Skynet Skynet - Router Firewall & Security Enhancements

Adamm · May 29, 2018

Mutzli said:
Thanks, I'll enable it and report any observations should there be any problems. Great feature to have. Just wondering if it really does help since most attacker IP's in that list are from a unique source.

Out of 211 reported hits, there were 55 unique IP's. Then after banning said IP's, Skynet reported other packets being blocked that AiProtect wasn't picking up. So all in all I think its worthwhile, if they are being detected sending malicious content there's probably a good chance the other packets not being picked up are also malicious.

visortgw · May 29, 2018

Adamm said:
I've pushed v6.2.0

Changes since the last version;

Code:

Comment support for import command Fix lock files with blank PID line due to user error Give imported entries identifiable string Fix char limits on certian entries "whitelist list imported" command Guess Unban_PrivateIP never worked due to extra space, oops Add Refresh_AiProtect()

The one feature that needs testing and feedback is that Skynet now bans IP's that AiProtect flags as malicious upon startup (if the feature is enabled). The current downside is that it will also ban source addresses (aka your current and previous IP's), but our whitelist should make this not matter. I'm hoping in a future version to filter out these addresses out without needing to install any additional entware packages.

To enable/disable this feature use the following commands;

Code:

sh /jffs/scripts/firewall debug banaiprotect enable sh /jffs/scripts/firewall debug banaiprotect disable

In attempting to enable, I encountered the following error:

Code:

Enabling AiProtect Banning
ipset v6.32: Error in line 1: Syntax error: cannot parse 767.xxx.xx.11: resolving to IPv4 address failed
Saving Changes

Not sure where first octet of 767 comes from...

Tekneek · May 29, 2018

I also received an error when attempting to enable banaiprotect (not the same error):

Code:

Enabling AiProtect Banning
ipset v6.32: Error in line 5: Syntax error: cannot parse 159.65.202.482: resolving to IPv4 address failed

Skynet: [Complete] 108646 IPs / 13854 Ranges Banned. 0 New IPs / 0 New Ranges Banned. 2533 Inbound / 1408 Outbound Connections Blocked! [debug] [3s]

Perhaps AiProtect contains spurious data or something is going wrong in the parsing?

Adamm · May 29, 2018

visortgw said:
In attempting to enable, I encountered the following error:

Code:

Enabling AiProtect Banning ipset v6.32: Error in line 1: Syntax error: cannot parse 767.xxx.xx.11: resolving to IPv4 address failed Saving Changes

Not sure where first octet of 767 comes from...

Tekneek said:
I also received an error when attempting to enable banaiprotect (not the same error):

Code:

Enabling AiProtect Banning ipset v6.32: Error in line 5: Syntax error: cannot parse 159.65.202.482: resolving to IPv4 address failed Skynet: [Complete] 108646 IPs / 13854 Ranges Banned. 0 New IPs / 0 New Ranges Banned. 2533 Inbound / 1408 Outbound Connections Blocked! [debug] [3s]

Perhaps AiProtect contains spurious data or something is going wrong in the parsing?

Thanks for pointing this out, using grep alone isn't accurate enough to grab this data as a sql db isn't a text format. I've pushed v6.2.1 which instead uses the sqlite3-cli package from entware. That means this specific feature will require entware to be installed, assuming it is Skynet will then proceed to install the package behind the scenes.

This also means the concern about our public IP's being incorrectly blacklisted is no longer relevant as we are querying the specific data now from the database.

visortgw · May 29, 2018

Tekneek said:
I also received an error when attempting to enable banaiprotect (not the same error):

Code:

Enabling AiProtect Banning ipset v6.32: Error in line 5: Syntax error: cannot parse 159.65.202.482: resolving to IPv4 address failed Skynet: [Complete] 108646 IPs / 13854 Ranges Banned. 0 New IPs / 0 New Ranges Banned. 2533 Inbound / 1408 Outbound Connections Blocked! [debug] [3s]

Perhaps AiProtect contains spurious data or something is going wrong in the parsing?

Mine was invalid first octet, and yours is invalid fourth octet. Most likely common parsing bug...

Tekneek · May 29, 2018

Adamm said:
Thanks for pointing this out, using grep alone isn't accurate enough to grab this data as a sql db isn't a text format. I've pushed v6.2.1 which instead uses the sqlite3-cli package from entware. That means this specific feature will require entware to be installed, assuming it is Skynet will then proceed to install the package behind the scenes.

