Skynet Skynet - Router Firewall & Security Enhancements

[Secret Squirrel Mission]

Yes, the phone see the embedded bitcoin host when you're connected to the cell data but what it does I don't know but my guess is, it's not that bad. Just to be clear, your phone does not initiate the outbound connect, it happens when you go to a website where the bitcoin host resides. It's more likely a reply to the sites inquiry.
If you look at your first post, the filter that blocks the outgoing connection were browser something list, it indicates the block comes from browsing sites that has hosts blacklisted.

That makes sense, I guess my next step is to start from scratch and see which one is the culprit. Thanks for the feedback everyone, I truly appreciate it. I guess I was just worried because I've never seen outbound connections like that and it's happening to several devices after installing Skynet. For example my Xbox One was showing it was connected to a bunch of local IP addresses 192.168.x.x. for example but then I realized my kid was playing Roblox and it was most likely just the other players.

 

[martinr]

Glad I'm not being overly paranoid haha. Definitely let me know what you find out in regards to your devices.

You asked me to let you know whether I also noticed blocked outbound connections when my devices were not in use. Two iPads and one iPhone showed no outbound blocks when left in standby overnight. Made me realise though that I’ve been complacent, even negligent. So I’m very grateful for you post.

 

[Adamm]

Hi @Adamm for some reason I never, ever, ever have seen the "associated domains" listed in my logs and wondering if I am missing a configuration item somewhere. I checked the code and it appears "extendedstats" is enabled when "/opt/var/log/dnsmasq.log" exists. On my rig, I have setup ""/var/log/dnsmasq.log" as the location but as expected the "extendedstats" variable shows as "disabled".

Can anyone let me know how I need to get this going? Hoping it doesn't involve installing Entware.

Thanks.

This feature works with how Diversion configures dnsmasq extended logging to "/opt/var/log/dnsmasq.log", therefore Diversion and therefore entware is required.

Is there a way to hide the IOT - BLOCKED events from showing in the syslog?

Adding to the options above, you can also disable "debug mode", but without logs you also miss out on stats so its a catch 22.

That makes sense, I guess my next step is to start from scratch and see which one is the culprit. Thanks for the feedback everyone, I truly appreciate it. I guess I was just worried because I've never seen outbound connections like that and it's happening to several devices after installing Skynet. For example my Xbox One was showing it was connected to a bunch of local IP addresses 192.168.x.x. for example but then I realized my kid was playing Roblox and it was most likely just the other players.

Sounds like your questions got covered, but to reiterate the culprit was most likely a website or app trying to connect to a host known for mining. Traditional "malware" on devices like iPhones/Xbox's is very unlikely.

 

[cmkelley]

Adding to the options above, you can also disable "debug mode", but without logs you also miss out on stats so its a catch 22.

Is "IOT - BLOCKED" something I should add to the syslog-ng Skynet filter to send to the log file for scrubbing by Skynet? Currently any message that is identified as coming from the program "Skynet" or contains either "BLOCKED -" or "DROP IN=" is going to the alternate log file. Should I add "IOT - BLOCKED" and/or any other keywords? I don't use any IoT devices so I've never seen this message ...

Thanks.

 

[Secret Squirrel Mission]

This feature works with how Diversion configures dnsmasq extended logging to "/opt/var/log/dnsmasq.log", therefore Diversion and therefore entware is required.



Adding to the options above, you can also disable "debug mode", but without logs you also miss out on stats so its a catch 22.



Sounds like your questions got covered, but to reiterate the culprit was most likely a website or app trying to connect to a host known for mining. Traditional "malware" on devices like iPhones/Xbox's is very unlikely.

Learn something new everyday. I imagine there is no way to stop things like this from happening other than the standard vigilance? Looks like I found a new topic to dive into haha Thanks for the feedback everyone.

 

[Secret Squirrel Mission]

You asked me to let you know whether I also noticed blocked outbound connections when my devices were not in use. Two iPads and one iPhone showed no outbound blocks when left in standby overnight. Made me realise though that I’ve been complacent, even negligent. So I’m very grateful for you post.

Thanks for getting back to me and I'm glad to hear you're not having any issues. From the other answers it looks like it was a lack of vigilance on my part, live and learn =)

 

[martinr]

Thanks for getting back to me and I'm glad to hear you're not having any issues. From the other answers it looks like it was a lack of vigilance on my part, live and learn =)

Take comfort then from at least 2 people learning from it.

 

[dave14305]

Is there a way to hide the IOT - BLOCKED events from showing in the syslog?

