Skynet Skynet - Router Firewall & Security Enhancements
Noticed this morning that I was getting a lot of blocked outbound traffic to 131.253.34.230 over the evening. According to Whois and alienvault seems to map to Microsoft. Similar blocks to outbound 65.55.44.109, also maps to Microsoft, this time when using OneDrive, which so far functions in limited testing on my iPad. Haven’t noticed any thing amiss with Microsoft functions, but I use them sparingly. Wouldn’t have mentioned this if not for your post about MS services above.
Adamm
Part of the Furniture
As long as they don't affect functionality that's perfectly normal, probably just certain telemetry requests being blocked.
skeal
Part of the Furniture
Yes it is.
OK, here's a fun one.
Skynet is blocking some IPs that I'd like to whitelist, but when I try to go in via AMTM I get
Skynet: [ERROR] Legacy v5 Installation Detected - Please Run Installer Manually To Upgrade!
So I try to run the v6 installer, but it doesn't work though because I still only have a 256MB USB so I can't have a swap file. Can I not even access the v5 menu anymore?
Skynet is blocking some IPs that I'd like to whitelist, but when I try to go in via AMTM I get
Skynet: [ERROR] Legacy v5 Installation Detected - Please Run Installer Manually To Upgrade!
So I try to run the v6 installer, but it doesn't work though because I still only have a 256MB USB so I can't have a swap file. Can I not even access the v5 menu anymore?
DonnyJohnny
Very Senior Member
what are you waiting for? Get a bigger flash drive.... $2-$5???????
Yasss it's on my list. There aren't any on Amazon and I haven't been out to a store lately. That intent doesn't help me with the immediate problem of being locked out of some websites at this point. Or, for that matter, the blocking of outbound Google Hangouts messages. lol
Adamm
Part of the Furniture
To temporarily downgrade to the last v5 commit use the following command;
Code:
/usr/sbin/curl --retry 3 "https://raw.githubusercontent.com/Adamm00/IPSet_ASUS/8efff7acef7b83723ad6d622cd9243cbbe043b72/firewall.sh" -o "/jffs/scripts/firewall" && chmod +x /jffs/scripts/firewallMmmm. It was a good try... it opens but then when I try to backup it tells me
Skynet Not Running - Aborting
(Edit: I get this even after (8) Restart Skynet and the Merlin web interface shows me the crazy processor activity.)
So. Just need to figure out how to do my ABS/Pixelserv backups. I've purchased my wife a new 8GB thumbdrive and stolen a 1GB one from her. That should do the trick.
Skynet Not Running - Aborting
(Edit: I get this even after (8) Restart Skynet and the Merlin web interface shows me the crazy processor activity.)
So. Just need to figure out how to do my ABS/Pixelserv backups. I've purchased my wife a new 8GB thumbdrive and stolen a 1GB one from her. That should do the trick.
I. AM. BEATING. MY. HEAD. AGAINST. THE. WALL.
Ok. I thought swapping the thumbdrive was going to take about a half-hour. I started three hours ago.
Got 1GB thumbdrive. Spent another 20 minutes trying to figure out how to format it. mkfs.ext4 doesn't exist in this router, went for mkfs.ext3
Tried to use AMTM to install ABS. "/dev/sda1 doesn't have a label! Are you sure?"
Spent another 20 minutes trying to figure out how to label /dev/sda1 before I figured out the -L option on mkfs.ext3...
Installed ABS through AMTM. Installed Skynet through AMTM... or tried. Somehow even though this is a different thumbdrive, it was trying to run v5 again? So I grabbed the new command off page 1 of this thread. Selected 512MB cache... router spent several minutes creating the cache... eventually got this:
Creating SWAP File...
524288+0 records in
524288+0 records out
Setting up swapspace version 1, size = 536866816 bytes
UUID=f1730f8a-455d-427e-8408-43f149c1d273
swapon: /tmp/mnt/USBStick/myswap.swp: Invalid argument
SWAP File Located At /tmp/mnt/USBStick/myswap.swp
touch: /tmp/mnt/USBStick/skynet/events.log: Input/output error
touch: /tmp/mnt/USBStick/skynet/skynet.log: Input/output error
/jffs/scripts/firewall: line 1: can't create /tmp/mnt/USBStick/skynet/skynet.cfg: Input/output error
Restarting Firewall To Complete Installation
/jffs/scripts/firewall: line 1: can't create /tmp/mnt/USBStick/skynet/skynet.cfg: Input/output error
Now AMTM is black-and-white.
ABS doesn't work. Try to (re-install, since AMTM isn't showing me that it's installed...) I get:
Welcome
This is AB-Solution 3.11.2
looking for an installation
[: /tmp/mnt/USBStick: unknown operand
--> AB-Solution device change detected
--> fixing paths in files...
