ubuntuusers.de

Installation ist ein Ubuntu 24.04. Dieser soll als DNS,DHCP und Gateway fungieren. Läuft auch alles soweit, nur die Firewall - eingerichtet mit firewall-cmd lässt keine Pakete durch. Es komm beim ping - icmp "Paket filtered" es geht auch sonst nix durch. ip_forward in der /etc/sysctl.conf ist an und firewall-cmd --add-masquerade --permanent ist auch gemacht.

Das gleiche mit einem 20.0 - focal fossa funktioniert tadellos. Hab ich mal upgedatet auf jammy - dann filtert es auch.

kann da wer was zu sagen, bzw das Problem lösen... Bitte

Moin, ich kenne das Script nicht was du da nutzt, was macht das denn?

Ich habe mir das letzte mal wo ich eine Firewall unter Linux eingerichtet habe alles selber konfiguriert (von Hand ohne fremde Script)

das "script" ist firewalld

ok, in deinem ersten Beitrag hast du was von „firewall-cmd“ geschrieben deshalb hatte ich es so verstanden. Was genau nutzt du denn nftables oder iptabels. Poste doch mal deine Firewall config als Code-block

der firewalld greift auf nftables zurück, bzw macht das damit irgendwie... Wie krieg ich denn raus, was es bei nftables an einstellungen gibt.. ? Du hast bei Dir "proxmox" stehen - das ganze Läuft In einem proxmox container.

Aber wie geschrieben. mit focal fossa funktioniert es tadellos

mit Debian 12.7 funktioniert es auch nicht. Ich hab schon alles durch

Grad habe ich mal was ausprobiert. Ich kann den Server auf seiner internen Adresse anpingen, und die IP vom "DMZ" Netzwerk Die FritzBox dahinter nicht mehr. und auch alles andere in dem Netz nicht.

Ich bin gerade nur am Handy. Du musst doch wissen wie du wo was konfigutihast. Schau in deine config Datei

ipv6 hab ich komplett deaktviert

nft list ruleset
table inet firewalld {
	ct helper helper-ftp-tcp {
		type "ftp" protocol tcp
		l3proto inet
	}

	ct helper helper-netbios-ns-udp {
		type "netbios-ns" protocol udp
		l3proto ip
	}

	chain mangle_PREROUTING {
		type filter hook prerouting priority mangle + 10; policy accept;
		jump mangle_PREROUTING_POLICIES
	}

	chain mangle_PREROUTING_POLICIES {
		iifname "ens19" jump mangle_PRE_policy_allow-host-ipv6
		iifname "ens19" jump mangle_PRE_external
		iifname "ens19" return
		iifname "ens18" jump mangle_PRE_policy_allow-host-ipv6
		iifname "ens18" jump mangle_PRE_internal
		iifname "ens18" return
		jump mangle_PRE_policy_allow-host-ipv6
		jump mangle_PRE_public
		return
	}

	chain nat_PREROUTING {
		type nat hook prerouting priority dstnat + 10; policy accept;
		jump nat_PREROUTING_POLICIES
	}

	chain nat_PREROUTING_POLICIES {
		iifname "ens19" jump nat_PRE_policy_allow-host-ipv6
		iifname "ens19" jump nat_PRE_external
		iifname "ens19" return
		iifname "ens18" jump nat_PRE_policy_allow-host-ipv6
		iifname "ens18" jump nat_PRE_internal
		iifname "ens18" return
		jump nat_PRE_policy_allow-host-ipv6
		jump nat_PRE_public
		return
	}

	chain nat_POSTROUTING {
		type nat hook postrouting priority srcnat + 10; policy accept;
		jump nat_POSTROUTING_POLICIES
	}