If you’re good with vi or nano editors, you can comment out lines 383-384 and 473 from the current version of /jffs/scripts/firewall. These lines load the logging rules for IOT. I do something similar to stop the logging of inbound events, because I still want to log outbound events. Same logic should apply for IOT.

Line numbers valid only for v6.8.5. Disable auto-update of SkyNet if you choose this path (the script, not the banmalware lists). I don’t recommend it for the general public, but if you don’t want to give up all the other logging, this will do it.

 

[TripleRipple]

I am having an issue with my Samsung S9 connecting to the OTA system updates.

It fails whenever connected via WiFi to my RT-AC3100 (Merlin 381.12) with Skynet v6.8.5 and Diversion v4.1.1 installed. Whenever I connect the phone to LTE vs wireless, it connects no problem and shows updates or no updates.

On WiFi..."Couldn't download the update....Unable to update the software. A network or server error occurred. Try again later." is the error message.

I have an app that monitors network connections from my phone so I can see the IPs that apps and others system functions are connecting to. I believe I ironed down the OTA system updates to the IP 213.71.30.137:443.

The IP tracks back to Verizon Deutschland GmbH in Germany. The connection to the IP stays stuck at TCP6 SYN_SENT status when viewing the network monitor on my phone. It never flips to TCP6 ESTABLISHED like other apps and connections do.

I checked the Skynet debug logs and there are no entries of this IP being blocked. I have the IP added to the Whitelist. Has anyone else experienced a similar issue before?

I am still very junior in experience level with Skynet and Diversion so any recommendations or suggestions to troubleshoot further would be appreciated. The issue may not be with Skynet but would like to rule it out.

 

[dave14305]

I am having an issue with my Samsung S9 connecting to the OTA system updates.

It fails whenever connected via WiFi to my RT-AC3100 (Merlin 381.12) with Skynet v6.8.5 and Diversion v4.1.1 installed. Whenever I connect the phone to LTE vs wireless, it connects no problem and shows updates or no updates.

On WiFi..."Couldn't download the update....Unable to update the software. A network or server error occurred. Try again later." is the error message.

I have an app that monitors network connections from my phone so I can see the IPs that apps and others system functions are connecting to. I believe I ironed down the OTA system updates to the IP 213.71.30.137:443.

The IP tracks back to Verizon Deutschland GmbH in Germany. The connection to the IP stays stuck at TCP6 SYN_SENT status when viewing the network monitor on my phone. It never flips to TCP6 ESTABLISHED like other apps and connections do.

I checked the Skynet debug logs and there are no entries of this IP being blocked. I have the IP added to the Whitelist. Has anyone else experienced a similar issue before?

I am still very junior in experience level with Skynet and Diversion so any recommendations or suggestions to troubleshoot further would be appreciated. The issue may not be with Skynet but would like to rule it out.

If you have debug mode enabled, you would see plenty of BLOCKED - OUTBOUND logs with your phone’s lan IP. You may not be getting the right destination IP, so go by source IP. If you don’t see anything, it wouldn’t be SkyNet’s ban lists to blame. Is Diversion blocking anything from your phone when you update? Follow the log (diversion f).

 

[Diamond67]

Is Diversion blocking anything from your phone when you update? Follow the log (diversion f).

I recommend that as well.

But if you won't find Diversion blocking any sites crucial for your Samsung updates, you could try to temporarily remove all Banned Countries (you have some? right?) from Skynet (copy/paste a backup of your current Banned Countries from the main menu to notepad etc. before going to [2] Ban -menu). Maybe some banned country needs to be unbanned?

 

[Adamm]

I am having an issue with my Samsung S9 connecting to the OTA system updates.

It fails whenever connected via WiFi to my RT-AC3100 (Merlin 381.12) with Skynet v6.8.5 and Diversion v4.1.1 installed. Whenever I connect the phone to LTE vs wireless, it connects no problem and shows updates or no updates.

On WiFi..."Couldn't download the update....Unable to update the software. A network or server error occurred. Try again later." is the error message.

I have an app that monitors network connections from my phone so I can see the IPs that apps and others system functions are connecting to. I believe I ironed down the OTA system updates to the IP 213.71.30.137:443.

The IP tracks back to Verizon Deutschland GmbH in Germany. The connection to the IP stays stuck at TCP6 SYN_SENT status when viewing the network monitor on my phone. It never flips to TCP6 ESTABLISHED like other apps and connections do.

