topic Re: Super Hub 7 Plus - unless you want DMZ - forget port 443 on Firewall Rules! in Broadband & Landline

Super Hub 7 Plus - unless you want DMZ - forget port 443 on Firewall Rules!

Hyperjase — Mon, 20 Jul 2026 12:11:05 GMT

Just had a 20 minute call with a tech "trying" to resolve an issue with a brand new Super Hub 7 Plus (just fitted on full fibre today).

Had a load of firewall rules for different devices, different ports - so I copied these all over as they were.

First problem, I had the DHCP range set to 192.168.1.50 > 192.168.1.253, but obviously I could use anything < 192.168.1.50 - to which most of my devices which had firewall rules assigned were set to - on this new awful "thing", the IP addresses disappear and show the MAC address; but then, as they're outside the DHCP range - the IP addresses show as "N/A" and when you select ONE you select ALL of them! Making this a totally unusable feature. This was working on my previous hub (not full fibre) - without issue. Firmware written by someone who doesn't have a clue obviously.

But this then led to the next problem. Added all the firewall rules in - all good (apart from the fact the original DHCP issue meant I couldn't actually remove or add any new ones, had to factory reset this thing!).

But as I have a web server - running port 443 (HTTPS) - this was not working. Checked via a port checker website - all ports EXCEPT 443 were working! So I tested the theory via DMZ; guess what - IT WORKS! So I disabled DMZ, then the port was showing as closed again - despite the fact I've removed and readded several times. Port 80 assigned to the same device - working fine.

Screwy firmware, badly written - I've raised a complaint but doubt it will come to anything.

The only good thing is the speed is better now - but now I have to FULLY expose a Windows server to open port 443!!!

Broken firmware version: r4.27.0-R-1862249-PROD-84001

Re: Super Hub 7 Plus - unless you want DMZ - forget port 443 on Firewall Rules!

JimM11 — Mon, 20 Jul 2026 14:02:40 GMT

@Hyperjase Can you first check your version in case you did it wrong, the one below is reported by others. If your version is lower please say, you could have a new one and that is the OOB FW applied and the sucker has not been FW updated as yet, surprised EE did not say if you raised that with them.... Reference to all the EE is EE Smart Hub 7 Plus as the version although it may just change again, so everyone is sure just getting used to the New EE naming conventions at present....

FW: r4.27.1-R-1862254-PROD-84001 and the gui is at App version 3.14.5 13/07/2026

Nothing we can do about the DHCP scope, that is what it is with EE's setup for all there hubs and the reserved space that they have decided. Do believe that others have port https:443 open and working so will tag @bobpullen he can say as got the same 7 Plus as you but not sure which ports he is using. Let's just wait till he reply's....

There is a few oops on the 7 Plus to start with and PF sure is one off those.... Cluelessness may be one off the factor's just not for me to say, know what i mean....

Re: Super Hub 7 Plus - unless you want DMZ - forget port 443 on Firewall Rules!

Hyperjase — Mon, 20 Jul 2026 14:53:32 GMT

I tried everything - I even reset the hub; the only way I could get port 443 to work was through DMZ, had to lock the server down - not an ideal situation.

The GUI version on mine is 3.14.5 - I see there is a slight difference in my firmware version - I wonder if there's a fix between these two versions.

Hopefully something simple and can be resolved - just frustrating!

Re: Super Hub 7 Plus - unless you want DMZ - forget port 443 on Firewall Rules!

JimM11 — Mon, 20 Jul 2026 15:05:44 GMT

@Hyperjase The person that i tagged has extensive knowledge in using the 7 Plus version, so if he comes back when time permits for him if he is using port 443:https wise and working for him he will say, again the Hub is new just out Jan has had a somewhat rocky road to even get were it is currently, and the wheels on the EE bus just go one pace and that is slowly, there will be NO Instant get it done and fixed for sure.... That's why i said you FW may be the OOB out off box as delivered to you being just new Factory supplied version, the usual is connect it up and the FW gets updated, re-boots etc but it all depends on what is going on etc in EE land..... DMZ is the get out off jail and testing advised to see what happens, relying on how good your server Fire Wall is working now, but you are well aware from your posted start!

Also here is the EE FW pinned post on the opening Forum top page....

(2) EE Hub firmware versions - The EE Community

Re: Super Hub 7 Plus - unless you want DMZ - forget port 443 on Firewall Rules!

Hyperjase — Tue, 21 Jul 2026 08:07:45 GMT

FYI I've just checked and it appears the firmware has updated, it's now showing as r4.27.1-R-1862254-PROD-84001 - but still having to use DMZ to get port 443 open, I have just disabled DMZ and left TCP 443 open against the MAC address of the device in question - with DMZ disabled, still not showing as open, so I've had to re-enable DMZ.

