Fritz!Box 7490 Port Forward headaches with Windows machines

Forums › LAN (ethernet/Wifi/routers/Bluetooth) › Fritz!Box 7490 Port Forward headaches with Windows machines

spacedog

496 posts

Ultimate Geek
+1 received by user: 62

#268206 5-Mar-2020 08:51

While I think the Fritz Box is a pretty good piece of hardware, the internal lan configuration absolutely drives me insane and never seems to work for me properly. I know there were bugs in old versions of the firmware regarding assigning fixed IP addresses, but now I'm having a massive headache trying to setup port forwards in the permit access section.

No matter what I try I keep getting:

A device with this name has already been configured

As best I can tell, it's using the the network name/id as an index for the port forwards and once you to try to setup a port forward to a specific windows 10 machine on the FritzBox 7490 it locks it up and you can't add other port forwards?

I'm running the 7.10 firmware so I'm at the latest revision.

In this particular case, I managed to finally force it to accept a port forward by manually configuring it against and IP address rather than selecting it from the dropdown list, but I wanted to add a secondary port forward as I'm trying to expose several different services on this one windows 10 machine to the internet. So I hoped that I could just add a new share to that one device that is already working in the Permit Access section but I get that same error again.

I have other machines on the network setup in the exact same fashion, but, admittedly that was done last year when the Fritz firmware was at an earlier revision. So I suspect this is a new bug. It's a bit of a nightmare trying to get support from the internet though as most published pages for the fritz box on google are from German forums so it becomes really hard to seek support from other users to see what they are all doing.

Anyone here have this issue and any suggestions on fixing it?

spacedog

496 posts

Ultimate Geek
+1 received by user: 62

#2444265 23-Mar-2020 07:37

Anyone?

surfisup1000

5288 posts

Uber Geek
+1 received by user: 2159

#2444284 23-Mar-2020 08:21

You are running old firmware, update that first.

I'm on 7.12, and port forwarding/permit access works perfectly on my 7490. I believe permit access is uPNP, and ports are only forwarded as needed. Probably as many ports as required.

spacedog

496 posts

Ultimate Geek
+1 received by user: 62

#2445138 24-Mar-2020 07:49

Sorry, typo on my part, I've been on 7.12 since September 2019. Don't know why I typed 7.10

surfisup1000

5288 posts

Uber Geek
+1 received by user: 2159

#2445218 24-Mar-2020 09:17

I don't totally understand what you are saying.

Is your problem is that you cannot forward 2 ports to the same machine?

You can add multiple port sharing under a single windows machine. But, you cannot add the same windows machine twice. If you try to add the same machine again, you get error "A device with this name has already been configured"

eg, I setup 2 ports as follows ...

You need "new sharing" in the lower right, and you can add as many as you like.

amorangi

63 posts

Master Geek
+1 received by user: 1

#2507586 18-Jun-2020 16:29

I've had the same problem on 2 different 7490s for years. The only way I've found to get around it is a factory reset, then enter all your port-forwards again in a single go. The fact that I've had the exact same problem on 2 different routers shows this is not isolated.

Mark

1653 posts

Uber Geek
+1 received by user: 555

#2507736 18-Jun-2020 20:47

Have you manually configured the IP on the Windows machine ? I've always found port forwarding either didn't work or was flakey if the FritzBox hadn't been the one to assign the host it's IP.

Samsung

Shop now on Samsung phones, tablets, TVs and more (affiliate link).

amorangi

63 posts

Master Geek
+1 received by user: 1

#2507743 18-Jun-2020 21:07

Using DHCP from the Fritz. Only port forward to linux machines that I can recall. Can anyone recommend a replacement for the Fritzes that does SIP? I'm so sick of dealing with these routers.

fe31nz

1294 posts

Uber Geek
+1 received by user: 423

#2507809 19-Jun-2020 00:59

amorangi:

Using DHCP from the Fritz. Only port forward to linux machines that I can recall. Can anyone recommend a replacement for the Fritzes that does SIP? I'm so sick of dealing with these routers.

