Viktor Jaep
Part of the Furniture
That seems to have done the trick! Thank you very much!
Skynet Skynet - Router Firewall & Security Enhancements
That seems to have done the trick! Thank you very much!
Jack Yaz
Part of the Furniture
Thanks. I know about the white list, I was going to save her the trouble of using putty etc and making something that takes domain input and sends it off over ssh
Builder71
Very Senior Member
Wish I could, but my ancient RT-N66U router doesn't support IPSet v6.
(But the ya-malware-block script works great on my RT-N66U !)
Adamm
Part of the Furniture
Code:
Ipset -L WhitelistThis is already done by default in a much safer way if you have entware installed. The script can be executed by simply using the command "firewall".
Jack Yaz
Part of the Furniture
Fair enough, post #1 seemed to reference the full script path, so I assumed it wasn't in there. I'll take a look at the entware approach in the source, I'd like to see how I can utilise it in other scripts.
EDIT:
Ah, it installs into /opt/bin.
thelonelycoder
Part of the Furniture
You just add a symlink, or place the script there.
AB-Solution adds one as well: ab-solution
All you have to type is ab, then use the TAB key to complete it.
Jack Yaz
Part of the Furniture
Can it be done without entware, since entware isn't a Skynet requirement and it would be nice for all users to get a consistent script call.
Out of interest, what makes the alias in profile.add "unsafe"?
thelonelycoder
Part of the Furniture
Nope, unless optware is installed.
Or some other way such as manually add the physical directory everytime the router boots.
Adamm
Part of the Furniture
Maybe unsafe was the wrong word, but I don't want to recommend modifications to users which aren't handled directly by the script. I try to make sure that no third party modifications are required as it leaves the potential for people to make mistakes (and for me to troubleshoot in future).
That's more for consistency, I don't want to write instructions that only apply to some users and confuse others as optware/entware are not requirements for this script.
Jack Yaz
Part of the Furniture
Could the script not add the line in (and create the file if missing), much like it does with firewall-start?
thelonelycoder
Part of the Furniture
If automated, that adds complications elsewhere.
AB-Solution relies on optware/entware not being present by testing for binaries.
If not found, /opt/ is force removed and added.
There is no check if someone has added the physical directories in an other way.
Entware also mounts its filestructure to it, removing stuff added outside it.
eclp
Senior Member
The debug mode is disabled.
The script reinstalled already twice, but again and again the drop messages in the syslog. The Firewall setting jumps always again back to dropped.
skeal
Part of the Furniture
My install is working awesome and I have a drop setting in my firewall. This typical behavior for this script.
Adamm
Part of the Furniture
Skynet will force the firewall setting to dropped regardless of the mode you select, that is purely for the fact it changes how IPTables rules are handled.
When debug mode is disabled, I disable the dropped messages via not adding the IPTables rules for them in the first place. So after skynet has completely started up there should be no log messages containing "BLOCKED - OUTGOING" etc.
If you still think Skynet is posting logs incorrectly, post the output of;
"sh /jffs/scripts/firewall debug info"
And I will take a look at it in the morning, but as far as I'm aware this should work as expected unless I recently introduced an bug somewhere.
eclp
Senior Member
@skeal .... It looks like in your system log?
