Skynet Skynet - Router Firewall & Security Enhancements

[dazedv3]

This feature is now live with v6.7.1

( sh /jffs/scripts/firewall settings iot ports 123,124,125 ) Allow Port(s) To Access WAN (Use Comma As Separator)
( sh /jffs/scripts/firewall settings iot ports reset ) Reset Allowed Port List To Default

Thanks for adding that so quickly.

I have added custom port 587 but I still can't send the email notifications is there something else I need to do?

 

[Adamm]

Thanks for adding that so quickly.

I have added custom port 587 but I still can't send the email notifications is there something else I need to do?

The logs will show you what packets and ports are being blocked. You can investigate accordingly or post a snippet of the IOT logs here.

 

[Jack Yaz]

The logs will show you what packets and ports are being blocked. You can investigate accordingly or post a snippet of the IOT logs here.

This might be because the firewall rules seem to only allow UDP (unless I misread the commit!)

 

[dazedv3]

The logs will show you what packets and ports are being blocked. You can investigate accordingly or post a snippet of the IOT logs here.

Ok how do I access the relevant logs?

 

[Adamm]

This might be because the firewall rules seem to only allow UDP (unless I misread the commit!)

Good catch, I’ll have a look when I get home and see what the best way to approach specifying the protocol

Ok how do I access the relevant logs?

With debug mode enable it should be spamming your syslog with the relevant blocked packets.

 

[Jack Yaz]

Good catch, I’ll have a look when I get home and see what the best way to approach specifying the protocol



With debug mode enable it should be spamming your syslog with the relevant blocked packets.

I use a small loop:

for PROTO in tcp udp; do
                    iptables -I FORWARD -p "$PROTO" --dport 53 -j ACCEPT
                done

 

[Zastoff]

Thank you @Adamm for this awesome security tool
Tried some different Cron jobs for Banmalware update, Had 3 before morning midday and evening update.
Tested to change yesterday to 30 1-23/4 * * * works really good so far, Will try /6 or /8 later and see how that works

 

[rromeroa]

Hi @Adamm

This is the output of a banmalware update on my AC68U with last beta firmare 384.9_beta1

Downloading filter.list         | [0s]
Refreshing Whitelists           | /opt/bin/firewall: line 4816: can't fork
/opt/bin/firewall: line 4816: can't fork
/opt/bin/firewall: line 4816: can't fork
[12s]
Consolidating Blacklist         | [24s]
Filtering IPv4 Addresses        | [9s]
Filtering IPv4 Ranges           | [0s]
Applying New Blacklist          | [13s]
Refreshing AiProtect Bans       | [0s]
Saving Changes                  | [8s]

what could be the cause of the message "/opt/bin/firewall: line 4816: can't fork"?

thanks

 

[pattiri]

what could be the cause of the message "/opt/bin/firewall: line 4816: can't fork"?

setup a swap partition on your USB drive.

 

[rromeroa]

setup a swap partition on your USB drive.

has got a 512MB swap file.

 

[consorts]

dumps the IPSets from the ram to a hard copy in your installation directory, it also purges the logs of all the BLOCKED messages.

adam, thanks elaborating on how your app functions. i was hoping you could take a moment to explain why would my inbound blocks double after midnight, particularly when everyone was sleeping on our network;

Jan 30 21:00:06 Skynet: [#] 156138 IPs (+0) -- 1671 Ranges Banned (+0) || 46955 Inbound -- 18 Outbound Connections Blocked! [save] [6s]
Jan 30 22:00:07 Skynet: [#] 156138 IPs (+0) -- 1671 Ranges Banned (+0) || 47061 Inbound -- 18 Outbound Connections Blocked! [save] [7s]
Jan 30 23:00:06 Skynet: [#] 156138 IPs (+0) -- 1671 Ranges Banned (+0) || 47167 Inbound -- 18 Outbound Connections Blocked! [save] [6s]
Jan 31 00:00:07 Skynet: [#] 156138 IPs (+0) -- 1671 Ranges Banned (+0) || 108027 Inbound -- 18 Outbound Connections Blocked! [save] [7s]
Jan 31 01:00:07 Skynet: [#] 156138 IPs (+0) -- 1671 Ranges Banned (+0) || 108133 Inbound -- 18 Outbound Connections Blocked! [save] [7s]
Jan 31 02:00:07 Skynet: [#] 156138 IPs (+0) -- 1671 Ranges Banned (+0) || 108258 Inbound -- 18 Outbound Connections Blocked! [save] [7s]

 

[Adamm]

adam, thanks elaborating on how your app functions. i was hoping you could take a moment to explain why would my inbound blocks double after midnight, particularly when everyone was sleeping on our network;

Jan 30 21:00:06 Skynet: [#] 156138 IPs (+0) -- 1671 Ranges Banned (+0) || 46955 Inbound -- 18 Outbound Connections Blocked! [save] [6s]
Jan 30 22:00:07 Skynet: [#] 156138 IPs (+0) -- 1671 Ranges Banned (+0) || 47061 Inbound -- 18 Outbound Connections Blocked! [save] [7s]
Jan 30 23:00:06 Skynet: [#] 156138 IPs (+0) -- 1671 Ranges Banned (+0) || 47167 Inbound -- 18 Outbound Connections Blocked! [save] [6s]
Jan 31 00:00:07 Skynet: [#] 156138 IPs (+0) -- 1671 Ranges Banned (+0) || 108027 Inbound -- 18 Outbound Connections Blocked! [save] [7s]
Jan 31 01:00:07 Skynet: [#] 156138 IPs (+0) -- 1671 Ranges Banned (+0) || 108133 Inbound -- 18 Outbound Connections Blocked! [save] [7s]
Jan 31 02:00:07 Skynet: [#] 156138 IPs (+0) -- 1671 Ranges Banned (+0) || 108258 Inbound -- 18 Outbound Connections Blocked! [save] [7s]

Check your stats using the commands in the readme, you will be able to break down the data in any way you like.

