Menu
What's new
By:
Filters Better Search

Skynet Skynet - Router Firewall & Security Enhancements

  • SNBForums Code of Conduct

    SNBForums is a community for everyone, no matter what their level of experience.

    Please be tolerant and patient of others, especially newcomers. We are all here to share and learn!

    The rules are simple: Be patient, be nice, be helpful or be gone!

CaptainSTX said:
Here are the countries I have banned based on frequency of hits or figuring nothing good can come from them. af,bg,br,bz,cn,cz,ee,ge,gr,iq,ir,kp,lv,md,mk,ng,nl,pl,ro,ru,ve
Click to expand...
I'm apparently even more paranoid than most (145369 IPs -- 42416 Ranges Banned):

ru cn ir iq ua by al af ba az bg cz kp kz kg ly md ng pk rs ro sk ye dz bn bo hr ly ne cs sa sy su br bz ee ge lv mk nl pl ve
 
dev_null said:
I'm apparently even more paranoid than most (145369 IPs -- 42416 Ranges Banned):

ru cn ir iq ua by al af ba az bg cz kp kz kg ly md ng pk rs ro sk ye dz bn bo hr ly ne cs sa sy su br bz ee ge lv mk nl pl ve
Click to expand...

I don't think you're, I have a similar amount of countries blocked:
cn ru sc ua ee ls gr ba bg hr cz ge hu kg lv lt mc kp ro sk vn uz lk br ar cl co pa py uy iq ir jm
 
Does it require latest firmware? I don't think so reading nothing about this in first post but if so, is there a firmware check done so people don't break last working version? Just curious as I'm still on 380.68_4
 
skeal said:
Yeah I get easily 400 total an hour. I just wonder what have I done to bring this on? Or is this just random stuff? I usually see 250 to 300 and hour. Now like I say about 400 to 500 per hour with an occasional spike. 80% of my blocked traffic is from Russia Federation. :eek:
Click to expand...
I am seeing less than 100 hits per hour from Russia. It is almost entirely from two IP addresses, one port scanning in the 33000 range and the other in the 34000 range. I do not block by country.
Code: 
[i] Monitoring From Dec 25 21:00:12 To Dec 26 21:25:13

Top 10 Blocks (Inbound);
--------   | --------------       | --------------                                          | --------------                                | ----------------------
| Hits |   | | IP Address |       | | AlienVault |                                          | | Ban Reason |                                | | Associated Domains |
--------   | --------------       | --------------                                          | --------------                                | ----------------------

1155x      | 45.141.85.3     (RU) | https://otx.alienvault.com/indicator/ip/45.141.85.3     | BanMalware: firehol_level3.netset             |
1117x      | 194.26.69.100   (RU) | https://otx.alienvault.com/indicator/ip/194.26.69.100   | BanMalware: firehol_level3.netset             |
334x       | 148.251.48.231  (DE) | https://otx.alienvault.com/indicator/ip/148.251.48.231  | BanMalware: blocklist_net_ua.ipset            |
92x        | 185.156.73.52   (NL) | https://otx.alienvault.com/indicator/ip/185.156.73.52   | BanMalware: alienvault_reputation.ipset       |
67x        | 92.118.37.58    (RU) | https://otx.alienvault.com/indicator/ip/92.118.37.58    | BanMalware: firehol_level3.netset             |
67x        | 92.118.37.53    (RU) | https://otx.alienvault.com/indicator/ip/92.118.37.53    | BanMalware: firehol_level3.netset             |
64x        | 185.156.73.64   (NL) | https://otx.alienvault.com/indicator/ip/185.156.73.64   | BanMalware: alienvault_reputation.ipset       |
61x        | 185.156.73.66   (NL) | https://otx.alienvault.com/indicator/ip/185.156.73.66   | BanMalware: alienvault_reputation.ipset       |
57x        | 92.118.37.55    (RU) | https://otx.alienvault.com/indicator/ip/92.118.37.55    | BanMalware: firehol_level3.netset             |
53x        | 92.118.37.83    (RU) | https://otx.alienvault.com/indicator/ip/92.118.37.83    | BanMalware: firehol_level3.netset             |


