Skynet Skynet - Router Firewall & Security Enhancements

[Adamm]

I added
https://hosts.ubuntu101.co.za/ips.list from https://github.com/mitchellkrogza/Ultimate.Hosts.Blacklist, now skynet says it reached it's limit with 500.000 blocked ips. :-D

Oct 28 12:08:23 kernel: Set Skynet-Blacklist is full, maxelem 500000 reached
Oct 28 12:08:51 Skynet: [#] 500000 IPs (+369267) -- 0 Ranges Banned (-4708) || 1983 Inbound -- 12 Outbound Connections Blocked! [banmalware] [126s]

@Adamm Can you cancel the limit? And why are the ranges gone?
I think this is a sophisticated list and should be added?

This list is nothing more then a badly maintained version of content that can be found on firehol in a much more compressed format (most of which is included by default). Any single list that is 500k+ entries isn't a list worth using.

2o7.net
Adblock No-Coin List
Add_Risk
Add_Spam
Ads_Disconnect.me
Airelle's Anti-Sex Hosts
Anti-PopAds
AnudeepND's blacklist (ad servers)
Bad JAV Sites
Badd Boyz Hosts
BadIPS.com
Barbock filter list
Blocklist.de
Cameleon
DShield.org Suspicious Domain List
Firehol
Global Advert Servers Blocklist - Personal Edition
hpHosts - GRM only
Hosts ADBlock
JustDomains
KADHosts
malc0de
Malware Domain List
Michael Trimm's Hosts
MoaAB adblock.makala.is
Phishing.Database
pl-host file
Quidsup NoTrack Malware
Quidsup NoTrack
Reddestdream's Minimal Hosts
Ransomware Tracker Domain Blocklist
ShallaList
SMed79 - Various Lists
somewhocares.org
Spam404
Suspicious.Snooping.Sniffing.Hacking.IP.Addresses
The Big List of Hacked Malware Web Sites
Top Attacking Wordpress IP's
uBlock Filters Plus
WaLLy3K_Blacklist
YousList
YoYo.org
ZeroDot1 - CoinBlocker Lists
ZeroDot1 - CoinBlocker Lists (Browser)
ZeroDot1 - CoinBlocker Lists (Optional)
ZeusTracker

 

[Torson]

My question is with regards to post #3191 - configuring fast-switch (aka wife-mode.)
I'm running Skynet 6.5.3 and tried the suggestion in the above mentioned post to configure the custom filter url (to enable switching)

sh /jffs/scripts/firewall fs www.google.com/filter.list (I replaced wm with fs). This results in:

Fast Swap Enabled
Custom Filter Detected: www.google.com/filter.list
[*] 404 Error Detected - Stopping Banmalware

Also, running 'firewall fs' yields a 'Skynet: [*] Wife-Mode URL Not Detected - Stopping Banmalware'.

Any suggestions? BTW - under 11 - Settings in the main interface there's an option 9 - Fast Swap - I assume that wife-mode, fast-switch and fast swap are one and the same thing. Is that correct?

 

[Adamm]

My question is with regards to post #3191 - configuring fast-switch (aka wife-mode.)
I'm running Skynet 6.5.3 and tried the suggestion in the above mentioned post to configure the custom filter url (to enable switching)

sh /jffs/scripts/firewall fs www.google.com/filter.list (I replaced wm with fs). This results in:

Fast Swap Enabled
Custom Filter Detected: www.google.com/filter.list
[*] 404 Error Detected - Stopping Banmalware

Also, running 'firewall fs' yields a 'Skynet: [*] Wife-Mode URL Not Detected - Stopping Banmalware'.

Any suggestions? BTW - under 11 - Settings in the main interface there's an option 9 - Fast Swap - I assume that wife-mode, fast-switch and fast swap are one and the same thing. Is that correct?

You are right in saying the wording is.. inconsistent. I've corrected this and pushed an update so it is correctly referenced throughout the script as "Fast Switch".

As for functionality, the command didn't work becuase you are supposed to replace the url with a real one, google certianly isn't hosting skynet content on its main domain

 

[JemTheWire]

Just out of interest, what exactly is ‘wife mode’?

I have heard it mentioned but cannot seem to find out what it means/does.

Thanks

 

[visortgw]

Just out of interest, what exactly is ‘wife mode’?

I have heard it mentioned but cannot seem to find out what it means/does.

Thanks

"Wife mode" allows you to temporarily switch to an alternate filter typically to relax filters, allowing "wife" to shop, etc. on sites normally blocked.

 

[Torson]

Would it be possible to have a default of some 3 urls to chose from, known to be shopping etc friendly and then also the option to input your own? Something like Diversion where fast switch allows to have a current pair out of small / standard / medium / large lists plus edits.

 

[Adamm]

I've pushed v6.5.5

Add connectivity test
Lower lockfile kill timeout to 30mins from 3hrs
Add cloudflare dns to exclusion filter
Correct exit codes
Better tmp file management (/tmp/skynet/)
Fix whitelist removal bug

The biggest change is the new connectivity test. Let me know if it causes any issues as Skynet will now only allow certain commands after it checks your internet connectivity (4 attempts over a 30s period) to prevent issues downloading lists/updates etc. Most of the other changes are internal.

 

[bitmonster]

Thanks.. Really appreciate your work as always..

