Only now I have taken the time to investigate how I can use voip_forwardrules to enable remote access.
Somehow I couldn't get it working.
It was also suspicious that port 5060 wasn't working either.
It now turns out that the firewall disables these rules when no voip is enabled.
Is there a workaround for this?
I would like to use that a firewall when there's no VoIP in use.
Or am I making it too difficult for myself and is there no need to use "voip_forwardrules" and can I use this same procedure with "internet_forwardrules" ???
I understand that I first need to enable remote access on the fritzbox and create a user that has remote access.
That's not a problem as I need to do that anyhow.
If there are no further downsides to using "internet_forwardrules" this way I will follow that route and adapt my provisioning script.
Here's the script I'm using to make my life a bit easier when I provision a new Fritzbox. The script survives a factory reset, which is a requirement for my use-case.
cat /etc/init.d/S90-provision
Somehow I couldn't get it working.
It was also suspicious that port 5060 wasn't working either.
It now turns out that the firewall disables these rules when no voip is enabled.
Is there a workaround for this?
I would like to use that a firewall when there's no VoIP in use.
Or am I making it too difficult for myself and is there no need to use "voip_forwardrules" and can I use this same procedure with "internet_forwardrules" ???
I understand that I first need to enable remote access on the fritzbox and create a user that has remote access.
That's not a problem as I need to do that anyhow.
If there are no further downsides to using "internet_forwardrules" this way I will follow that route and adapt my provisioning script.
Here's the script I'm using to make my life a bit easier when I provision a new Fritzbox. The script survives a factory reset, which is a requirement for my use-case.
cat /etc/init.d/S90-provision
Code:
#!/bin/sh
REBOOT_REQUIRED=
FREETZ_INTERFACE=81818
SSH_REMOTE=52222
ZABBIX_SERVER=zabbix.yourowndomain.net
THIS_SCRIPT=/etc/init.d/S90-provision
LOG="/var/tmp/flash/${THIS_SCRIPT##*/}.log"
PUBLIC_KEYS=''
FORWARDS=" internet_forwardrules = \"tcp 0.0.0.0:${FREETZ_INTERFACE} 0.0.0.0:${FREETZ_INTERFACE} 0 # Freetz\",
\"tcp 0.0.0.0:${SSH_REMOTE} 0.0.0.0:22 0 # SSH\",
\"tcp 0.0.0.0:10050 0.0.0.0:10050 0 # Zabbix\","
FORWARD_TAIL="`echo "${FORWARDS}" | tail -n1 | sed 's/^ *//g'`"
[ `grep -c . ${LOG}` -gt 60 ] && tail -n40 ${LOG} >${LOG}
date >>${LOG}
echo "Start custom initialization running ${THIS_SCRIPT} ($0)" >>${LOG}
echo "Config version: ${CONFIG_VERSION}" >>${LOG}
CONFIG=/var/tmp/flash/authorized_keys_root/authorized_keys
# Add public keys if none are there
if [ ! -s ${CONFIG} ] ; then
if [ -n "${PUBLIC_KEYS}" ] ; then
mkdir /var/tmp/flash/authorized_keys_root
echo "${PUBLIC_KEYS}" | egrep -v '^ *($|#)' >${CONFIG}
REBOOT_REQUIRED=true
echo "add public keys to ${CONFIG}" >>${LOG}
fi
fi
CONFIG=/var/mod/etc/conf/dropbear.cfg
# Enable SSH
if grep -q "^export DROPBEAR_ENABLED='no'" ${CONFIG} ; then
sed -i "s/^export DROPBEAR_ENABLED=.*/export DROPBEAR_ENABLED=\'yes\'/g" ${CONFIG}
REBOOT_REQUIRED=true
echo "enable dropbear, change ${CONFIG}" >>${LOG}
fi
CONFIG=/var/mod/etc/conf/zabbix_agentd.cfg
# Change Zabbix server
if grep -q "^export ZABBIX_AGENTD_SERVER='zabbix.example.com.'" ${CONFIG} ; then
sed -i "s/^export ZABBIX_AGENTD_SERVER=.*/export ZABBIX_AGENTD_SERVER=\'${ZABBIX_SERVER}\'/g" ${CONFIG}
sed -i "s/^export ZABBIX_AGENTD_ENABLED=.*/export ZABBIX_AGENTD_ENABLED=\'yes\'/g" ${CONFIG}
# REBOOT_REQUIRED=true
echo "change ${CONFIG}" >>${LOG}
fi
CONFIG=/var/mod/etc/conf/mod.cfg
# Change Freetz interface to other port
if ! grep -q "^export MOD_HTTPD_PORT='${FREETZ_INTERFACE}'" ${CONFIG} ; then
