Port Fowarding DOUBLE NAT - Fritz7590

Installing and Using OpenWrt Network and Wireless Configuration
1

Hello,
I've been trying all the possibile configuration and once Obtained the "Open" nat but then had to reset to factory and now I'm having trouble to set it "Open" again.

Modem - Fritz settings

image
image1247×129 10.6 KB

Got external public ip

OpenWRT - Settings

image
image983×488 25.2 KB

image
image963×659 24.7 KB

config defaults
        option input 'ACCEPT'
        option output 'ACCEPT'
        option forward 'ACCEPT'
        option synflood_protect '1'

config zone
        option name 'lan'
        option input 'ACCEPT'
        option output 'ACCEPT'
        option forward 'ACCEPT'
        list network 'lan'

config zone
        option name 'wan'
        option input 'ACCEPT'
        option output 'ACCEPT'
        option forward 'ACCEPT'
        option mtu_fix '1'
        list network 'wan'
        option masq '1'

config forwarding
        option src 'lan'
        option dest 'wan'

config rule
        option name 'Allow-DHCP-Renew'
        option src 'wan'
        option proto 'udp'
        option dest_port '68'
        option target 'ACCEPT'
        option family 'ipv4'

config rule
        option name 'Allow-Ping'
        option src 'wan'
        option proto 'icmp'
        option icmp_type 'echo-request'
        option family 'ipv4'
        option target 'ACCEPT'

config rule
        option name 'Allow-IGMP'
        option src 'wan'
        option proto 'igmp'
        option family 'ipv4'
        option target 'ACCEPT'

config rule
        option name 'Allow-DHCPv6'
        option src 'wan'
        option proto 'udp'
        option dest_port '546'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-MLD'
        option src 'wan'
        option proto 'icmp'
        option src_ip 'fe80::/10'
        list icmp_type '130/0'
        list icmp_type '131/0'
        list icmp_type '132/0'
        list icmp_type '143/0'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-ICMPv6-Input'
        option src 'wan'
        option proto 'icmp'
        list icmp_type 'echo-request'
        list icmp_type 'echo-reply'
        list icmp_type 'destination-unreachable'
        list icmp_type 'packet-too-big'
        list icmp_type 'time-exceeded'
        list icmp_type 'bad-header'
        list icmp_type 'unknown-header-type'
        list icmp_type 'router-solicitation'
        list icmp_type 'neighbour-solicitation'
        list icmp_type 'router-advertisement'
        list icmp_type 'neighbour-advertisement'
        option limit '1000/sec'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-ICMPv6-Forward'
        option src 'wan'
        option dest '*'
        option proto 'icmp'
        list icmp_type 'echo-request'
        list icmp_type 'echo-reply'
        list icmp_type 'destination-unreachable'
        list icmp_type 'packet-too-big'
        list icmp_type 'time-exceeded'
        list icmp_type 'bad-header'
        list icmp_type 'unknown-header-type'
        option limit '1000/sec'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-IPSec-ESP'
        option src 'wan'
        option dest 'lan'
        option proto 'esp'
        option target 'ACCEPT'

config rule
        option name 'Allow-ISAKMP'
        option src 'wan'
        option dest 'lan'
        option dest_port '500'
        option proto 'udp'
        option target 'ACCEPT'

config redirect
        option dest 'lan'
        option target 'DNAT'
        option name 'test'
        option src 'wan'
        option src_dport '3478-3480'
        option dest_ip '192.168.1.243'
        option dest_port '3478-3480'
        option family 'ipv4'

config redirect
        option dest 'lan'
        option target 'DNAT'
        option name '3074'
        option src 'wan'
        option src_dport '3074'
        option dest_ip '192.168.1.243'
        option dest_port '3074'
        list proto 'udp'

config redirect
        option target 'DNAT'
        option name 'test1234214'
        list proto 'udp'
        option src 'wan'
        option src_dport '3074'
        option dest_ip '192.168.1.243'
        option dest_port '3074'

config redirect
        option target 'DNAT'
        option name '3074/2'
        list proto 'udp'
        option src 'lan'
        option src_dport '3074'
        option dest_ip '192.168.1.243'
        option dest_port '3074'

Any way to carry out the pre-mentioned?
Best Regards

2

It appears that you're trying to allow COD ports, so you'll want DMZ or "exposed host" Setting up a DMZ with the FRITZ!Box

You shouldn't have to set your OpenWRT wan zone to accept all. change it back to reject-accept-reject.