This also means the concern about our public IP's being incorrectly blacklisted is no longer relevant as we are querying the specific data now from the database.

With entware installed, I got a new error after updating Skynet and trying again:

Code:

Enabling AiProtect Banning
Downloading http://bin.entware.net/armv7sf-k2.6/Packages.gz
Updated list of available packages in /opt/var/opkg-lists/entware
Installing sqlite3-cli (3230100-1) to root...
Downloading http://bin.entware.net/armv7sf-k2.6/sqlite3-cli_3230100-1_armv7-2.6.ipk
Installing libsqlite3 (3230100-1) to root...
Downloading http://bin.entware.net/armv7sf-k2.6/libsqlite3_3230100-1_armv7-2.6.ipk
Installing zlib (1.2.11-2) to root...
Downloading http://bin.entware.net/armv7sf-k2.6/zlib_1.2.11-2_armv7-2.6.ipk
Installing libncurses (6.1-1) to root...
Downloading http://bin.entware.net/armv7sf-k2.6/libncurses_6.1-1_armv7-2.6.ipk
Installing libncursesw (6.1-1) to root...
Downloading http://bin.entware.net/armv7sf-k2.6/libncursesw_6.1-1_armv7-2.6.ipk
Installing libreadline (7.0-1) to root...
Downloading http://bin.entware.net/armv7sf-k2.6/libreadline_7.0-1_armv7-2.6.ipk
Configuring zlib.
Configuring libsqlite3.
Configuring libncursesw.
Configuring libncurses.
Configuring libreadline.
Configuring sqlite3-cli.
ipset v6.32: Error in line 1: The set with the given name does not exist

Adamm · May 29, 2018

Tekneek said:

With entware installed, I got a new error after updating Skynet and trying again:

Code:

Enabling AiProtect Banning
Downloading http://bin.entware.net/armv7sf-k2.6/Packages.gz
Updated list of available packages in /opt/var/opkg-lists/entware
Installing sqlite3-cli (3230100-1) to root...
Downloading http://bin.entware.net/armv7sf-k2.6/sqlite3-cli_3230100-1_armv7-2.6.ipk
Installing libsqlite3 (3230100-1) to root...
Downloading http://bin.entware.net/armv7sf-k2.6/libsqlite3_3230100-1_armv7-2.6.ipk
Installing zlib (1.2.11-2) to root...
Downloading http://bin.entware.net/armv7sf-k2.6/zlib_1.2.11-2_armv7-2.6.ipk
Installing libncurses (6.1-1) to root...
Downloading http://bin.entware.net/armv7sf-k2.6/libncurses_6.1-1_armv7-2.6.ipk
Installing libncursesw (6.1-1) to root...
Downloading http://bin.entware.net/armv7sf-k2.6/libncursesw_6.1-1_armv7-2.6.ipk
Installing libreadline (7.0-1) to root...
Downloading http://bin.entware.net/armv7sf-k2.6/libreadline_7.0-1_armv7-2.6.ipk
Configuring zlib.
Configuring libsqlite3.
Configuring libncursesw.
Configuring libncurses.
Configuring libreadline.
Configuring sqlite3-cli.
ipset v6.32: Error in line 1: The set with the given name does not exist

This should be fixed in v6.2.2

Skynet wasn't checking if the database was empty, so if it was ipset would error out when generating commands.

TheUntouchable · May 29, 2018

After installing entware and afterwards updating skynet to latest version it didn't start anymore, had to reinstall it

EDIT: I know why, the swap file was missing..

.TT. · May 29, 2018

Got the same error as @Tekneek

Configuring sqlite3-cli.
ipset v6.32: Error in line 1: The set with the given name does not exist
ipset v6.32: Error in line 1: The set with the given name does not exist

Running v. 6.2.2 on AC86U
@Adamm Happy to see this feature added, nice work!

Adamm · May 29, 2018

TheUntouchable said:
After installing entware and afterwards updating skynet to latest version it didn't start anymore, had to reinstall it

EDIT: I know why, the swap file was missing..

Yeah whoever coded the entware-setup script didn't do a great job of being non destructive. Entware from memory nukes several startup scripts.

.TT. said:
Got the same error as @Tekneek

Configuring sqlite3-cli.
ipset v6.32: Error in line 1: The set with the given name does not exist
ipset v6.32: Error in line 1: The set with the given name does not exist

Running v. 6.2.2 on AC86U
@Adamm Happy to see this feature added, nice work!