Re: Super Hub 7 Plus - unless you want DMZ - forget port 443 on Firewall Rules!

bobpullen — Wed, 22 Jul 2026 13:16:23 GMT

@Hyperjase - I've managed to successfully forward port 443 using 7 Plus previously. In my case it was forwarded to a reverse proxy, then onward forwarded to various local web servers. Couple of questions spring to mind: -

What machine is the HTTPS server running on? Windows ot something else? If it's Windows, then have you ensured the Network connection Properties in Windows haven't reverted from 'Private' to 'Public' when swapping the hub out?
What does your list of port forwarding rules look like? Are there any 'greyed out' UPnP rules present? This has been found to be a problem previously if the UPnP rule sits above the one you're trying to create - see here.

Unsure I'm following what you observed with the 'N/A' LAN IP's? Are you saying that devices assigned IP's outside of the hub's DHCP range were showing an 'N/A' IP address in the Hub Manager? And that this was somehow stopping you from creating a port forwarding rule? In what way exactly? It's also unclear to me why you had to factory reset things after trying?

Re: Super Hub 7 Plus - unless you want DMZ - forget port 443 on Firewall Rules!

Hyperjase — Fri, 24 Jul 2026 08:54:08 GMT

@bobpullen thanks for the reply, to clarify these points:

I was using an older EE hub on a "super fast" broadband (not full fibre) line - and I had all the rules set up correctly, DHCP was assigned to be 192.168.1.50 > 192.168.1.253, also Dynamic DNS enabled; all has been working absolutely brilliantly.

So when I received the new Super Hub, I configured exactly the same; DHCP range as previously set up. All my servers were assigned IP address outside of this range (192.168.1.10 > 192.168.1.24). When I then attempted to add these out-of-dhcp-range devices to the firewall rules; it shows you a list of devices, their MAC address and assigned IP address (again, on the previous hub - no issues with this). When I wanted to select my Windows Server (192.168.1.21) - I could figure this out by the MAC address, but the IP address wasn't shown, but just "N/A" - along with two other Linux servers (I didn't hang around long enough to figure out which was which) - so there were 3 different devices with MAC addresses showing and all displayed "N/A" for the IP address. Clicking the MAC address of the Windows Server; all 3 were selected!! I couldn't actually only select 1 - selecting any of the 3, would select all 3. So I did test this, and this wasn't the solution as it used the first MAC address.

I then attempted to change it to use the IP address, but was met with an error each time. I couldn't update them, I couldn't delete them - hence I was forced to factory reset the hub.

So that mess aside (and I'm sorry - this is just badly built, badly tested firmware), I then changed the DHCP scope to include the servers and made them all static (they are static on the servers themselves anyway).

Then I began opening ports (and I have multiple; around 10 in total for different reasons) - all worked well adding - but did spot yet another issue. Adding a firewall rule in, then putting the port (eg 443 in all 4 boxes), then setting to TCP only - if you then change the drop-down to be TCP/UDP, it says the range is wrong! The left two port boxes display red. Yet more badly written firmware.

But - as I find these little annoying issues, I get to the end and test my web server connectivity - dead. Won't load anything. So I use a website to check ports open. Port 443 - closed. Port 80 - open! Along with ALL the other ports I'd opened on the hub, just not 443.

Brainwave to fix EE's badly written and tested firmware; use DMZ - not idea but solves their mess. DMZ works, but obviously exposes the server to the internet - security risk or what! This is a Windows Server 2019 running just IIS but has internal connectivity to multiple SQL Express servers (no external access). I lock this down best I can to only permit IIS (port 80/443) as access. This solves my issue.

There is one PnP Firewall Rule - which sits at the top of the list. I will review the link you provided above.

For clarity, the Windows Server network is showing as Private.

Maybe some of this is on me - but I would half expect it work the same between hub versions. The DHCP mess required a factory reset to resolve, thankfully it had only been in a few minutes so wasn't a big issue. But it does seem like there are bugs - most of which I think I found!

Re: Super Hub 7 Plus - unless you want DMZ - forget port 443 on Firewall Rules!

Hyperjase — Fri, 24 Jul 2026 12:56:30 GMT

It does appear to be the UPnP issue; Plex had added the rule - but I had created this manually for a single port - so I changed the configuration in Plex (not to use UPnP), this then removed the automatic rule from the hub; I've disabled DMZ and left all the existing rules as-is - and it works!

As stated, badly written, poorly tested firmware.

I'm leaving well alone now - it works and won't be making any additional changes to save more firmware disasters!

Re: Super Hub 7 Plus - unless you want DMZ - forget port 443 on Firewall Rules!

JimM11 — Fri, 24 Jul 2026 15:48:52 GMT

@Hyperjase Well done, just another uPnP FW update introduction to mess with Port Forwarding rules. Think that one is on the EE Radar 7 Plus wise and if they are seeing the posted threads the 6 Plus may just be doing it also... Factory reset with the uPnP devices disabled until you get all the Manual ones in seems to be the work around at present although not a pretty way to be doing it all.