Skynet Skynet - Router Firewall & Security Enhancements

[Adamm]

Anyway to have skynet log to another file instead of syslog? Love keeping stats, but blocks are so frequent that you can’t see anything but blocks making observing other activity (especially anything abnormal) next to impossible.

The syslog is purged every hour to skynets personal log, you can then use the various stats commands to phrase the data.

 

[MisterGriffiths]

I am seeing an unexpected output again when I run 'debug info':

Skynet: [Complete] 46 IPs / 0 Ranges Banned. 0 New IPs / 0 New Ranges Banned. 0 Inbound / 4261 Outbound Connections Blocked! [debug] [1s]

Any ideas why there would be so few IPs and zero Ranges blocked?

Yesterday it was showing:

[Complete] 110726 IPs / 1640 Ranges Banned. 0 New IPs / 0 New Ranges Banned. 898 Inbound / 0 Outbound Connections Blocked! [save] [7s]

 

[Adamm]

Any ideas why there would be so few IPs and zero Ranges blocked?

You can run the banmalware function to repopulate it, ideally with one of the automatic updating options in the install menu.

 

[MisterGriffiths]

You can run the banmalware function to repopulate it, ideally with one of the automatic updating options in the install menu.

Thank you Adamm, is this something I need to run regularly? I am seeing this issue quite often and am not aware the issue has occurred until I log in and check the logs.

Whenever I have installed Skynet, I have always chosen the recommended options which I believe does automatically update 'Malwarelist' Daily and also updates 'Skynet' Weekly.

 

[DonnyJohnny]

Thank you Adamm, is this something I need to run regularly? I am seeing this issue quite often and am not aware the issue has occurred until I log in and check the logs.

Whenever I have installed Skynet, I have always chosen the recommended options which I believe does automatically update 'Malwarelist' Daily and also updates 'Skynet' Weekly.

It could be due to thumddive corruption or Low memory. I used to have this problem.
Try do a fdisk on your thumddrive. Amtm have an option to install a check (fdisk) on router boot up.
Make sure you have 512mb swap. If still can’t work, maybe try changing a new thumb drive.

 

[MisterGriffiths]

It could be due to thumddive corruption or Low memory. I used to have this problem.
Try do a fdisk on your thumddrive. Amtm have an option to install a check (fdisk) on router boot up.
Make sure you have 512mb swap. If still can’t work, maybe try changing a new thumb drive.

Ahh, ok, I have been running the amtm disk check script at boot and have just checked the log, I have this:

Thu Jun 21 08:00:51 DST 2018 Unknown filesystem type on /dev/sda - skipping check.

Is it possible to get some clearer instruction on how to prepare the external USB storage. I have used a few different types, including adapter fitted micro sd card. I am currently running an 8Gb thumbdrive with a 2Gb swapfile but it would seem I may not have prepared and formatted the thumbdrive correctly.

I dont have anything running any linux, except for the router and a few RPIs.

To format the thumbdrive, I unmounted it and ran this:

mkfs.ext2 /dev/sda -L <label>

Is there a better way than this or maybe ext2 is not correct?

 

[Adamm]

Ahh, ok, I have been running the amtm disk check script at boot and have just checked the log, I have this:

Thu Jun 21 08:00:51 DST 2018 Unknown filesystem type on /dev/sda - skipping check.

Is it possible to get some clearer instruction on how to prepare the external USB storage. I have used a few different types, including adapter fitted micro sd card. I am currently running an 8Gb thumbdrive with a 2Gb swapfile but it would seem I may not have prepared and formatted the thumbdrive correctly.

I dont have anything running any linux, except for the router and a few RPIs.

To format the thumbdrive, I unmounted it and ran this:

mkfs.ext2 /dev/sda -L <label>

Is there a better way than this or maybe ext2 is not correct?

Thats a better discussion for the amtm thread where with enough searching you will find the answer to.

 

[MisterGriffiths]

Thats a better discussion for the amtm thread where with enough searching you will find the answer to.

Understood

 

[SanPe]

Hey!

