Skynet Skynet - Router Firewall & Security Enhancements

[ScenicView]

Thanks! Eventually I'll have a better idea what this means. So it seems ok to whitelist in Skynet? Maybe just the apps phoning home to check for updates?

 

[Adamm]

Thanks! Eventually I'll have a better idea what this means. So it seems ok to whitelist in Skynet? Maybe just the apps phoning home to check for updates?

Should be okay, CDN's host tens of thousands of websites so even if %99 of those websites are legitimate, it only takes one to get the whole server blacklisted.

 

[ScenicView]

One other question. I noticed that after turning on Skynet that I'm not getting any hits on aiProtect. Can I take that to mean that nothing is making it through Skynet to aiProtect so far?

 

[Adamm]

One other question. I noticed that after turning on Skynet that I'm not getting any hits on aiProtect. Can I take that to mean that nothing is making it through Skynet to aiProtect so far?

IIRC last I checked traffic was hitting AiProtect first before IPTables rules took effect. Can't say I looked into it too much as there's no great way to test. In any case both work together seamlessly, I generally get about 5 hits per day on average from AiProtect logs.

 

[XIII]

I noticed that after turning on Skynet that I'm not getting any hits on aiProtect.

What router?

I do get Two-Way IPS hits on AC56U and AC68U, but not on AC86U.

 

[Adamm]

What router?

I do get Two-Way IPS hits on AC56U and AC68U, but not on AC86U.

If you are not getting hits its probably a signature issue or something, works fine on my AC86U.

 

[XIII]

If you are not getting hits its probably a signature issue or something, works fine on my AC86U.

All routers have 2.068, last updated last month.

Where are they stored? Can I compare hashes or do they differ per model/platform?

 

[ScenicView]

What router?

I do get Two-Way IPS hits on AC56U and AC68U, but not on AC86U.

I have the AC3100.

 

[ScenicView]

IIRC last I checked traffic was hitting AiProtect first before IPTables rules took effect. Can't say I looked into it too much as there's no great way to test. In any case both work together seamlessly, I generally get about 5 hits per day on average from AiProtect logs.

Interesting. AiProtect is in front. I used to get about 5 hits per day on AiProtect. My signature file is up-to-date. Maybe I'm just lucky now.

 

[joe scian]

Hi Adamm
should I be concerned on the error message below? Thank you
Skynet: [INFO] Lock File Detected (save) (pid=6718) - Exiting (cpid=6911)

 

[Adamm]

Hi Adamm
should I be concerned on the error message below? Thank you
Skynet: [INFO] Lock File Detected (save) (pid=6718) - Exiting (cpid=6911)

No, that just means a command was already running so it prevented you from running another (in this case it was the save command). Skynet only allows one command at a time in most cases to prevent commands interfering with each-other.

 

[magenta]

If you are not getting hits its probably a signature issue or something, works fine on my AC86U.

i need this visualization in my life xD

 

[blueshark]

Skynet filter/ block ipv6 like ipv4 ?

 

[DonnyJohnny]

Skynet filter/ block ipv6 like ipv4 ?

Skynet currently don’t support ipv6. Only ipv4

 

[ScenicView]

Would there be a way of capturing which apps are involved in the top 10 or 20 outbound / inbound blocks?

 

[Adamm]

Would there be a way of capturing which apps are involved in the top 10 or 20 outbound / inbound blocks?

No, Skynet isn't an IPS engine, it can only tell you what the local IP is, its then up to the user to make the distinction of whats being blocked.

 

[joe scian]

Hi Adam Im on 6.1.8. I noticed that Im getting only INBOUND blocks - no OUTBOUND.
Anyone else experiencing this?

 

[Adamm]

Hi Adam Im on 6.1.8. I noticed that Im getting only INBOUND blocks - no OUTBOUND.
Anyone else experiencing this?

You may only have inbound filtering enabled, use the install command and make sure you select "All Traffic". Besides that, outbound blocks aren't as common unless you use things like P2P (torrenting).

 

[joe scian]

You may only have inbound filtering enabled, use the install command and make sure you select "All Traffic". Besides that, outbound blocks aren't as common unless you use things like P2P (torrenting).

Thanks Adam I had both selected and yes with Bit Torrent download I am seeing OUTBOUND blocking. Thank you

 

[91Quartz]

Hi Adam,
The # of IPs blocked decreased to 35,000 from 100, 000 on reinstall. Is this common?

Warm Regards,