[: /tmp/mnt/USBStick: unknown operand
ab-solution.sh: .: line 1: can't open '/adblocking/.config/ab-solution.cfg'
SNBForum Asuswrt-Merlin Terminal Menu
So. AMTM doesn't look or work right. Skynet doesn't work. I tried chmod -R 777 all of the directories in /mnt/USBStick/ in case somehow they had become read-only... to no avail. wtf
Ok. I thought swapping the thumbdrive was going to take about a half-hour. I started three hours ago.
Got 1GB thumbdrive. Spent another 20 minutes trying to figure out how to format it. mkfs.ext4 doesn't exist in this router, went for mkfs.ext3
Tried to use AMTM to install ABS. "/dev/sda1 doesn't have a label! Are you sure?"
Spent another 20 minutes trying to figure out how to label /dev/sda1 before I figured out the -L option on mkfs.ext3...
Installed ABS through AMTM. Installed Skynet through AMTM... or tried. Somehow even though this is a different thumbdrive, it was trying to run v5 again? So I grabbed the new command off page 1 of this thread. Selected 512MB cache... router spent several minutes creating the cache... eventually got this:
Creating SWAP File...
524288+0 records in
524288+0 records out
Setting up swapspace version 1, size = 536866816 bytes
UUID=f1730f8a-455d-427e-8408-43f149c1d273
swapon: /tmp/mnt/USBStick/myswap.swp: Invalid argument
SWAP File Located At /tmp/mnt/USBStick/myswap.swp
touch: /tmp/mnt/USBStick/skynet/events.log: Input/output error
touch: /tmp/mnt/USBStick/skynet/skynet.log: Input/output error
/jffs/scripts/firewall: line 1: can't create /tmp/mnt/USBStick/skynet/skynet.cfg: Input/output error
Restarting Firewall To Complete Installation
/jffs/scripts/firewall: line 1: can't create /tmp/mnt/USBStick/skynet/skynet.cfg: Input/output error
Now AMTM is black-and-white.
ABS doesn't work. Try to (re-install, since AMTM isn't showing me that it's installed...) I get:
Welcome
This is AB-Solution 3.11.2
looking for an installation
[: /tmp/mnt/USBStick: unknown operand
--> AB-Solution device change detected
--> fixing paths in files...
[: /tmp/mnt/USBStick: unknown operand
ab-solution.sh: .: line 1: can't open '/adblocking/.config/ab-solution.cfg'
SNBForum Asuswrt-Merlin Terminal Menu
So. AMTM doesn't look or work right. Skynet doesn't work. I tried chmod -R 777 all of the directories in /mnt/USBStick/ in case somehow they had become read-only... to no avail. wtf
Adamm
Part of the Furniture
Sounds like the USB mounted incorrrctly, try a router reboot and go through the installation process again.
OK. Just tried it. Hard reset (unplugged power cord).
touch: /tmp/mnt/USBStick/skynet/events.log: Not a directory
touch: /tmp/mnt/USBStick/skynet/skynet.log: Not a directory
/jffs/scripts/firewall: line 1: can't create /tmp/mnt/USBStick/skynet/skynet.cfg: nonexistent directory
Restarting Firewall To Complete Installation
/jffs/scripts/firewall: line 1: can't create /tmp/mnt/USBStick/skynet/skynet.cfg: nonexistent directory
Adamm
Part of the Furniture
OK. Just tried it. Hard reset (unplugged power cord).
touch: /tmp/mnt/USBStick/skynet/events.log: Not a directory
touch: /tmp/mnt/USBStick/skynet/skynet.log: Not a directory
/jffs/scripts/firewall: line 1: can't create /tmp/mnt/USBStick/skynet/skynet.cfg: nonexistent directory
Restarting Firewall To Complete Installation
/jffs/scripts/firewall: line 1: can't create /tmp/mnt/USBStick/skynet/skynet.cfg: nonexistent directory
I suggest formatting again, try using Minitool Partition Wizard on a windows machine, it is much more user friendly then linux cmdline tools.
Patrick Walden
New Around Here
Pardon me is this has already been posted, but is there a way to get the county codes for sh /jffs/scripts/firewall ban country? IE Israel, Saudia Arabia, Iran, Burma to name a few
Adamm
Part of the Furniture
Patrick Walden
New Around Here
Thank you very much Sir!
Butterfly Bones
Very Senior Member
Well, it seems to still be causing problems. These outbound ips are my Chromecast Ultra, Sony Vizio TV and Google Home Mini (x2) it stops all from working.