A few copied lines only:
A few copied lines only:
Code:
Aug 24 22:07:07 kernel: DROP IN=eth0 OUT=br0 SRC=2a04:4e42:001b:0000:0000:0000:0000:0403 DST=2003:00da:4bd6:3344:5cd7:18fb:bc56:c52a LEN=136 TC=0 HOPLIMIT=56 FLOWLBL=227226 PROTO=TCP SPT=443 DPT=55125 SEQ=740859260 ACK=1419299069 WINDOW=57 RES=0x00 ACK URGP=0 OPT (0101080ABF57BC001AC70C2C)
Aug 24 22:07:07 kernel: DROP IN=eth0 OUT=br0 SRC=2a04:4e42:001b:0000:0000:0000:0000:0403 DST=2003:00da:4bd6:3344:5cd7:18fb:bc56:c52a LEN=136 TC=0 HOPLIMIT=56 FLOWLBL=261576 PROTO=TCP SPT=443 DPT=55168 SEQ=4181769772 ACK=2137326954 WINDOW=57 RES=0x00 ACK URGP=0 OPT (0101080AB7ECBA001AC71272)
Aug 24 22:07:08 kernel: DROP IN=eth0 OUT=br0 SRC=2a04:4e42:001b:0000:0000:0000:0000:0403 DST=2003:00da:4bd6:3344:5cd7:18fb:bc56:c52a LEN=136 TC=0 HOPLIMIT=56 FLOWLBL=304845 PROTO=TCP SPT=80 DPT=55161 SEQ=1572105113 ACK=2879872395 WINDOW=55 RES=0x00 ACK URGP=0 OPT (0101080A3FF658001AC71164)
Aug 24 22:07:08 kernel: DROP IN=eth0 OUT=br0 SRC=2a04:4e42:001b:0000:0000:0000:0000:0403 DST=2003:00da:4bd6:3344:5cd7:18fb:bc56:c52a LEN=136 TC=0 HOPLIMIT=56 FLOWLBL=599964 PROTO=TCP SPT=443 DPT=55196 SEQ=2939944409 ACK=1264918734 WINDOW=57 RES=0x00 ACK URGP=0 OPT (0101080A4031A8011AC7160A)
Aug 24 22:07:09 kernel: DROP IN=eth0 OUT=br0 SRC=2a04:4e42:001b:0000:0000:0000:0000:0403 DST=2003:00da:4bd6:3344:5cd7:18fb:bc56:c52a LEN=136 TC=0 HOPLIMIT=56 FLOWLBL=403645 PROTO=TCP SPT=80 DPT=55203 SEQ=3513765726 ACK=2943252120 WINDOW=55 RES=0x00 ACK URGP=0 OPT (0101080A4010C6001AC71719)
Aug 24 22:07:09 kernel: DROP IN=eth0 OUT=br0 SRC=2a04:4e42:001b:0000:0000:0000:0000:0403 DST=2003:00da:4bd6:3344:5cd7:18fb:bc56:c52a LEN=136 TC=0 HOPLIMIT=57 FLOWLBL=450811 PROTO=TCP SPT=80 DPT=55205 SEQ=2195164847 ACK=2995835564 WINDOW=55 RES=0x00 ACK URGP=0 OPT (0101080A6AD42A001AC7177A)
Aug 24 22:07:10 kernel: DROP IN=eth0 OUT=br0 SRC=2a04:4e42:001b:0000:0000:0000:0000:0403 DST=2003:00da:4bd6:3344:5cd7:18fb:bc56:c52a LEN=136 TC=0 HOPLIMIT=56 FLOWLBL=523922 PROTO=TCP SPT=80 DPT=55191 SEQ=3473526613 ACK=1725112124 WINDOW=55 RES=0x00 ACK URGP=0 OPT (0101080A50D9EC001AC714DB)
Aug 24 22:07:11 kernel: DROP IN=eth0 OUT=br0 SRC=2a04:4e42:001b:0000:0000:0000:0000:0403 DST=2003:00da:4bd6:3344:5cd7:18fb:bc56:c52a LEN=136 TC=0 HOPLIMIT=57 FLOWLBL=70326 PROTO=TCP SPT=443 DPT=55076 SEQ=2814461830 ACK=1700784977 WINDOW=57 RES=0x00 ACK URGP=0 OPT (0101080A4010C8001AC70952)
Aug 24 22:07:11 kernel: DROP IN=eth0 OUT=br0 SRC=2a04:4e42:001b:0000:0000:0000:0000:0403 DST=2003:00da:4bd6:3344:5cd7:18fb:bc56:c52a LEN=136 TC=0 HOPLIMIT=56 FLOWLBL=483389 PROTO=TCP SPT=443 DPT=55088 SEQ=3046071959 ACK=4048840805 WINDOW=57 RES=0x00 ACK URGP=0 OPT (0101080A3ED640011AC70A80)
Aug 24 22:09:06 kernel: DROP IN=eth0 OUT=br0 SRC=2a04:4e42:001b:0000:0000:0000:0000:0403 DST=2003:00da:4bd6:3344:5cd7:18fb:bc56:c52a LEN=108 TC=0 HOPLIMIT=57 FLOWLBL=104858 PROTO=TCP SPT=443 DPT=54927 SEQ=457721307 ACK=3791213383 WINDOW=57 RES=0x00 ACK URGP=0 OPT (0101080ABBB59C001AC53ED7)
