Port forwarding on 8 IP block with Fritzbox 3490

I am trying to set up my new Fritzbox 3490 and have managed most things.

But, I am stuck with port forwarding of IP address X.Y.Z.16 port 80 to a local web server. (my router address is X.Y.Z.22 on 8 IP block)

I can't find any way to specify the .16 address.

It all works just fine with my old Draytek 2600 or my newer Draytek 2820.

Any help would be appreciated as I am missing something.on the help pages (or, perhaps, they refer to a different OS version?)

I can share that on pfSense you set up virtual IP for the IPv4 Address block then set up a 1-1 NAT from the WAN IP to the LAN IP.

Suspect its something similar on the Fitzbox

If the X.Y.Z is publically accessible and you are using routed IP configuration then port forwarding is not an issue, since that only applies if you are using NAT ie. public IP address on Internet side of router and a local LAN IP for the device.

If your web server is not visible to others on the Internet then it may be a firewall access rule blocking you in the router, or the OS of the web server machine

I am still confused.

The Drayteks use port forwarding - so simple to setup. (Perhaps I should ditch the Zen free Fritzbox and buy myself a DrayTek 2860!)

It is not a firewall issue, as I am stuck on how to set it up (I can't find where to specify that I want to forward port 80 on public IP address 16). I have not got as far as testing it.

No mention of just port 80 with that suggestion.

But the whole point is, as Andrew said, you don't need to port forward. You're looking for the wrong thing.

Your 8 IP addresses exist on the Internet - They're publicly accessible - That's the point of having them! Port forwarding is used with NAT (or more correctly, PAT) where the router doesn't know which non-public address to forward access to a port. In your case, the IP address is explicit, as it's public.

I've no idea why you used port forwarding with the Draytek, other than perhaps the forwarding rule was ignored but coincidentally opened a firewall?

As Andrew said, look at firewall configs... Or alternatively, release your block of 8 addresses and revert to a single address and NAT/PAT as it sounds like you can't really justify having your /29?

Thinking further, if you have a /29 that has .16 and .22 within the subnet then .16 is the network ID so can't be used. The usable addresses are .17 to .22 with .23 as the broadcast address.

Edited by ferretuk (Wed 26-Apr-17 22:53:17)

I have web servers and other servers on more than 1 public address (this was just the first one I tried to set up). I have now reverted to using the old Draytek and have decided to ditch the Fritzbox and buy a Draytek 2860 for FTTC.

I probably should have used the term Open Ports rather than Port Forwarding (as that is how the Draytek user interface describes it).

All of my servers have local addresses, so Open Ports is the correct way to do it with Draytek. (and the .16 address can be used for Open Ports)

The Draytek Open Ports is very flexible and even lets us forward two or more ports on the same public IP address to two or more local computers.

But, thanks for your comments anyway.

Edited by Sandgrounder (Wed 26-Apr-17 23:15:53)

OK, I *think* I understand your setup.

The port forwarding config for most routers are designed to cope with the standard 'one public IP address, many private addresses' setup. As such, they don't provide any way of specifying the WAN address as it is assumed to be the single public address. The only configuration you then need is to specify the target address (and port) of course.

Seemingly the Draytek is unusual in that you can specify the WAN address as part of the rule set? You've probably done the right thing buying another one then

That is correct.

With Draytek Open Ports, I can specify the WAN address (any 1 of the 8) , for a range of ports.

With Draytek Port Redirection, I can specify the WAN address (any 1, or all, of the 8) and I can redirect the LAN port, as well. (but only for a single port, not a range).

20 of each, giving a total of 40.

I am happy with my decision to buy a 2860. I am also happy that your post caused me to think it all through properly.

Edit: and I could have used Draytek DMZ with local computers having public IP addresses as you suggested, but then the Draytek firewall would have been disabled for those addresses, leaving all ports open to the internet.

Edited by Sandgrounder (Thu 27-Apr-17 00:40:36)

Sounds like many to many NAT then

Next one, are you getting someone outside the LAN to check visibility? Once you have 'opened' the ports?