Skynet Skynet - Router Firewall & Security Enhancements

[azdeltawye]

What is the output of;

sh /jffs/scripts/firewall debug info

===========================================================================================


[#] 143832 IPs (+0) -- 1653 Ranges Banned (+0) || 8544 Inbound -- 2 Outbound Connections B]

DSIMS@RT-AC86U-D8E0:/tmp/home/root#
DSIMS@RT-AC86U-D8E0:/tmp/home/root#
DSIMS@RT-AC86U-D8E0:/tmp/home/root#
DSIMS@RT-AC86U-D8E0:/tmp/home/root#
DSIMS@RT-AC86U-D8E0:/tmp/home/root# sh /jffs/scripts/firewall debug info
################################################################################################
#                                                                                              #
#                  ███████╗██╗  ██╗██╗   ██╗███╗   ██╗███████╗████████╗    ██╗   ██╗███████╗   #
#                  ██╔════╝██║ ██╔╝╚██╗ ██╔╝████╗  ██║██╔════╝╚══██╔══╝    ██║   ██║╚════██║   #
#                  ███████╗█████╔╝  ╚████╔╝ ██╔██╗ ██║█████╗     ██║       ██║   ██║    ██╔╝   #
#                  ╚════██║██╔═██╗   ╚██╔╝  ██║╚██╗██║██╔══╝     ██║       ╚██╗ ██╔╝   ██╔╝    #
#                  ███████║██║  ██╗   ██║   ██║ ╚████║███████╗   ██║        ╚████╔╝    ██║     #
#                  ╚══════╝╚═╝  ╚═╝   ╚═╝   ╚═╝  ╚═══╝╚══════╝   ╚═╝         ╚═══╝     ╚═╝     #
#                                                                                              #
#                                 Router Firewall And Security Enhancements                    #
#                             By Adamm -  https://github.com/Adamm00/IPSet_ASUS                #
#                                            02/03/2020 - v7.1.2                               #
################################################################################################


================================================================================================


Router Model; RT-AC86U
Skynet Version; v7.1.2 (02/03/2020) (ce332140e76f161724aad3e2ed67c11a)
iptables v1.4.15 - (eth0 @ 192.168.175.1)
ipset v6.32, protocol version: 6
IP Address; (*.*.*.*)
FW Version; 384.15_0 (Feb 8 2020) (4.1.27)
Install Dir; /tmp/mnt/ASUS-1/skynet (111.2G / 119.6G Space Available)
SWAP File; /tmp/mnt/ASUS-1/myswap.swp (2.0G)
Uptime; 3 days, 8 hours, 6 minutes.
Ram Available; (61M / 430M)


---------------                          | ------------     | ---------------      | ----------
| Device Name |                          | | Local IP |     | | MAC Address |      | | Status |
---------------                          | ------------     | ---------------      | ----------