I'm running nginx on my Asus AC86U.
Would it be possible for Skynet to ban IP getting a 403 or 401 error in nginx logs?
If yes, how?

Thanks

 

[punkinduster]

Question:
I have debug temporarily set to off so once every hour Skynet is showing me the total number of blocks for inbound as well as outbound connections in the log file which is great. But when I look using the stats feature for the top ten in both directions it lists nothing in any of the outbound categories. It does list the inbound offenders. Do I need to change something to identify the outbound offenders or is the only solution to keep debug enabled all the time filling my log file?

 

[Adamm]

Question:
I have debug temporarily set to off so once every hour Skynet is showing me the total number of blocks for inbound as well as outbound connections in the log file which is great. But when I look using the stats feature for the top ten in both directions it lists nothing in any of the outbound categories. It does list the inbound offenders. Do I need to change something to identify the outbound offenders or is the only solution to keep debug enabled all the time filling my log file?

Skynet stats entirely depend on debug mode being enabled and working, no other way around it unfortunately.

 

[zyxmon]

Again my guess is this is due to entware (and will also be fixed by running the installer again), their installer is terrible in the fact it overwrites several jffs scripts completely. @ryzhov_al @zyxmon would be great if you guys could improve this, there's really no need to overwrite files.

Our installer is universal and cannot use platform specific files and folders. Our installers are here - https://github.com/Entware/Entware/wiki/Alternative-install-vs-standard

 

[AZDNice]

I am fairly new at this but it seems that my skynet cannot restart due to a 'Lock File Detection'. Can someone assist me with this on how to rectify this situation please? Thank you in advance.

https://i.imgur.com/GFd4Tyh.png

 

[Adamm]

I am fairly new at this but it seems that my skynet cannot restart due to a 'Lock File Detection'. Can someone assist me with this on how to rectify this situation please? Thank you in advance.

https://i.imgur.com/GFd4Tyh.png

As this error suggests, it should disappear within 20-60 seconds, was this the case?

 

[AZDNice]

@Adamm Sorry for just getting back to you. But I just checked now by opening Skynet, selecting 8 (to restart via AB) and got the same message. This has been way more than 60 sec. Should I uninstall and re-install? When I select (5) Skynet in AB-Solution it loads as if everything is fine but when I restart to ensure that it is running correctly this is the error I get. I don't know if I'm reading this correctly. Please lmk.

https://i.imgur.com/5Dgbg4H.png

 

[Adamm]

@Adamm Sorry for just getting back to you. But I just checked now by opening Skynet, selecting 8 (to restart via AB) and got the same message. This has been way more than 60 sec. Should I uninstall and re-install? When I select (5) Skynet in AB-Solution it loads as if everything is fine but when I restart to ensure that it is running correctly this is the error I get. I don't know if I'm reading this correctly. Please lmk.

https://i.imgur.com/5Dgbg4H.png

You saw the message again because you restarted skynet. Skynet is working fine.

 

[AZDNice]

Sorry for just getting back to you. But I just checked now by opening Skynet, selecting 8 (to restart) and got the same message. This has been way more than 60 sec. Should I uninstall and re-install? When I select (5) Skynet in AB-Solution it loads as if everything is fine but when I restart to ensure that it is running this is the error I get. I don't know if I'm reading this correctly. Please lmk.

https://i.imgur.com/5Dgbg4H.png

You saw the message again because you restarted skynet. Skynet is working fine.

Thanks, still learning....never seen the error before. Thanks for your help.

 

[Mutzli]

Thanks, still learning....never seen the error before. Thanks for your help.

Use r and not 8 to refresh the screen after 60sec. to display the menu again and the error should be gone.

 

[elnash]

Good, a newbie question. skynet works with IPv4 ?? Thanks in advance. regards!!!

 

[popxunga]

Good, a newbie question. skynet works with IPv4 ?? Thanks in advance. regards!!!

IPSet v6 and IPv6 are not the same thing.
Skynet supports IPv4.
Skynet doesn't support IPv6.