Blacklist Reason;
 "BanMalware: firehol_level3.netset"

[i] IP Location - Russia (UGB Hosting OU / AS206485)

[i] 45.141.85.3 First Tracked On Dec 25 21:03:37
[i] 45.141.85.3 Last Tracked On Dec 26 21:30:53
[i] 1159 Blocks Total

Top 10 Targeted Ports From 45.141.85.3 (Inbound);

--------   | --------   | --------------
| Hits |   | | Port |   | | SpeedGuide |
--------   | --------   | --------------

1x         | 33029      | https://www.speedguide.net/port.php?port=33029
1x         | 33022      | https://www.speedguide.net/port.php?port=33022
1x         | 33019      | https://www.speedguide.net/port.php?port=33019
1x         | 33017      | https://www.speedguide.net/port.php?port=33017
1x         | 33016      | https://www.speedguide.net/port.php?port=33016
1x         | 33015      | https://www.speedguide.net/port.php?port=33015
1x         | 33013      | https://www.speedguide.net/port.php?port=33013
1x         | 33010      | https://www.speedguide.net/port.php?port=33010
1x         | 33009      | https://www.speedguide.net/port.php?port=33009
1x         | 33008      | https://www.speedguide.net/port.php?port=33008


Blacklist Reason;
 "BanMalware: firehol_level3.netset"

[i] IP Location - Russia (Undefined / Undefined)

[i] 194.26.69.100 First Tracked On Dec 25 21:01:10
[i] 194.26.69.100 Last Tracked On Dec 26 21:32:26
[i] 1124 Blocks Total

Top 10 Targeted Ports From 194.26.69.100 (Inbound);

--------   | --------   | --------------
| Hits |   | | Port |   | | SpeedGuide |
--------   | --------   | --------------

1x         | 34031      | https://www.speedguide.net/port.php?port=34031
1x         | 34030      | https://www.speedguide.net/port.php?port=34030
1x         | 34028      | https://www.speedguide.net/port.php?port=34028
1x         | 34026      | https://www.speedguide.net/port.php?port=34026
1x         | 34024      | https://www.speedguide.net/port.php?port=34024
1x         | 34021      | https://www.speedguide.net/port.php?port=34021
1x         | 34019      | https://www.speedguide.net/port.php?port=34019
1x         | 34018      | https://www.speedguide.net/port.php?port=34018
1x         | 34012      | https://www.speedguide.net/port.php?port=34012
1x         | 34011      | https://www.speedguide.net/port.php?port=34011
 
EmeraldDeer said:
I am seeing less than 100 hits per hour from Russia. It is almost entirely from two IP addresses, one port scanning in the 33000 range and the other in the 34000 range. I do not block by country.
Code: 
[i] Monitoring From Dec 25 21:00:12 To Dec 26 21:25:13

Top 10 Blocks (Inbound);
--------   | --------------       | --------------                                          | --------------                                | ----------------------
| Hits |   | | IP Address |       | | AlienVault |                                          | | Ban Reason |                                | | Associated Domains |
--------   | --------------       | --------------                                          | --------------                                | ----------------------