Unknown                                  | *.*.*.*      | *:*:*:*:*:*    | Online
Tesla_Model_3                            | 192.168.7.106    | Unknown              | Offline
*                                        | 192.168.7.119    | *:*:*:*:*:*    | Inactive
MyQ-625                                  | 192.168.7.172    | *:*:*:*:*:*    | Inactive
Gateway95B465                            | 192.168.7.210    | *:*:*:*:*:*    | Online
*                                        | 192.168.7.213    | *:*:*:*:*:*    | Online
*                                        | 192.168.7.222    | *:*:*:*:*:*    | Inactive
MyQ-653                                  | 192.168.7.229    | *:*:*:*:*:*    | DELAY
*                                        | 192.168.7.232    | *:*:*:*:*:*    | Inactive
*                                        | 192.168.7.233    | *:*:*:*:*:*    | Inactive
MyQ-10D                                  | 192.168.7.244    | *:*:*:*:*:*    | Inactive
*                                        | 192.168.9.121    | Unknown              | Offline
Living-Room                              | 192.168.9.141    | *:*:*:*:*:*    | Inactive
Unknown                                  | 192.168.175.3    | *:*:*:*:*:*    | Inactive
Unknown                                  | 192.168.175.4    | *:*:*:*:*:*    | Inactive
Unknown                                  | 192.168.175.5    | Unknown              | Offline
Unknown                                  | 192.168.175.10   | *:*:*:*:*:*    | Inactive
Unknown                                  | 192.168.175.20   | *:*:*:*:*:*    | Inactive
Unknown                                  | 192.168.175.30   | *:*:*:*:*:*    | Online
Unknown                                  | 192.168.175.40   | *:*:*:*:*:*    | Inactive
Unknown                                  | 192.168.175.41   | *:*:*:*:*:*    | Inactive
Unknown                                  | 192.168.175.50   | *:*:*:*:*:*    | Inactive
Unknown                                  | 192.168.175.51   | *:*:*:*:*:*    | Inactive
Unknown                                  | 192.168.175.52   | *:*:*:*:*:*    | Inactive
Unknown                                  | 192.168.175.53   | *:*:*:*:*:*    | Online
Unknown                                  | 192.168.175.60   | *:*:*:*:*:*    | Inactive
mysimplelink                             | 192.168.175.70   | *:*:*:*:*:*    | Inactive
Ellens-iPad                              | 192.168.175.102  | *:*:*:*:*:*    | Inactive
ECTiPhonep                               | 192.168.175.120  | *:*:*:*:*:*    | Inactive
SIMSCO-HPZ600                            | 192.168.175.124  | *:*:*:*:*:*    | Online
Unknown                                  | 192.168.175.200  | *:*:*:*:*:*    | Inactive
Unknown                                  | 192.168.175.210  | *:*:*:*:*:*    | Inactive
Unknown                                  | 192.168.175.213  | *:*:*:*:*:*    | Inactive
Unknown                                  | 192.168.175.233  | Unknown              | Offline
Unknown                                  | 192.168.175.244  | Unknown              | Offline
Unknown                                  | 192.168.175.246  | *:*:*:*:*:*    | Inactive
DSiPhone                                 | 192.168.175.249  | *:*:*:*:*:*    | Inactive


--------------------                | ----------
| Test Description |                | | Result |
--------------------                | ----------

Internet-Connectivity               | [Passed]
Write Permission                    | [Passed]
Firewall-Start Entry                | [Passed]
Services-Stop Entry                 | [Passed]
Service-Event Entry                 | [Passed]
SWAP File                           | [Passed]
Cron Jobs                           | [Passed]
NTP Sync                            | [Passed]
IPSet Comment Support               | [Passed]
Log Level 4 Settings                | [Passed]
Duplicate Rules In RAW              | [Passed]
IPSets                              | [Passed]
IPTables Rules                      | [Passed]
Local WebUI Files                   | [Passed]
Mounted WebUI Files                 | [Passed]
MenuTree.js Entry                   | [Passed]
Diversion Plus Content              | [Passed]


-----------                         | ----------
| Setting |                         | | Status |
----------                          | ----------

Skynet Auto-Updates                 | [Enabled]
Malware List Auto-Updates           | [Enabled]
Logging                             | [Enabled]
Filter Traffic                      | [Enabled]
Unban PrivateIP                     | [Enabled]
Log Invalid Packets                 | [Disabled]
Ban AiProtect                       | [Enabled]
Secure Mode                         | [Enabled]
Fast Switch List                    | [Disabled]
Syslog Location                     | [Default]
IOT Blocking                        | [Enabled]
Country Lookup For Stats            | [Enabled]
CDN Whitelisting                    | [Enabled]
Display WebUI                       | [Enabled]

17/17 Tests Sucessful


================================================================================================


[#] 143832 IPs (+0) -- 1653 Ranges Banned (+0) || 8549 Inbound -- 2 Outbound Connections Blocke]