	chain nat_POSTROUTING_POLICIES {
		iifname "ens19" oifname "ens19" jump nat_POST_external
		iifname "ens19" oifname "ens19" return
		iifname "ens18" oifname "ens19" jump nat_POST_external
		iifname "ens18" oifname "ens19" return
		oifname "ens19" jump nat_POST_external
		oifname "ens19" return
		iifname "ens19" oifname "ens18" jump nat_POST_internal
		iifname "ens19" oifname "ens18" return
		iifname "ens18" oifname "ens18" jump nat_POST_internal
		iifname "ens18" oifname "ens18" return
		oifname "ens18" jump nat_POST_internal
		oifname "ens18" return
		iifname "ens19" jump nat_POST_public
		iifname "ens19" return
		iifname "ens18" jump nat_POST_public
		iifname "ens18" return
		jump nat_POST_public
		return
	}

	chain nat_OUTPUT {
		type nat hook output priority dstnat + 10; policy accept;
		jump nat_OUTPUT_POLICIES
	}

	chain nat_OUTPUT_POLICIES {
		oifname "ens19" jump nat_OUT_external
		oifname "ens19" return
		oifname "ens18" jump nat_OUT_internal
		oifname "ens18" return
		jump nat_OUT_public
		return
	}

	chain filter_PREROUTING {
		type filter hook prerouting priority filter + 10; policy accept;
		icmpv6 type { nd-router-advert, nd-neighbor-solicit } accept
		meta nfproto ipv6 fib saddr . mark . iif oif missing drop
	}

	chain filter_INPUT {
		type filter hook input priority filter + 10; policy accept;
		ct state { established, related } accept
		ct status dnat accept
		iifname "lo" accept
		ct state invalid drop
		jump filter_INPUT_POLICIES
		reject with icmpx admin-prohibited
	}

	chain filter_FORWARD {
		type filter hook forward priority filter + 10; policy accept;
		ct state { established, related } accept
		ct status dnat accept
		iifname "lo" accept
		ct state invalid drop
		ip6 daddr { ::/96, ::ffff:0.0.0.0/96, 2002::/24, 2002:a00::/24, 2002:7f00::/24, 2002:a9fe::/32, 2002:ac10::/28, 2002:c0a8::/32, 2002:e000::/19 } reject with icmpv6 addr-unreachable
		jump filter_FORWARD_POLICIES
		reject with icmpx admin-prohibited
	}

	chain filter_OUTPUT {
		type filter hook output priority filter + 10; policy accept;
		ct state { established, related } accept
		oifname "lo" accept
		ip6 daddr { ::/96, ::ffff:0.0.0.0/96, 2002::/24, 2002:a00::/24, 2002:7f00::/24, 2002:a9fe::/32, 2002:ac10::/28, 2002:c0a8::/32, 2002:e000::/19 } reject with icmpv6 addr-unreachable
		jump filter_OUTPUT_POLICIES
	}

	chain filter_INPUT_POLICIES {
		iifname "ens19" jump filter_IN_policy_allow-host-ipv6
		iifname "ens19" jump filter_IN_external
		iifname "ens19" reject with icmpx admin-prohibited
		iifname "ens18" jump filter_IN_policy_allow-host-ipv6
		iifname "ens18" jump filter_IN_internal
		iifname "ens18" reject with icmpx admin-prohibited
		jump filter_IN_policy_allow-host-ipv6
		jump filter_IN_public
		reject with icmpx admin-prohibited
	}

	chain filter_FORWARD_POLICIES {
		iifname "ens19" oifname "ens19" jump filter_FWD_external
		iifname "ens19" oifname "ens19" reject with icmpx admin-prohibited
		iifname "ens19" oifname "ens18" jump filter_FWD_external
		iifname "ens19" oifname "ens18" reject with icmpx admin-prohibited
		iifname "ens19" jump filter_FWD_external
		iifname "ens19" reject with icmpx admin-prohibited
		iifname "ens18" oifname "ens19" jump filter_FWD_internal
		iifname "ens18" oifname "ens19" reject with icmpx admin-prohibited
		iifname "ens18" oifname "ens18" jump filter_FWD_internal
		iifname "ens18" oifname "ens18" reject with icmpx admin-prohibited
		iifname "ens18" jump filter_FWD_internal
		iifname "ens18" reject with icmpx admin-prohibited
		oifname "ens19" jump filter_FWD_public
		oifname "ens19" reject with icmpx admin-prohibited
		oifname "ens18" jump filter_FWD_public
		oifname "ens18" reject with icmpx admin-prohibited
		jump filter_FWD_public
		reject with icmpx admin-prohibited
	}