 

[Adamm]

I've pushed v6.7.2

Use random hour between 12pm - 9am for banmalware
Aesthetics
Configurable IOT allowed port protocol

( sh /jffs/scripts/firewall settings iot proto udp|tcp|all ) Select IOT Allowed Port Protocol

 

[WET]

I have a RT-AC86U running latest versions of AMTM, Diversion, Stubby w/ a swap file. I added Skynet & configured Diversion to work w/ Skynet. I configured Skynet to block inbound & outbound (recommended).

I need help with a an inbound ip being constantly blocked 24.13.248.148 which when I look up states it is Comcast Aurora. My service provider is Comcast and Aurora is nearby suburb to my location. This looks legit to me. When I go to whitelist the ip I get an error stating the ip is already whitelisted.

Is this an inbound vs outbound thing? Am I configured incorrectly? I seem to be operating fine with now over 70 of these log entries in the past hour.

Edit: Continuing to look at previous posts this seems to be how Skynet operates because I enabled debug mode. I see I can disable debug mode if I want to stop the log entries. Can I get a confirmation this please.

 

[Twiglets]

Hi @Adamm

This is the output of a banmalware update on my AC68U with last beta firmare 384.9_beta1

Downloading filter.list         | [0s]
Refreshing Whitelists           | /opt/bin/firewall: line 4816: can't fork
/opt/bin/firewall: line 4816: can't fork
/opt/bin/firewall: line 4816: can't fork
[12s]
Consolidating Blacklist         | [24s]
Filtering IPv4 Addresses        | [9s]
Filtering IPv4 Ranges           | [0s]
Applying New Blacklist          | [13s]
Refreshing AiProtect Bans       | [0s]
Saving Changes                  | [8s]

what could be the cause of the message "/opt/bin/firewall: line 4816: can't fork"?

thanks

I had the same thing happen today, it was the same 'Refreshing Whitelists' part of the script.
It is running out of memory to allow the process to fork.
I stopped running other sessions to free up some memory to allow the refresh to complete.
(I actually stopped running the 'Log Filter' in AB-Solution which I normally run in one session in 'Xshell 6' and a 'htop' running in another session in 'Xshell 6'. )

I have a swap file setup and this has previously been enough to allow 'banmalware update' to run.
I suspect that as Skynet is developing more and more features etc the memory required to perform some actions is increasing.

 

[Adamm]

I had the same thing happen today, it was the same 'Refreshing Whitelists' part of the script.
It is running out of memory to allow the process to fork.
I stopped running other sessions to free up some memory to allow the refresh to complete.
(I actually stopped running the 'Log Filter' in AB-Solution which I normally run in one session in 'Xshell 6' and a 'htop' running in another session in 'Xshell 6'. )

I have a swap file setup and this has previously been enough to allow 'banmalware update' to run.
I suspect that as Skynet is developing more and more features etc the memory required to perform some actions is increasing.

I can not reproduce this. Skynets peak memory usage during banmawlare is quite small. fork errors almost exclusively are swap file related, try recreating it.

skynet@RT-AX88U-DC28:/tmp/home/root# free
             total       used       free     shared    buffers     cached
Mem:        904148     564600     339548       2752      29812      86564
-/+ buffers/cache:     448224     455924
Swap:       524284          0     524284
skynet@RT-AX88U-DC28:/tmp/home/root# free
             total       used       free     shared    buffers     cached
Mem:        904148     605852     298296       2856      29812      86680
-/+ buffers/cache:     489360     414788
Swap:       524284          0     524284
skynet@RT-AX88U-DC28:/tmp/home/root# free
             total       used       free     shared    buffers     cached
Mem:        904148     617280     286868       2856      29812      86680
-/+ buffers/cache:     500788     403360
Swap:       524284          0     524284

 

[Twiglets]

I can not reproduce this. Skynets peak memory usage during banmawlare is quite small. fork errors almost exclusively are swap file related, try recreating it.

skynet@RT-AX88U-DC28:/tmp/home/root# free
             total       used       free     shared    buffers     cached
Mem:        904148     564600     339548       2752      29812      86564
-/+ buffers/cache:     448224     455924
Swap:       524284          0     524284
skynet@RT-AX88U-DC28:/tmp/home/root# free
             total       used       free     shared    buffers     cached
Mem:        904148     605852     298296       2856      29812      86680
-/+ buffers/cache:     489360     414788
Swap:       524284          0     524284
skynet@RT-AX88U-DC28:/tmp/home/root# free
             total       used       free     shared    buffers     cached
Mem:        904148     617280     286868       2856      29812      86680
-/+ buffers/cache:     500788     403360
Swap:       524284          0     524284

Thanks I will recreate my swapfile.

 

[Skeptical.me]

I’ll be looking into specifying custom allowed ports in the very near future, was Australia Day long weekend here so I didn’t have time to implement it yet.

Are you an Aussie too @Adamm ?? I'm born and bred NSW


Sent from my iPhone using Tapatalk Pro

 

[martinr]

Are you an Aussie too @Adamm ?? I'm born and bred NSW


Sent from my iPhone using Tapatalk Pro

I’m beginning to wonder if Colin Taylor and I are the only 2 Poms here.

 

[Skeptical.me]

I’m beginning to wonder if Colin Taylor and I are the only 2 Poms here.

My old man's a POM, so I'm half/half ... so make that 2.5 Pom's lol


Sent from my iPhone using Tapatalk Pro