DSIMS@RT-AC86U-D8E0:/tmp/home/root#

 

[Adamm]

===========================================================================================


[#] 143832 IPs (+0) -- 1653 Ranges Banned (+0) || 8544 Inbound -- 2 Outbound Connections B]

DSIMS@RT-AC86U-D8E0:/tmp/home/root#
DSIMS@RT-AC86U-D8E0:/tmp/home/root#
DSIMS@RT-AC86U-D8E0:/tmp/home/root#
DSIMS@RT-AC86U-D8E0:/tmp/home/root#
DSIMS@RT-AC86U-D8E0:/tmp/home/root# sh /jffs/scripts/firewall debug info
################################################################################################
#                                                                                              #
#                  ███████╗██╗  ██╗██╗   ██╗███╗   ██╗███████╗████████╗    ██╗   ██╗███████╗   #
#                  ██╔════╝██║ ██╔╝╚██╗ ██╔╝████╗  ██║██╔════╝╚══██╔══╝    ██║   ██║╚════██║   #
#                  ███████╗█████╔╝  ╚████╔╝ ██╔██╗ ██║█████╗     ██║       ██║   ██║    ██╔╝   #
#                  ╚════██║██╔═██╗   ╚██╔╝  ██║╚██╗██║██╔══╝     ██║       ╚██╗ ██╔╝   ██╔╝    #
#                  ███████║██║  ██╗   ██║   ██║ ╚████║███████╗   ██║        ╚████╔╝    ██║     #
#                  ╚══════╝╚═╝  ╚═╝   ╚═╝   ╚═╝  ╚═══╝╚══════╝   ╚═╝         ╚═══╝     ╚═╝     #
#                                                                                              #
#                                 Router Firewall And Security Enhancements                    #
#                             By Adamm -  https://github.com/Adamm00/IPSet_ASUS                #
#                                            02/03/2020 - v7.1.2                               #
################################################################################################


================================================================================================


Router Model; RT-AC86U
Skynet Version; v7.1.2 (02/03/2020) (ce332140e76f161724aad3e2ed67c11a)
iptables v1.4.15 - (eth0 @ 192.168.175.1)
ipset v6.32, protocol version: 6
IP Address; (*.*.*.*)
FW Version; 384.15_0 (Feb 8 2020) (4.1.27)
Install Dir; /tmp/mnt/ASUS-1/skynet (111.2G / 119.6G Space Available)
SWAP File; /tmp/mnt/ASUS-1/myswap.swp (2.0G)
Uptime; 3 days, 8 hours, 6 minutes.
Ram Available; (61M / 430M)


---------------                          | ------------     | ---------------      | ----------
| Device Name |                          | | Local IP |     | | MAC Address |      | | Status |
---------------                          | ------------     | ---------------      | ----------