You got that error after updating to v6.2.2? If so please post the output of the following;

Code:

sh -x /jffs/scripts/firewall debug banaiprotect enable

.TT. · May 29, 2018

Adamm said:
You got that error after updating to v6.2.2? If so please post the output of the following;

Code:

sh -x /jffs/scripts/firewall debug banaiprotect enable

Code:

#############################################################################################                        ################
#                                _____ _                     _             __                                           #
#                               / ____| |                   | |           / /                                           #
#                              | (___ | | ___   _ _ __   ___| |_  __   __/ /_                                           #
#                               \___ \| |/ / | | | '_ \ / _ \ __| \ \ / / '_ \                                          #
#                               ____) |   <| |_| | | | |  __/ |_   \ V /| (_) |                                         #
#                              |_____/|_|\_\\__, |_| |_|\___|\__|   \_/  \___/                                          #
#                                            __/ |                                                                      #
#                                           |___/                                                                       #
#                                                                                                                       #
## - 30/05/2018 -                  Asus Firewall Addition By Adamm v6.2.2                                               #
##                                 https://github.com/Adamm00/IPSet_ASUS                                                            #
#############################################################################################                        ################


+ export LC_ALL=C
+ retry=1
+ nvram get ntp_ready
+ [ 1 = 0 ]
+ [ 1 -ge 300 ]
+ red=printf \e[1;31m%s\e[0m\n
+ grn=printf \e[1;32m%s\e[0m\n
+ blue=printf \e[1;36m%s\e[0m\n
+ ylow=printf \e[1;33m%s\e[0m\n
+ date +%s
+ stime=1527622078
+ grep -ow skynetloc=.* # Skynet /jffs/scripts/firewall-start+
cut -c 11-
+ grep -vE ^#
+ awk {print $1}
+ skynetloc=/tmp/mnt/Asus/skynet
+ skynetcfg=/tmp/mnt/Asus/skynet/skynet.cfg
+ skynetlog=/tmp/mnt/Asus/skynet/skynet.log
+ skynetevents=/tmp/mnt/Asus/skynet/events.log
+ skynetipset=/tmp/mnt/Asus/skynet/skynet.ipset
+ [ -z /tmp/mnt/Asus/skynet ]
+ [ ! -f /tmp/mnt/Asus/skynet/skynet.cfg ]
+ [ ! -f /tmp/mnt/Asus/skynet/skynet.cfg ]
+ [ ! -d /tmp/mnt/Asus/skynet ]
+ nvram get wan0_proto
+ [ dhcp = pppoe ]
+ nvram get wan0_proto
+ [ dhcp = pptp ]
+ nvram get wan0_proto
+ [ dhcp = l2tp ]
+ nvram get wan0_ifname
+ iface=eth0
+ [ -z debug ]
+ [ -n  ]
+ [ -f /tmp/mnt/Asus/skynet/skynet.cfg ]
+ . /tmp/mnt/Asus/skynet/skynet.cfg
+ model=RT-AC86U
+ localver=v6.2.0
+ autoupdate=enabled
+ banmalwareupdate=daily
+ forcebanmalwareupdate=
+ debugmode=disabled
+ filtertraffic=all
+ blacklist1count=109286
+ blacklist2count=8811
+ customlisturl=
+ countrylist=ru
+ excludelists=
+ unbanprivateip=
+ loginvalid=disabled
+ banaiprotect=enabled
+ Check_Lock debug banaiprotect enable
+ [ -f /tmp/skynet.lock ]
+ echo debug banaiprotect enable
+ echo 31023
+ lockskynet=true
+ Purge_Logs
+ sed \~BLOCKED -~!d /tmp/syslog.log-1 /tmp/syslog.log
+ sed -i \~BLOCKED -~d /tmp/syslog.log-1 /tmp/syslog.log
+ + awk {print $1}
du /tmp/mnt/Asus/skynet/skynet.log
+ [ 3678 -ge 10240 ]
+ [  = all ]
+ grep -c Skynet: \[Complete\] /tmp/syslog.log
+ [ 4 -gt 24 ]
+ [ ! -f /opt/bin/opkg ]
+ echo Enabling AiProtect Banning
Enabling AiProtect Banning
+ banaiprotect=enabled
+ Refresh_AiProtect
+ [ enabled = enabled ]
+ [ -f /jffs/.sys/AiProtectionMonitor/AiProtectionMonitor.db ]
+ [ -f /opt/bin/opkg ]
+ [ ! -f /opt/bin/sqlite3 ]
+ [ -f /opt/bin/opkg ]
+ [ -f /opt/bin/sqlite3 ]
+ sqlite3 /jffs/.sys/AiProtectionMonitor/AiProtectionMonitor.db SELECT src FROM monitor;
+ grep -qE ^([0-9]{1,3}\.){3}[0-9]{1,3}$
+ sed \~add Skynet-Blacklist ~!d;\~BanAiProtect~!d;s~ comment.*~~;s~add~del~g /tmp/mnt/Asus/s                        kynet/skynet.ipset
+ ipset restore -!
ipset v6.32: Error in line 1: The set with the given name does not exist
+ sqlite3 /jffs/.sys/AiProtectionMonitor/AiProtectionMonitor.db SELECT src FROM monitor;
+ ipset restore -!
+ Filter_PrivateIP
+ grep -vE (^127\.)|(^10\.)|(^172\.1[6-9]\.)|(^172\.2[0-9]\.)|(^172\.3[0-1]\.)|(^192\.168\.)|                        (^0.)|(^169\.254\.)|(^22[4-9]\.)|(^23[0-9]\.)|(^255\.255\.255\.255)|(^8\.8\.8\.8)|(^8\.8\.4\.                        4)
+ grep -oE ^([0-9]{1,3}\.){3}[0-9]{1,3}$
+ awk {print "add Skynet-Blacklist " $1 " comment \"BanAiProtect\""}
+ awk !x[$0]++
ipset v6.32: Error in line 1: The set with the given name does not exist
+ Save_IPSets
+ Check_Status
+ [ -f /tmp/mnt/Asus/skynet/skynet.ipset ]
+ ipset -L -n Skynet-Whitelist
+ [ -f /tmp/mnt/Asus/skynet/skynet.ipset ]
+ ipset -L -n Skynet-Whitelist
+ echo

