Block Ports On Airport Extreme

Yesterday my Linux Gateway crashed. It was an old computer and I had been thinking of replacing it with my Airport Extreme. Now, that the old computer has crashed, I am forced to do this.
I know that I can do port mapping to forward incoming ports to specific computers, but I am curious whether I can block certain ports. I would like not to allow, pinging, and telnet for instance. I have a lot of computers behind this router and don't really want to block each and everyone. Is there a way to do this?
Is this considered a Gateway?
I am curious about port mapping. I created two maps. POP and SMTP. When doing this, it asks for an internal private IP address. I gave it the address of my computer that has my mail client on it. So I assumed that this would allow these ports to go to that IP. But, my wife's computer has her mail client on it. (we both use MS Outlook). She was able to get her mail and send mail. So, what is the deal with the private IP address?
I would also like to be able to VNC and RDP into several different computers on my network. On my previous Gateway, I set up port forwarding by using bogus ports to each machine. (ie. incoming port 50001 would go to my internal ip of 10.0.1.101 and port 50002 would go to my internal 10.0.2.102, etc). I am assuming that I can do this on the airport extreme as well.
I have STF for these, but really haven't found my answers (or maybe just not searching by the right words). Can anyone help me on this?

I know that I can do port mapping to forward incoming ports to specific computers, but I am curious whether I can block certain ports. I would like not to allow, pinging, and telnet for instance. I have a lot of computers behind this router and don't really want to block each and everyone. Is there a way to do this?
By default, the AirPort Extreme Base Station (AEBS) blocks ALL incoming ports. Unfortunately, the AirPort Utility does not offer any means to configure ports specifically. As a workaround, you could port forward any ports that you wanted "blocked" to a fictitious device on the local network.
Is this considered a Gateway?
A term "Gateway" can have a number of interpretations. In general computer networking terms, a Gateway is a network device that is used to connect devices across two different media. In the most commonly used case, these media would be Internet & Local Area Network.
Gateways are also used interchangeably to mean the same thing as routers, modem or combination router/modems and often leads to confusion.
So to answer your question, yes, the AEBS is a Gateway device.
I am curious about port mapping. I created two maps. POP and SMTP. When doing this, it asks for an internal private IP address. I gave it the address of my computer that has my mail client on it. So I assumed that this would allow these ports to go to that IP. But, my wife's computer has her mail client on it. (we both use MS Outlook). She was able to get her mail and send mail. So, what is the deal with the private IP address?
The problem with port mapping is that even though you can map multiple ports to a single device, you cannot map a single port to multiple devices.
Did you make sure to map ALL ports used by these two mail protocols? That is there are secure ports used by these protocols as well. It may be possible that your wife's mail client used one of these instead or that her client is configured to use other ports to receive or send mail.
I would also like to be able to VNC and RDP into several different computers on my network. On my previous Gateway, I set up port forwarding by using bogus ports to each machine. (ie. incoming port 50001 would go to my internal ip of 10.0.1.101 and port 50002 would go to my internal 10.0.2.102, etc). I am assuming that I can do this on the airport extreme as well.
Yes.

Similar Messages

Need help with opening ports on airport extreme

My vonage phone is connected to airport extreme router, voice quality of phone calls was poor. Vonage tech support says vonage port on my airport extreme was closed and i need to open it.
Here is my chat details with vonage tech support-
The following ports are needed for Internet communication between the Vonage adapters and the Vonage servers.
SIP: Port 5061 UDP
RTP (Voice) Traffic: Ports 10000-20000 UDP. When a call is made, a random port between 10000 and 20000 is used for RTP (Voice) traffic. If any of these ports are blocked, you may experience one way or no audio.
Please do suggest me the way to open the ports on airport extreme
Thanks
Venki

Instructions for opening ports is here.
https://discussions.apple.com/docs/DOC-3415
You should be fine opening the whole range, 10000-20000

What is voltage power block at Apple Airport Extreme?

What is voltage power block at Apple Airport Extreme? 110 or 220 Volt. Or both type support.