Aug 24 22:11:07 kernel: DROP IN=eth0 OUT=br0 SRC=2a04:4e42:001b:0000:0000:0000:0000:0403 DST=2003:00da:4bd6:3344:5cd7:18fb:bc56:c52a LEN=108 TC=0 HOPLIMIT=57 FLOWLBL=1009280 PROTO=TCP SPT=443 DPT=54927 SEQ=457721307 ACK=3791213383 WINDOW=57 RES=0x00 ACK URGP=0 OPT (0101080ABBB612001AC53ED7)
Aug 24 22:13:07 kernel: DROP IN=eth0 OUT=br0 SRC=2a04:4e42:001b:0000:0000:0000:0000:0403 DST=2003:00da:4bd6:3344:5cd7:18fb:bc56:c52a LEN=108 TC=0 HOPLIMIT=57 FLOWLBL=415370 PROTO=TCP SPT=443 DPT=54927 SEQ=457721307 ACK=3791213383 WINDOW=57 RES=0x00 ACK URGP=0 OPT (0101080ABBB688001AC53ED7)
Aug 24 22:14:14 kernel: DROP IN=eth0 OUT=br0 SRC=2600:3c03:0000:0000:f03c:91ff:fed4:6b53 DST=2003:00da:4bd6:3344:3d34:b66a:ef62:c078 LEN=80 TC=0 HOPLIMIT=52 FLOWLBL=149797 PROTO=TCP SPT=58700 DPT=443 SEQ=547267615 ACK=0 WINDOW=28800 RES=0x00 SYN URGP=0 OPT (0204052C0402080A1C2CAEEB0000000001030307)
Aug 24 22:14:15 kernel: DROP IN=eth0 OUT=br0 SRC=2600:3c03:0000:0000:f03c:91ff:fed4:6b53 DST=2003:00da:4bd6:3344:3d34:b66a:ef62:c078 LEN=80 TC=0 HOPLIMIT=52 FLOWLBL=609914 PROTO=TCP SPT=58700 DPT=443 SEQ=547267615 ACK=0 WINDOW=28800 RES=0x00 SYN URGP=0 OPT (0204052C0402080A1C2CB0180000000001030307)skeal
Part of the Furniture
I would have to say no my logs don't look like that. It would seem skynet is only sort of working. The output from skynet would be something like: kernel: [BLOCKED - NEW BAN] blah blah blah.
Adamm
Part of the Furniture
That rule should be removed during Skynet startup regardless of the mode (and old logs purged), this makes me believe Skynet is failing to start possibly. Please post the output of the debug info command.
Similar threads
Similar threads
Similar threads
-
-
Skynet Skynet showing router itself making calls to China?
- Started by Skywise
- Replies: 26
-
Skynet Skynet - Blocked outbounds coming from the router itself?
- Started by JuanGF
- Replies: 12
-
Skynet Installing Skynet causes router to crash and reboot
- Started by ovancantfort
- Replies: 26
-
[RESOLVED] Skynet UI not Displaying Statistics- Started by copperhead
- Replies: 1
-
Skynet I have installed the skynet firewall how do I configure it if the security of iot devices is important?
- Started by lenovomen
- Replies: 2
-
Skynet Message on SKYNET I havent seen before- Started by Davidncali001
- Replies: 1
-
-
-
Skynet SkyNet/Firewall blocking all ping requests, including outbound
- Started by nearlyheadlessarvie
- Replies: 6
Latest threads
-
-
-
Issue with selective VPN Routing on ASUS GS-AX3000 (WireGuard & VPN Fusion)
- Started by BerkayDrsn
- Replies: 1
-
-
Support SNBForums w/ Amazon
If you'd like to support SNBForums, just use this link and buy anything on Amazon. Thanks!
Sign Up For SNBForums Daily Digest
Get an update of what's new every day delivered to your mailbox. Sign up here!