	chain filter_OUTPUT_POLICIES {
		oifname "ens19" jump filter_OUT_external
		oifname "ens19" return
		oifname "ens18" jump filter_OUT_internal
		oifname "ens18" return
		jump filter_OUT_public
		return
	}

	chain filter_IN_public {
		jump filter_IN_public_pre
		jump filter_IN_public_log
		jump filter_IN_public_deny
		jump filter_IN_public_allow
		jump filter_IN_public_post
		meta l4proto { icmp, ipv6-icmp } accept
	}

	chain filter_IN_public_pre {
	}

	chain filter_IN_public_log {
	}

	chain filter_IN_public_deny {
	}

	chain filter_IN_public_allow {
		tcp dport 22 accept
		tcp dport 21 ct helper set "helper-ftp-tcp"
		tcp dport 21 accept
		tcp dport 10000-10100 accept
		tcp dport 2222 accept
		tcp dport 49152-65535 accept
		tcp dport 20000 accept
	}

	chain filter_IN_public_post {
	}

	chain filter_OUT_public {
		jump filter_OUT_public_pre
		jump filter_OUT_public_log
		jump filter_OUT_public_deny
		jump filter_OUT_public_allow
		jump filter_OUT_public_post
	}

	chain filter_OUT_public_pre {
	}

	chain filter_OUT_public_log {
	}

	chain filter_OUT_public_deny {
	}

	chain filter_OUT_public_allow {
	}

	chain filter_OUT_public_post {
	}

	chain nat_OUT_public {
		jump nat_OUT_public_pre
		jump nat_OUT_public_log
		jump nat_OUT_public_deny
		jump nat_OUT_public_allow
		jump nat_OUT_public_post
	}

	chain nat_OUT_public_pre {
	}

	chain nat_OUT_public_log {
	}

	chain nat_OUT_public_deny {
	}

	chain nat_OUT_public_allow {
	}

	chain nat_OUT_public_post {
	}

	chain nat_POST_public {
		jump nat_POST_public_pre
		jump nat_POST_public_log
		jump nat_POST_public_deny
		jump nat_POST_public_allow
		jump nat_POST_public_post
	}

	chain nat_POST_public_pre {
	}

	chain nat_POST_public_log {
	}

	chain nat_POST_public_deny {
	}

	chain nat_POST_public_allow {
		meta nfproto ipv4 oifname != "lo" masquerade
	}

	chain nat_POST_public_post {
	}

	chain filter_FWD_public {
		jump filter_FWD_public_pre
		jump filter_FWD_public_log
		jump filter_FWD_public_deny
		jump filter_FWD_public_allow
		jump filter_FWD_public_post
	}

	chain filter_FWD_public_pre {
	}

	chain filter_FWD_public_log {
	}

	chain filter_FWD_public_deny {
	}

	chain filter_FWD_public_allow {
	}

	chain filter_FWD_public_post {
	}

	chain nat_PRE_public {
		jump nat_PRE_public_pre
		jump nat_PRE_public_log
		jump nat_PRE_public_deny
		jump nat_PRE_public_allow
		jump nat_PRE_public_post
	}

	chain nat_PRE_public_pre {
	}

	chain nat_PRE_public_log {
	}

	chain nat_PRE_public_deny {
	}

	chain nat_PRE_public_allow {
	}

	chain nat_PRE_public_post {
	}

	chain mangle_PRE_public {
		jump mangle_PRE_public_pre
		jump mangle_PRE_public_log
		jump mangle_PRE_public_deny
		jump mangle_PRE_public_allow
		jump mangle_PRE_public_post
	}