The AirPort Extreme will operate on 100-240 Volts and 50-60 Hz, so it will work just about anywhere in the world if you have the right adapter for the wall jack.
The outboard power supply provides 12 Volts to the AirPort Extreme at about 2 Amps.

Blocking outgoing ports on airport extreme

I have a current generation (mid-2014) Airport Extreme as the wireless router for a network at a small guest house/holiday home. Our broadband internet service is provided by satellite and we have therefore a usage limit as well as a restrictive FUP/Traffic management policy.
What I'd like to be able to do is block certain ports/ip addresses from outgoing traffic. That is, I want people not to be able to use the network for really intensive stuff, things like streaming video (e.g. hulu plus, BBC iPlayer, netflix, that kind of thing), background p2p, and torrents, as it'll eat up all our broadband usage and bring our overall speed to a crawl. I see that there Airport Extreme doesn't have that kind of ability built-in to the software like some other routers do, but am I right in surmising that there might be an option of configuring it so that outgoing traffic to certain IPs be port-forwarded to a non-existent device on the network (for example)?
If so, can someone just help me with that process. Or if there's another process that I can use to block certain kinds of traffic.
Many thanks!

It is simply not possible.. the AE is the wrong device in this setup.
I would strongly recommend a cheap router with 3rd party firmware.. eg... TP-Link WDR3600 with gargoyle firmware.. just google for the info as I have had it deleted by mods here in the past.
It will allow you to set daily quotas on usage. You can let people do whatever they like.. but they can only use a set amount per day or week or whatever time period you set. This firmware is unique in providing this ability in a domestic router.. for free.

How do you block a specific port on airport extreme

I'd like to prevent access to World of Warcraft during daylight hours so that my house squatter will actually do something productive during the day. Any ideas?
Thanks!
S. G.

There isn't a direct way to block ports on the AirPort routers. One possible workaround is to use Port Mapping to direct a single or multiple ports to a 'unused' local IP address ... like 10.0.1.255 that would be above the default DHCP range of the base station. Be aware that this would 'block' these port for every user.
To get an idea on how to set up port mapping, please check out the following AirPort User Tip.

Trying to Port Forward Airport Extreme 802.11ac using Airpot Utility 6.3.2

Hello kind experts. I am finally getting around to replacing my old BEFSR81 Cisco Router with an old Time Capsule attached with the Airport Extreme 802.11ac. The BEFSR81 also had 8 ports, so I have 8 hardwired locations throughout the house. I have a couple of IP cameras for which it was easy to port forward on the Cisco (just click on the port range forwarding tab, type the start/end ranges (which are identical) and the assigned IP address). Everything has been working well for years. Here's what I wish to do with the new setup: Cable Modem -> Airport Extreme -> Dumb gigaport switch with the hardwires connected to it.
When I go to Airport Utility (6.3.2) -> Network Tab -> Port Settings -> "+", the following comes up:
Firewall Entry Type (Defaulted to IPv4 Port Mapping)
Description (5 pull down choices)
Public UDP Ports : _________
Public TCP Ports: __________
Private IP Address (I take it that is where I enter the IP address for each camera, e.g. 192.168.1.xxx)?
Private UDP Ports: __________
Private TCP Ports: __________
I am obviously not a technophile, especially when it comes to networking, but was able to create my old setup.
Any advice on whether or not my configuration is appropriate and what exactly I need to put in the port fields would be greatly appreciated!
Thanks in advance!

To successfully access an IP camera on the local network from the Internet, the following basics need to be taken care of:
Install the camera(s) and verify that you can access them from the local network.
Configure port mapping/forwarding on your router. Typically, IP cameras require at least two ports: 1) A web port for administering the camera; Usually TCP port 80, and 2) A streaming port to broadcast the camera video feed; Usually UDP port 9000. Note: You should check with your camera's documentation for the exact ports required.
If the camera is attached to a computer, you will need to configure the computer's firewall to open the same ports as in step 2 above.
Verify that your modem is in bridge mode, i.e., if the modem provides NAT & DHCP services, turn them off.
Test your network. Use CheckIP to determine your router's current WAN-side (public) IP address. Then, from a remote location (not from a computer on the local network), use the DynDNS Open Port Tool to verify that the required ports are open. Success is an "Open" response from the Tool.
Check out the following AirPort User tip for configuring port mapping on an AirPort base station.

