Skynet Skynet - Router Firewall & Security Enhancements

[Adamm]

I found that if you do a lot of VPN or Torrents you will likely need the swap. Just saying from user experience.

Yeah when you factor in the 382 codebase also (the new trendmicro engine adds around 50MB more ram usage) these devices are starting to get to that point, but whats the point of free resources when you can be putting it to use

 

[thelonelycoder]

go to AB-Solution then "b" and "8", but you should be using "AB-Solution 3.10.2 beta"

@iManuB and all: Release of AB-Solution 3.11 on the release channel is within hours, I hope.
No need to change over to the beta channel just to get that message away.

 

[Ubimo]

I just installed Skynet on my R7000 and it says:

Dec 10 10:27:52 Skynet: [INFO] Startup Initiated... ( banmalwareweekly autoupdate usb=/tmp/mnt/USB )
Dec 10 10:28:13 Skynet: [Complete] 0 IPs / 0 Ranges Banned. 0 New IPs / 0 New Ranges Banned. 0 Inbound / 0 Outbound Connections Blocked! [21s]

Shouldn't there be a default IP ban list? I chose default in setup.

 

[Adamm]

I just installed Skynet on my R7000 and it says:

Dec 10 10:27:52 Skynet: [INFO] Startup Initiated... ( banmalwareweekly autoupdate usb=/tmp/mnt/USB )
Dec 10 10:28:13 Skynet: [Complete] 0 IPs / 0 Ranges Banned. 0 New IPs / 0 New Ranges Banned. 0 Inbound / 0 Outbound Connections Blocked! [21s]

Shouldn't there be a default IP ban list? I chose default in setup.

Use the "banmalware' feature if you want to use the predefined banlist along with autobanning if selected.

 

[iManuB]

@iManuB and all: Release of AB-Solution 3.11 on the release channel is within hours, I hope.
No need to change over to the beta channel just to get that message away.

Thanks so much, thelonelycoder!
I saw that the new 382 update also came out for my RT-AC3200 router (from Asus only now.). Are Skynet and AB-Solution doing well in the new firmware?

 

[Ubimo]

Use the "banmalware' feature if you want to use the predefined banlist along with autobanning if selected.

Thanks, that did the trick. It's working now.

 

[thelonelycoder]

Thanks so much, thelonelycoder!
I saw that the new 382 update also came out for my RT-AC3200 router (from Asus only now.). Are Skynet and AB-Solution doing well in the new firmware?

If I had a device to test it on myself I would say SURE.
Lacking that possibility, I rely on users comments and I hear it's a resounding SURE.

 

[Adamm]

I saw that the new 382 update also came out for my RT-AC3200 router (from Asus only now.). Are Skynet and AB-Solution doing well in the new firmware?

I have the 382 alpha running on my AC68U, so far so good with both scripts. Making slow progress towards getting the elusive AC86U.

 

[thelonelycoder]

I have the 382 alpha running on my AC68U, so far so good with both scripts. Making slow progress towards getting the elusive AC86U.

Can't keep up with everything, just realised there's a build for 86U 68U devices.
Updating my RT-AC1900P now, crossing fingers...

 

[iManuB]

Nice to see! You guys are amazing!

 

[Adamm]

Can't keep up with everything, just realised there's a build for 86U devices.
Updating my RT-AC1900P now, crossing fingers...

I assume you mean 68U, in which case a build was only uploaded like 2 days ago, I don't think it was "officially" announced though so more work may need to be done.

 

[thelonelycoder]

I assume you mean 68U, in which case a build was only uploaded like 2 days ago, I don't think it was "officially" announced though so more work may need to be done.

The RT-AC68U and RT-AC1900P are the same models, just different vendor SKU's. I bought my 1900P at BestBuy in the US while on vacation.
The 'P' indicates the vendor.

 

[Adamm]

The RT-AC68U and RT-AC1900P are the same models, just different vendor SKU's. I bought my 1900P at BestBuy in the US while on vacation.
The 'P' indicates the vendor.

I was referring to your first sentence, but nevermind.

just realised there's a build for 86U devices.

 

[thelonelycoder]

I was referring to your first sentence, but nevermind.

Sunday --> dumb day.

 

[RMerlin]

I assume you mean 68U, in which case a build was only uploaded like 2 days ago, I don't think it was "officially" announced though so more work may need to be done.

Those are very early test builds, so I didn't announce them - they're for people keeping an eye on the Test Build folders and wishing to experiment. They've only gone through very basic testing on my end.

The first few builds had broken CTF support causing routers to crash for some users. The build I made last night should in theory address it.

 

[pattiri]

[BLOCKED - NEW BAN] IN=eth0 OUT= MAC=xx:xx:xx............ SRC=104.25.234.15 DST=MY_WAN_IP LEN=40 TOS=0x00 PREC=0x00 TTL=49 ID=28839 DF PROTO=TCP SPT=443 DPT=11935 SEQ=935352551 ACK=0 WINDOW=0 RES=0x00 RST URGP=0

I don't know how but Skynet blocked one of the IP addresses of SNBForums

I'm not sure if this IP address belong to SNBForums but;

http://snbforums.com.cutestat.com/

Also same IP address is here in this post;

https://www.snbforums.com/threads/a...king-solution-v3-11.37511/page-65#post-343955

 

[Adamm]

[BLOCKED - NEW BAN] IN=eth0 OUT= MAC=xx:xx:xx............ SRC=104.25.234.15 DST=MY_WAN_IP LEN=40 TOS=0x00 PREC=0x00 TTL=49 ID=28839 DF PROTO=TCP SPT=443 DPT=11935 SEQ=935352551 ACK=0 WINDOW=0 RES=0x00 RST URGP=0

I don't know how but Skynet blocked one of the IP addresses of SNBForums

I'm not sure if this IP address belong to SNBForums but;

http://snbforums.com.cutestat.com/

View attachment 11168

Also same IP address is here in this post;

https://www.snbforums.com/threads/a...king-solution-v3-11.37511/page-65#post-343955

The website must have sent an invalid packet, not a very common situation but like everything there's always a small margin of error with the built in SPI firewall. I've added it to the default whitelist (theres no version change as its only a minor change, you can force update now or await the next version and whitelist it manually yourself)

 

[Butterfly Bones]

That IP is a CloudFlare host with many sites on the same IP. I know SNB uses CloudFlare since it like to block when I use to many Code tags in a post.

https://otx.alienvault.com/indicator/ip/104.25.234.15

 

[Protik]

Is there a way to export list of manually whitelisted IPs?

I would like to keep a backup of them so that if something goes wrong, I can import the list rather than starting from zero.

 

[Adamm]

Is there a way to export list of manually whitelisted IPs?

I would like to keep a backup of them so that if something goes wrong, I can import the list rather than starting from zero.

Manually added IPs;

sh /jffs/scripts/firewall whitelist list ips

Manually added domains;

sh /jffs/scripts/firewall whitelist list domains

Or both;

ipset -L Whitelist | grep ManualWlist