Skynet Skynet - Router Firewall & Security Enhancements

[nakti]

I have updated to latest merlin and now I can't install Skynet, I have formatted the USB via amtm and tried with
/usr/sbin/curl -s "https://raw.githubusercontent.com/Adamm00/IPSet_ASUS/master/firewall.sh" -o "/jffs/scripts/firewall" && chmod 755 /jffs/scripts/firewall && sh /jffs/scripts/firewall install
but nothing happens after. No errors. When I open skynet from AMTM then I only see the "SKYNET V7" nothing else. What to do?

 

[Adamm]

I have updated to latest merlin and now I can't install Skynet, I have formatted the USB via amtm and tried with
/usr/sbin/curl -s "https://raw.githubusercontent.com/Adamm00/IPSet_ASUS/master/firewall.sh" -o "/jffs/scripts/firewall" && chmod 755 /jffs/scripts/firewall && sh /jffs/scripts/firewall install
but nothing happens after. No errors. When I open skynet from AMTM then I only see the "SKYNET V7" nothing else. What to do?

What is the output of;

sh -x /jffs/scripts/firewall install

 

[nakti]

What is the output of;

sh -x /jffs/scripts/firewall install

+ export LC_ALL=C
+ mkdir -p /tmp/skynet/lists
+ mkdir -p /jffs/addons/shared-whitelists
+ ntptimer=0
+ nvram get ntp_ready
+ [ 0 = 0 ]
+ [ 0 -lt 300 ]
+ echo install
+ grep -qE (uninstall|disable)
+ ntptimer=1
+ [ 1 = 60 ]
+ sleep 1

and its looping

 

[nakti]

What is the output of;

sh -x /jffs/scripts/firewall install

I found the solution.

Needed to reset amtm and now its working to start skynet

 

[Adamm]

+ export LC_ALL=C
+ mkdir -p /tmp/skynet/lists
+ mkdir -p /jffs/addons/shared-whitelists
+ ntptimer=0
+ nvram get ntp_ready
+ [ 0 = 0 ]
+ [ 0 -lt 300 ]
+ echo install
+ grep -qE (uninstall|disable)
+ ntptimer=1
+ [ 1 = 60 ]
+ sleep 1

and its looping

I found the solution.

Needed to reset amtm and now its working to start skynet

fwiw your issue was due to NTP not being unable to sync correctly.

 

[nakti]

fwiw your issue was due to NTP not being unable to sync correctly.

Yeah thanks I did update this in router

 

[nakti]

I think something is wrong with the latest version of Merlin as I now get:
Skynet: [*] USB Not Found - Sleeping For 10 Seconds ( Attempt 1 Of 10 )
Worked properly on beta version

 

[Adamm]

I think something is wrong with the latest version of Merlin as I now get:
Skynet: [*] USB Not Found - Sleeping For 10 Seconds ( Attempt 1 Of 10 )
Worked properly on beta version

That means either your USB hadn't mounted yet, or your mount location has changed from the original install path (which is listed in /jffs/scripts/firewall-start).

You can correct this error by running the install command which will retain your data and correct the path.

 

[nakti]

That means either your USB hadn't mounted yet, or your mount location has changed from the original install path (which is listed in /jffs/scripts/firewall-start).

You can correct this error by running the install command which will retain your data and correct the path.

Install command didn't work as the USB got protected. Needed to do a full format of the usb device on pc to fat and back to the router again to do a ext3 format via amtm.

Think it was because of the ext4 with journalling. Tried with ext3 without journalling and now I can install skynet and create new swap file. (Maby something with the USB device which couldn't handle ext4) Maby I had ext3 before but after updating the firmware of merlin, skynet died and needed to reinstall from beginning and maby forgot which ext I was using before.

 

[Adamm]

Install command didn't work as the USB got protected. Needed to do a full format of the usb device on pc to fat and back to the router again to do a ext3 format via amtm.

Think it was because of the ext4 with journalling. Tried with ext3 without journalling and now I can install skynet and create new swap file. (Maby something with the USB device which couldn't handle ext4) Maby I had ext3 before but after updating the firmware of merlin, skynet died and needed to reinstall from beginning and maby forgot which ext I was using before.