sed -i "s/^export MOD_HTTPD_PORT=.*/export MOD_HTTPD_PORT=\'${FREETZ_INTERFACE}\'/g" ${CONFIG}
REBOOT_REQUIRED=true
echo "change MOD_HTTPD_PORT in ${CONFIG}" >>${LOG}
fi
# Make sure cron is turned on
if grep -q "^export MOD_CROND='no'" ${CONFIG} ; then
sed -i "s/^export MOD_CROND=.*/export MOD_CROND=\'yes\'/g" ${CONFIG}
REBOOT_REQUIRED=true
echo "change MOD_CROND in ${CONFIG}" >>${LOG}
fi
CONFIG=/var/tmp/flash/mod/crontab
# Add myself to crontab
if ! grep -q "${THIS_SCRIPT}" ${CONFIG} ; then
echo "0 5 * * * ${THIS_SCRIPT}" >>${CONFIG}
REBOOT_REQUIRED=true
echo "Add ${THIS_SCRIPT} to ${CONFIG}" >>${LOG}
killall -HUP crond
fi
CONFIG=/var/tmp/flash/sudo/sudoers
# Add myself to crontab
if ! grep -q "includedir" ${CONFIG} ; then
mkdir /var/tmp/flash/sudo
echo "## Read drop-in files from /etc/sudoers.d
## (the '#' here does not indicate a comment)
#includedir /etc/sudoers.d" >>${CONFIG}
REBOOT_REQUIRED=true
echo "change ${CONFIG}" >>${LOG}
fi
if ! pcplisten -? 2>/dev/null && echo pcplisten ; then
CONFIG=/var/flash/ar7.cfg
# Execute on old Fritz!box versions (up tu version 6.84)
if grep -q 'internet_forwardrules = \"tcp' ${CONFIG} ; then
if ! grep -A15 internet_forwardrules ${CONFIG} | grep -q "${FORWARD_TAIL}" ; then
ctlmgr -s
# write a modified at7.cfg to /tmp
# all lines before "voip_forwardrules = "
grep -B999999 internet_forwardrules ${CONFIG} | head -n-1 >/tmp/ar7.cfg
# insert custom rules
echo "${FORWARDS}" >>/tmp/ar7.cfg
# restore first "voip_forwardrules = " line without "voip_forwardrules = " itself
grep internet_forwardrules ${CONFIG} | sed 's/internet_forwardrules = / /g' >>/tmp/ar7.cfg
# all lines after "voip_forwardrules = "
grep -A999999 internet_forwardrules ${CONFIG} | tail -n+2 >>/tmp/ar7.cfg
sed -i 's/two_factor_auth_enabled.*/two_factor_auth_enabled = no;/g' /tmp/ar7.cfg
echo "Write internet_forwardrules to ${CONFIG}" >&2
cat /tmp/ar7.cfg >${CONFIG}
REBOOT_REQUIRED=true
echo "change internet_forwardrules in ${CONFIG}" >>${LOG}
fi
fi
else
# This will be executed on newer boxes supporting pcplisten
CONFIG=/var/tmp/flash/iforwards.cfg
# Execute on new Fritz!box versions (up tu version 7.xx)
if [ ! -s ${CONFIG} ] ; then
echo "tcp @ ${FREETZ_INTERFACE} * Freetz
tcp @ 10050 * Zabbix
tcp @ ${SSH_REMOTE} * SSH" >${CONFIG}
modsave flash
REBOOT_REQUIRED=true
echo "change forwardrules in ${CONFIG}" >>${LOG}
fi
CONFIG=/var/tmp/flash/mod/crontab
if ! grep -q iforwards ${CONFIG} ; then
mkdir /var/tmp/flash/mod
REBOOT_REQUIRED=true
echo '*/3 * * * * /bin/ps | grep -q "[i]forwards" || (/sbin/iforwards &)' >>${CONFIG}
echo "add /sbin/iforwards to ${CONFIG}" >>${LOG}
killall -HUP crond
fi
CONFIG=/var/mod/etc/conf/dropbear.cfg
if ! grep -q "DROPBEAR_PORT.*${SSH_REMOTE}" ${CONFIG} ; then
REBOOT_REQUIRED=true
sed -i "s/^export DROPBEAR_PORT=.*/export DROPBEAR_PORT=\'${SSH_REMOTE}\'/g" ${CONFIG}
echo "change SSH port in ${CONFIG}" >>${LOG}
fi
CONFIG=/var/flash/ar7.cfg
if ! grep -q "two_factor_auth_enabled.*no" ${CONFIG} ; then
REBOOT_REQUIRED=true
ctlmgr -s
sed "s/two_factor_auth_enabled.*/two_factor_auth_enabled = no;/g" ${CONFIG} >/tmp/ar7.cfg
cat /tmp/ar7.cfg >${CONFIG}
echo "turn off 2 factor authentication in ${CONFIG}" >>${LOG}
fi
fi
if [ ${REBOOT_REQUIRED} ] ; then
echo "modsave flash && modsave all" | wall
modsave flash && modsave all
ctlmgr # Start ctlmgr so you can access the AVM-webif during provisioning
echo "A reboot will follow in 2 minutes" >>${LOG}
echo "sleep 90
echo \"System reboots in 30 seconds because ${THIS_SCRIPT} made some initial configuration changes\" | wall
sleep 30 && /sbin/reboot" >/tmp/delayed_reboot
sh /tmp/delayed_reboot &
else
pcplisten -? 2>/dev/null && (/sbin/iforwards &)
echo "Nothing has changed" >>${LOG}
fi
echo "End of ${THIS_SCRIPT}" >>${LOG}
Zuletzt bearbeitet:
( Or 24h )