Cannot open port through Airport Extreme to access security system DVR

I have internet access through Bellsouth DSL -- modem only. We had a security system set up around a DVR recording images and connected to the internet through a Linksys router. We would use a client on outside computers to connect to the security system dvr and see what was happening (live or recorded). I switched out the Linksys for the Airport Extreme, and now we cannot connect to the DVR.
Do I need to manually open a port to the DVR? How do I do this? The DVR connects to the Airport Extreme via Ethernet, and as far as I can tell, the Airport Extreme connects to the DSL modem via Ethernet using DHCP. We have a static IP address. I thank you in advance for any answers, and I apologize if I'm not giving enough information.

Let's double-check your Port Mapping setup on the 802.11n AirPort Extreme Base Station (AEBSn) ...
To setup port mapping on an 802.11n AirPort Extreme Base Station (AEBSn), either connect to the AEBSn's wireless network or temporarily connect directly, using an Ethernet cable, to one of the LAN port of the AEBSn, and then use the AirPort Utility, in Manual Setup, to make these settings:
1. Reserve a DHCP-provided IP address for the host device.
Internet > DHCP tab
o On the DHCP tab, click the "+" (Add) button to enter DHCP Reservations.
o Description: <enter the desired description of the host device>
o Reserve address by: MAC Address
o Click Continue.
o MAC Address: <enter the MAC (what Apple calls Ethernet ID if you are using wired or AirPort ID if wireless) hardware address of the host computer>
o IPv4 Address: 10.0.1.4
o Click Done.
2. Setup Port Mapping on the AEBSn.
Advanced > Port Mapping tab
o Click the "+" (Add) button
o Service: <choose the appropriate service from the Service pop-up menu>
o Public UDP Port(s): 6746
o Public TCP Port(s): 6746
o Private IP Address: 10.0.1.4
o Private UDP Port(s): 6746
o Private TCP Port(s): 6746
o Click "Continue"

Is there ANY way to configure the wired ports on Airport Extreme with 7.6.1 software?

I need to connect a Cisco router to one of the wired ports because I'm creating a home lab with several switches and routers and attached hosts. I need the VERY BASIC ability to set (or even just to SEE) what IP address the AirPort is using/assigning, but with the current AirPort Utility, you apparently can't show the DHCP table for wired connections or set up a static pool of addresses to use or really, to do anything else that is ABSOLUTELY BASIC networking configurations for a router. I don't even know what range of IP addresses the AirPort is using for the wired ports.
I love this device - it works much better than my old Linksys that I replaced a couple years ago, but this is the Apple Nannies taking things too far. Sure, make the products easy to configure and use, but stop taking away the ability for advanced users to actually use the product because all you're doing is ******* off your power users - which are the exact people whose friends always ask for recommendations on what products to buy. I've always recommended Apple products to everyone, but if they're going to engineer everything so that only stupid people can use them, then only stupid people will buy (and recommend) them. (Can you tell I'm annoyed that I've wasted so much time on a completely unnecessary and irrelvant side-issue when I should be already working on my actual work project?)
/Rant-off
So, does anyone know how to access the actual configuration of the AirPort Extreme so I can use a static IP address for my Cisco router that's plugged into one of the AirPort's wired ports? That's all I need.
Thanks.

The AirPort assigns IP addresses via DHCP in a range you specify. You may also elect to assign devices their own static IP addresses. That does not involve the Extreme at all, though you may "reserve" those addresses in its DHCP Reservations table.
AirPort Utility > Network > Network Options...
Assigning static IP addresses obviates any need to determine the IP addresses the Extreme assigns.
Update its firmware to version 7.6.3.