	chain mangle_PRE_public_pre {
	}

	chain mangle_PRE_public_log {
	}

	chain mangle_PRE_public_deny {
	}

	chain mangle_PRE_public_allow {
	}

	chain mangle_PRE_public_post {
	}

	chain filter_IN_external {
		jump filter_IN_external_pre
		jump filter_IN_external_log
		jump filter_IN_external_deny
		jump filter_IN_external_allow
		jump filter_IN_external_post
		meta l4proto { icmp, ipv6-icmp } accept
	}

	chain filter_IN_external_pre {
	}

	chain filter_IN_external_log {
	}

	chain filter_IN_external_deny {
	}

	chain filter_IN_external_allow {
		tcp dport 22 accept
		tcp dport 25 accept
		tcp dport 465 accept
		tcp dport 587 accept
		tcp dport 110 accept
		tcp dport 995 accept
		tcp dport 143 accept
		tcp dport 993 accept
		tcp dport 80 accept
		tcp dport 443 accept
		tcp dport 20 accept
		tcp dport 20000 accept
		tcp dport 49152-65535 accept
	}

	chain filter_IN_external_post {
	}

	chain filter_OUT_external {
		jump filter_OUT_external_pre
		jump filter_OUT_external_log
		jump filter_OUT_external_deny
		jump filter_OUT_external_allow
		jump filter_OUT_external_post
	}

	chain filter_OUT_external_pre {
	}

	chain filter_OUT_external_log {
	}

	chain filter_OUT_external_deny {
	}

	chain filter_OUT_external_allow {
	}

	chain filter_OUT_external_post {
	}

	chain nat_OUT_external {
		jump nat_OUT_external_pre
		jump nat_OUT_external_log
		jump nat_OUT_external_deny
		jump nat_OUT_external_allow
		jump nat_OUT_external_post
	}

	chain nat_OUT_external_pre {
	}

	chain nat_OUT_external_log {
	}

	chain nat_OUT_external_deny {
	}

	chain nat_OUT_external_allow {
	}

	chain nat_OUT_external_post {
	}

	chain nat_POST_external {
		jump nat_POST_external_pre
		jump nat_POST_external_log
		jump nat_POST_external_deny
		jump nat_POST_external_allow
		jump nat_POST_external_post
	}

	chain nat_POST_external_pre {
	}

	chain nat_POST_external_log {
	}

	chain nat_POST_external_deny {
	}

	chain nat_POST_external_allow {
		meta nfproto ipv4 oifname != "lo" masquerade
	}

	chain nat_POST_external_post {
	}

	chain filter_FWD_external {
		jump filter_FWD_external_pre
		jump filter_FWD_external_log
		jump filter_FWD_external_deny
		jump filter_FWD_external_allow
		jump filter_FWD_external_post
	}

	chain filter_FWD_external_pre {
	}

	chain filter_FWD_external_log {
	}

	chain filter_FWD_external_deny {
	}

	chain filter_FWD_external_allow {
		oifname "ens19" accept
	}

	chain filter_FWD_external_post {
	}

	chain nat_PRE_external {
		jump nat_PRE_external_pre
		jump nat_PRE_external_log
		jump nat_PRE_external_deny
		jump nat_PRE_external_allow
		jump nat_PRE_external_post
	}

	chain nat_PRE_external_pre {
	}

	chain nat_PRE_external_log {
	}

	chain nat_PRE_external_deny {
	}

	chain nat_PRE_external_allow {
	}

	chain nat_PRE_external_post {
	}

	chain mangle_PRE_external {
		jump mangle_PRE_external_pre
		jump mangle_PRE_external_log
		jump mangle_PRE_external_deny
		jump mangle_PRE_external_allow
		jump mangle_PRE_external_post
	}