+ [  != 2 ]
+ Logging debug banaiprotect enable
+ oldips=109286
+ oldranges=8811
+ grep -Foc add Skynet-Black /tmp/mnt/Asus/skynet/skynet.ipset
+ blacklist1count=109286
+ grep -Foc add Skynet-Block /tmp/mnt/Asus/skynet/skynet.ipset
+ blacklist2count=8811
+ Check_Status
+ [ -f /tmp/mnt/Asus/skynet/skynet.ipset ]
+ ipset -L -n Skynet-Whitelist
+ [ -f /tmp/mnt/Asus/skynet/skynet.ipset ]
+ ipset -L -n Skynet-Whitelist
+ date +%s
+ ftime=1
+ [ debug = minimal ]
+ logger -st Skynet [Complete] 109286 IPs / 8811 Ranges Banned. 0 New IPs / 0 New Ranges Bann                        ed.  Inbound /  Outbound Connections Blocked! [debug] [1s]
Skynet: [Complete] 109286 IPs / 8811 Ranges Banned. 0 New IPs / 0 New Ranges Banned.  Inbound                         /  Outbound Connections Blocked! [debug] [1s]
+ echo

+ [  != 1 ]
+ Write_Config
+ echo ## Generated By Skynet - Do Not Manually Edit ##
+ date +%b %d %T
+ echo ## May 29 21:27:59 ##
+ echo
+ echo ## Installer ##
+ echo model="RT-AC86U"
+ echo localver="v6.2.0"
+ echo autoupdate="enabled"
+ echo banmalwareupdate="daily"
+ echo forcebanmalwareupdate=""
+ echo debugmode="disabled"
+ echo filtertraffic="all"
+ echo
+ echo ## Other ##
+ echo blacklist1count="109286"
+ echo blacklist2count="8811"
+ echo customlisturl=""
+ echo countrylist="ru"
+ echo excludelists=""
+ echo unbanprivateip=""
+ echo loginvalid="disabled"
+ echo banaiprotect="enabled"
+ [ true = true ]
+ rm -rf /tmp/skynet.lock
+ [ -n  ]

Let me know if i can help further

johnathonm · May 29, 2018

Hi,

I have a dumb question. I am trying to figure out what mac address is being hit from the logs but I am not sure how to decipher it.