Mar 29 14:02:49 kernel: [BLOCKED - OUTBOUND] SRC=192.168.1.62 DST=8.8.8.8
Mar 29 14:02:49 kernel: [BLOCKED - OUTBOUND] SRC=192.168.1.105 DST=8.8.8.8
Mar 29 14:02:50 kernel: [BLOCKED - OUTBOUND] SRC=192.168.1.105 DST=8.8.8.8
Mar 29 14:02:51 kernel: [BLOCKED - OUTBOUND] SRC=192.168.1.105 DST=8.8.8.8
Mar 29 14:02:52 kernel: [BLOCKED - OUTBOUND] SRC=192.168.1.50 DST=8.8.8.8
Mar 29 14:02:52 kernel: [BLOCKED - OUTBOUND] SRC=192.168.1.106 DST=8.8.8.8
Mar 29 14:02:52 kernel: [BLOCKED - OUTBOUND] SRC=192.168.1.106 DST=8.8.8.8
Mar 29 14:02:52 kernel: [BLOCKED - OUTBOUND] SRC=192.168.1.105 DST=8.8.8.8
Mar 29 14:02:53 kernel: [BLOCKED - OUTBOUND] SRC=192.168.1.105 DST=8.8.8.8
Input IP Or Range To Whitelist:
[IP/Range]: 8.8.8.8
Input Comment For Whitelist:
[Comment]: Google DNS
Whitelisting 8.8.8.8
ipset v6.32: Element cannot be added to the set: it's already added
Saving Changes
*************************
edit, here is the search output I forgot
Debug Data Detected in /tmp/mnt/SNB/skynet/skynet.log - 5.1M
Monitoring From Mar 21 06:00:16 To Mar 29 14:25:59
19302 Block Events Detected
3032 Unique IPs
62 Autobans Issued
5 Manual Bans Issued
Exact Matches;
https://iplists.firehol.org/files/coinbl_hosts.ipset - 8.8.8.8
Possible CIDR Matches;
Skynet: [Complete] 115740 IPs / 1673 Ranges Banned. 0 New IPs / 0 New Ranges Banned. 42 Inbound / 0 Outbound Connections Blocked! [stats] [6s]
Last edited:
Adamm
Part of the Furniture
Does it show up as whitelisted when you issue the following command?
Code:
sh /jffs/scripts/firewall stats search ip 8.8.8.8If so, it shouldn’t be blocked (technically there may be a 1-2s period whenever the whitelist is updated but nothing noticeable).
Butterfly Bones
Very Senior Member
Debug Data Detected in /tmp/mnt/SNB/skynet/skynet.log - 5.1M
Monitoring From Mar 21 06:00:16 To Mar 29 14:44:07
19336 Block Events Detected
3035 Unique IPs
62 Autobans Issued
5 Manual Bans Issued
8.8.8.8 is in set Skynet-Whitelist.
8.8.8.8 is NOT in set Skynet-Blacklist.
8.8.8.8 is NOT in set Skynet-BlockedRanges.
Whitelist Reason;
8.8.8.8 "CDN-Whitelist"
8.8.8.4 "nvram: wan_dns2_x"
8.8.8.8 First Tracked On Mar 27 02:25:01
8.8.8.8 Last Tracked On Mar 29 14:02:53
31 Blocks Total
Event Log Entries From 8.8.8.8;
Mar 23 08:20:38 Skynet: [Manual Whitelist] TYPE=Single SRC=8.8.8.8 COMMENT=Google DNS for Google Home
First Block Tracked From 8.8.8.8;
Mar 27 02:25:01 kernel: [BLOCKED - OUTBOUND] IN=br0 OUT= MAC=88:d7:f6:1d:46:08:a0:6a:44:07:e9:58:08:00 SRC=192.168.1.62 DST=8.8.8.8 LEN=61 TOS=0x00 PREC=0x00 TTL=64 ID=36890 DF PROTO=UDP SPT=58271 DPT=53 LEN=41
10 Most Recent Blocks From 8.8.8.8;
Mar 29 13:59:14 kernel: [BLOCKED - OUTBOUND] IN=br0 OUT= MAC=88:d7:f6:1d:46:08:48:d6:d5:07:06:f2:08:00 SRC=192.168.1.50 DST=8.8.8.8 LEN=84 TOS=0x00 PREC=0x00 TTL=64 ID=55194 DF PROTO=ICMP TYPE=8 CODE=0 ID=6924 SEQ=4
Mar 29 14:02:49 kernel: [BLOCKED - OUTBOUND] IN=br0 OUT= MAC=88:d7:f6:1d:46:08:a0:6a:44:07:e9:58:08:00 SRC=192.168.1.62 DST=8.8.8.8 LEN=61 TOS=0x00 PREC=0x00 TTL=64 ID=62085 DF PROTO=UDP SPT=41376 DPT=53 LEN=41