	chain mangle_PRE_external_pre {
	}

	chain mangle_PRE_external_log {
	}

	chain mangle_PRE_external_deny {
	}

	chain mangle_PRE_external_allow {
	}

	chain mangle_PRE_external_post {
	}

	chain filter_IN_internal {
		jump filter_IN_internal_pre
		jump filter_IN_internal_log
		jump filter_IN_internal_deny
		jump filter_IN_internal_allow
		jump filter_IN_internal_post
		meta l4proto { icmp, ipv6-icmp } accept
	}

	chain filter_IN_internal_pre {
	}

	chain filter_IN_internal_log {
	}

	chain filter_IN_internal_deny {
	}

	chain filter_IN_internal_allow {
		tcp dport 22 accept
		ip daddr 224.0.0.251 udp dport 5353 accept
		ip6 daddr ff02::fb udp dport 5353 accept
		udp dport 137 ct helper set "helper-netbios-ns-udp"
		udp dport 137 accept
		udp dport 138 accept
		ip6 daddr fe80::/64 udp dport 546 accept
		tcp dport 53 accept
		udp dport 53 accept
		tcp dport 139 accept
		tcp dport 445 accept
		tcp dport 88 accept
		udp dport 88 accept
		tcp dport 389 accept
		tcp dport 636 accept
		tcp dport 464 accept
		udp dport 464 accept
		tcp dport 135 accept
		udp dport 389 accept
		tcp dport 49152-65535 accept
		tcp dport 3268 accept
		tcp dport 3269 accept
		tcp dport 10000 accept
	}

	chain filter_IN_internal_post {
	}

	chain filter_OUT_internal {
		jump filter_OUT_internal_pre
		jump filter_OUT_internal_log
		jump filter_OUT_internal_deny
		jump filter_OUT_internal_allow
		jump filter_OUT_internal_post
	}

	chain filter_OUT_internal_pre {
	}

	chain filter_OUT_internal_log {
	}

	chain filter_OUT_internal_deny {
	}

	chain filter_OUT_internal_allow {
	}

	chain filter_OUT_internal_post {
	}

	chain nat_OUT_internal {
		jump nat_OUT_internal_pre
		jump nat_OUT_internal_log
		jump nat_OUT_internal_deny
		jump nat_OUT_internal_allow
		jump nat_OUT_internal_post
	}

	chain nat_OUT_internal_pre {
	}

	chain nat_OUT_internal_log {
	}

	chain nat_OUT_internal_deny {
	}

	chain nat_OUT_internal_allow {
	}

	chain nat_OUT_internal_post {
	}

	chain nat_POST_internal {
		jump nat_POST_internal_pre
		jump nat_POST_internal_log
		jump nat_POST_internal_deny
		jump nat_POST_internal_allow
		jump nat_POST_internal_post
	}

	chain nat_POST_internal_pre {
	}

	chain nat_POST_internal_log {
	}

	chain nat_POST_internal_deny {
	}

	chain nat_POST_internal_allow {
	}

	chain nat_POST_internal_post {
	}

	chain filter_FWD_internal {
		jump filter_FWD_internal_pre
		jump filter_FWD_internal_log
		jump filter_FWD_internal_deny
		jump filter_FWD_internal_allow
		jump filter_FWD_internal_post
	}

	chain filter_FWD_internal_pre {
	}

	chain filter_FWD_internal_log {
	}

	chain filter_FWD_internal_deny {
	}

	chain filter_FWD_internal_allow {
		oifname "ens18" accept
	}

	chain filter_FWD_internal_post {
	}

	chain nat_PRE_internal {
		jump nat_PRE_internal_pre
		jump nat_PRE_internal_log
		jump nat_PRE_internal_deny
		jump nat_PRE_internal_allow
		jump nat_PRE_internal_post
	}

	chain nat_PRE_internal_pre {
	}

	chain nat_PRE_internal_log {
	}

	chain nat_PRE_internal_deny {
	}

	chain nat_PRE_internal_allow {
	}

	chain nat_PRE_internal_post {
	}

	chain mangle_PRE_internal {
		jump mangle_PRE_internal_pre
		jump mangle_PRE_internal_log
		jump mangle_PRE_internal_deny
		jump mangle_PRE_internal_allow
		jump mangle_PRE_internal_post
	}

	chain mangle_PRE_internal_pre {
	}

	chain mangle_PRE_internal_log {
	}

	chain mangle_PRE_internal_deny {
	}

	chain mangle_PRE_internal_allow {
	}

	chain mangle_PRE_internal_post {
	}

	chain filter_IN_policy_allow-host-ipv6 {
		jump filter_IN_policy_allow-host-ipv6_pre
		jump filter_IN_policy_allow-host-ipv6_log
		jump filter_IN_policy_allow-host-ipv6_deny
		jump filter_IN_policy_allow-host-ipv6_allow
		jump filter_IN_policy_allow-host-ipv6_post
	}

	chain filter_IN_policy_allow-host-ipv6_pre {
	}

	chain filter_IN_policy_allow-host-ipv6_log {
	}

	chain filter_IN_policy_allow-host-ipv6_deny {
	}

	chain filter_IN_policy_allow-host-ipv6_allow {
		icmpv6 type nd-neighbor-advert accept
		icmpv6 type nd-neighbor-solicit accept
		icmpv6 type nd-router-advert accept
		icmpv6 type nd-redirect accept
	}

	chain filter_IN_policy_allow-host-ipv6_post {
	}

	chain nat_PRE_policy_allow-host-ipv6 {
		jump nat_PRE_policy_allow-host-ipv6_pre
		jump nat_PRE_policy_allow-host-ipv6_log
		jump nat_PRE_policy_allow-host-ipv6_deny
		jump nat_PRE_policy_allow-host-ipv6_allow
		jump nat_PRE_policy_allow-host-ipv6_post
	}

	chain nat_PRE_policy_allow-host-ipv6_pre {
	}

	chain nat_PRE_policy_allow-host-ipv6_log {
	}

	chain nat_PRE_policy_allow-host-ipv6_deny {
	}

	chain nat_PRE_policy_allow-host-ipv6_allow {
	}

	chain nat_PRE_policy_allow-host-ipv6_post {
	}

	chain mangle_PRE_policy_allow-host-ipv6 {
		jump mangle_PRE_policy_allow-host-ipv6_pre
		jump mangle_PRE_policy_allow-host-ipv6_log
		jump mangle_PRE_policy_allow-host-ipv6_deny
		jump mangle_PRE_policy_allow-host-ipv6_allow
		jump mangle_PRE_policy_allow-host-ipv6_post
	}

	chain mangle_PRE_policy_allow-host-ipv6_pre {
	}

	chain mangle_PRE_policy_allow-host-ipv6_log {
	}

	chain mangle_PRE_policy_allow-host-ipv6_deny {
	}

	chain mangle_PRE_policy_allow-host-ipv6_allow {
	}

	chain mangle_PRE_policy_allow-host-ipv6_post {
	}
}

im Anhang ist das ruleset was der firewalld geschrieben hat. ens18 ist die interne esn19 die "externe" die als exposed Host von de Fritzbox bedient wird

Und jetzt nochmal lesbar formatiert in einem Codeblock.

Und Anhänge bitte immer mit Dateiendung hochladen. → Forum/Syntax (Abschnitt „Bilder“)

Hier nochmal die nftables rules . als Anhang mit richtigem Namen ens18 ist die interne , ens19 die externe Schnittstelle

Was ich an deiner Schilderung NICHT verstehe, du schreibst

ens18 ist die interne , ens19 die externe

Ich entsinne mich das du, was von einer Fritzbox geschrieben hast, wie genau soll das gehen.

Bitte mal einen Grafischen Netzwerkplan, damit man deinen Aufbau besser verstehen kann. Und was genau stellst du den bereit im Internet, ich hatte viele Ports gesehen die erreichbar sein sollen

Anbei der "Versuchsaufbau" was ich nicht verstehe, das man die 192.168.1.11 von intern anpingen kann. Bei der 192.168.1.1 oder anderen IPs in dem Netztwerk geht auch nicht

Die Fritzbox schickt alles was von aussen kommt an die 192.168.1.11 weiter. Da laufen mailserver, apache, ftp

und - mit focal fossa funktioniert es: wobei der iptables benutzt.

auch ein umstellen auf dem Gateway auf iptables brachte keine Besserung.

In deinem Netzwerkplan sehe ich nicht woher das 10.10.1.1 kommt. Setzt du den 10.10.1.1 als Router ein und warum setzt du dann noch eine Fritzbox ein? Ich habe es so bei mir am laufen:

                                            ┌──────────────────────────┐
                                            │                          │
                                            │  WAN / Internet (PPPoE)  │
                                            │        Willy.tel         │
                                            │ 1000/250Mbit/s Glasfaser │
                                            │                          │
                                            └─────────────┬────────────┘
─ ─ ─ ─ ─ ─ ─ ─WAN─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ┼ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ WAN ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─
                                                          │
 ┌────────────────┐   ┌────────────────┐    ╔═════════════╩═════════ pfSense+ ════════╗
 │                │   │     Switch     │    ║                             Netgate 6100║    Stand: ─ ─ ┐
 │    TrueNAS     ├───┤  USW-Flex-XG   ├────╣                      LAN: 192.168.3.0/24║  │
 │                │   │                │    ║   Gäste (W)LAN (VLAN33): 192.168.33.0/24║    07.09.2024 │
 └────────────────┘   └───┬────┬───────┘    ║       IoT WLAN (VLAN34): 192.168.34.0/24║  │
 ┌────────────────┐       │    │            ║  DynDNS über deSEC.io mit eigener Domain║   ─ ─ ─ ─ ─ ─ ┘
 │      UBNT      │       │    │            ║                                   VPN's:║
 │UniFI AP AC Pro ├───────┘    │            ║                 1 x Fritzbox 7490) IPSec║
 │                │            │            ║             1 x S2S WireGuard Fritz 6591║
 └────────────────┘            │            ║     1 x pfSense S2S (Netgate 6100) IPSec║
                               │            ║             1 x OpenVPN Road Warrior DCO║
                               │            ║                          (172.16.3.0/24)║
                               │            ║               1 x WireGuard Road Warrior║
                               │            ║                         (172.16.33.0/24)║
                               │            ║                                         ║
                               │            ╚═════════════════════════════════════════╝
                               │
 ┌────────────────┐   ┌────────┴───────┐ ┌────────────────────┐ ┌────────────────┐
 │ Fritzbox 7490  │   │     Switch     │ │        UBNT        │ │    1 x UBNT    │
 │    IPClient    ├───┤  USW-Flex-XG   ├─┤USW-ENTERPRISE-8-POE├─┤UniFi AP-Flex-HD│
 │   (Nur VoIP)   │   │                │ │                    │ │                │
 └────────────────┘   └────┬───────────┘ └──────┬─────────────┘ └────────────────┘
 ┌────────────────┐        │                    │    ┌───────────┐
 │      UBNT      │        │                    │    │           │
 │UniFI AP AC Pro ├────────┘                    └────┤  Clients  │
 │                │                                  │           │
 └────────────────┘                                  └───────────┘

als Router/Firewall setze ich eine pfSense ein die bei mir direkt am GLAS hängt. Bitte mehr Informationen zu deinem Aufbau

Warum brauchst du ftp, ich persönlich und auch in der Firma setzen kein ftp mehr ein sondern sftp

die 10.10.1.1 ist die interne IP vom Gateway über die die Clients die Verbindung nach draussen machen. Wenn es denn funktionieren würde. Die Fritzbox schickt halt alles was von draussen kommt an den 192.168.1.11. Der kümmert sich dann um die einzelnen services. Im Prinzip wie bei Dir was die pfsense macht. Aber das ist ja nicht mein Problem.