Unknown                                  | *.*.*.*      | *:*:*:*:*:*    | Online
Tesla_Model_3                            | 192.168.7.106    | Unknown              | Offline
*                                        | 192.168.7.119    | *:*:*:*:*:*    | Inactive
MyQ-625                                  | 192.168.7.172    | *:*:*:*:*:*    | Inactive
Gateway95B465                            | 192.168.7.210    | *:*:*:*:*:*    | Online
*                                        | 192.168.7.213    | *:*:*:*:*:*    | Online
*                                        | 192.168.7.222    | *:*:*:*:*:*    | Inactive
MyQ-653                                  | 192.168.7.229    | *:*:*:*:*:*    | DELAY
*                                        | 192.168.7.232    | *:*:*:*:*:*    | Inactive
*                                        | 192.168.7.233    | *:*:*:*:*:*    | Inactive
MyQ-10D                                  | 192.168.7.244    | *:*:*:*:*:*    | Inactive
*                                        | 192.168.9.121    | Unknown              | Offline
Living-Room                              | 192.168.9.141    | *:*:*:*:*:*    | Inactive
Unknown                                  | 192.168.175.3    | *:*:*:*:*:*    | Inactive
Unknown                                  | 192.168.175.4    | *:*:*:*:*:*    | Inactive
Unknown                                  | 192.168.175.5    | Unknown              | Offline
Unknown                                  | 192.168.175.10   | *:*:*:*:*:*    | Inactive
Unknown                                  | 192.168.175.20   | *:*:*:*:*:*    | Inactive
Unknown                                  | 192.168.175.30   | *:*:*:*:*:*    | Online
Unknown                                  | 192.168.175.40   | *:*:*:*:*:*    | Inactive
Unknown                                  | 192.168.175.41   | *:*:*:*:*:*    | Inactive
Unknown                                  | 192.168.175.50   | *:*:*:*:*:*    | Inactive
Unknown                                  | 192.168.175.51   | *:*:*:*:*:*    | Inactive
Unknown                                  | 192.168.175.52   | *:*:*:*:*:*    | Inactive
Unknown                                  | 192.168.175.53   | *:*:*:*:*:*    | Online
Unknown                                  | 192.168.175.60   | *:*:*:*:*:*    | Inactive
mysimplelink                             | 192.168.175.70   | *:*:*:*:*:*    | Inactive
Ellens-iPad                              | 192.168.175.102  | *:*:*:*:*:*    | Inactive
ECTiPhonep                               | 192.168.175.120  | *:*:*:*:*:*    | Inactive
SIMSCO-HPZ600                            | 192.168.175.124  | *:*:*:*:*:*    | Online
Unknown                                  | 192.168.175.200  | *:*:*:*:*:*    | Inactive
Unknown                                  | 192.168.175.210  | *:*:*:*:*:*    | Inactive
Unknown                                  | 192.168.175.213  | *:*:*:*:*:*    | Inactive
Unknown                                  | 192.168.175.233  | Unknown              | Offline
Unknown                                  | 192.168.175.244  | Unknown              | Offline
Unknown                                  | 192.168.175.246  | *:*:*:*:*:*    | Inactive
DSiPhone                                 | 192.168.175.249  | *:*:*:*:*:*    | Inactive


--------------------                | ----------
| Test Description |                | | Result |
--------------------                | ----------

Internet-Connectivity               | [Passed]
Write Permission                    | [Passed]
Firewall-Start Entry                | [Passed]
Services-Stop Entry                 | [Passed]
Service-Event Entry                 | [Passed]
SWAP File                           | [Passed]
Cron Jobs                           | [Passed]
NTP Sync                            | [Passed]
IPSet Comment Support               | [Passed]
Log Level 4 Settings                | [Passed]
Duplicate Rules In RAW              | [Passed]
IPSets                              | [Passed]
IPTables Rules                      | [Passed]
Local WebUI Files                   | [Passed]
Mounted WebUI Files                 | [Passed]
MenuTree.js Entry                   | [Passed]
Diversion Plus Content              | [Passed]


-----------                         | ----------
| Setting |                         | | Status |
----------                          | ----------

Skynet Auto-Updates                 | [Enabled]
Malware List Auto-Updates           | [Enabled]
Logging                             | [Enabled]
Filter Traffic                      | [Enabled]
Unban PrivateIP                     | [Enabled]
Log Invalid Packets                 | [Disabled]
Ban AiProtect                       | [Enabled]
Secure Mode                         | [Enabled]
Fast Switch List                    | [Disabled]
Syslog Location                     | [Default]
IOT Blocking                        | [Enabled]
Country Lookup For Stats            | [Enabled]
CDN Whitelisting                    | [Enabled]
Display WebUI                       | [Enabled]

17/17 Tests Sucessful


================================================================================================


[#] 143832 IPs (+0) -- 1653 Ranges Banned (+0) || 8549 Inbound -- 2 Outbound Connections Blocke]

DSIMS@RT-AC86U-D8E0:/tmp/home/root#

Your default log level settings are wrong in the WebUI, change them back to how they should be;

 

[Smokey613]

I am running scribe. How can I see what my logging levels are currently set to?