Mar 29 14:02:49 kernel: [BLOCKED - OUTBOUND] IN=br0 OUT= MAC=88:d7:f6:1d:46:08:20:df:b9:9d:c4:af:08:00 SRC=192.168.1.105 DST=8.8.8.8 LEN=84 TOS=0x00 PREC=0x00 TTL=64 ID=0 DF PROTO=ICMP TYPE=8 CODE=0 ID=2406 SEQ=1
Mar 29 14:02:50 kernel: [BLOCKED - OUTBOUND] IN=br0 OUT= MAC=88:d7:f6:1d:46:08:20:df:b9:9d:c4:af:08:00 SRC=192.168.1.105 DST=8.8.8.8 LEN=84 TOS=0x00 PREC=0x00 TTL=64 ID=0 DF PROTO=ICMP TYPE=8 CODE=0 ID=2406 SEQ=2
Mar 29 14:02:51 kernel: [BLOCKED - OUTBOUND] IN=br0 OUT= MAC=88:d7:f6:1d:46:08:20:df:b9:9d:c4:af:08:00 SRC=192.168.1.105 DST=8.8.8.8 LEN=84 TOS=0x00 PREC=0x00 TTL=64 ID=0 DF PROTO=ICMP TYPE=8 CODE=0 ID=2406 SEQ=3
Mar 29 14:02:52 kernel: [BLOCKED - OUTBOUND] IN=br0 OUT= MAC=88:d7:f6:1d:46:08:48:d6:d5:07:06:f2:08:00 SRC=192.168.1.50 DST=8.8.8.8 LEN=75 TOS=0x00 PREC=0x00 TTL=64 ID=21329 DF PROTO=UDP SPT=52117 DPT=53 LEN=55
Mar 29 14:02:52 kernel: [BLOCKED - OUTBOUND] IN=br0 OUT= MAC=88:d7:f6:1d:46:08:e4:f0:42:5d:0a:11:08:00 SRC=192.168.1.106 DST=8.8.8.8 LEN=195 TOS=0x00 PREC=0xC0 TTL=64 ID=64055 PROTO=ICMP TYPE=3 CODE=3 [SRC=8.8.8.8 DST=192.168.1.106 LEN=167 TOS=0x00 PREC=0x00 TTL=64 ID=35540 DF PROTO=UDP SPT=53 DPT=42163 LEN=147 ]
Mar 29 14:02:52 kernel: [BLOCKED - OUTBOUND] IN=br0 OUT= MAC=88:d7:f6:1d:46:08:e4:f0:42:5d:0a:11:08:00 SRC=192.168.1.106 DST=8.8.8.8 LEN=127 TOS=0x00 PREC=0xC0 TTL=64 ID=64056 PROTO=ICMP TYPE=3 CODE=3 [SRC=8.8.8.8 DST=192.168.1.106 LEN=99 TOS=0x00 PREC=0x00 TTL=64 ID=35543 DF PROTO=UDP SPT=53 DPT=42163 LEN=79 ]
Mar 29 14:02:52 kernel: [BLOCKED - OUTBOUND] IN=br0 OUT= MAC=88:d7:f6:1d:46:08:20:df:b9:9d:c4:af:08:00 SRC=192.168.1.105 DST=8.8.8.8 LEN=84 TOS=0x00 PREC=0x00 TTL=64 ID=0 DF PROTO=ICMP TYPE=8 CODE=0 ID=2406 SEQ=4
Mar 29 14:02:53 kernel: [BLOCKED - OUTBOUND] IN=br0 OUT= MAC=88:d7:f6:1d:46:08:20:df:b9:9d:c4:af:08:00 SRC=192.168.1.105 DST=8.8.8.8 LEN=84 TOS=0x00 PREC=0x00 TTL=64 ID=0 DF PROTO=ICMP TYPE=8 CODE=0 ID=2406 SEQ=5
Top 10 Targeted Ports From 8.8.8.8 (Inbound);
Top 10 Sourced Ports From 8.8.8.8 (Inbound);
Skynet: [Complete] 115740 IPs / 1673 Ranges Banned. 0 New IPs / 0 New Ranges Banned. 76 Inbound / 0 Outbound Connections Blocked! [stats] [3s]
Similar threads
Similar threads
Similar threads
-
-
Skynet Skynet showing router itself making calls to China?
- Started by Skywise
- Replies: 26
-
Skynet Skynet - Blocked outbounds coming from the router itself?
- Started by JuanGF
- Replies: 12
-
Skynet Installing Skynet causes router to crash and reboot
- Started by ovancantfort
- Replies: 26
-
[RESOLVED] Skynet UI not Displaying Statistics- Started by copperhead
- Replies: 1
-
Skynet I have installed the skynet firewall how do I configure it if the security of iot devices is important?
- Started by lenovomen
- Replies: 2
-
Skynet Message on SKYNET I havent seen before- Started by Davidncali001
- Replies: 1
-
-
-
Skynet SkyNet/Firewall blocking all ping requests, including outbound
- Started by nearlyheadlessarvie
- Replies: 6