Where is the Telecom Optical Mode firewall set up? Port mapping, UPnP, and DMZ are configured but still cannot be connected. Check this switch first.

Last month, I helped my cousin access the Synology NAS from the Internet. The port mapping on the router was neatly filled in. When I tested the mobile phone traffic, it still showed "connection timeout". He was so angry that he wanted to restore factory settings. I asked him not to touch the router yet, and go to the backend of optical modem to browse the firewall page, lower the level from "high" to "low", save it, and test again. The port is open. This step took us both most of the afternoon.

I later tested this on Huawei HS8145V5 and ZTE F7015T. The menu names are not exactly the same, but the logic is the same.: The optical modem firewall stands on the outside, with port mapping, UPnP, and DMZ all lined up behind it. If the door in the front does not open, it will be useless to open more small doors in the back.

Let’s first explain where the firewall is blocking

When the optical modem dials up at home, the public IP is in the hands of the optical modem. External requests go to the optical modem first, and then decide whether to send them to the router, NAS, and camera behind. This "go through it first" level is the optical modem Firewall. It's usually a good thing. It blocks the scanner when it scans your home. ； But if you take the initiative to connect from the outside, it may also block normal requests.

Many people only remember to enable port mapping in the router and forget about the optical modem layer. The background of the router shows "Effective", which does not mean that the public network can really call in, because the router's own WAN port may be 192.168.2.x For this kind of intranet address, the real door lies with optical modem. So as long as the optical modem is dialing, the firewall has to look at the mapping together.

How to tell whether optical modem is dialing? I was there before 192.168.2.1 Is it an optical modem or a router? I’ve already discussed it before, so I won’t repeat it here. Simply put, the router WAN port IP is 192.168.2.x , basically just optical modem dialing.

My cousin checked both ends at that time, and the port forwarding status in the router was clearly written, but the WAN port of the optical modem was the public network address. It's equivalent to the community guard letting you go, but the unit door is still locked. In optical modem routing mode, mapping is best done on the optical modem layer. ； After the optical modem changed to bridging, the firewall was handed over to the router along with the dialing rights, and the port functions in the optical modem background became a decoration.

So don’t be reassured when you see the words “Effective”, that’s just the router’s own record. The link is open link by link. If any link is stuck, the outside will not be able to get in.

Huawei HS8145V5: path and three stalls

I have one of this cats, the path is to enter the browser 192.168.2.1 , enter the useradmin sticker account, click "Advanced Settings", look for "Security" on the left, and there will be "Firewall". Different firmwares will write "security" as "security settings", but it is generally not wrong to look for these two words.

After entering, there are mainly three stalls. The default setting is "High". At this time, all unfamiliar connections to the outside are basically blocked, and remote access is often blocked. To test port mapping, NAS external network, and monitoring playback, select "Low" first. It will allow common services and the exposure will be acceptable. I advise you not to save trouble by clicking the "Turn off" button at the bottom. It means that all the equipment behind the Mouse will be directly connected to the public network. My cousin wanted to turn it off directly at that time, but I stopped him.

Remember to click Save after making changes. Some firmwares will interrupt dialing or restart the firewall module after saving. Wait for more than ten seconds before testing again. Don’t rush to swipe your phone as soon as you click save, the cat hasn’t reacted yet.

ZTE F7015T: Look for the word "safety"

I adjusted the ZTE one at a friend's house, and the menu is more convoluted than Huawei's. Log in 192.168.2.1 Finally, some firmwares have "Firewall" directly under "Security", and some are hidden in "Applications" or "Advanced Settings" and may be called "Firewall", "Anti-Attack" or "Filtering Rules". You don't need to memorize the entire path. After entering the backend, look for the menus with the words "Security" and "Firewall" one by one. The most similar one is the one.

Some versions from ZTE only have two levels: "on" and "off", with no intermediate state between high and low. In this case, don't rush to turn it off. You can first check whether the mapping on the router side has taken effect. If it is necessary, temporarily turn off the test, and turn it back on immediately after the test. If the firmware in your hand is too old and you can’t even find it in the firewall menu, first go to “Management” to see if there is a firmware upgrade. I did this step before. How to upgrade telecom optical modem firmware Wrote in.

Another point is that some ZTE cats put the firewall switch in a place where only super administrators can see it. When ordinary useradmins enter, it is grayed out. At this time, don’t worry about super-density for the firewall. I spent two hours on a machine in vain, and finally found that the port mapping was filled in wrongly.

How to cooperate with port mapping, UPnP and DMZ

All three functions are behind the firewall, but they open the door differently. Port mapping is to release a certain port by name. The rules are the most rigid and safest. ； UPnP allows the device to apply for a port by itself, which saves trouble but sometimes cannot be applied for. ； DMZ is the most dangerous thing to throw out a piece of equipment. If the firewall level on Optical Modem is too high, all three will fail together because the traffic will be blocked before their turn.

So don’t mess up the order of checking.: First confirm that the public IP is real, then check the firewall, and finally look at the mapping rules one by one. My cousin filled in the rules correctly this time and got stuck in the firewall. On the other hand, some people turn off the firewall and still can't connect. That's a problem on another level. For example, what is the public IP address? 100.64 The intranet address at the beginning. This situation has nothing to do with the firewall. I am How to check whether Telecom Broadband has a public IP Li said.

My own habit is to open one on my computer first python -m http.server 8080 Temporary web page, mobile phone traffic 公网IP:8080 . You can tell at a glance whether it's correct or not, and you don't have to wait for the software on the NAS to report an error. This method is cleaner than trying a real service. At least it can first separate the "link failure" and "the service does not start on its own".

The two pitfalls I stepped on

The first pitfall is to use your home WiFi to test the public network. NAT backflow is enabled on the router, and the public network address can be accessed on the intranet. It seems to be successful. However, when I go out and test the traffic, it still doesn't work. When testing remote access, you must turn off your mobile phone's WiFi and use data traffic. Don't lie to yourself.

The second pitfall is to only turn off the modem firewall and not check the router firewall. Some routers also have a set of SPI or DoS protection of their own. If some old machines turn on the "DoS protection" too hard, they will block high-frequency reconnections as attacks. These two layers of firewalls are responsible for their own affairs, and the world cannot be peaceful just by shutting down the firewall.

I summarize the sequence into one sentence:

Also, don’t confuse “firewall” with “Internet time control”. Some optical modem security pages have a row of functions, including parental control, MAC filtering, and firewall. If you want remote access, just touch the firewall and don't touch anything else, otherwise your TV may even go offline.

• To test mobile phone traffic, first prove that the external network is connected to your door.
• Look at the WAN port IP, and resolve the public IP first for the internal network address.
• Reduce the optical modem Firewall to "Low" and then retest.
• If it still doesn’t work, it’s time to check the router’s firewall and mapping rules.

ending: Don’t let your device run naked all the time

Firewall downgrade is for troubleshooting, not a long-term state. After the test is successful, my habit is to change the port mapping if I can, and then restore the firewall to the default setting. If you really want to use remote desktop and monitor playback for a long time, you must also give the device a strong password and apply full system patches. Don't expect the optical modem firewall to protect your whole family with just a switch.

Finally, follow this order and there will be basically no confusion.:

The switch on this page is not big, but the jammer is pretty tough. The next time the port mapping fails, don't restart the router yet. Go to the optical modem security page and take a look. It might save you an afternoon.