Skynet Skynet - Router Firewall & Security Enhancements

[Teymur]

Okay good so that rules out quite a few functions, what about the following command;

sh /jffs/scripts/firewall debug genstats

Adam this time around it took about 4 min to complete.

 ====================================================================

[i] Generating Stats For WebUI


====================================================================

[#] 147535 IPs (+0) -- 1785 Ranges Banned (+0) || 863 Inbound -- 0 ]
teymur88@router:/tmp/home/root#

Regards

Teymur

 

[martinr]

Send me a copy of your stats.js file and skynet.log



This is due to one of the YazFi compatibility changes which in turn broke other usage, I'll be reverting this commit shortly and working on (or dropping all-together) YazFi support another day.

I still cannot account for any lock files taking excessive amounts of time, for anyone affected does this happen when you manually run banmalware or the restart commands? Hopefully I will be back to a somewhat normal schedule this weekend, moving has been eating up all my free time

What's the official way to get skynet.js and skynet.log to you? Both file extensions are unacceptable in Upload a file. I can change the extension to .txt but the logfile at 7.6MB, is too large to be uploaded.

 

[Adamm]

What's the official way to get skynet.js and skynet.log to you? Both file extensions are unacceptable in Upload a file. I can change the extension to .txt but the logfile at 7.6MB, is too large to be uploaded.

Pastebin, google drive, dropbox... Whatever works.

Adam this time around it took about 4 min to complete.

 ====================================================================

[i] Generating Stats For WebUI


====================================================================

[#] 147535 IPs (+0) -- 1785 Ranges Banned (+0) || 863 Inbound -- 0 ]
teymur88@router:/tmp/home/root#

Regards

Teymur

Okay so thats most likely the issue, now update to 7.1.3 and try;

sh /jffs/scripts/firewall settings lookupcountry disable

sh /jffs/scripts/firewall debug genstats

FYI, you may want to maximize your terminal window, your output is being cut off (including the script timer!)

 

[Teymur]

FYI, you may want to maximize your terminal window, your output is being cut off (including the script timer!)

Missed that part sorry, that was done from a phone. I'm very remote now and don't always have a pc access. Here is the actual output:

[#] 147535 IPs (+0) -- 1785 Ranges Banned (+0) || 905 Inbound -- 0 Outbound Connections Blocked! [debug] [202s]

Updating to 7.1.3 now.

 

[Teymur]

Pastebin, google drive, dropbox... Whatever works.



Okay so thats most likely the issue, now update to 7.1.3 and try;

sh /jffs/scripts/firewall settings lookupcountry disable

sh /jffs/scripts/firewall debug genstats

FYI, you may want to maximize your terminal window, your output is being cut off (including the script timer!)

it's very fast now!

[#] 147534 IPs (+0) -- 1785 Ranges Banned (+0) || 3 Inbound -- 0 Outbound Connections Blocked! [debug] [13s]

 

[martinr]

Pastebin, google drive, dropbox... Whatever works.



Okay so thats most likely the issue, now update to 7.1.3 and try;

sh /jffs/scripts/firewall settings lookupcountry disable

sh /jffs/scripts/firewall debug genstats

FYI, you may want to maximize your terminal window, your output is being cut off (including the script timer!)

Many thanks, Adam.

skynet.js is at https://www.dropbox.com/s/igdbh8nmk8nym9b/skynet.js?dl=0

skynet.log is at https://www.dropbox.com/s/tq1zgnbjs7gbo34/skynet .log?dl=0

 

[Chris_J]

So, looks like the issue with the speed is to do with generating the stats? I'm on 7.1.3 and ran the genstats with debug on, took about 5 mins (certainly faster than before) but they all say "no data..."

 

[Diamond67]

Updated to Skynet Version; v7.1.3 (13/03/2020) (98ed3362458908cb350851ecf11a8c25).