I checked the Skynet debug logs and there are no entries of this IP being blocked. I have the IP added to the Whitelist. Has anyone else experienced a similar issue before?

I am still very junior in experience level with Skynet and Diversion so any recommendations or suggestions to troubleshoot further would be appreciated. The issue may not be with Skynet but would like to rule it out.

As stated above, anything blocked by Skynet is logged in the syslog which you can whitelist via this guide. Another way to test if Skynet is blocking these updates is to temporarily disable Skynet using the appropriate menu option.

 

[TripleRipple]

As stated above, anything blocked by Skynet is logged in the syslog which you can whitelist via this guide. Another way to test if Skynet is blocking these updates is to temporarily disable Skynet using the appropriate menu option.

Thank you dave14305, Diamond67 and Adamm for the replies. I really appreciate how supportive everyone is on this forum and this thread in particular.

As suspected it was not Diversion or Skynet.

Prior to my initial post, I did review the Skynet debug logs as you suggested dave14305. Unfortunately I never saw the outbound connection to 213.71.30.137. That should have been my first clue. However, I found that odd but never the less I kept going.

Then I temporarily disabled Skynet as you suggested Adamm. Thank you for putting that feature in. Also I reviewed the Diversion logs as you suggested Diamond67...and I received the following output (replaced actual IPs with x.x.x.x):

Jun 23 11:49:50 dnsmasq[1101]: query[A] dms.ospserver.net from x.x.x.x
Jun 23 11:49:50 dnsmasq[1101]: forwarded dms.ospserver.net to x.x.x.x
Jun 23 11:49:50 dnsmasq[1101]: forwarded dms.ospserver.net to x.x.x.x
Jun 23 11:49:50 dnsmasq[1101]: reply dms.ospserver.net is 213.71.30.137

In my city my ISP has Wifi Hotspots. We happened to visit a restaurant last night that had one of my ISPs Hotspots. Typically I am always running a VPN connection back to my home router, but for testing, I ran cold turkey on the WiFi Hotspot for a few minutes (obviously I never do this typically due to security, but I needed to do it quick for this test). It tested fine. It went to the update server and the status was no update available. No error messages. Disconnected, tried on LTE again...same good result. Then back home tried again....same bad result....network or server error.

At that point I determined it appeared to be an issue with home connection to my ISP. Or a least the local node/router that my home is connected to. I eliminated the Asus router and used the ISPs provided router (typically in bridge mode) and enabled their wireless. I tried again and still not working. Verified that my issue definitely has nothing to do with Skynet, Diversion or my Asus router. I can't even ping the 213.71.30.137 from my ISP at my home on their supplied router, but on LTE, or VPN via PIA, or elsewhere outside of my home....no issues.

It appears I have to contact my ISP about this. Very strange though when connecting to the ISP Hotspot last night produced successful results. It has to be the local node or something else in my area causing this issue.

In any regard, I really appreciate the suggestions and troubleshooting assistance. It is very much appreciated.

Unfortunately I am away on travel for the next couple of weeks, but I will follow-up with the ISP on this issue when I return. I will let everyone know what the fix was on their end....just to make sure those of you interested find out about the final resolution.

 

[davidlee93]

@Adamm

My RT-AC86U on the lastest 384.12 firmware still randomly reboots with Skynet installed (blocked ru, cn, hk, mo, kp, ir, sg + personalized IP lists):

