Skynet Skynet - Router Firewall & Security Enhancements

[visortgw]

I pushed a fix for movistar users (aka you )



Unfortunately Skynet wasn't designed for that particular scenario. But you can read all about the dozens of other features Skynet offers.



IIRC his issue is Stubby/DNSCrypt related, so an entry for your ntp server is required in a dnsmasq custom config file.

Great test of update detection without version number change! Thanks again for your endless dedication to the project.

 

[Mutzli]

I pushed a fix for movistar users (aka you )

Unfortunately Skynet wasn't designed for that particular scenario. But you can read all about the dozens of other features Skynet offers.

IIRC his issue is Stubby/DNSCrypt related, so an entry for your ntp server is required in a dnsmasq custom config file.

The last update killed my swap file. Starting Skynet after the update failed with a swap file missing error. Checked for swap file and its really gone now. Had to create a new one and all is working again. Did anyone else experience this problem?

Updated post with log:
Nov 27 12:21:19 Skynet: [%] New Version Detected - Updating To v6.6.4 (c1ae58fcd1ea7ebc03d558be29141a1c)
Nov 27 12:21:26 Skynet: [%] Restarting Firewall Service
Nov 27 12:21:26 rc_service: service 24382:notify_rc restart_firewall
Nov 27 12:21:27 nat: apply nat rules (/tmp/nat_rules_eth0_eth0)
Nov 27 12:21:27 custom_script: Running /jffs/scripts/firewall-start (args: eth0)
Nov 27 12:21:28 Skynet: [%] Startup Initiated... ( skynetloc=/tmp/mnt/AB_Solution/skynet )
Nov 27 12:21:28 Skynet: [*] Restoring Damaged Swap File ( /myswap.swp )
Nov 27 12:21:28 Skynet: [*] SWAP File Missing - Fix This By Running ( /jffs/scripts/firewall debug swap uninstall )

 

[joe scian]

yes same issue but all good now

 

[Adamm]

The last update killed my swap file. Starting Skynet after the update failed with a swap file missing error. Checked for swap file and its really gone now. Had to create a new one and all is working again. Did anyone else experience this problem?

Thanks there was a typo in the swap validation code that affected an edge case of users. I pushed a hotfix accordingly.

 

[Therion87]

Sorry if this has been asked. When using AiProtect does Skynet ignore internal IPs when adding addressed from the IPS logs? I have an internal device that appears on the logs of the web GUI. Do I need to worry about whitelisting those types of detections?

 

[Adamm]

Sorry if this has been asked. When using AiProtect does Skynet ignore internal IPs when adding addressed from the IPS logs? I have an internal device that appears on the logs of the web GUI. Do I need to worry about whitelisting those types of detections?

Should be fine, Skynet specifically filters out internal address not to mention whitelisting them in advance.

 

[visortgw]

Sorry if this has been asked. When using AiProtect does Skynet ignore internal IPs when adding addressed from the IPS logs? I have an internal device that appears on the logs of the web GUI. Do I need to worry about whitelisting those types of detections?

You probably want to enable the setting to unban private IPs through the GUI or the following shell command:

sh /jffs/scripts/firewall settings unbanprivate enable​

 

[Adamm]

You probably want to enable the setting to unban private IPs through the GUI or the following shell command:

sh /jffs/scripts/firewall settings unbanprivate enable​

Oh yeah, theres also that too. The other functions also specifically filter these addresses, thats the backup incase anything slips past.

 

[Therion87]

Thanks for the answers guys.

 

[Mutzli]

For the last four days I have a terrible time with Skynet. It hasn't been running right since the update to 6.6.4. It all started with the deletion of the swap file as mentioned in post #3621. on Tuesday. Everyday it's something else. This morning it can't find the swap file again, but this time it's actually still there. Diversion has access to the swap file and works just fine. It seems that Skynet is looking for the swap file in the wrong place. It ignores the configured path and assumes its in the root directory /myswap.swp instead of /mnt/AB_Solution/myswap.swp.
Here some info from the system log:

Nov 30 10:32:14 Skynet: [%] New Version Detected - Updating To v6.6.4 (8d385e0a4f74d1c7321ddc26dccc1956)
Nov 30 10:32:15 Skynet: [%] Restarting Firewall Service
Nov 30 10:32:15 rc_service: service 6627:notify_rc restart_firewall
Nov 30 10:32:16 nat: apply nat rules (/tmp/nat_rules_eth0_eth0)
Nov 30 10:32:17 custom_script: Running /jffs/scripts/firewall-start (args: eth0)
Nov 30 10:32:17 Skynet: [%] Startup Initiated... ( skynetloc=/tmp/mnt/AB_Solution/skynet )
Nov 30 10:32:17 Skynet: [*] SWAP File Missing - Fix This By Running ( /jffs/scripts/firewall debug swap uninstall )
Nov 30 10:33:02 Skynet: [%] Restarting Firewall Service
Nov 30 10:33:03 rc_service: service 7299:notify_rc restart_firewall
Nov 30 10:33:04 nat: apply nat rules (/tmp/nat_rules_eth0_eth0)
Nov 30 10:33:04 custom_script: Running /jffs/scripts/firewall-start (args: eth0)
Nov 30 10:33:04 Skynet: [%] Startup Initiated... ( skynetloc=/tmp/mnt/AB_Solution/skynet )
Nov 30 10:33:05 Skynet: [*] Restoring Damaged Swap File ( /myswap.swp )
Nov 30 10:33:05 Skynet: [*] SWAP File Missing - Fix This By Running ( /jffs/scripts/firewall debug swap uninstall )