 

[Butterfly Bones]

I am running scribe. How can I see what my logging levels are currently set to?

You need to disable or temporarily remove uiScribe, that is what changes the System Log page

 

[martinr]

You need to disable or temporarily remove uiScribe, that is what changes the System Log page

And whatever you set those 2 logging levels to, are they then overridden by uiScribe presets when you then install uiScribe, or does uiScribe respect/preserve whatever those 2 settings were at when it gets installed?

 

[Butterfly Bones]

And whatever you set those 2 logging levels to, are they then overridden by uiScribe presets when you then install uiScribe, or does uiScribe respect/preserve whatever those 2 settings were at when it gets installed?

From my experience they are preserved, just not visible in the uiScribe page. (Screen cap here.)
https://www.snbforums.com/threads/uiscribe-custom-system-log-page-for-scribed-logs.57040/

All my logging is the same, from what I see. I only have a few items for quick checks in uiScribe, but got through most others thoroughly with a large SSH terminal, many grep queries.

That is ultimately a question for @Jack Yaz to verify.

 

[vipersox]

I installed skynet recently and I'm trying to figure out how to get to my router's public web page. The nonstandard port 8500 seems to be blocked from the outside. The router's public IP address is already whitelisted and I tried adding the line "iptables -I INPUT -p tcp --destination-port 8500 -j ACCEPT" to the firewall start but that didn't seem to help.

 

[martinr]

I installed skynet recently and I'm trying to figure out how to get to my router's public web page. The nonstandard port 8500 seems to be blocked from the outside. The router's public IP address is already whitelisted and I tried adding the line "iptables -I INPUT -p tcp --destination-port 8500 -j ACCEPT" to the firewall start but that didn't seem to help.

Welcome to the forum.

You’re really going to have to clarify a couple of things: what do you mean by your router’s “public web page”? You mean the webui? When you are inside your network what do you type into your browser to see your webui? Something like 192.168.1.1? In which case, you are accessing the webui on Port 80, like the rest of us, so where does Port 8500 come in? The word “public” rings alarm bells; are you trying to access your webui from some remote location on the WAN?

“The router's public IP address is already whitelisted and I tried adding the line "iptables -I INPUT -p tcp --destination-port 8500 -j ACCEPT" to the firewall”.

You really should be using OpenVPN Server to access your webui from the remote WAN; anything else is just asking for real trouble from hackers.

 

[vipersox]

Welcome to the forum.

You’re really going to have to clarify a couple of things: what do you mean by your router’s “public web page”? You mean the webui? When you are inside your network what do you type into your browser to see your webui? Something like 192.168.1.1? In which case, you are accessing the webui on Port 80, like the rest of us, so where does Port 8500 come in? The word “public” rings alarm bells; are you trying to access your webui from some remote location on the WAN?

“The router's public IP address is already whitelisted and I tried adding the line "iptables -I INPUT -p tcp --destination-port 8500 -j ACCEPT" to the firewall”.

You really should be using OpenVPN Server to access your webui from the remote WAN; anything else is just asking for real trouble from hackers.

Nevermind, my apologies. Installing skynet automatically disables "Enable Web Access from WAN" in the Administration, Remote Access Config tab in Merlin.

 

[Adamm]

Nevermind, my apologies. Installing skynet automatically disables "Enable Web Access from WAN" in the Administration, Remote Access Config tab in Merlin.

Yes that is part of the "secure mode" setting as leaving HTTP/SSH exposed to WAN is a security risk. Instead access those services via VPN.

 

[JimbobJay]

Is anyone else having issues accessing websites that use a service called Incapsula? Is this a false positive? Has anyone heard of this service before?