Can't open FTP ports in Airport Extreme router

Hi,
I have three computers networked at home with an Airport Extreme serving as a router to the internet. A couple days ago I set up an FTP server on one computer (Ubuntu Linux). It is running properly and I CAN get into the FTP server via the local area IP address (10.0.1.101). However, no matter what I do I can't get the Airport Extreme to forward any FTP connections from outside. I have port forwarding set up correctly and working correctly for echo (7), daytime (13) ssh (22) http (80) nfs (2049) and vnc (5900). However, even though I set ports 20,21 to be forwarded to the correct computer nmap they are NOT open. (nmap doesn't see them, and telnet to ports 20 or 21 is refused. However nmap on the server locally (ie as localhost) shows that these ports ARE open on the server, and ftpd IS running.) Neither of my mac laptops has ftp file sharing turned on in the preferences (not like this should matter anyway). The Airport Extreme just plain does not open or forward anything to ports 20-21.
I also tried putting the FTP server on a different port (2121), but this doesn't work either. Is this just Apple playing nanny and not allowing me to run FTP for my own good? I have been troubleshooting this for two days and no closer to a solution. I hope someone can offer some advice.
Craig

I believe that I've found the problem with the AirPort/Time Capsule (version 7.3.1) support for FTP.
For whatever reason, when an FTP connection comes-in from the WAN, the NAT translation is reporting the IP address of WAN side of the router instead of the IP address of the actual system connecting from the Internet.
I confirmed this by setting up a FTP server on my Linux machine and watching the connection to the FTP server from the internet. When you perform a:
netstat -an | grep ':21 '
from the Linux shell, you see that the IP address that is connected is your own WAN IP address of your AirPort/Time Capsule.
Apparently the AirPort/Time Capsule recognizes the connection is an FTP client and manipulates the connection in such a way as to report the wrong IP address that is connecting to your FTP server.
This isn't a problem, unless you're using /etc/hosts.allow and /etc/hosts.deny to have port wrapper permit only listed IP addresses to have access to the FTP service. In that case, all connections seem to come in from your router's WAN IP address, so there's no way to distinguish where the connection is coming from.
Apple needs to take a closer look at the version 7.3.1 for the Time Capsule (not sure what the version is for the AirPort Extreme) and fix the reported IP address from the WAN side connection.

Configuring Ethernet 'WAN' port on AirPort Extreme

I would like to know if there is any way to configure the Ethernet MAC address on the WAN port of the AirPort Extreme.
This is a feature available on most other brands to accommodate the lock-down to the first Ethernet MAC address that the ISP encounters on their port.
Quickly replacing one router with another requires the ability to set this address. Otherwise, lengthy support calls are needed with some service providers to reset equipment on their end.

Even if you can't spoof a mac address with the Apple networking products, why not just call your cable company/ISP and give them the new mac address? That's all I had to do in order to switch from Linksys products to all Apple products.
The ISPs do this because it's their little way of trying to control traffic thru each of the modems but only allowing for one device to be connected to it at a time.
I'm wondering why you would keep switching back and forth between routers? I would think that when you do change routers, you'd want that to be a 'permanent' change and not a temporary one.

Port Forwarding Non-Preconfigured Ports on Airport Extreme

1. Opened up Airport Utility.
2. Under Internet/DHCP, reserved a static IP - 172.16.1.201 for a VoIP unit that is wired to one of the AEBS ports.
2. Under Internet/NAT, checked "Enable NAT Port Mapping Protocol" then clicked on "Configure Port Mappings..." button (which transfers me to Advanced/Port Mapping).
3. Added a pre-configured "Personal Web Sharing" port (80) to 172.16.1.201.
4. Updated and restarted AEBS.
5. Using http://www.canyouseeme.org/ as well as opening a browser referencing my global IP:80, I was able to verify that port 80 is indeed open.
6. Went back to step #3 and added a non-pre-configured port going to the same private address 172.16.1.201. Port is UDP 5060 for SIP.
7. Updated and restarted AEBS.
8. Verified port 80 is still open, but 5060 is not.
Is there anything wrong with my setup? Any help / advise would be GREATLY appreciated!
Thanks!