However, the swap file location on the main screen shows the correct path.

 

[skeal]

For the last four days I have a terrible time with Skynet. It hasn't been running right since the update to 6.6.4. It all started with the deletion of the swap file as mentioned in post #3621. on Tuesday. Everyday it's something else. This morning it can't find the swap file again, but this time it's actually still there. Diversion has access to the swap file and works just fine. It seems that Skynet is looking for the swap file in the wrong place. It ignores the configured path and assumes its in the root directory /myswap.swp instead of /mnt/AB_Solution/myswap.swp.
Here some info from the system log:

Nov 30 10:32:14 Skynet: [%] New Version Detected - Updating To v6.6.4 (8d385e0a4f74d1c7321ddc26dccc1956)
Nov 30 10:32:15 Skynet: [%] Restarting Firewall Service
Nov 30 10:32:15 rc_service: service 6627:notify_rc restart_firewall
Nov 30 10:32:16 nat: apply nat rules (/tmp/nat_rules_eth0_eth0)
Nov 30 10:32:17 custom_script: Running /jffs/scripts/firewall-start (args: eth0)
Nov 30 10:32:17 Skynet: [%] Startup Initiated... ( skynetloc=/tmp/mnt/AB_Solution/skynet )
Nov 30 10:32:17 Skynet: [*] SWAP File Missing - Fix This By Running ( /jffs/scripts/firewall debug swap uninstall )
Nov 30 10:33:02 Skynet: [%] Restarting Firewall Service
Nov 30 10:33:03 rc_service: service 7299:notify_rc restart_firewall
Nov 30 10:33:04 nat: apply nat rules (/tmp/nat_rules_eth0_eth0)
Nov 30 10:33:04 custom_script: Running /jffs/scripts/firewall-start (args: eth0)
Nov 30 10:33:04 Skynet: [%] Startup Initiated... ( skynetloc=/tmp/mnt/AB_Solution/skynet )
Nov 30 10:33:05 Skynet: [*] Restoring Damaged Swap File ( /myswap.swp )
Nov 30 10:33:05 Skynet: [*] SWAP File Missing - Fix This By Running ( /jffs/scripts/firewall debug swap uninstall )

However, the swap file location on the main screen shows the correct path.

View attachment 15281

Normally a persons swap file is in the root directory. Wow! Do you block many countries or what?

 

[Mutzli]

Normally a persons swap file is in the root directory. Wow! Do you block many countries or what?

Well the swap file was created by AB_Solution or ATM. It used to work this way for a long time now even after updating to Diversion. I mean theoretically it shouldn't matter where the swap file is located as long as the configured path is correct.

 

[skeal]

Well the swap file was created by AB_Solution or ATM. It used to work this way for a long time now even after updating to Diversion. I mean theoretically it shouldn't matter where the swap file is located as long as the configured path is correct.

That depends Skynet may require a swap be installed in the root directory. Why not have the swap in the intended root directory. It would seem that having the swap somewhere else has proven to be problematic. I would go with default setup IMHO.

 

[Mutzli]

That depends Skynet may require a swap be installed in the root directory. Why not have the swap in the intended root directory. It would seem that having the swap somewhere else has proven to be problematic. I would go with default setup IMHO.

I'll try this and see if this solved the problem.

Edit:
So far so good, Skynet is running again. Hopefully this solved it.

2nd Edit:
Nevermind, after a router reboot Skynet failed again to find the swap file. I had to delete and create it again to get it to work.

