0.0.0/0
17 1113 262K OVPNSI all -- * * 0.0.0.0/0 0.0.0.0/0
18 1113 262K OVPNCI all -- * * 0.0.0.0/0 0.0.0.0/0
19 1113 262K logdrop all -- * * 0.0.0.0/0 0.0.0.0/0

Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
num pkts bytes target prot opt in out source destination
1 63036 23M IPSEC_DROP_SUBNET_ICMP all -- * * 0.0.0.0/0 0.0.0.0/0
2 63036 23M IPSEC_STRONGSWAN all -- * * 0.0.0.0/0 0.0.0.0/0
3 20 1440 PControls all -- br0 * 0.0.0.0/0 0.0.0.0/0 MAC 5C:62:8B:F9:7F:8E
4 0 0 PControls all -- br0 * 0.0.0.0/0 0.0.0.0/0 MAC FA:8A:15:45:02:88
5 18 2003 PControls all -- br0 * 0.0.0.0/0 0.0.0.0/0 MAC 2E:3D:E5:A6:6A:4F
6 59865 22M ACCEPT all -- * * 0.0.0.0/0 0.0.0.0/0 state RELATED,ESTABLISHED
7 0 0 ACCEPT all -- * * 0.0.0.0/0 0.0.0.0/0 policy match dir in pol ipsec
8 3151 1316K WGSF all -- * * 0.0.0.0/0 0.0.0.0/0
9 3151 1316K OVPNSF all -- * * 0.0.0.0/0 0.0.0.0/0
10 0 0 logdrop all -- !br0 eth0 0.0.0.0/0 0.0.0.0/0
11 0 0 ACCEPT all -- br0 br0 0.0.0.0/0 0.0.0.0/0
12 112 4900 logdrop all -- * * 0.0.0.0/0 0.0.0.0/0 state INVALID
13 0 0 SECURITY all -- eth0 * 0.0.0.0/0 0.0.0.0/0
14 0 0 ACCEPT all -- * * 0.0.0.0/0 0.0.0.0/0 ctstate DNAT
15 3039 1311K WGCF all -- * * 0.0.0.0/0 0.0.0.0/0
16 3039 1311K OVPNCF all -- * * 0.0.0.0/0 0.0.0.0/0
17 3039 1311K VPNCF all -- * * 0.0.0.0/0 0.0.0.0/0
18 3039 1311K ACCEPT all -- br0 * 0.0.0.0/0 0.0.0.0/0
19 0 0 logdrop all -- * * 0.0.0.0/0 0.0.0.0/0

Chain INPUT_ICMP (1 references)
num pkts bytes target prot opt in out source destination
1 0 0 RETURN icmp -- * * 0.0.0.0/0 0.0.0.0/0 icmptype 8
2 0 0 RETURN icmp -- * * 0.0.0.0/0 0.0.0.0/0 icmptype 13
3 0 0 ACCEPT icmp -- * * 0.0.0.0/0 0.0.0.0/0

Chain INPUT_PING (1 references)
num pkts bytes target prot opt in out source destination
1 0 0 RETURN icmp -- * * 0.0.0.0/0 0.0.0.0/0 policy match dir in pol ipsec
2 2 64 logdrop icmp -- eth0 * 0.0.0.0/0 0.0.0.0/0

Chain IPSEC_DROP_SUBNET_ICMP (1 references)
num pkts bytes target prot opt in out source destination

Chain IPSEC_STRONGSWAN (1 references)
num pkts bytes target prot opt in out source destination

Chain SECURITY (1 references)
num pkts bytes target prot opt in out source destination
1 0 0 RETURN tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcpflags: 0x17/0x02 limit: avg 1/sec burst 5
2 0 0 logdrop tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcpflags: 0x17/0x02
3 0 0 RETURN tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcpflags: 0x17/0x04 limit: avg 1/sec burst 5
4 0 0 logdrop tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcpflags: 0x17/0x04
5 0 0 RETURN icmp -- * * 0.0.0.0/0 0.0.0.0/0 icmptype 8 limit: avg 1/sec burst 5
6 0 0 logdrop icmp -- * * 0.0.0.0/0 0.0.0.0/0 icmptype 8
7 0 0 RETURN all -- * * 0.0.0.0/0 0.0.0.0/0
Click to expand...
 
It's NOT uncommon for inbound pings to be denied in an effort for the router to remain stealthy. At least by default.

If outbound ping (or another traffic) was being denied from the router's own processes, then it would likely appear in the OUTPUT chain of the filter table, which you haven't provided.

Code: 
iptables -vnL OUTPUT
 
Thank you for the clarification. I do get a passing truestealth check, but denying outbound seems too much. I do not remember when this started, and I wouldn't want to reset my router but it's becoming annoying already.