You can keep the FritzBox doing VOIP for you behind another router of your choice - you just have to forward all the ports needed for VOIP to the FritzBox. It probably pays to also forward the TR-069 management ports so that 2Degrees can update the VOIP settings if they ever change them. I did this with my FritzBox 7390 before 2Degrees supported using non-Fritz routers, so I have mine hidden behind an extra EdgeRouter Lite in a way that makes 2Degrees unable to distinguish that it is not the main router. But these days that is apparently unnecessary as 2Degrees does now support you using your own router. I have these ports forwarded in my EdgeRouter 4:

5060 (UDP: SIP for VOIP)

7078-7109 (UDP: RTP for VOIP)

8089 (TCP: TR-069)

xxxx (TCP: HTTPS access for 2Degrees - the port number is different for each customer, so you need to see what they are currently using. It can change if the FritzBox is reset, or if it gets changed via TR-069. It should not be necessary to keep this open except when you need them to have full access to the FritzBox, such as when you are on the phone to them getting something fixed. On my 7390, this setting is found under Internet > Permit Access > TCP port for HTTPS.)

amorangi

63 posts

Master Geek
+1 received by user: 1

#2507823 19-Jun-2020 07:25

You can keep the FritzBox doing VOIP for you behind another router of your choice - you just have to forward all the ports needed for VOIP to the FritzBox.

That's a great idea - for some reason I'd never thought of doing it that way round.

For others reading this in the future and considering this with a 7490, the ports are listed under Diagnostics|Security.

cyril7

9075 posts

Uber Geek
+1 received by user: 2499

ID Verified

Trusted

Subscriber

#2507826 19-Jun-2020 07:35

You should not need to port forward to support voip, all connections are outbound so port forwarding is unnecessary, TR069 is probably a different matter.

Cyril

sbiddle

30853 posts

Uber Geek
+1 received by user: 9996

Retired Mod

Trusted

Biddle Corp

Lifetime subscriber

#2507845 19-Jun-2020 08:22

Port forwarding for VoIP also introduces huge security risks so should never be done unless you've got proper firewall rules or a SBC protecting the connection.

Lego

Shop now for Lego sets and other gifts (affiliate link).

amorangi

63 posts

Master Geek
+1 received by user: 1

#2507860 19-Jun-2020 08:59

OK, so if I follow this route should I just not forward any port except TR-069, and just connect the Fritzbox to the router?

cyril7

9075 posts

Uber Geek
+1 received by user: 2499

ID Verified

Trusted

Subscriber

#2507874 19-Jun-2020 09:27

Hi, do you really need TR069, if it is required I would be looking at locking it down to 2D's mgmnt servers

Cyril

fe31nz

1294 posts

Uber Geek
+1 received by user: 423

#2508537 20-Jun-2020 01:23

cyril7:

Hi, do you really need TR069, if it is required I would be looking at locking it down to 2D's mgmnt servers

Cyril

TR-069 on a FritzBox is safe. The protocol will only connect to its known management server. You can send the FritzBox a packet to ask it to phone home, and it will, but you can not tell it to connect to a different server. To change the server, the original server needs to be running and send a new config over TR-069 to the FritzBox telling it to connect to the new server. The connections are authenticated, so I believe even a man in the middle crack will not work. So the worst that can happen is that an attacker can keep telling the FritzBox to phone home all the time.

fe31nz

1294 posts

Uber Geek
+1 received by user: 423

#2508538 20-Jun-2020 01:35

sbiddle:

Port forwarding for VoIP also introduces huge security risks so should never be done unless you've got proper firewall rules or a SBC protecting the connection.

VOIP in FritzBoxes as set up by 2Degrees is secure. They did have a problem or two in the early days of Snap running VOIP, where FritzBoxes got hijacked and used by hackers including 0900 calls. But the config they use now is not vulnerable. Which is not to say that the occasional hacker does not try, but it does not work.

It is a long time since I set up my FritzBox behind my other routers, but my recollection is that you do need to forward the RTP/RTCP UDP ports, otherwise the first few packets incoming are lost as the outgoing packets are not sent in time to open the incoming UDP ports. And for the SIP port, unless the UDP port timeout of your main router (where it closes unused UDP ports) is higher than the time between keepalive SIP packets, then you also need that port open.