Here is an entry:

May 29 16:32:50 kernel: [BLOCKED - INBOUND] IN=eth0 OUT= MAC=4c:ed:fb:90:2b:48:00:01:5c:7a:4c:46:08:00 SRC=181.214.87.34 DST=76.124.127.21 LEN=40 TOS=0x00 PREC=0x20 TTL=239 ID=54875 PROTO=TCP SPT=44737 DPT=64004 SEQ=2345751370 ACK=0 WINDOW=1024 RES=0x00 SYN URGP=0 MARK=0x8000000

Thank you,

J

Adamm · May 29, 2018

.TT. said:

Code:

#############################################################################################                        ################
#                                _____ _                     _             __                                           #
#                               / ____| |                   | |           / /                                           #
#                              | (___ | | ___   _ _ __   ___| |_  __   __/ /_                                           #
#                               \___ \| |/ / | | | '_ \ / _ \ __| \ \ / / '_ \                                          #
#                               ____) |   <| |_| | | | |  __/ |_   \ V /| (_) |                                         #
#                              |_____/|_|\_\\__, |_| |_|\___|\__|   \_/  \___/                                          #
#                                            __/ |                                                                      #
#                                           |___/                                                                       #
#                                                                                                                       #
## - 30/05/2018 -                  Asus Firewall Addition By Adamm v6.2.2                                               #
##                                 https://github.com/Adamm00/IPSet_ASUS                                                            #
#############################################################################################                        ################


+ export LC_ALL=C
+ retry=1
+ nvram get ntp_ready
+ [ 1 = 0 ]
+ [ 1 -ge 300 ]
+ red=printf \e[1;31m%s\e[0m\n
+ grn=printf \e[1;32m%s\e[0m\n
+ blue=printf \e[1;36m%s\e[0m\n
+ ylow=printf \e[1;33m%s\e[0m\n
+ date +%s
+ stime=1527622078
+ grep -ow skynetloc=.* # Skynet /jffs/scripts/firewall-start+
cut -c 11-
+ grep -vE ^#
+ awk {print $1}
+ skynetloc=/tmp/mnt/Asus/skynet
+ skynetcfg=/tmp/mnt/Asus/skynet/skynet.cfg
+ skynetlog=/tmp/mnt/Asus/skynet/skynet.log
+ skynetevents=/tmp/mnt/Asus/skynet/events.log
+ skynetipset=/tmp/mnt/Asus/skynet/skynet.ipset
+ [ -z /tmp/mnt/Asus/skynet ]
+ [ ! -f /tmp/mnt/Asus/skynet/skynet.cfg ]
+ [ ! -f /tmp/mnt/Asus/skynet/skynet.cfg ]
+ [ ! -d /tmp/mnt/Asus/skynet ]
+ nvram get wan0_proto
+ [ dhcp = pppoe ]
+ nvram get wan0_proto
+ [ dhcp = pptp ]
+ nvram get wan0_proto
+ [ dhcp = l2tp ]
+ nvram get wan0_ifname
+ iface=eth0
+ [ -z debug ]
+ [ -n  ]
+ [ -f /tmp/mnt/Asus/skynet/skynet.cfg ]
+ . /tmp/mnt/Asus/skynet/skynet.cfg
+ model=RT-AC86U
+ localver=v6.2.0
+ autoupdate=enabled
+ banmalwareupdate=daily
+ forcebanmalwareupdate=
+ debugmode=disabled
+ filtertraffic=all
+ blacklist1count=109286
+ blacklist2count=8811
+ customlisturl=
+ countrylist=ru
+ excludelists=
+ unbanprivateip=
+ loginvalid=disabled
+ banaiprotect=enabled
+ Check_Lock debug banaiprotect enable
+ [ -f /tmp/skynet.lock ]
+ echo debug banaiprotect enable
+ echo 31023
+ lockskynet=true
+ Purge_Logs
+ sed \~BLOCKED -~!d /tmp/syslog.log-1 /tmp/syslog.log
+ sed -i \~BLOCKED -~d /tmp/syslog.log-1 /tmp/syslog.log
+ + awk {print $1}
du /tmp/mnt/Asus/skynet/skynet.log
+ [ 3678 -ge 10240 ]
+ [  = all ]
+ grep -c Skynet: \[Complete\] /tmp/syslog.log
+ [ 4 -gt 24 ]
+ [ ! -f /opt/bin/opkg ]
+ echo Enabling AiProtect Banning
Enabling AiProtect Banning
+ banaiprotect=enabled
+ Refresh_AiProtect
+ [ enabled = enabled ]
+ [ -f /jffs/.sys/AiProtectionMonitor/AiProtectionMonitor.db ]
+ [ -f /opt/bin/opkg ]
+ [ ! -f /opt/bin/sqlite3 ]
+ [ -f /opt/bin/opkg ]
+ [ -f /opt/bin/sqlite3 ]
+ sqlite3 /jffs/.sys/AiProtectionMonitor/AiProtectionMonitor.db SELECT src FROM monitor;
+ grep -qE ^([0-9]{1,3}\.){3}[0-9]{1,3}$
+ sed \~add Skynet-Blacklist ~!d;\~BanAiProtect~!d;s~ comment.*~~;s~add~del~g /tmp/mnt/Asus/s                        kynet/skynet.ipset
+ ipset restore -!
ipset v6.32: Error in line 1: The set with the given name does not exist
+ sqlite3 /jffs/.sys/AiProtectionMonitor/AiProtectionMonitor.db SELECT src FROM monitor;
+ ipset restore -!
+ Filter_PrivateIP
+ grep -vE (^127\.)|(^10\.)|(^172\.1[6-9]\.)|(^172\.2[0-9]\.)|(^172\.3[0-1]\.)|(^192\.168\.)|                        (^0.)|(^169\.254\.)|(^22[4-9]\.)|(^23[0-9]\.)|(^255\.255\.255\.255)|(^8\.8\.8\.8)|(^8\.8\.4\.                        4)
+ grep -oE ^([0-9]{1,3}\.){3}[0-9]{1,3}$
+ awk {print "add Skynet-Blacklist " $1 " comment \"BanAiProtect\""}
+ awk !x[$0]++
ipset v6.32: Error in line 1: The set with the given name does not exist
+ Save_IPSets
+ Check_Status
+ [ -f /tmp/mnt/Asus/skynet/skynet.ipset ]
+ ipset -L -n Skynet-Whitelist
+ [ -f /tmp/mnt/Asus/skynet/skynet.ipset ]
+ ipset -L -n Skynet-Whitelist
+ echo