But after updating it still took some 6 minutes to get rid of the red&yellow "Lock File Detected" phase

[*] Lock File Detected (start skynetloc=/tmp/mnt/ASUS_ENTWARE/skynet) (pid=9290)
[*] Locked Processes Generally Take 1-2 Minutes To Complete And May Result In Temporarily "Failed" Tests

IPTables Rules                      | [Failed]

and eventually get "all green". That is some 4 minutes more than a month ago or so.

 

[Ubimo]

Same here, it takes 6 minutes.

 

[Adamm]

it's very fast now!

[#] 147534 IPs (+0) -- 1785 Ranges Banned (+0) || 3 Inbound -- 0 Outbound Connections Blocked! [debug] [13s]

Many thanks, Adam.

skynet.js is at https://www.dropbox.com/s/igdbh8nmk8nym9b/skynet.js?dl=0

skynet.log is at https://www.dropbox.com/s/tq1zgnbjs7gbo34/skynet .log?dl=0

So, looks like the issue with the speed is to do with generating the stats? I'm on 7.1.3 and ran the genstats with debug on, took about 5 mins (certainly faster than before) but they all say "no data..."

Updated to Skynet Version; v7.1.3 (13/03/2020) (98ed3362458908cb350851ecf11a8c25).

But after updating it still took some 6 minutes to get rid of the red&yellow "Lock File Detected" phase

[*] Lock File Detected (start skynetloc=/tmp/mnt/ASUS_ENTWARE/skynet) (pid=9290)
[*] Locked Processes Generally Take 1-2 Minutes To Complete And May Result In Temporarily "Failed" Tests

IPTables Rules                      | [Failed]

and eventually get "all green". That is some 4 minutes more than a month ago or so.

Same here, it takes 6 minutes.

These issues are all related and are due to ipapi.co and their API failing / being rate limited. Something must have changed recently on their end. I will investigate and/or try find an alternative.

 

[Adamm]

I posted a hotfix in an attempt to fix the issue above. We seem to be getting rate limited based on our useragent, so I changed it

Any feedback would be appreciated.

 

[Teymur]

I posted a hotfix in an attempt to fix the issue above. We seem to be getting rate limited based on our useragent, so I changed it

Any feedback would be appreciated.

Hi Adam,

I’ll try that now to see what happens. Do I enable the country lookups again and run the commands you told me yesterday?


Regards

Teymur

 

[Adamm]

Hi Adam,

I’ll try that now to see what happens. Do I enable the country lookups again and run the commands you told me yesterday?


Regards

Teymur

Correct, enable country lookups then use the genstats command.

 

[Teymur]

Correct, enable country lookups then use the genstats command.

This is the output now with country lookups enabled:

[#] 149108 IPs (+0) -- 1866 Ranges Banned (+0) || 13 Inbound -- 0 Outbound Connections Blocked! [debug] [35s]

 

[Adamm]

This is the output now with country lookups enabled:

[#] 149108 IPs (+0) -- 1866 Ranges Banned (+0) || 13 Inbound -- 0 Outbound Connections Blocked! [debug] [35s]

Great its fixed, until they realize what I did to bypass their rate limiting

 

[Teymur]

Great its fixed, until they realize what I did to bypass their rate limiting

Cool man! Thanks a lot![emoji3][emoji106]


Regards

Teymur

 

[Diamond67]

Any feedback would be appreciated.

No more extra delay after updating to Skynet Version; v7.1.3 (13/03/2020) (11855137d302091048cc3f4cfbf369e8). Took normal 2 minutes to get "green".

 

[Jack Yaz]

Great its fixed, until they realize what I did to bypass their rate limiting

You could define an enum of various UserAgents and select 1 at random to delay detection. Best approach, however, would be to have a conversation with them to see if there's an amicable solution to using their API

 

[Chris_J]

Hotfix sorted it. Thanks, Adam

 

[Adamm]

Best approach, however, would be to have a conversation with them to see if there's an amicable solution to using their API

We are well within their 30k per month limit, I actually implemented the update frequency around this value. I assume the changes made on their end were unintended.