What's Cloudflare exclusion about? I use Cloudflare DNS (1.1.1.1)

Sent from my SM-G965F using Tapatalk

 

[skeal]

Thanks.. Really appreciate your work as always..

What's Cloudflare exclusion about? I use Cloudflare DNS (1.1.1.1)

Sent from my SM-G965F using Tapatalk

In some user configs the 1.1.1.1 addressed was somehow banned. @Adamm fixed it.

 

[bitmonster]

There is a lot of junk on that route apparently so I could see why... Works fine though.

Sent from my SM-G965F using Tapatalk

 

[NSNE]

Apologies if this was mentioned in one of the previous 169 pages, but why is the USB drive required?

I'm contemplating installing Skynet because there's one IP address that will not leave my network alone. "EXPLOIT Remote Command Execution via Shell Script -2" every two or three hours.

 

[skeal]

Skynet requires a swap file to operate now. The swap is put on your usb stick. This is done during the install.

 

[skeal]

I would recommend you read the 1st post on the first page. It has everything you need.

 

[Skeptical.me]

So, I'm trying to delete the old swap file path.

The swap file doesn't exist but it's path remains in the router. And I'm not sure how to delete.

However, I seem to have an issue. It appears Skynet won't start:

 

[Adamm]

So, I'm trying to delete the old swap file path.

The swap file doesn't exist but it's path remains in the router. And I'm not sure how to delete.

However, I seem to have an issue. It appears Skynet won't start:

Use;

sh /jffs/scripts/firewall debug swap uninstall
sh /jffs/scripts/firewall debug swap install

If that doesn't work, you will need to remove the entry manually from the post-mount file and reboot.

 

[Skeptical.me]

Use;

sh /jffs/scripts/firewall debug swap uninstall
sh /jffs/scripts/firewall debug swap install

If that doesn't work, you will need to remove the entry manually from the post-mount file and reboot.

Thank you very much!! That fixed it, perfect.

 

[thelonelycoder]

Use;

sh /jffs/scripts/firewall debug swap uninstall
sh /jffs/scripts/firewall debug swap install

If that doesn't work, you will need to remove the entry manually from the post-mount file and reboot.

Would be a good idea to add further checks in our swap tests for such cases.
What I don't like is the device name/label in the path. The way Diversion starts Entware has so far proofed as being 100% reliable. I'm thinking of implementing the same for swap.
But before I can start coding I have to solve my "cpu overtemperature error" on my workhorse. Asus Sabertooth z77 MB is a pain in the butt if you set the bios settings wrong, even resetting to default won't solve it.
Something to do for a lazy Saturday I guess...

 

[Adamm]

Would be a good idea to add further checks in our swap tests for such cases.
What I don't like is the device name/label in the path. The way Diversion starts Entware has so far proofed as being 100% reliable. I'm thinking of implementing the same for swap.
But before I can start coding I have to solve my "cpu overtemperature error" on my workhorse. Asus Sabertooth z77 MB is a pain in the butt if you set the bios settings wrong, even resetting to default won't solve it.
Something to do for a lazy Saturday I guess...

I anticipated this might happen a few months ago (pointing to a non existent swap file), so my uninstallation function will remove the post-mount entry if the file doesn't exist, I'm going to carry over a similar check to my startup code. Might be worth adjusting diversion in a similar way.

                        if ! grep -qF "swapon" /jffs/scripts/post-mount 2>/dev/null; then echo "[*] No SWAP File Detected - Exiting!"; echo; exit 1; fi
                        swaplocation="$(grep -o "swapon .*" /jffs/scripts/post-mount | awk '{print $2}')"
                        Save_IPSets >/dev/null 2>&1
                        echo "[i] Unloading Skynet Components"
                        Unload_Cron "all"
                        Unload_IPTables
                        Unload_DebugIPTables
                        Unload_IPSets
                        echo "[i] Removing SWAP File ($swaplocation)"
                        if [ -f "$swaplocation" ]; then
                            sed -i '\~swapon ~d' /jffs/scripts/post-mount
                            swapoff "$swaplocation"
                            if rm -rf "$swaplocation"; then echo "[i] SWAP File Removed"; else "[*] SWAP File Partially Removed - Please Inspect Manually"; fi
                        else
                            sed -i '\~swapon ~d' /jffs/scripts/post-mount
                            echo "[*] SWAP File Partially Removed - Please Inspect Manually"
                        fi

 

[thelonelycoder]

I anticipated this might happen a few months ago (pointing to a non existent swap file), so my uninstallation function will remove the post-mount entry if the file doesn't exist, I'm going to carry over a similar check to my startup code. Might be worth adjusting diversion in a similar way.

amtm has better code for such situations and offers to correct paths or remove the post-mount entry. Diversion will have it in an upcoming update.
I'm still thinking about having something like this in post-mount instead of the hard path:

swapFile="$(find /mnt/*/myswap.swp 2> /dev/null)"

Now that my overheating problem is solved by getting a new CPU water cooler I might have some time.

 

[Marin]

@Adamm—-when I installed Skynet last night, went with 2GB option for my swap file as I wasn’t sure what to go with (option 4 I think). Is that too much space?

I am currently using a Sandisk Ultra Flair 16GB thumb drive so I wasn’t very concerned.

Thank you!




Sent from my iPhone using Tapatalk