+ [  != 2 ]
+ Logging debug banaiprotect enable
+ oldips=109286
+ oldranges=8811
+ grep -Foc add Skynet-Black /tmp/mnt/Asus/skynet/skynet.ipset
+ blacklist1count=109286
+ grep -Foc add Skynet-Block /tmp/mnt/Asus/skynet/skynet.ipset
+ blacklist2count=8811
+ Check_Status
+ [ -f /tmp/mnt/Asus/skynet/skynet.ipset ]
+ ipset -L -n Skynet-Whitelist
+ [ -f /tmp/mnt/Asus/skynet/skynet.ipset ]
+ ipset -L -n Skynet-Whitelist
+ date +%s
+ ftime=1
+ [ debug = minimal ]
+ logger -st Skynet [Complete] 109286 IPs / 8811 Ranges Banned. 0 New IPs / 0 New Ranges Bann                        ed.  Inbound /  Outbound Connections Blocked! [debug] [1s]
Skynet: [Complete] 109286 IPs / 8811 Ranges Banned. 0 New IPs / 0 New Ranges Banned.  Inbound                         /  Outbound Connections Blocked! [debug] [1s]
+ echo

+ [  != 1 ]
+ Write_Config
+ echo ## Generated By Skynet - Do Not Manually Edit ##
+ date +%b %d %T
+ echo ## May 29 21:27:59 ##
+ echo
+ echo ## Installer ##
+ echo model="RT-AC86U"
+ echo localver="v6.2.0"
+ echo autoupdate="enabled"
+ echo banmalwareupdate="daily"
+ echo forcebanmalwareupdate=""
+ echo debugmode="disabled"
+ echo filtertraffic="all"
+ echo
+ echo ## Other ##
+ echo blacklist1count="109286"
+ echo blacklist2count="8811"
+ echo customlisturl=""
+ echo countrylist="ru"
+ echo excludelists=""
+ echo unbanprivateip=""
+ echo loginvalid="disabled"
+ echo banaiprotect="enabled"
+ [ true = true ]
+ rm -rf /tmp/skynet.lock
+ [ -n  ]

Let me know if i can help further

Looks like Skynet isn't running. Try use the restart command or run through the installer again to fix any issues.