1155x      | 45.141.85.3     (RU) | https://otx.alienvault.com/indicator/ip/45.141.85.3     | BanMalware: firehol_level3.netset             |
1117x      | 194.26.69.100   (RU) | https://otx.alienvault.com/indicator/ip/194.26.69.100   | BanMalware: firehol_level3.netset             |
334x       | 148.251.48.231  (DE) | https://otx.alienvault.com/indicator/ip/148.251.48.231  | BanMalware: blocklist_net_ua.ipset            |
92x        | 185.156.73.52   (NL) | https://otx.alienvault.com/indicator/ip/185.156.73.52   | BanMalware: alienvault_reputation.ipset       |
67x        | 92.118.37.58    (RU) | https://otx.alienvault.com/indicator/ip/92.118.37.58    | BanMalware: firehol_level3.netset             |
67x        | 92.118.37.53    (RU) | https://otx.alienvault.com/indicator/ip/92.118.37.53    | BanMalware: firehol_level3.netset             |
64x        | 185.156.73.64   (NL) | https://otx.alienvault.com/indicator/ip/185.156.73.64   | BanMalware: alienvault_reputation.ipset       |
61x        | 185.156.73.66   (NL) | https://otx.alienvault.com/indicator/ip/185.156.73.66   | BanMalware: alienvault_reputation.ipset       |
57x        | 92.118.37.55    (RU) | https://otx.alienvault.com/indicator/ip/92.118.37.55    | BanMalware: firehol_level3.netset             |
53x        | 92.118.37.83    (RU) | https://otx.alienvault.com/indicator/ip/92.118.37.83    | BanMalware: firehol_level3.netset             |


Blacklist Reason;
 "BanMalware: firehol_level3.netset"

[i] IP Location - Russia (UGB Hosting OU / AS206485)

[i] 45.141.85.3 First Tracked On Dec 25 21:03:37
[i] 45.141.85.3 Last Tracked On Dec 26 21:30:53
[i] 1159 Blocks Total

Top 10 Targeted Ports From 45.141.85.3 (Inbound);

--------   | --------   | --------------
| Hits |   | | Port |   | | SpeedGuide |
--------   | --------   | --------------

1x         | 33029      | https://www.speedguide.net/port.php?port=33029
1x         | 33022      | https://www.speedguide.net/port.php?port=33022
1x         | 33019      | https://www.speedguide.net/port.php?port=33019
1x         | 33017      | https://www.speedguide.net/port.php?port=33017
1x         | 33016      | https://www.speedguide.net/port.php?port=33016
1x         | 33015      | https://www.speedguide.net/port.php?port=33015
1x         | 33013      | https://www.speedguide.net/port.php?port=33013
1x         | 33010      | https://www.speedguide.net/port.php?port=33010
1x         | 33009      | https://www.speedguide.net/port.php?port=33009
1x         | 33008      | https://www.speedguide.net/port.php?port=33008


Blacklist Reason;
 "BanMalware: firehol_level3.netset"

[i] IP Location - Russia (Undefined / Undefined)

[i] 194.26.69.100 First Tracked On Dec 25 21:01:10
[i] 194.26.69.100 Last Tracked On Dec 26 21:32:26
[i] 1124 Blocks Total

Top 10 Targeted Ports From 194.26.69.100 (Inbound);

--------   | --------   | --------------
| Hits |   | | Port |   | | SpeedGuide |
--------   | --------   | --------------

1x         | 34031      | https://www.speedguide.net/port.php?port=34031
1x         | 34030      | https://www.speedguide.net/port.php?port=34030
1x         | 34028      | https://www.speedguide.net/port.php?port=34028
1x         | 34026      | https://www.speedguide.net/port.php?port=34026
1x         | 34024      | https://www.speedguide.net/port.php?port=34024
1x         | 34021      | https://www.speedguide.net/port.php?port=34021
1x         | 34019      | https://www.speedguide.net/port.php?port=34019
1x         | 34018      | https://www.speedguide.net/port.php?port=34018
1x         | 34012      | https://www.speedguide.net/port.php?port=34012
1x         | 34011      | https://www.speedguide.net/port.php?port=34011
Click to expand...
how did you get this output lol?
 
SomeWhereOverTheRainBow said:
how did you get this output lol?
Click to expand...
The first part is excerpted from the default [13] Stats top 10 report with [11] Settings "Stats Country Lookup" Enabled.