I was trying to access my mobile network’s website giffgaff.com which is a legit mobile network provider in the UK. I was having access problems and narrowed the problem down to Skynet blocking inbound access from a domain called incapdns.net.

Research took me to an explanation (screenshots below) that it is apparently some kind of CDN that websites can use to protect themselves from bots? Can anyone vouch for the safety of allowing incapdns.net?


They also have a wikipedia page https://en.wikipedia.org/wiki/Incapsula
which would appear to describe them as a fairly legit security minded CDN. I have had no problems access giffgaff.com before now. Is there any reason that Skynet seems to be blocking Incapsula now (that is assuming that GiffGaff.com have always been using this Incapsula CDN and haven’t only just switched so that I’ve only jist now noticed the block)?

Thanks for the great firewall

 

[azdeltawye]

Your default log level settings are wrong in the WebUI, change them back to how they should be;

Thanks for the reply however I cannot seem to find those settings in the UI... Where do they live?

 

[Adamm]

Thanks for the reply however I cannot seem to find those settings in the UI... Where do they live?

System > General Log


Unless you have scribe installed, in which case this is most likely a scribe configuration issue.

 

[Butterfly Bones]

System > General Log


Unless you have scribe installed, in which case this is most likely a scribe configuration issue.

Just to be clear, if only scribe in stalled, the System Log is the same, no change to that page. It is uiScribe by Jack Yaz that changes the System Log page. Scribe does ask to install uiScribe upon installation, I suspect most users respond yes. If uiScribe is in uninstalled leaving scribe as is, the normal System Log webgui returns.

 

[vipersox]

Yes that is part of the "secure mode" setting as leaving HTTP/SSH exposed to WAN is a security risk. Instead access those services via VPN.

Will do. Thanks for the hard work on this.

 

[martinr]

Nevermind, my apologies. Installing skynet automatically disables "Enable Web Access from WAN" in the Administration, Remote Access Config tab in Merlin.

Indeed, Skynet not only saves us from the bad guys, it saves us from ourselves.

Setting up OpenVPN Server is as easy as falling off a log. No previous experience required. That’s the way to go, plus you have your own VPN to use for safe Internet browsing when using untrusted wifi.

No apologies needed in this forum.

 

[Centrifuge]

Nevermind, my apologies. Installing skynet automatically disables "Enable Web Access from WAN" in the Administration, Remote Access Config tab in Merlin.

This post and thread for your own VPN server tips, don't let the public have their way with your router dude.

 

[vipersox]

Indeed, Skynet not only saves us from the bad guys, it saves us from ourselves.

Setting up OpenVPN Server is as easy as falling off a log. No previous experience required. That’s the way to go, plus you have your own VPN to use for safe Internet browsing when using untrusted wifi.

No apologies needed in this forum.

This post and thread for your own VPN server tips, don't let the public have their way with your router dude.

I got ya'. I configured OpenVPN quite a while ago, but I just installed Skynet for the very first time yesterday to better protect an internal mail server I run at home. Thanks for the responses.

 

[azdeltawye]

Your default log level settings are wrong in the WebUI, change them back to how they should be;

Thanks for the reply but that did not fix all the logging issues I am still experiencing with Skynet. I uninstalled UIscribe and restored the above logging settings to default and yes I am now seeing data in the 'Skynet' tab of the Firewall UI however when I manually go to Skynet in AMTM and choose: Debug Options/Show Log Entries As They Appear/All, I do not see any blocked inbound or outbound traffic. Instead I see this message repeated every hour or so:

[$] /jffs/scripts/firewall debug watch

=============================================================================================================


