Suchergebnisse

Over a year ago I freetzed my FB7340, using xs4all with native IPv6 Problem I run into: DHCP6 advertises fritzbox as DNS server. Fritzbox uses ISP DNS, so internal domain names (like MS AD) aren't accessible. I already tried to make FB use internal DNS for its lookups in 3 ways: -Freetz...

Update the docs? Seems like fritzbox designers just swapped ethernet ports, even their tool asks for LAN1 connection, whereas it only works on LAN2 http://www.ip-phone-forum.de/showthread.php?t=237579&p=1735043#post1735043

Combining that with original question: In avm firewall, just allow dns traffic to opendns , and block all other dns traffic. This way clients can't specify their own dns server (unless it's the same dns server as fb is already using)

afaik, fritz firewall is on the outside interface. Packets are already NATted, so you can't tell the difference between dns requests originating from your LAN or the box itself.

If dsld doesn't allow this mapping, NATting both source and destination address is needed. In config, first map to previous used dummy addres 192.168.0.123 then use 2 iptables NAT rules: iptables -t nat -A PREROUTING -d 192.168.0.123 -j DNAT --to-destination 192.168.12.205 iptables -t nat...

Of course you need the port mapping. Do you still get the error "192.168.12.205 not an intern host" ? Did you add the route in fritz gui? On my routes, I see 192.168.1.11 as next hop, instead of * Destination Gateway Genmask Flags Metric Ref Use Iface 192.168.180.1...

fritz-gui, expert mode , chose "home network" in left menu, tab "network settings", button "ip routes"

I have following routes on my 7340: Network Subnet mask Gateway 10.0.0.0 255.0.0.0 192.168.1.11 172.16.0.0 255.240.0.0 192.168.1.11 192.168.0.0 255.255.0.0 192.168.1.11 Although 192.168.1.0/24 is fritzbox internal LAN, I can still map ports to any host in any of 3...

Looking at routing table again: VPN tunnel is tun0 instead of tun1

You could try iptables rule like this on BoxA iptables -t nat -A POSTROUTING -s ! 192.168.0.0/24 -o tun1 -j SNAT --to-source 192.168.0.123 This replaces source IP address on packets leaving tun1 , but only if source address isn't from local LanA. Source address is replaced with some...

That won't work! Packets going from internet->BoxA->portmapping->Tunnel->BoxB->Webserver will work OK However, return packets will use default route on BoxB and flow like: Webserver->BoxB->Internet

If you do have a VPN tunnel, why do you need the portmapping? You just need routing table entries, that send packets destined for remote inside addresses over the VPN tunnel.

Indeed, firewall rules don't do the NAT-ting. You still need a port forward. Aim of suggested firewall rules is to filter your existing port forward. I used freetz GUI to add 4 outgoing rules in my current 7340 without any problems. Manual editing is prone to typos and syntax errors resulting...

To get back to original question: Don't look into NAT stuff in ar7.cfg, look to firewall rules instead. On incoming rules, add stuff like this (to make your internal webserver only accessible from external IP 81.171.230.52) On freetzed box, this can be done from web interface

This was my old thread: http://www.ip-phone-forum.de/showthread.php?t=237579&pagenumber=

Was flashing really succesfull ? On 7340, I once had avm beta loaded. Flashing from there looked OK, but it took a while for me to figure out that after reboot, it was still on avm beta, so freetz pages were missing too.

Why not just activate the setting "Alle Computer befinden sich im selben IP-Netzwerk" ?

if the "ip" command is present, you can also try setting static entry with command like:

Instead of adding block rules to input chain, I would add them to forward chain. In your config, even DHCP might not work for unauthorised clients, giving them no access to local stuff like NAS

-You are forwarding packets, so the rules must be in the forward in stead of input chain. The input chain is for filtering traffic to processes on local host -iptables -A INPUT -s nagios.domain.de -m tcp -p tcp -d 0.0.0.0 --dport 8080 -j ACCEPT Make sure internet connection is up, before...