The second and third parts are excerpted from:
firewall stats search ip 45.141.85.3
firewall stats search ip 194.26.69.100
 
dev_null said:
I'm apparently even more paranoid than most (145369 IPs -- 42416 Ranges Banned):

ru cn ir iq ua by al af ba az bg cz kp kz kg ly md ng pk rs ro sk ye dz bn bo hr ly ne cs sa sy su br bz ee ge lv mk nl pl ve
Click to expand...

You don't have full access to Internet anymore. There are big data centers providing common Internet resources in some countries you have blocked. You basically limit yourself. As people say, too much of anything is good for nothing.
 
There is generally no point in blocking countries on a home connection when all these connection attempts are already dropped by your firewall's default policy (which is DROP). Such blocklists only make sense if you are actually hosting an Internet-facing server (like a website) and wanted to limit access to it.
 
Adamm,

Ignore my previous post, Since i updated to version 7 it hasn't happened. I will post debug if it does.
 
RMerlin said:
There is generally no point in blocking countries on a home connection when all these connection attempts are already dropped by your firewall's default policy (which is DROP). Such blocklists only make sense if you are actually hosting an Internet-facing server (like a website) and wanted to limit access to it.
Click to expand...

I may not concur on this. I think there is a reason for blocking countries, and that is if you for example browse the web and hit a webpage that has for example an ad (-provider) which is hosted in a country where one may or may not like/prefer to be connected to.
 
one dirty way to block a list of domains, (don't recommend it though)

Code: 
cat "domain.list" | while read -r a; do sh /jffs/scripts/firewall ban domain $a; done
 
Bamsefar said:
I may not concur on this. I think there is a reason for blocking countries, and that is if you for example browse the web and hit a webpage that has for example an ad (-provider) which is hosted in a country where one may or may not like/prefer to be connected to.
Click to expand...

And this is exactly limiting yourself. The entire legitimate website or parts of it may be coming from one of the multiple European countries I see on the block list above.
 
Val D. said:
And this is exactly limiting yourself. The entire legitimate website or parts of it may be coming from one of the multiple European countries I see on the block list above.
Click to expand...

Well it is a free world after all is it not? That also means that I can decide not to let some countries be acceptable for connection. Which is why I block a lot more than on that rather short list, and you know what, internet works just fine.
 
Val D. said:
You don't have full access to Internet anymore. There are big data centers providing common Internet resources in some countries you have blocked. You basically limit yourself. As people say, too much of anything is good for nothing.
Click to expand...
Thanks for the feedback. I've tested the apps and services we use and whitelisted a few that were blocked by the above, but otherwise no issues identified (and the whole family is home for the holidays so I'd be sure to know).

FWIW, over time I've monitored reports for the "least offenders" and dropped a few countries from this list and will continue to do so.

@Adamm, is there a way to output the report to a file (I use the display option usually)?

EDIT: NM. "sh /jffs/scripts/firewall stats 20 > skynet.txt" accomplishes that (tho with a lot of extraneous characters, but still readable). Cheers,
 
Last edited:
Rhialto said:
Does it require latest firmware? I don't think so reading nothing about this in first post but if so, is there a firmware check done so people don't break last working version? Just curious as I'm still on 380.68_4
Click to expand...
You do need the latest firmware for Skynet. Skynet will now require at least v384.13 or the latest curl package from Entware.
 
dev_null said:
EDIT: NM. "sh /jffs/scripts/firewall stats 20 > skynet.txt" accomplishes that (tho with a lot of extraneous characters, but still readable). Cheers,
Click to expand...

The command was never designed to be visually pleasing when output to a file, but to make it somewhat more readable you can do the following;

Code: 
sh /jffs/scripts/firewall stats | sed -r 's/'$(echo -e "\033")'\[[0-9]{1,2}(;([0-9]{1,2})?)?[mK]//g' | strings > skynet.txt
 
Adamm said:
The command was never designed to be visually pleasing when output to a file, but to make it somewhat more readable you can do the following;

Code: 
sh /jffs/scripts/firewall stats | sed -r 's/'$(echo -e "\033")'\[[0-9]{1,2}(;([0-9]{1,2})?)?[mK]//g' | strings > skynet.txt
Click to expand...