Here's the output chain btw:
Chain OUTPUT (policy ACCEPT 320K packets, 370M bytes)
pkts bytes target prot opt in out source destination
22579 1802K OUTPUT_DNS udp -- * * 0.0.0.0/0 0.0.0.0/0 udp dpt:53 u32 "0x0>>0x16&0x3c@0x8>>0xf&0x1=0x0"
239 38576 OUTPUT_DNS tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:53 u32 "0x0>>0x16&0x3c@0xc>>0x1a&0x3c@0x8>>0xf&0x1=0x0"
433K 472M OUTPUT_IP all -- * * 0.0.0.0/0 0.0.0.0/0
Click to expand...

Chain OUTPUT_DNS (2 references)
pkts bytes target prot opt in out source destination
0 0 logdrop_dns all -- * * 0.0.0.0/0 0.0.0.0/0 STRING match "|10706f697579747975696f706b6a666e6603636f6d00|" ALGO name bm TO 65535 ICASE
0 0 logdrop_dns all -- * * 0.0.0.0/0 0.0.0.0/0 STRING match "|0d72666a656a6e666a6e65666a6503636f6d00|" ALGO name bm TO 65535 ICASE
0 0 logdrop_dns all -- * * 0.0.0.0/0 0.0.0.0/0 STRING match "|1131306166646d617361787373736171726b03636f6d00|" ALGO name bm TO 65535 ICASE
0 0 logdrop_dns all -- * * 0.0.0.0/0 0.0.0.0/0 STRING match "|0f376d667364666173646d6b676d726b03636f6d00|" ALGO name bm TO 65535 ICASE
0 0 logdrop_dns all -- * * 0.0.0.0/0 0.0.0.0/0 STRING match "|0d386d617361787373736171726b03636f6d00|" ALGO name bm TO 65535 ICASE
0 0 logdrop_dns all -- * * 0.0.0.0/0 0.0.0.0/0 STRING match "|0f3966646d617361787373736171726b03636f6d00|" ALGO name bm TO 65535 ICASE
0 0 logdrop_dns all -- * * 0.0.0.0/0 0.0.0.0/0 STRING match "|1265666274686d6f6975796b6d6b6a6b6a677403636f6d00|" ALGO name bm TO 65535 ICASE
0 0 logdrop_dns all -- * * 0.0.0.0/0 0.0.0.0/0 STRING match "|086861636b7563647403636f6d00|" ALGO name bm TO 65535 ICASE
0 0 logdrop_dns all -- * * 0.0.0.0/0 0.0.0.0/0 STRING match "|076c696e77756469056633333232036e657400|" ALGO name bm TO 65535 ICASE
0 0 logdrop_dns all -- * * 0.0.0.0/0 0.0.0.0/0 STRING match "|0f6c6b6a68676664736174727975696f03636f6d00|" ALGO name bm TO 65535 ICASE
0 0 logdrop_dns all -- * * 0.0.0.0/0 0.0.0.0/0 STRING match "|0b6d6e627663787a7a7a313203636f6d00|" ALGO name bm TO 65535 ICASE
0 0 logdrop_dns all -- * * 0.0.0.0/0 0.0.0.0/0 STRING match "|077131313133333303746f7000|" ALGO name bm TO 65535 ICASE
0 0 logdrop_dns all -- * * 0.0.0.0/0 0.0.0.0/0 STRING match "|057371353230056633333232036e657400|" ALGO name bm TO 65535 ICASE
0 0 logdrop_dns all -- * * 0.0.0.0/0 0.0.0.0/0 STRING match "|077563746b6f6e6503636f6d00|" ALGO name bm TO 65535 ICASE
0 0 logdrop_dns all -- * * 0.0.0.0/0 0.0.0.0/0 STRING match "|0e7a786376626d6e6e666a6a66777103636f6d00|" ALGO name bm TO 65535 ICASE
0 0 logdrop_dns all -- * * 0.0.0.0/0 0.0.0.0/0 STRING match "|0a65756d6d6167766e627003636f6d00|" ALGO name bm TO 65535 ICASE
0 0 logdrop_dns all -- * * 0.0.0.0/0 0.0.0.0/0 STRING match "|0b726f75746572736173757303636f6d00|" ALGO name bm TO 65535 ICASE
0 0 logdrop_dns all -- * * 0.0.0.0/0 0.0.0.0/0 STRING match "|037777770b726f757465722d6173757303636f6d00|" ALGO name bm TO 65535 ICASE
0 0 logdrop_dns all -- * * 0.0.0.0/0 0.0.0.0/0 STRING match "|0377777709617375736c6f67696e03636f6d00|" ALGO name bm TO 65535 ICASE
0 0 logdrop_dns all -- * * 0.0.0.0/0 0.0.0.0/0 STRING match "|0d72657065617461722d6173757303636f6d00|" ALGO name bm TO 65535 ICASE
0 0 logdrop_dns all -- * * 0.0.0.0/0 0.0.0.0/0 STRING match "|037777310b726f757465722d6173757303636f6d00|" ALGO name bm TO 65535 ICASE