This is the exact same problem I'm having. Strangely, some of my non-standard ports are being forwarded just fine.
Specifically, I need to forward ports to enable ftp clients to browse in passive mode. In order to do this they must be able to communicate with the ftp server on ports other than 21, with each client receiving its own additional port. I've been using the range 3000-3008 for this purpose and until recently it seemed to be working, but now all probe scans report closed, regardless of what port range I use them for.
I mention ftp because I know the Airport Extreme discriminates between certain types of traffic and handles them according to whatever programming they stick in there. I don't know how the Airport Extreme router could be discriminating between the different ports I'm reassigning and forwarding, but I know it's causing them to become closed. In a range previously undefined in the port forwarding, probe scans report "stealth". After forwarding, the probes report "closed".
Can anyone tell me what's going on here?
Enabling default host is not an option (and it shouldn't need to be). I have reasons for not wanting to let all ranges of ports automatically be forwarded to this computer.

Additional Ethernet ports on Airport Extreme Base Station

I would like to know how one could add additional Ethernet ports to an Airport Extreme Base Station - I need 6 ethernet ports.
Is it possible to daisychain two Airport Express Base Stations so that all computers can see each other, or is it best to buy an ethernet switch?
If the latter is the answer, hardware recommendations would be appreciated.
Thanks

Is it possible to daisychain two Airport Express Base Stations so that all computers can see each other, or is it best to buy an ethernet switch?
It would be best (cheapest) to use an Ethernet switch instead of getting a second wireless router with a built-in switch.
If the latter is the answer, hardware recommendations would be appreciated.
A 4-8 port model from any of the name brand vendors should do just fine. An example would be the Linksys SD2008.

Open UDP Ports on AirPort Extreme

I need to open a few UDP Ports on my new AirPort Extreme so that the software that is running on my network can access the internet over those ports and the software can be accessed from the internet as well. I can find in the AirPort Extreme manual how to open TCP ports but not UDP. I have the list of ports I need to open, but can't find where to configure them in the router firmware.
I would like help on where to configure these ports. Thank you.

If you are using the Airport Utility on the Airport Extreme N Base Station, the port mapping screen should look like what you see on page 56 of the manual "Designing Airport Networks" found at:
http://manuals.info.apple.com/en/DesigningAirPort_Networks_Using_AirPortUtility.pdf
...and it clearly shows how/where to specify UDP and TCP ports.

Opening multiple ports on Airport Extreme

I need to open multiple ports on an Airport Extreme to allow for ftps service (about 500 ports). In port forwarding, it appears that I would have to enter 500 entries to do that (e.g. port 4001, 4002, 4003 etc.) Sounds wacky. In other routers (or linux sortware), multiple entries can be entered like "400, 4000-4500". Apple docs don't address this (from what I could find). Is there a syntax for multiple port forwarding?

Are you using the round 802.11b/g AirPort Extreme base station (AEBS) or the square 802.11b/g/n AEBS?
The round AEBS does not allow you to enter ranges. The only solution for a great number of ports is to use the default host option and send ALL the ports to the designated computer.
I believe that the square AEBS allows you to enter ranges.

More ports on Airport Extreme

Hello,
I was wondering before I buy the Airport Extreme Base Station, would I be able to plug a switch into the back of it, so that I can plug in more computers. As I understand it has a built in router so should be quite easy?
or would I need a seperate router?
Any help would be great.

I in fact have an Airport Extreme that won't work with a linksys 8 port switch. In fact, it's been driving me up the wall trying to get the issue nailed down for a while. The minute I connect the switch (not just this switch, I've replaced it with a new one, and same deal) the AE freezes up and won't do anything until I unplug the switch again. The logs show nothing out of the ordinary, just a connection here or there before I hooked up the switch, then nothing until after I disconnect it, like it just gets locked up.
If anyone has any ideas, I'd appreciate it. I've replaced cables, router, switch, checked ports, checked cables, verified that everything works fine alone, but will not work hooked up together in any way shape or form.

Block Ports On Airport Extreme

Similar Messages

Maybe you are looking for