May  5 01:05:05 kernel: _ Reboot message ... _______________________________________________________
May  5 01:05:05 kernel: Kernel panic - not syncing: softlockup: hung tasksCPU: 1 PID: 210 Comm: bcmsw_rx Tainted: P           O L  4.1.27 #2Hardware name: Broadcom-v8A (DT)Call trace:[<ffffffc0000876d8>] dump_backtrace+0x0/0x150[<ffffffc00008783c>] show_stack+0x14/0x20[<ffffffc0005086fc>] dump_stack+0x90/0xb0[<ffffffc00050658c>] panic+0xe0/0x228[<ffffffc0000f8038>] watchdog+0x0/0x48[<ffffffc0000dcf8c>] hrtimer_run_queues+0x8c/0x1c8[<ffffffc0000dc49c>] update_process_times+0x2c/0x70[<ffffffc0000ea434>]
May  5 01:05:05 kernel: 5b80 ffffffc0 006e3980 ffffffc0f420: 30383533 30303030 574f444e 3535363d 52203533 303d5345 20303078 204e5953f440: 50475255 4f20303d 28205450 34303230 34423530 32303430 00728d7c ffffffc0f460: 190b1954 ffffffc0 11758460 ffffffc0 80728d77 ffffffc0 00728c20 ffffffc0f480: 00738000 ffffffc0 006f4000 ffffffc0 00000140 00000000 00728d78 ffffffc0f4a0: 00000001 00000000 00738b20 ffffffc0 00000123 00000000 00734b8c ffffffc0f4c0: 00000004 00000000 17adf500 ffffffc0 000cc6cc ffffffc0 17adf50
May  5 01:05:05 kernel: 042b0fc>] ip_rcv+0x2c4/0x3b8[<ffffffc0003bb310>] __netif_receive_skb_core+0x6
May  5 01:05:05 kernel: usb 3-1: new high-speed USB device number 2 using ehci-platform
May  5 01:05:05 kernel: 28/0xa40[<ffffffc0003be31c>] __netif_receive_skb+0x2c/0x88[<ffffffc0003be3b8>] netif_receive_skb_internal+0x40/0xc0[<ffffffc0003be448>] netif_receive_skb_sk+0x10/0x18[<ffffffc0004f2b08>] br_handle_frame_finish+0x220/0x658[<ffffffc0004f30d8>] br_handle_frame+0x198/0x2c0[<ffffffc0003bb138>] __netif_receive_skb_core+0x450/0xa40[<ffffffc0003be31c>] __netif_receive_skb+0x2c/0x88[<ffffffc0003be3b8>] netif_receive_skb_internal+0x40/0xc0[<ffffffc0003be448>] netif_receive_skb_sk+0x10/0x1
May  5 01:05:05 kernel: ____________________________________________________________________________

 

[SomeWhereOverTheRainBow]

@Adamm

My RT-AC86U on the lastest 384.12 firmware still randomly reboots with Skynet installed (blocked ru, cn, hk, mo, kp, ir, sg + personalized IP lists):

May  5 01:05:05 kernel: _ Reboot message ... _______________________________________________________
May  5 01:05:05 kernel: Kernel panic - not syncing: softlockup: hung tasksCPU: 1 PID: 210 Comm: bcmsw_rx Tainted: P           O L  4.1.27 #2Hardware name: Broadcom-v8A (DT)Call trace:[<ffffffc0000876d8>] dump_backtrace+0x0/0x150[<ffffffc00008783c>] show_stack+0x14/0x20[<ffffffc0005086fc>] dump_stack+0x90/0xb0[<ffffffc00050658c>] panic+0xe0/0x228[<ffffffc0000f8038>] watchdog+0x0/0x48[<ffffffc0000dcf8c>] hrtimer_run_queues+0x8c/0x1c8[<ffffffc0000dc49c>] update_process_times+0x2c/0x70[<ffffffc0000ea434>]
May  5 01:05:05 kernel: 5b80 ffffffc0 006e3980 ffffffc0f420: 30383533 30303030 574f444e 3535363d 52203533 303d5345 20303078 204e5953f440: 50475255 4f20303d 28205450 34303230 34423530 32303430 00728d7c ffffffc0f460: 190b1954 ffffffc0 11758460 ffffffc0 80728d77 ffffffc0 00728c20 ffffffc0f480: 00738000 ffffffc0 006f4000 ffffffc0 00000140 00000000 00728d78 ffffffc0f4a0: 00000001 00000000 00738b20 ffffffc0 00000123 00000000 00734b8c ffffffc0f4c0: 00000004 00000000 17adf500 ffffffc0 000cc6cc ffffffc0 17adf50
May  5 01:05:05 kernel: 042b0fc>] ip_rcv+0x2c4/0x3b8[<ffffffc0003bb310>] __netif_receive_skb_core+0x6
May  5 01:05:05 kernel: usb 3-1: new high-speed USB device number 2 using ehci-platform
May  5 01:05:05 kernel: 28/0xa40[<ffffffc0003be31c>] __netif_receive_skb+0x2c/0x88[<ffffffc0003be3b8>] netif_receive_skb_internal+0x40/0xc0[<ffffffc0003be448>] netif_receive_skb_sk+0x10/0x18[<ffffffc0004f2b08>] br_handle_frame_finish+0x220/0x658[<ffffffc0004f30d8>] br_handle_frame+0x198/0x2c0[<ffffffc0003bb138>] __netif_receive_skb_core+0x450/0xa40[<ffffffc0003be31c>] __netif_receive_skb+0x2c/0x88[<ffffffc0003be3b8>] netif_receive_skb_internal+0x40/0xc0[<ffffffc0003be448>] netif_receive_skb_sk+0x10/0x1
May  5 01:05:05 kernel: ____________________________________________________________________________

That stinks. look on the bright side, you won't need to use a reboot scheduler.

