DMZ caution notice

In the DMZ, the firewall of the IB is deactivated for the selected device

The devices in the DMZ are, so to speak, directly on the public Internet.

The remaining devices on your LAN are still behind the IBx firewall

@user109

I have another question about port forwarding.

I saw in a YouTube video on the AVM/Fritzbox channel that if port sharing is still set up on the first Fritzbox (in this scenario the IB), which is connected to the Internet, these will take effect first and therefore not access these ports the DMZ (at the FB Exposed Host) is passed on.

I hope you understand my description, otherwise I’ll try another example here, the way the FB would apparently handle it:

FB 192.168.178.1

Device Exposed Host (DMZ) 192.168.178.2

e.g. NAS 192.168.178.3

If I have now forwarded port 5001 to 192.168.178.3 in the Fritzbox and now someone comes from outside with port: 5001, despite the exposed host it does not go to 192.168.178.2 but continues to go to 192.168.178.3.

Is that also the case with the InternetBox?

Greetings Thomas

@Tom459 As far as I know, that’s the case at the IB. To be honest, I’ve never tested it

@Tom459 Port forwarding is always a bad idea, especially if you have no idea about network technology.

This is playing with fire. You don’t tamper with your front door lock to make it easier to open the front door, do you?

---

@5018 wrote:

Why do you need a FritzBox as a second router in the home network? If you don’t know what you’re talking about, you can only do nonsense with it. FritzBoxes should be disposed of. There are better solutions for everything than a second router or a FB in general.

---

Well, you can of course see it that way, but I’ll just turn your statement around without looking purely at Swisscom:

If you know your way around, there is always a better solution for the home network than operating it directly with a Swisscom Internet-Box 🙂

---

@5018 wrote:

Why do you need a FritzBox as a second router in the home network? If you don’t know what you’re talking about, you can only do nonsense with it. FritzBoxes should be disposed of. There are better solutions for everything than a second router or a FB in general.

---

For this post you get one of my popular trolls.

🧌

Can you please explain to us what nonsense you mean? And what does the nonsense specifically have to do with the Fritz boxes?

🫤

@Werner only if you are a Merlin disciple. I don’t like cults, I like facts.

Wow, that’s a lot of answers. 🙂

@“x”#19073I actually never said that I would/would like to use a Fritzbox (I may have expressed myself misleadingly), but I saw this reference on a “Fragfritz” video and was wondering whether that was the case IB is like that too.

I found their approach to how you could build an “IoT network” without VLANs exciting in their latest video.

@[deleted] I was really “just” asking a general question about IB3. I actually know a lot about port forwarding and networks. I even have an NDS degree 🙂

In my application scenario (the circumstances) it would be the case that I don’t have the opportunity to set up an untagged VLan and I admittedly haven’t had enough experience with a tagged one and am “afraid” that I could install something stupid/security-relevant.

@Tom459 No problem. The most adventurous installations are always being developed or suggested by people who then have no idea and that always leads to problems.

I’ve had discussions a few times with my former team about making VLAN support available to the IBs. Because it is implemented and is used, for example, for the guest network or for bonding. But at the moment there is still too much respect for the nonsense that users can do, which then leads to more support. I wouldn’t be so skeptical.

@“x”#19073Thanks for the feedback.

It would be cool if the IB supported Vlan (and ideally more extensive parental controls).

I’m currently running a Synology WRX 560 router with double NAT to test it. The user interface is very simple and the parental control functions are also extensive. Unfortunately, you are limited again when it comes to telephony because mine doesn’t have a Dect.

Every parental control can be bypassed. Especially if they are Mac address based.

@Tom459

Telephony is very simple, it’s best to just leave it on the Internet box.

@5018 That’s true, but at least the hurdle is a little bigger. I’m currently using Adguard in a Docker container on my Synology. In my opinion, Adgurad is a bit easier to use than pihole

@“x”#234740Due to the new arrangement of the devices, the IB is supposed to come from the living room to the basement and I can’t get the Dect signal into the living room. Unfortunately, Swisscom no longer offers LAN/WLAN telephones. I still have 2 Rousseau 300 at home, but I don’t think they’re ideal. I don’t know what the range of the repeater on offer is or whether it can bridge 2 floors.

---

@Tom459 wrote:

…..LAN/WLAN telephones are unfortunately no longer available at Swisscom……

---

You can place a Gigaset GO Dect base in the living room and connect it to the router via LAN.

[https://www.swisscom.ch/de/privatkunden/produkte/festnetztelefone/details.html/gigaset-ip-base-comfort-11060807?useCase=HARDWAREONLY&quantity=1] (https://www.swisscom.ch/de/privatkunden/produkte/festnetztelefone/details.html/gigaset-ip-base-comfort-11060807?useCase=HARDWAREONLY&quantity=1)