Flash drives going into write protect mode generally indicates they are dying / about to die. Your issue isn’t with Skynet / Merlin

 

[nakti]

Flash drives going into write protect mode generally indicates they are dying / about to die. Your issue isn’t with Skynet / Merlin

Will check how long it works. Now its as it should. The issue with protection mode was after it was formatting to ext4, it works perfect on fat and ext3. Had exact same issue 8 month ago and using same USB device. If I format again to ext4 its getting protected again.

 

[L&LD]

@nakti, how are you formatting it? Using amtm or on a computer?

 

[Todd Snigg]

Hello. I am currently running Merlin 384.19 on my AC-1900P. I am running Skynet v7.2.1.

I am having an issue where (I think) Skynet starts to block all new connections outbound. I lose any internet access for new connections, web pages, etc. And the WAN connection status in the GUI is 'Disconnected'. But I work from home and my Citrix connection never has an issue, it stays up during all of these disconnects. I can recover by forcing Skynet to restart. But it happens frequently. Sometimes it will be stable for days. But today it happened twice within 30 minutes. My syslog is shown here:

The first outage occurred right before the 09:42:56 entry the second right before the 10:11:25 entry. After the first one I restarted skynet using the command line "service restart_firewall" and then I was able to get into the Skynet menu and restart it again using option 8. The second time I had to restart via the command line and then I stopped Skynet completely using option 9. Since I stopped Skynet I have not had an issue recur (~1 hr).