 

[L&LD]

@Adamm

My RT-AC86U on the lastest 384.12 firmware still randomly reboots with Skynet installed (blocked ru, cn, hk, mo, kp, ir, sg + personalized IP lists):

May  5 01:05:05 kernel: _ Reboot message ... _______________________________________________________
May  5 01:05:05 kernel: Kernel panic - not syncing: softlockup: hung tasksCPU: 1 PID: 210 Comm: bcmsw_rx Tainted: P           O L  4.1.27 #2Hardware name: Broadcom-v8A (DT)Call trace:[<ffffffc0000876d8>] dump_backtrace+0x0/0x150[<ffffffc00008783c>] show_stack+0x14/0x20[<ffffffc0005086fc>] dump_stack+0x90/0xb0[<ffffffc00050658c>] panic+0xe0/0x228[<ffffffc0000f8038>] watchdog+0x0/0x48[<ffffffc0000dcf8c>] hrtimer_run_queues+0x8c/0x1c8[<ffffffc0000dc49c>] update_process_times+0x2c/0x70[<ffffffc0000ea434>]
May  5 01:05:05 kernel: 5b80 ffffffc0 006e3980 ffffffc0f420: 30383533 30303030 574f444e 3535363d 52203533 303d5345 20303078 204e5953f440: 50475255 4f20303d 28205450 34303230 34423530 32303430 00728d7c ffffffc0f460: 190b1954 ffffffc0 11758460 ffffffc0 80728d77 ffffffc0 00728c20 ffffffc0f480: 00738000 ffffffc0 006f4000 ffffffc0 00000140 00000000 00728d78 ffffffc0f4a0: 00000001 00000000 00738b20 ffffffc0 00000123 00000000 00734b8c ffffffc0f4c0: 00000004 00000000 17adf500 ffffffc0 000cc6cc ffffffc0 17adf50
May  5 01:05:05 kernel: 042b0fc>] ip_rcv+0x2c4/0x3b8[<ffffffc0003bb310>] __netif_receive_skb_core+0x6
May  5 01:05:05 kernel: usb 3-1: new high-speed USB device number 2 using ehci-platform
May  5 01:05:05 kernel: 28/0xa40[<ffffffc0003be31c>] __netif_receive_skb+0x2c/0x88[<ffffffc0003be3b8>] netif_receive_skb_internal+0x40/0xc0[<ffffffc0003be448>] netif_receive_skb_sk+0x10/0x18[<ffffffc0004f2b08>] br_handle_frame_finish+0x220/0x658[<ffffffc0004f30d8>] br_handle_frame+0x198/0x2c0[<ffffffc0003bb138>] __netif_receive_skb_core+0x450/0xa40[<ffffffc0003be31c>] __netif_receive_skb+0x2c/0x88[<ffffffc0003be3b8>] netif_receive_skb_internal+0x40/0xc0[<ffffffc0003be448>] netif_receive_skb_sk+0x10/0x1
May  5 01:05:05 kernel: ____________________________________________________________________________

Are you using a swap file? What other scripts are installed? Are you using amtm? What firmware was running previous to 384.12_0?

When was the last time you did a full reset to factory defaults followed by a minimal and manual configuration to secure the router and connect to your ISP (without using a saved backup config file)?

 

[davidlee93]

Are you using a swap file? What other scripts are installed? Are you using amtm? What firmware was running previous to 384.12_0?

When was the last time you did a full reset to factory defaults followed by a minimal and manual configuration to secure the router and connect to your ISP (without using a saved backup config file)?

I am using a 512mb swap file, Skynet is the only script installed on the usb, not using amtm, was previously on stock asus firmware 45717 and upgraded to 384.12 and did an initialize (which goes to a more clean state than a normal reset, see article)

I immediately did an initialize after the upgrade to 382.12 without using the backup config file.

 

[L&LD]

I am using a 512mb swap file, Skynet is the only script installed on the usb, not using amtm, was previously on stock asus firmware 45717 and upgraded to 384.12 and did an initialize (which goes to a more clean state than a normal reset, see article)

I immediately did an initialize after the upgrade to 382.12 without using the backup config file.

Here is what I suggest to get your router working as expected (I'm assuming you mean 384.12_0, btw).