[i] Watching Syslog For Log Entries (ctrl +c) To Stop

tail: /tmp/syslog.log has been replaced; following end of new file
Mar  2 01:26:06 RT-AC86U-D8E0 YazFi: wl0.1 (SSID: IOT_2.4) - sending all interface internet traffic over WAN interface
Associated Domain(s) - [settings-win.data.microsoft.com settingsfd-geo.trafficmanager.net gateway.fe.apple-dns.net time-ios.apple.com time-ios.g.aaplimg.com azeus1-client-s.gateway.messenger.live.com azeus1-client-s.msnmessenger.mt
e2603.x.akamaiedge.net 57724, 38388, amazon.cn dl.amazon.cn geocode.arcgis.com dyna.wikimedia.org 7836, 45580, amazon.de tp.abe2c2f23-frontier.amazon.de amazon.de.edgekey.net e15317.e22.akamaiedge.net dl.amazon.de tp.43c4c9fc3-fro]
Mar  2 01:26:09 RT-AC86U-D8E0 YazFi: wl1.1 (SSID: IOT_5.0) - sending all interface internet traffic over WAN interface
Associated Domain(s) - [settings-win.data.microsoft.com settingsfd-geo.trafficmanager.net gateway.fe.apple-dns.net time-ios.apple.com time-ios.g.aaplimg.com azeus1-client-s.gateway.messenger.live.com azeus1-client-s.msnmessenger.mt
e2603.x.akamaiedge.net 57724, 38388, amazon.cn dl.amazon.cn geocode.arcgis.com dyna.wikimedia.org 7836, 45580, amazon.de tp.abe2c2f23-frontier.amazon.de amazon.de.edgekey.net e15317.e22.akamaiedge.net dl.amazon.de tp.43c4c9fc3-fro]
tail: /tmp/syslog.log has been replaced; following end of new file
Mar  2 01:26:06 RT-AC86U-D8E0 YazFi: wl0.1 (SSID: IOT_2.4) - sending all interface internet traffic over WAN interface
Associated Domain(s) - [settings-win.data.microsoft.com settingsfd-geo.trafficmanager.net gateway.fe.apple-dns.net time-ios.apple.com time-ios.g.aaplimg.com azeus1-client-s.gateway.messenger.live.com azeus1-client-s.msnmessenger.mm
server.arcgisonline.com wildcard.arcgisonline.com.edgekey.net e2603.x.akamaiedge.net 57724, 38388, amazon.cn dl.amazon.cn geocode.arcgis.com dyna.wikimedia.org 7836, 45580, amazon.de tp.abe2c2f23-frontier.amazon.de amazon.de.edgek]
Mar  2 01:26:09 RT-AC86U-D8E0 YazFi: wl1.1 (SSID: IOT_5.0) - sending all interface internet traffic over WAN interface
Associated Domain(s) - [settings-win.data.microsoft.com settingsfd-geo.trafficmanager.net gateway.fe.apple-dns.net time-ios.apple.com time-ios.g.aaplimg.com azeus1-client-s.gateway.messenger.live.com azeus1-client-s.msnmessenger.mm
server.arcgisonline.com wildcard.arcgisonline.com.edgekey.net e2603.x.akamaiedge.net 57724, 38388, amazon.cn dl.amazon.cn geocode.arcgis.com dyna.wikimedia.org 7836, 45580, amazon.de tp.abe2c2f23-frontier.amazon.de amazon.de.edgek]

Back when I originally installed Skynet about 6 months ago I would run the Debug Option/Show/All command and see literally hundreds of blocked inbound connections per hour and even more blocked outbound connections from my Chinese IP cams trying to 'phone home'. Now I get nothing but the above...

 

[Adamm]

Thanks for the reply but that did not fix all the logging issues I am still experiencing with Skynet. I uninstalled UIscribe and restored the above logging settings to default and yes I am now seeing data in the 'Skynet' tab of the Firewall UI however when I manually go to Skynet in AMTM and choose: Debug Options/Show Log Entries As They Appear/All, I do not see any blocked inbound or outbound traffic. Instead I see this message repeated every hour or so:

Try reinstall Scribe (not uiScribe), like I said it sounds like a configuration issue as Scribe usually changes the syslog location setting in Skynet.