Aug 31 08:46:15 cstats[257]: Problem loading /mnt/CENTONSTICK/tomato_cstats_3497f698a970.gz. Still trying...
Aug 31 08:46:39 rstats[256]: Problem loading /mnt/CENTONSTICK/tomato_rstats_3497f698a970.gz. Still trying...
Aug 31 09:00:27 syslog: WLCEVENTD wlceventd_proc_event(500): eth1: Auth XX:XX:XX:XX:XX:5D, status: Successful (0)
Aug 31 09:00:27 syslog: WLCEVENTD wlceventd_proc_event(529): eth1: Assoc XX:XX:XX:XX:XX:5D, status: Successful (0)
Aug 31 09:00:27 dnsmasq-dhcp[232]: DHCPREQUEST(br0) 192.168.2.81 XX:XX:XX:XX:XX:5d
Aug 31 09:00:27 dnsmasq-dhcp[232]: DHCPACK(br0) 192.168.2.81 XX:XX:XX:XX:XX:5d GearFit2-9C5C
Aug 31 09:00:28 syslog: WLCEVENTD wlceventd_proc_event(481): eth1: Disassoc XX:XX:XX:XX:XX:5D, status: 0, reason: Disassociated because sending station is leaving (or has left) BSS (8)
Aug 31 09:01:15 cstats[257]: Problem loading /mnt/CENTONSTICK/tomato_cstats_3497f698a970.gz. Still trying...
Aug 31 09:01:39 rstats[256]: Problem loading /mnt/CENTONSTICK/tomato_rstats_3497f698a970.gz. Still trying...
Aug 31 09:06:52 syslog: WLCEVENTD wlceventd_proc_event(500): eth1: Auth XX:XX:XX:XX:XX:BC, status: Successful (0)
Aug 31 09:06:52 syslog: WLCEVENTD wlceventd_proc_event(529): eth1: Assoc XX:XX:XX:XX:XX:BC, status: Successful (0)
Aug 31 09:06:53 dnsmasq-dhcp[232]: DHCPREQUEST(br0) 192.168.2.104 XX:XX:XX:XX:XX:bc
Aug 31 09:06:53 dnsmasq-dhcp[232]: DHCPACK(br0) 192.168.2.104 XX:XX:XX:XX:XX:bc Corris-MBP
Aug 31 09:12:02 syslog: WLCEVENTD wlceventd_proc_event(500): eth2: Auth XX:XX:XX:XX:XX:B5, status: Successful (0)
Aug 31 09:12:02 syslog: WLCEVENTD wlceventd_proc_event(529): eth2: Assoc XX:XX:XX:XX:XX:B5, status: Successful (0)
Aug 31 09:12:02 dnsmasq-dhcp[232]: DHCPDISCOVER(br0) XX:XX:XX:XX:XX:b5
Aug 31 09:12:02 dnsmasq-dhcp[232]: DHCPOFFER(br0) 192.168.2.118 XX:XX:XX:XX:XX:b5
Aug 31 09:12:02 dnsmasq-dhcp[232]: DHCPREQUEST(br0) 192.168.2.118 XX:XX:XX:XX:XX:b5
Aug 31 09:12:02 dnsmasq-dhcp[232]: DHCPACK(br0) 192.168.2.118 XX:XX:XX:XX:XX:b5
Aug 31 09:12:56 syslog: WLCEVENTD wlceventd_proc_event(466): eth2: Deauth_ind XX:XX:XX:XX:XX:B5, status: 0, reason: Disassociated due to inactivity (4)
Aug 31 09:16:15 cstats[257]: Problem loading /mnt/CENTONSTICK/tomato_cstats_3497f698a970.gz. Still trying...
Aug 31 09:16:39 rstats[256]: Problem loading /mnt/CENTONSTICK/tomato_rstats_3497f698a970.gz. Still trying...
Aug 31 09:21:16 dnsmasq-dhcp[232]: DHCPREQUEST(br0) 192.168.2.50 XX:XX:XX:XX:XX:70
Aug 31 09:21:16 dnsmasq-dhcp[232]: DHCPACK(br0) 192.168.2.50 XX:XX:XX:XX:XX:70 raspberrypi3
Aug 31 09:31:15 cstats[257]: Problem loading /mnt/CENTONSTICK/tomato_cstats_3497f698a970.gz. Still trying...
Aug 31 09:31:39 rstats[256]: Problem loading /mnt/CENTONSTICK/tomato_rstats_3497f698a970.gz. Still trying...
Aug 31 09:39:15 syslog: WLCEVENTD wlceventd_proc_event(481): wl0.2: Disassoc XX:XX:XX:XX:XX:1F, status: 0, reason: Disassociated because sending station is leaving (or has left) BSS (8)
Aug 31 09:39:19 syslog: WLCEVENTD wlceventd_proc_event(500): wl0.2: Auth XX:XX:XX:XX:XX:1F, status: Successful (0)
Aug 31 09:39:19 syslog: WLCEVENTD wlceventd_proc_event(529): wl0.2: Assoc XX:XX:XX:XX:XX:1F, status: Successful (0)
Aug 31 09:39:21 dnsmasq-dhcp[232]: DHCPDISCOVER(br0) XX:XX:XX:XX:XX:1f
Aug 31 09:39:21 dnsmasq-dhcp[232]: DHCPOFFER(br0) 192.168.2.99 XX:XX:XX:XX:XX:1f
Aug 31 09:39:21 dnsmasq-dhcp[232]: DHCPREQUEST(br0) 192.168.2.99 XX:XX:XX:XX:XX:1f
Aug 31 09:39:21 dnsmasq-dhcp[232]: DHCPACK(br0) 192.168.2.99 XX:XX:XX:XX:XX:1f Gateway5CB01F
Aug 31 09:42:56 dropbear[10165]: Password auth succeeded for 'xxxx' from 192.168.2.111:51775
Aug 31 09:43:22 dnsmasq[232]: read / etc/ hosts - 6 addresses
Aug 31 09:43:22 dnsmasq[232]: read / etc/ hosts.dnsmasq - 1 addresses
Aug 31 09:43:22 dnsmasq[232]: using nameserver 8.8.8.8#53
Aug 31 09:43:22 dnsmasq[232]: using nameserver 1.1.1.1#53
Aug 31 09:46:15 cstats[257]: Problem loading /mnt/CENTONSTICK/tomato_cstats_3497f698a970.gz. Still trying...
Aug 31 09:46:39 rstats[256]: Problem loading /mnt/CENTONSTICK/tomato_rstats_3497f698a970.gz. Still trying...
Aug 31 10:01:15 cstats[257]: Problem loading /mnt/CENTONSTICK/tomato_cstats_3497f698a970.gz. Still trying...
Aug 31 10:01:39 rstats[256]: Problem loading /mnt/CENTONSTICK/tomato_rstats_3497f698a970.gz. Still trying...
Aug 31 10:02:57 kernel: nvram: consolidating space!
Aug 31 10:11:25 dnsmasq[232]: read / etc/ hosts - 6 addresses
Aug 31 10:11:25 dnsmasq[232]: read / etc / hosts.dnsmasq - 1 addresses
Aug 31 10:11:25 dnsmasq[232]: using nameserver 8.8.8.8#53
Aug 31 10:11:25 dnsmasq[232]: using nameserver 1.1.1.1#53
Aug 31 10:16:15 cstats[257]: Problem loading /mnt/CENTONSTICK/tomato_cstats_3497f698a970.gz. Still trying...
Aug 31 10:16:39 rstats[256]: Problem loading /mnt/CENTONSTICK/tomato_rstats_3497f698a970.gz. Still trying...