  1. OpenWRT router as the exposed host in the Fritz7590
  2. Static IP for your lan device in OpenWRT
  3. Create lan device port forwards.
  4. Reboot both firewalls.
3

Unless there is a specific reason you have changed this, set the input rule to REJECT.

4

Hello and thanks for quick reply.

config defaults
        option input 'ACCEPT'
        option output 'ACCEPT'
        option forward 'ACCEPT'
        option synflood_protect '1'

config zone
        option name 'lan'
        option input 'ACCEPT'
        option output 'ACCEPT'
        option forward 'ACCEPT'
        list network 'lan'

config zone
        option name 'wan'
        option input 'REJECT'
        option output 'ACCEPT'
        option forward 'REJECT'
        option mtu_fix '1'
        list network 'wan'
        option masq '1'

config forwarding
        option src 'lan'
        option dest 'wan'

config rule
        option name 'Allow-DHCP-Renew'
        option src 'wan'
        option proto 'udp'
        option dest_port '68'
        option target 'ACCEPT'
        option family 'ipv4'

config rule
        option name 'Allow-Ping'
        option src 'wan'
        option proto 'icmp'
        option icmp_type 'echo-request'
        option family 'ipv4'
        option target 'ACCEPT'

config rule
        option name 'Allow-IGMP'
        option src 'wan'
        option proto 'igmp'
        option family 'ipv4'
        option target 'ACCEPT'

config rule
        option name 'Allow-DHCPv6'
        option src 'wan'
        option proto 'udp'
        option dest_port '546'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-MLD'
        option src 'wan'
        option proto 'icmp'
        option src_ip 'fe80::/10'
        list icmp_type '130/0'
        list icmp_type '131/0'
        list icmp_type '132/0'
        list icmp_type '143/0'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-ICMPv6-Input'
        option src 'wan'
        option proto 'icmp'
        list icmp_type 'echo-request'
        list icmp_type 'echo-reply'
        list icmp_type 'destination-unreachable'
        list icmp_type 'packet-too-big'
        list icmp_type 'time-exceeded'
        list icmp_type 'bad-header'
        list icmp_type 'unknown-header-type'
        list icmp_type 'router-solicitation'
        list icmp_type 'neighbour-solicitation'
        list icmp_type 'router-advertisement'
        list icmp_type 'neighbour-advertisement'
        option limit '1000/sec'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-ICMPv6-Forward'
        option src 'wan'
        option dest '*'
        option proto 'icmp'
        list icmp_type 'echo-request'
        list icmp_type 'echo-reply'
        list icmp_type 'destination-unreachable'
        list icmp_type 'packet-too-big'
        list icmp_type 'time-exceeded'
        list icmp_type 'bad-header'
        list icmp_type 'unknown-header-type'
        option limit '1000/sec'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-IPSec-ESP'
        option src 'wan'
        option dest 'lan'
        option proto 'esp'
        option target 'ACCEPT'

config rule
        option name 'Allow-ISAKMP'
        option src 'wan'
        option dest 'lan'
        option dest_port '500'
        option proto 'udp'
        option target 'ACCEPT'

config redirect
        option dest 'lan'
        option target 'DNAT'
        option name 'test'
        option src 'wan'
        option src_dport '3478-3480'
        option dest_ip '192.168.1.159'
        option dest_port '3478-3480'
        option family 'ipv4'

config redirect
        option dest 'lan'
        option target 'DNAT'
        option name '3074'
        option src 'wan'
        option src_dport '3074'
        option dest_ip '192.168.1.159'
        option dest_port '3074'
        list proto 'udp'

image
image1237×148 11.5 KB

image

Regards

5

Is the host at 192.168.1.159 up, and the service that listens on port 3478 actively running and listening for connections?

If it is an application or game or whatever and it's not running, the port will be reported as closed.

If you run a port scan with an app (or nmap) locally on your network probing 192.168.1.159, does it show the port as open?

6

It was because I wasn't actually testing with the service listening.... Thanks! Just for information purposes it's working even without DMZ by fowarding both fritz and openwrt

image

Regards

7

That was going to be second suggestion but we didn't receive any feedback. Glad it's working for you now.

8

This topic was automatically closed 10 days after the last reply. New replies are no longer allowed.