Chain OUTPUT_IP (1 references)
pkts bytes target prot opt in out source destination
0 0 logdrop_ip all -- * * 0.0.0.0/0 193.201.224.0/24
0 0 logdrop_ip all -- * * 0.0.0.0/0 51.15.120.245
0 0 logdrop_ip all -- * * 0.0.0.0/0 45.33.73.134
0 0 logdrop_ip all -- * * 0.0.0.0/0 190.115.18.28
0 0 logdrop_ip all -- * * 0.0.0.0/0 51.159.52.250
0 0 logdrop_ip all -- * * 0.0.0.0/0 190.115.18.86
Click to expand...
 
I don't see anything in that dump of the OUTPUT chain(s) that would suggest ICMP was being actively blocked. At best, I suppose you might be blocked (perhaps completely) from specific LAN devices based on their MAC addresss due to Parental Controls (the PControls chain specifically referenced in the FORWARD chain). But that's about it.

P.S. IIRC, connectivity checking is sometimes based on success w/ DNS, NOT always ping. But again, I don't see any DNS matches being blocked by the firewall. Perhaps one of your add-ons is blocking name resolution w/ DNSMasq, pihole, Unbound, etc.
 
Last edited:
Perhaps the ISP is blocking it, or the op is on CG-NAT?
 
If you want to see all rules from all tables, use:
Code: 
iptables-save -c
Your earlier command was only showing the filter table. Skynet works on the raw table, plus there’s nat and mangle.
 
My router is on public IP and ping definitely works when firewall is off (with or without skynet). But I think I got it working now, at least from the router to the internet and LAN-to-LAN. LAN to internet is not working but there is no real need for it so it's all good.

Just added these iptables rules in firewall-start, before skynet start.
Bash: 
iptables -I INPUT 1 -p icmp -j INPUT_ICMP
iptables -A OUTPUT -p icmp --icmp-type echo-request -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT

Where INPUT_ICMP is:
Chain INPUT_ICMP (2 references)
pkts bytes target prot opt in out source destination
86 6908 RETURN icmp -- * * 0.0.0.0/0 0.0.0.0/0 icmptype 8
0 0 RETURN icmp -- * * 0.0.0.0/0 0.0.0.0/0 icmptype 13
2296 363K ACCEPT icmp -- * * 0.0.0.0/0 0.0.0.0/0
Click to expand...

It is added by the firewall, when Respond ICMP echo request from WAN is off
1722315374793.png
 
You must log in or register to reply here.

Similar threads

octopus
  • Locked
Solved Can you connect to Wireguard server from wan side?
Replies
17
Views
2K
octopus
octopus
A
Policy-based port routing to bypass NordVPN client
Replies
10
Views
2K
Don->
D
v.y.k
iptables pkts & bytes numbers are too low on Merlin 3004.388
Replies
13
Views
1K
v.y.k
v.y.k
lluke
No internet on clients after firewall restart (WG, Unbound, YazFi)
Replies
10
Views
2K
ZebMcKayhan
Z
K
Can't get SNAT/MASQ to work.
2
Replies
24
Views
3K
eibgrad
eibgrad
Similar threads
Thread starter Title Forum Replies Date
L Skynet I have installed the skynet firewall how do I configure it if the security of iot devices is important? Asuswrt-Merlin AddOns 2
S Skynet firewall reduces wireless range Asuswrt-Merlin AddOns 14
ChickenheadOS Skynet Skynet 7.5.8 Firewall UI Issues Asuswrt-Merlin AddOns 19
Davidncali001 Skynet Message on SKYNET I havent seen before Asuswrt-Merlin AddOns 1
P Skynet Internet speed lower with Skynet on Asuswrt-Merlin AddOns 9
W Skynet SOLVED: Scrollbar Disappears on Skynet Tab on Asuswrt-Merlin 386.14 Asuswrt-Merlin AddOns 10
D Skynet Best way to configure SkyNet on RX-AT82U Asuswrt-Merlin AddOns 7
Klonoa Skynet Skynet causes router to crash and reboot Asuswrt-Merlin AddOns 1
G Skynet SkyNet and Diversion have conflicts when using user defined DNS servers - SOLVED Asuswrt-Merlin AddOns 16
W Skynet Why does Skynet ban perfectly legit websites Asuswrt-Merlin AddOns 4

Similar threads

Latest threads

Support SNBForums w/ Amazon

If you'd like to support SNBForums, just use this link and buy anything on Amazon. Thanks!

Sign Up For SNBForums Daily Digest

Get an update of what's new every day delivered to your mailbox. Sign up here!

Members online

Total: 700 (members: 35, guests: 665)
Top