 

[Adamm]

For the last four days I have a terrible time with Skynet. It hasn't been running right since the update to 6.6.4. It all started with the deletion of the swap file as mentioned in post #3621. on Tuesday. Everyday it's something else. This morning it can't find the swap file again, but this time it's actually still there. Diversion has access to the swap file and works just fine. It seems that Skynet is looking for the swap file in the wrong place. It ignores the configured path and assumes its in the root directory /myswap.swp instead of /mnt/AB_Solution/myswap.swp.
Here some info from the system log:

Nov 30 10:32:14 Skynet: [%] New Version Detected - Updating To v6.6.4 (8d385e0a4f74d1c7321ddc26dccc1956)
Nov 30 10:32:15 Skynet: [%] Restarting Firewall Service
Nov 30 10:32:15 rc_service: service 6627:notify_rc restart_firewall
Nov 30 10:32:16 nat: apply nat rules (/tmp/nat_rules_eth0_eth0)
Nov 30 10:32:17 custom_script: Running /jffs/scripts/firewall-start (args: eth0)
Nov 30 10:32:17 Skynet: [%] Startup Initiated... ( skynetloc=/tmp/mnt/AB_Solution/skynet )
Nov 30 10:32:17 Skynet: [*] SWAP File Missing - Fix This By Running ( /jffs/scripts/firewall debug swap uninstall )
Nov 30 10:33:02 Skynet: [%] Restarting Firewall Service
Nov 30 10:33:03 rc_service: service 7299:notify_rc restart_firewall
Nov 30 10:33:04 nat: apply nat rules (/tmp/nat_rules_eth0_eth0)
Nov 30 10:33:04 custom_script: Running /jffs/scripts/firewall-start (args: eth0)
Nov 30 10:33:04 Skynet: [%] Startup Initiated... ( skynetloc=/tmp/mnt/AB_Solution/skynet )
Nov 30 10:33:05 Skynet: [*] Restoring Damaged Swap File ( /myswap.swp )
Nov 30 10:33:05 Skynet: [*] SWAP File Missing - Fix This By Running ( /jffs/scripts/firewall debug swap uninstall )

However, the swap file location on the main screen shows the correct path.

View attachment 15281

So I wrote up a big long post detailing how the system works behind the scenes and why this is such an odd case. Then I may have accidentally stumbled across the answer.

Do you have any weird characters in your USB name? Spaces for example are interpenetrated as "\040"... Beyond that this case is really unusual. The contents of your /jffs/scripts/post-mount file and the swap location from /proc/swaps don't match. I'm having a real hard time reproducing it on my end so does any of this ring a bell? I think it also goes without saying make sure it was Skynet which created the swap file just to rule out other possibilities.

Edit;

Going over your post (and newer posts) again, it could have also been a badly generated swap entry from the previous buggy version and it was never flushed out until you updated?

I guess we will play it by ear now that its working again

 

[Mutzli]

So I wrote up a big long post detailing how the system works behind the scenes and why this is such an odd case. Then I may have accidentally stumbled across the answer.

Do you have any weird characters in your USB name? Spaces for example are interpenetrated as "\040"... Beyond that this case is really unusual. The contents of your /jffs/scripts/post-mount file and the swap location from /proc/swaps don't match. I'm having a real hard time reproducing it on my end so does any of this ring a bell? I think it also goes without saying make sure it was Skynet which created the swap file just to rule out other possibilities.

The USB drive is named AB_Solution, which I have to admit is an unfortunate name. It confused me in above post with the location of the swap file. The swap was always in the drives root (/tmp/mnt/AB_Solution/). I'll rename the drive and see if that solves the problem.

 

[Adamm]

The USB drive is named AB_Solution, which I have to admit is an unfortunate name. It confused me in above post with the location of the swap file. The swap was always in the drives root (/tmp/mnt/AB_Solution/). I'll rename the drive and see if that solves the problem.

Good plan. I also pushed a small update specifically for this case that will give us more output in the hopefully unlikely event the issue persists.

 

[Mutzli]

Good plan. I also pushed a small update specifically for this case that will give us more output in the hopefully unlikely event the issue persists.

So I renamed the USB drive to USBDrive. After that I reinstalled all scripts anew. It seemed to work all until I restarted the router and the same issue occurred. This was before you pushed the updated. I'll update and test it again after lunch.

 

[Adamm]

So I renamed the USB drive to USBDrive. After that I reinstalled all scripts anew. It seemed to work all until I restarted the router and the same issue occurred. This was before you pushed the updated. I'll update and test it again after lunch.

While in its broken state, whats the output of the following;

cat /proc/swaps

cat /jffs/scripts/post-mount

sed -n '2p' /proc/swaps | awk '{print $1}'

sh /jffs/scripts/firewall debug info

 

[Mutzli]

The update didn't help, now I'm still getting the swap file missing in the log and new it says cron jobs [Failed] after I rebooting the router:

Nov 30 14:17:44 custom_script: Running /jffs/scripts/firewall-start (args: eth0)
Nov 30 14:17:45 Skynet: [%] Startup Initiated... ( skynetloc=/tmp/mnt/USBDrive/skynet )
Nov 30 14:17:45 hour_monitor: daemon is starting
Nov 30 14:17:45 Skynet: [*] Restoring Damaged Swap File ( /myswap.swp )
Nov 30 14:17:46 Skynet: [*] SWAP File Missing ( /myswap.swp ) - Fix This By Running ( /jffs/scripts/firewall debug swap uninstall )
See attachments for the output of your commands: