Hi,
first, welcome to the IPFire community.
Is the behaviour expected?
Yes. The detection of selectively announced networks also includes targets being hosted on IP ranges not globally routable - in this case, RFC 1918 IPv4 space.
In the logs, you should see messages like these:
Dec 04 14:01:00 squid-asnbl-helper[18208] WARN: Destination '192.168.178.1' resolves to IP addresses '192.168.178.1' without corresponding ASN, probably selectively announced
Dec 04 14:01:00 squid-asnbl-helper[18208] INFO: Denying access to destination '192.168.178.1' due to suspected selective announcements
If so, how do I access the Fritzbox without unchecking the second option.
Zut alors, this is a use-case I haven’t thought about while implementing this: If you tried to query a FQDN which is blocked by the anomaly detection script (such as fedoraproject.org
and getfedora.org
, which both trigger the fast flux detection), the list of allowed domains in the URL filter section applies first, so you can override the anomaly detection for the FQDN in question.
However, this is not implemented for destination IP addresses - I simply did not thought about it. Sorry.
In the meantime, you can…
- leave the detection of selectively announced networks disabled (I am not happy with that either) or
- access the FritzBox via a FQDN -
fritz.box
won’t work directly, since it is not a globally unique FQDN, and breaks DNSSEC, but you can create a local DNS record for it (please see the documentation for further details) and whiteliste it in via the URL filter section, as mentioned above.
A third possibility would be to access the FritzBox without going through IPFire’s web proxy, but that requires changes to the client’s proxy settings, and is not an ideal solution in terms of security either.
Sorry to disappoint, and best regards,
Peter MĂĽller