I have a complex and chaotic issue with accessing my FBx from external. It is different to the one discussed here before and I realized it after changing the scheme with my provider to higher speed and lower cost. Probably the cause is somewhere at my provider and a wrong configuration of my router, not the FBx. All my computers are connecting via WLAN to the router.
But to start with, I want to make sure the FBx network connection is correct especially the assignment of internal/external for the Firewall.
My FBx is a Raspberry 4B, connected via LAN to the router which connects to the internet.
In my FBx the network connections are set by default to :
Aktiv Wired connection 1 Ethernet (eth0, primary, intern)
Aktiv lo loopback
Inaktiv FreedomBox WAN Ethernet (eth0, extern)
In this configuration everything works fine (except the network issues from external) except Privoxy. To have this working I have to activate “FreedomBox WAN”, which is deactivated after every restart. Thus I am wondering if this configuration with or without acive WAN is correct?
Do you have a domain and services connected to that domain?
Some thoughts: I guess, that your config with a WAN and a LAN is not correct. You need to have either a LAN or a WAN connection configured, as much as I know and have learned.
You need a LAN connection from your router (with WLAN) to your FBX.
Or if you need access from outside to your FBX, then you need to configure your router with domain resolution, so he knows, where to route the incoming traffic to.
Another way is to open your router to forward all WAN traffic to your FBX. In this case you need to find a way, how access your FBX from your LAN.
Yes, I do have a domain. DynDNS is configured in the FBx and I think it’s set up correctly. Nevertheless, I will check all these steps again, to be sure.
Maybe the issues have to do with IPv6 as well.
So active LAN is correct if the path goes from the router to the FBx, I understand. Keeping WAN inactive is thus the consequence. That makes sense as this is the default configuration on my FBx.
However, why does Privoxy not work in this configuration?
Today I switched DynDNS on my Freedombox from IPv6 to IPv4. For the time being this allows me to access my box from external. I will continue observing this.
Is there any idea what might be wrong that IPv6 does not allow external access? Still, I think the culprit is my router, but could not find any clue in its settings.
Yes, my DynDNS provider (Strato) supports IPv6.
I found some discussions on the web, that the router has to have special settings to route IPv6 through to the FBx because of the changing IPv6 - I do not have static addressses. Port forwarding, as needed for IPv4 has no effect here. I will study this further.
As a side note, I realized my provider allows for both IPv4 and IPv6. I will put this on the wish list in the bug reports.
Some networks do not support IPv6 and provide no way to access IPv6 hosts. If you only configured DynDNS for IPv6 and you try accessing your freedombox externally from such a network, it cannot work.
Usually, IPv6-only networks provide some way to access IPv4 hosts, so it should work if you only have IPv4 DynDNS configured, but having both IPv4 and IPv6 would be better.
Most often, routers advertise an “IPv6 prefix” and a “preferred lifetime” and machines served by the router add a somehow random suffix to this prefix to make an IPv6 address, then ask neighbours if anyone is already using that address, and if not, use it for the “preferred lifetime” (plus some time).
So, even if the IPv6 prefix is not changed, the IPv6 address may change, and this may be rather frequent (2 hours or less). It may be a good idea to activate DHCPv6 on the router and set a fixed suffix for the freedombox, so that the IPv6 address of the freedombox will only change when the prefix changes.
Also, you need to check whether the router applies firewall rules for IPv6 and if it does, you need to either disable it completely or configure it so that it lets requests for the freedombox (at least, incoming TCP packets for ports 80 and 443) go through.
I checked these hints, IPv6 access is now working until the mandatory re-connection every 24 hours, IF I first enable IPv4 only, have DynDNS do its job and then switch to IPv6.
The next day, a nslookup shows the correct IPv6 address (as in DynDNS of my Freedombox) but the old and thus wrong IPv4 address. Using the correct one (shown in the router) I have access to the Freedombox.
So I think that because I checkmarked “use IPv6 instead of IPv4” in DynDNS the IPv4 address is not updated. Thus, because apparently some devices / software still prefer IPv4 where available, as long as DynDNS does not update BOTH addresses, it is a matter of luck if access works.
I will add this note to my " Proposal: Allow IPv4 AND IPv6 in DynDNS" [ I Challenge Thee ] and wait until this is implemented and keep using IPv4 for time being.
It really looks like the current limitation is that the DynDNS implementation only updates one address family at a time. If IPv6 is correct but the IPv4 record is still stale after the ISP reconnect, many clients will still try the old IPv4 address first and fail. Until dual-stack DynDNS updates are supported, the most reliable workaround is probably to stick with IPv4 or to make sure the A and AAAA records remain synchronised.