1. Select the 'Format JFFS partition on next boot' option. Make sure you hit Apply at the bottom of the page before continuing.
2. Reboot the router and wait for 5 to 10 minutes for the router to settle (the CPU cores will be idle).
3. Reboot the router again and wait for another 5 to 10 minutes for the router to settle again.
4. Reboot one last time and wait for the router to settle and then reflash the 384.12_0 firmware again.
5. Follow the amtm Step-by-Step guide to have your USB drive formatted properly in the way the router is expecting and use it to create a swap file too. Ext4 with journalling enabled is recommended.
6. Make sure to enable the disk checker utility in amtm and check the log after any future reboots to confirm your USB drive is healthy.
7. At this point, install the Skynet script as per the first post in this thread.
8. 15 minutes or more after Skynet is installed and working, reboot the router and confirm it continues to work after the reboot.
9. 60 minutes or more after you've confirmed it is still working with no unexpected errors, reboot a final time.

If, after following the above steps and the indicated guide to properly formatting the USB drive doesn't work, I would recommend a full M&M Config of the router at that point, followed by the steps above once more.

Hopefully, the above will be enough to get your router to a good/known state.

 

[Adamm]

@Adamm

My RT-AC86U on the lastest 384.12 firmware still randomly reboots with Skynet installed (blocked ru, cn, hk, mo, kp, ir, sg + personalized IP lists):

May  5 01:05:05 kernel: _ Reboot message ... _______________________________________________________
May  5 01:05:05 kernel: Kernel panic - not syncing: softlockup: hung tasksCPU: 1 PID: 210 Comm: bcmsw_rx Tainted: P           O L  4.1.27 #2Hardware name: Broadcom-v8A (DT)Call trace:[<ffffffc0000876d8>] dump_backtrace+0x0/0x150[<ffffffc00008783c>] show_stack+0x14/0x20[<ffffffc0005086fc>] dump_stack+0x90/0xb0[<ffffffc00050658c>] panic+0xe0/0x228[<ffffffc0000f8038>] watchdog+0x0/0x48[<ffffffc0000dcf8c>] hrtimer_run_queues+0x8c/0x1c8[<ffffffc0000dc49c>] update_process_times+0x2c/0x70[<ffffffc0000ea434>]
May  5 01:05:05 kernel: 5b80 ffffffc0 006e3980 ffffffc0f420: 30383533 30303030 574f444e 3535363d 52203533 303d5345 20303078 204e5953f440: 50475255 4f20303d 28205450 34303230 34423530 32303430 00728d7c ffffffc0f460: 190b1954 ffffffc0 11758460 ffffffc0 80728d77 ffffffc0 00728c20 ffffffc0f480: 00738000 ffffffc0 006f4000 ffffffc0 00000140 00000000 00728d78 ffffffc0f4a0: 00000001 00000000 00738b20 ffffffc0 00000123 00000000 00734b8c ffffffc0f4c0: 00000004 00000000 17adf500 ffffffc0 000cc6cc ffffffc0 17adf50
May  5 01:05:05 kernel: 042b0fc>] ip_rcv+0x2c4/0x3b8[<ffffffc0003bb310>] __netif_receive_skb_core+0x6
May  5 01:05:05 kernel: usb 3-1: new high-speed USB device number 2 using ehci-platform
May  5 01:05:05 kernel: 28/0xa40[<ffffffc0003be31c>] __netif_receive_skb+0x2c/0x88[<ffffffc0003be3b8>] netif_receive_skb_internal+0x40/0xc0[<ffffffc0003be448>] netif_receive_skb_sk+0x10/0x18[<ffffffc0004f2b08>] br_handle_frame_finish+0x220/0x658[<ffffffc0004f30d8>] br_handle_frame+0x198/0x2c0[<ffffffc0003bb138>] __netif_receive_skb_core+0x450/0xa40[<ffffffc0003be31c>] __netif_receive_skb+0x2c/0x88[<ffffffc0003be3b8>] netif_receive_skb_internal+0x40/0xc0[<ffffffc0003be448>] netif_receive_skb_sk+0x10/0x1
May  5 01:05:05 kernel: ____________________________________________________________________________

What makes you think Skynet is the cause? Nothing in your post indicates so.

 

[davidlee93]

What makes you think Skynet is the cause? Nothing in your post indicates so.

Because before the kernel panic occurred, the router/skynet was blocking a fairly high amount of IPs (50-100 IPs every two seconds) and it seems that either skynet or the RT-AC86U just isn't designed to handle this flood of blocked IPs.