Tekneek · May 29, 2018

Adamm said:
This should be fixed in v6.2.2

Skynet wasn't checking if the database was empty, so if it was ipset would error out when generating commands.

Working well here now, after reinstalling and updating to 6.2.2. Thanks!

DonnyJohnny · May 29, 2018

Adamm said:
I've pushed v6.2.0

Changes since the last version;

Code:

Comment support for import command Fix lock files with blank PID line due to user error Give imported entries identifiable string Fix char limits on certian entries "whitelist list imported" command Guess Unban_PrivateIP never worked due to extra space, oops Add Refresh_AiProtect()

The one feature that needs testing and feedback is that Skynet now bans IP's that AiProtect flags as malicious upon startup (if the feature is enabled). The current downside is that it will also ban source addresses (aka your current and previous IP's), but our whitelist should make this not matter. I'm hoping in a future version to filter out these addresses out without needing to install any additional entware packages.

To enable/disable this feature use the following commands;

Code:

sh /jffs/scripts/firewall debug banaiprotect enable sh /jffs/scripts/firewall debug banaiprotect disable

May I know the frequency of it checking database and adding ip? Updating together with banmalware list?

It has checking ability and will not duplicate its result right? Like adding the ip more than once in blacklist.

Adamm · May 29, 2018

DonnyJohnny said:
May I know the frequency of it checking database and adding ip? Updating together with banmalware list?

It has checking ability and will not duplicate its result right? Like adding the ip more than once in blacklist.

It updates upon startup and when banmalware is run. Skynet prevents duplicates and gets rid of stale entries.

johnathonm said:
I have a dumb question. I am trying to figure out what mac address is being hit from the logs but I am not sure how to decipher it.

Its probably the router's mac address. You can confirm via;

Code:

nvram show | grep 4c:ed

(You may need to capitalize the letters as its case sensitive)

popxunga · May 29, 2018

Code:
Code:

nvram show | grep 4c:ed

(You may need to capitalize the letters as its case sensitive)

Or:

nvram show | grep -i "4c:de"

Cheers

hervon · May 29, 2018

6.2.2 does not show up when i check for update in the GUI.

Adamm · May 29, 2018

hervon said:
6.2.2 does not show up when i check for update in the GUI.

Might be a github thing, try a force update and it should download the most recent version.

punkinduster · May 29, 2018

@Adamm, did you bump the version number back to 6.2.1 on purpose with your last change or was that a typo?

Thread starter	Title	Forum	Replies	Date
	Skynet Skynet causes router to crash and reboot	Asuswrt-Merlin AddOns	1	Jun 26, 2024
S	Skynet Skynet showing router itself making calls to China?	Asuswrt-Merlin AddOns	26	May 20, 2024
J	Skynet Skynet - Blocked outbounds coming from the router itself?	Asuswrt-Merlin AddOns	12	May 9, 2024
O	Skynet Installing Skynet causes router to crash and reboot	Asuswrt-Merlin AddOns	26	Feb 17, 2024
	Skynet Message on SKYNET I havent seen before	Asuswrt-Merlin AddOns	1	Oct 25, 2024
S	Skynet firewall reduces wireless range	Asuswrt-Merlin AddOns	14	Sep 30, 2024
P	Skynet Internet speed lower with Skynet on	Asuswrt-Merlin AddOns	9	Sep 19, 2024
N	Skynet SkyNet/Firewall blocking all ping requests, including outbound	Asuswrt-Merlin AddOns	6	Jul 29, 2024
W	Skynet SOLVED: Scrollbar Disappears on Skynet Tab on Asuswrt-Merlin 386.14	Asuswrt-Merlin AddOns	10	Jul 21, 2024
D	Skynet Best way to configure SkyNet on RX-AT82U	Asuswrt-Merlin AddOns	7	Jul 5, 2024

Skynet Skynet - Router Firewall & Security Enhancements

Part of the Furniture

Very Senior Member

Regular Contributor

Part of the Furniture

Very Senior Member

Regular Contributor

Part of the Furniture

Regular Contributor

Regular Contributor

Part of the Furniture

Regular Contributor

Regular Contributor

Part of the Furniture

Regular Contributor

Very Senior Member

Part of the Furniture

Regular Contributor

Regular Contributor

Part of the Furniture

Regular Contributor

Similar threads

Similar threads

Support SNBForums w/ Amazon

Sign Up For SNBForums Daily Digest