And skynet.txt can be found in the root directory.

i marvel at the amount of knowledge and experience it must take to come up with a line of code like that. I’m sure you regard it as trivial.
 
Adamm said:
The command was never designed to be visually pleasing when output to a file, but to make it somewhat more readable you can do the following;

Code: 
sh /jffs/scripts/firewall stats | sed -r 's/'$(echo -e "\033")'\[[0-9]{1,2}(;([0-9]{1,2})?)?[mK]//g' | strings > skynet.txt
Click to expand...
any objections if i dabble with a uiSkynet similar to the diversion stats, when 384.15 lands?
 
Mutzli said:
You do need the latest firmware for Skynet. Skynet will now require at least v384.13 or the latest curl package from Entware.
Click to expand...
Then first post need to reflect this, right @Adamm ? Also, does Skynet check firmware version to avoid installation on older/not supported firmware version?
 
Rhialto said:
Then first post need to reflect this, right @Adamm ? Also, does Skynet check firmware version to avoid installation on older/not supported firmware version?
Click to expand...

v384.13 or the latest curl package from Entware.
Click to expand...

Emphasis on the "or". Skynet will automatically handle this in the background assuming you have entware installed. Although the latest firmware version is generally recommended for the best user experience.
 
You must log in or register to reply here.

Similar threads

W
Looking for an add-on that does...
Replies
5
Views
2K
JGrana
JGrana
Viktor Jaep
Skynet Filter Validator v0.7 - Skynet Firewall Filter List IPv4 Integrity Validator
3 4 5
Replies
83
Views
13K
SomeWhereOverTheRainBow
SomeWhereOverTheRainBow
Viktor Jaep
TAILMON TAILMON v1.0.20 -July 27, 2024- WireGuard-based Tailscale Installer, Configurator and Monitor (Now available in AMTM!)
Replies
2
Views
317
Viktor Jaep
Viktor Jaep
RMerlin
Fun with ChatGPT...
2
Replies
33
Views
2K
RMerlin
RMerlin
Viktor Jaep
BACKUPMON BACKUPMON v1.8.22 -Nov 28, 2024- Backup/Restore your Router: JFFS + NVRAM + External USB Drive! CIFS/SMB/NFS! (Now available in AMTM!)
Replies
14
Views
269
Viktor Jaep
Viktor Jaep
Similar threads
Thread starter Title Forum Replies Date
Klonoa Skynet Skynet causes router to crash and reboot Asuswrt-Merlin AddOns 1
S Skynet Skynet showing router itself making calls to China? Asuswrt-Merlin AddOns 26
J Skynet Skynet - Blocked outbounds coming from the router itself? Asuswrt-Merlin AddOns 12
O Skynet Installing Skynet causes router to crash and reboot Asuswrt-Merlin AddOns 26
L Skynet I have installed the skynet firewall how do I configure it if the security of iot devices is important? Asuswrt-Merlin AddOns 2
Davidncali001 Skynet Message on SKYNET I havent seen before Asuswrt-Merlin AddOns 1
S Skynet firewall reduces wireless range Asuswrt-Merlin AddOns 14
P Skynet Internet speed lower with Skynet on Asuswrt-Merlin AddOns 9
N Skynet SkyNet/Firewall blocking all ping requests, including outbound Asuswrt-Merlin AddOns 6
W Skynet SOLVED: Scrollbar Disappears on Skynet Tab on Asuswrt-Merlin 386.14 Asuswrt-Merlin AddOns 10

Similar threads

Latest threads

Support SNBForums w/ Amazon

If you'd like to support SNBForums, just use this link and buy anything on Amazon. Thanks!

Sign Up For SNBForums Daily Digest

Get an update of what's new every day delivered to your mailbox. Sign up here!

Members online

Total: 580 (members: 20, guests: 560)
Top