Networking

Fritz!DNS - An authoritative DNS server for AVM FRITZ!Box routers

Jan 8, 2023

In my home network, I am using an AVM FRITZ!Box Cable 6690. It handles DHCP, DNS, Wifi and recently also interfaces my home network via WireGuard to my servers.

Just like the venerable Dnsmasq AVM’s FRITZ!OS uses hostnames learned from its DHCP leases and makes them resolvable via its internal DNS server.

Unfortunately, this feature in FRITZ!OS has some limitations:

The name of the DNS Zone is hard coded to fritz.box and can not be adjusted. Hence, the resolvable names have the following schema: myhostname.fritz.box
The internal DNS server only supports recursive DNS looks. It does not act as an authoritative DNS server. Hence the local zone can not be delegated.
AXFR zone transfers are not supported.

My solution to these shortcomings is Fritz-DNS which:

Is a small tool written in the Go programming language.
Is a small authoritative DNS server which serves A / AAAA resource records for local hosts connected to an AVM Fritz Box home WiFi router.
Can be used in a hidden master configuration as it supports AXFR zone transfers.
Uses the custom extension (X_AVM-DE_GetHostListPath) of the TR-064 Hosts SOAP-API as documented here to retrieve a list of local hosts.
Supports the generation of AAAA (IPv6) resource records based on the hosts MAC addresses using 64-Bit Extended Unique Identifier (EUI-64) and a configured unique local address (ULA) prefix.
Does not yet support PTR resource records (to be implemented…)
Is licensed under the Apache 2.0 license

You can find Fritz-DNS at Codeberg: /stv0g/fritz-dns .

Here is a small figure illustrating the interaction of Fritz-DNS with the Fritz!Box and other DNS servers / clients:

CLI Usage

$ fritz-dns
Usage of fritz-dns
  -ipv6-ula-prefix string
      Fritz Box IPv6 ULA Prefix (default "fd00::/64")
  -pass string
      FritzBox password
  -port int
      Listen port (default 53)
  -soa-expire duration
      SOA expire value (default 744h0m0s)
  -soa-mbox string
      SOA mailbox value
  -soa-minttl duration
      SOA minimum TTL value (default 1h0m0s)
  -soa-ns string
      Authorative DNS server for the zone
  -soa-refresh duration
      SOA refresh value (default 2h0m0s)
  -soa-retry duration
      SOA retry value (default 1h0m0s)
  -ttl duration
      default TTL values for records (default 5m0s)
  -url string
      FritzBox URL (default "http://fritz.box/")
  -user string
      FritzBox username (default "admin")
  -zone string
      DNS Zone (default "fritz.box.")

SSH Access for Netgear's Nighthawk M5 Mobile LTE/Router

Jul 3, 2022

Steffen Vogel

code poet, bit juggler & logic wizard

In my previous post, I demonstrated how to gain root access by enabling a Telnet daemon via the routers AT-over-TCP interface. In this post I will close this gasping security hole by replacing the Telnet with a Secure Shell (SSH) daemon. Netgear’s firmware does not ship with a SSH daemon itself. So we first build a statically linked Dropbear instead of the rather heavy OpenSSH daemon.

Having a detailed look at the Netgear Nighthawk M5 Mobile LTE/Router

Jun 29, 2022

Steffen Vogel

code poet, bit juggler & logic wizard

After gaining root access to the device in the first post of this series, we will have a closer look at the device and its firmware.

This post is documenting some internals of the device which is not the most exciting stuff to read. I mainly collected it here for documentation purposes.

All information in this post has been collected from a device running firmware version NTGX55_12.04.12.00.

A 3D-printed wall mount for Netgear Nighthawk mobile 5G/LTE routers

Jun 25, 2022

Steffen Vogel

code poet, bit juggler & logic wizard

I have recently designed and printed a wall mount for Netgear’s Nighthawk mobile 5G/LTE routers. More specifically a Nighthawk M5 (MR5200).

I have been inspired by an existing commercial wall mount for the Nighthawk M-series routers by FTS Hennig GmbH:

My inspiration: the wall-mount and antenna adapter from FTS Hennig.

Unfortunately, the mount is with a price tag of around 50 € rather expensive. So I decided to use our new lab 3D-printer and try do design it myself usings AutoDesk’s Fusion 360 software.

My own 3D printed holder is released under a creative commons license at Codeberg: /stv0g/3d-printing/netgear-m5-wall-mount

Gaining Root Access on Netgear Nighthawk Mobile 5G/LTE Routers

Jun 25, 2022

Steffen Vogel

code poet, bit juggler & logic wizard

This blog posts covers the required steps to gain root access via Telnet on Netgear Nighthawk Mobile 5G/LTE Routers. Its the first post in a small series covering my experiences playing around with this device.

Last month I obtained one of Netgear’s latest mobile 5G routers, the Netgear Nighthawk M5 (model MR5200-100EUS) . Being one of the most expensive consumer 5G routers, I was lucky to get a fairly good second hand deal from eBay.