Note: I could not, for some reason get the above to paste in here without an error until I added spaces on the dnsmasq paths. Those spaces are not there in my log.

I really prefer having Skynet running as I can see all the connection attempts it blocks in the logs. I noticed that once I disabled Skynet all the log entries in the syslog disappeared. But I reviewed those and they are all just inbound traffic block notifications.

One thing I will note is that my cable modem log shows a log of Lost MDD Timeouts and CM-STATUS messages, like 1 per minute. Could these errors be causing Skynet or another part of the router to mis-behave and lockup?

Also, this started happening when I was running Merlin 384.17 and a previous version of Skynet (not sure which). I upgraded to 384.19 and factory reset and then used the nvram tool to reload all my settings. I was hoping this would stop the issue, but it has not.

Edit/Update: So it looks like this may not be Skynet per se. I left Skynet diabled and had a similar issue again at around 2:34pm, over 4 hours from the last incident. But running the command 'service restart_firewall' immediately brought the WAN connection back up.

Thanks for any help.

Todd

 

[mongodb]

Hi, starting today I've noticed I keep getting this error when launching the firewall module:

/jffs/scripts/firewall: line 40: arithmetic syntax error

If I restart the service, it works OK for the first run then starts giving the same error. I'm running:

Router Model;
Skynet Version; (30/08/2020) (72525a315d73b0c0f1d6e82708d0c6b9)
iptables v1.4.15 - (eth0 @ xx.xx.xx.xx)
ipset v6.32, protocol version: 6
IP Address; (aa.bb.cc.dd)
FW Version; 384.8_2 (Dec 8 2018) (2.6.36.4brcmarm)
Install Dir; /tmp/mnt/sda1/skynet (11.2G / 14.1G Space Available)

Any thoughts what might be causing this please?

Thanks in advance.

 

[Adamm]

FW Version; 384.8_2 (Dec 8 2018)

That's probably your first issue, you are running a two year old firmware.

 

[mongodb]

That's probably your first issue, you are running a two year old firmware.

That's fair, Adam. I will get around to it soon.

I guess, for others benefit- I fixed it by renaming the folder to skynet-old and re-installed it. Works good as gold now. I think something wasn't right in the old directory.

 

[Stevens243]

fwiw your issue was due to NTP not being unable to sync correctly.

OOOOWwww...my brain...it hurts

 

[Wanabo]

Yesterday I noticed very slow internet connections. I wanted to temporarily disable skynet but received these errors:

Skynet: [*] Waiting For NTP To Sync
Skynet: [*] NTP Failed To Start After 5 Minutes - Please Fix Immediately!

In the days before I saw blocked outbound to pool.ntp.org so I thought this has to do with skynet.
No root command worked for skynet so I decided to do a factory reset.
But problems were the same, very slow internet connections.
Later it appeared to be a ddos attack on the network from my ISP and had nothing to do with skynet.

But two questions:
- Can you make outgoing ntp requests on port 53 default whitelisted?
- Please make it so that skynet stays responsive if ntp fails.

 

[Adamm]

But two questions:
- Can you make outgoing ntp requests on port 53 default whitelisted?
- Please make it so that skynet stays responsive if ntp fails.

Your current NTP server is whitelisted by default. Skynet relies on an accurate clock for logging, so NTP working correctly is essential.

 

[LaMpiR]

Check your syslog, Skynet will log any reason it fails to start if that is the case.

I have only found this:
Aug 31 01:07:01 Skynet: Skynet Update Detected - v7.2.1 (72525a315d73b0c0f1d6e82708d0c6b9)

@LaMpiR, have you rebooted the router after the firmware reboot it does? Are amtm and all other scripts (including Entware) fully updated?

If you have, you may have to remove Skynet (manually) and re-install.

I have no idea, let me check on how to check those things and update them.