pfSense Gold Subscription

Author Topic: UPnP support  (Read 116064 times)

0 Members and 1 Guest are viewing this topic.

Offline bradenmcg

  • Jr. Member
  • **
  • Posts: 97
  • Karma: +0/-0
  • AS13697
    • View Profile
Re: UPnP support
« Reply #285 on: November 07, 2006, 10:47:18 pm »
spectacular stuff.  Looking back at last Feb. I'm amazed at how far this project has come.  :)  My continued thanks to all of you who have put effort into UPnP as it has made my life at home a lot easier.  (No more screwing around with port forwards for random IM clients and stuff...)  Plus, I can have 2 xbox 360s under one roof without any problems.   ;D

Offline Superman

  • Full Member
  • ***
  • Posts: 136
  • Karma: +0/-0
    • View Profile
Re: UPnP support
« Reply #286 on: November 10, 2006, 09:11:11 am »
It's seems with this latest package the 100% CPU usage problem is back.

I'm get the old error:
Code: [Select]
miniupnpd[10622]: recv (state0): Operation timed out
It seems to happen every couple of days. I have to restart the miniupnpd service and then all is well. The earlier packages seemed to do it as well, but it took longer between times the problem would reappear.

I noticed that as of today (Nov 10/06) there is new version of miniupnpd on it's site, but the changelog doesn't mention any changes that would fix this problem.
« Last Edit: November 10, 2006, 09:16:39 am by Superman »

Offline rsw686

  • Global Moderator
  • Sr. Member
  • *****
  • Posts: 520
  • Karma: +0/-0
    • View Profile
    • The Reptile File
Re: UPnP support
« Reply #287 on: November 10, 2006, 10:20:55 am »
It's seems with this latest package the 100% CPU usage problem is back.

I'm get the old error:
Code: [Select]
miniupnpd[10622]: recv (state0): Operation timed out
It seems to happen every couple of days. I have to restart the miniupnpd service and then all is well. The earlier packages seemed to do it as well, but it took longer between times the problem would reappear.

I noticed that as of today (Nov 10/06) there is new version of miniupnpd on it's site, but the changelog doesn't mention any changes that would fix this problem.

Hmm I've never experienced that. I really have no way to test this on as my box is using DHCP on the WAN interface and the lease is renewed every 12 hours. The packages are resynced when this happens and miniupnpd restarts.

The changes that have been made to the code were fixing a major memory leak (about 40kb leak per add/remove mapping) and additional code to read the bytes/packets in/out and system uptime. No major changes have occurred and I can't see how the changes would affect this.

I will contact Thomas the author of miniupnpd and see what he has to say. The latest version on his site has improved error handling and I was planning to update the pfsense package later today. I will hold off until I receive word from Thomas.

Offline rsw686

  • Global Moderator
  • Sr. Member
  • *****
  • Posts: 520
  • Karma: +0/-0
    • View Profile
    • The Reptile File
Re: UPnP support
« Reply #288 on: November 10, 2006, 10:32:30 am »
I was looking at the code changes for the 20061110 version posted today and it might fix this issue. The error you receive is coming from upnphttp.c line 273: The new version adds the h->state = 100; which would close out that state instead of endlessly looping through it. I will build and update the package to the latest version and you can let me know if it addresses the issue. I sent Thomas another email asking what he thinks. I will let you know the response.

      if(n<0)
      {
         syslog(LOG_ERR, "recv (state0): %m");
         h->state = 100;
      }
« Last Edit: November 10, 2006, 10:47:40 am by rsw686 »

Offline Superman

  • Full Member
  • ***
  • Posts: 136
  • Karma: +0/-0
    • View Profile
Re: UPnP support
« Reply #289 on: November 10, 2006, 11:39:06 am »
Thanks for the quick response. I will try out the package when it is available! I'll post my observations. Of course I'll probably have to wait a few days to see if the problem resurfaces.

Thanks!! :D

Offline rsw686

  • Global Moderator
  • Sr. Member
  • *****
  • Posts: 520
  • Karma: +0/-0
    • View Profile
    • The Reptile File
Re: UPnP support
« Reply #290 on: November 10, 2006, 11:55:28 am »
Thanks for the quick response. I will try out the package when it is available! I'll post my observations. Of course I'll probably have to wait a few days to see if the problem resurfaces.

Thanks!! :D

I committed it a 15 min ago so you should be good to go. Just reinstall via package manager installed packages tab.

Offline bradenmcg

  • Jr. Member
  • **
  • Posts: 97
  • Karma: +0/-0
  • AS13697
    • View Profile
Re: UPnP support
« Reply #291 on: November 10, 2006, 12:33:49 pm »
Let us know when/if you put out a binary update for the poor embedded users...

I'm starting to consider building my own "hybrid" system - soekris board, but using a notebook drive or perhaps a microdrive so I can have packages and logging and stuff.  I suppose that is better discussed in a different thread though...

Offline rsw686

  • Global Moderator
  • Sr. Member
  • *****
  • Posts: 520
  • Karma: +0/-0
    • View Profile
    • The Reptile File
Re: UPnP support
« Reply #292 on: November 10, 2006, 12:43:34 pm »
Quote
I have myself experienced this problem but was unable to reproduce it.
This last couple of days, I tested the Daemon behaviour when receiving for ill formed HTTP requests. in some cases I succeded in reproducing the bug.
I improved a lot the handling of unexpected HTTP requests, because it was also possible to make the daemon seg fault very easily.
So yes, I hope I've fixed this cpu usage issue but I cannot be sure.

Thanks

Thomas.

That was his response. I forgot to mention that embeddeds can use the sh-update-miniupnpd.sh or reflash. It's been awhile so here are the instructions. The images I update after I commit the miniupnpd changes. The sh-update-miniupnpd.sh script always grabs the latest from the pfSense server.

http://wgnrs.dynalias.com:81/pfsense/pfSense-1.0.1-Embedded-Miniupnpd.img.gz

md5sums for the binaries: http://wgnrs.dynalias.com:81/pfsense/miniupnpd/md5sums

Either use the console terminal or ssh into the box. Select option 8 shell. Enter the following commands. If you use the webgui command prompt you will find the page just hangs.

Code: [Select]
fetch -o - "http://wgnrs.dynalias.com:81/pfsense/miniupnpd/sh-update-miniupnpd.sh" | sh -

The results should like similar to below. The current version prints the md5sum which you can compare to the above file.

Code: [Select]
-                                             100% of  868  B  294 kBps
/usr/local/sbin/miniupnpd                     100% of   50 kB  290 kBps
/usr/local/pkg/miniupnpd.inc                  100% of 5622  B 1316 kBps
/usr/local/pkg/miniupnpd.xml                  100% of 2904  B  923 kBps
/usr/local/www/status_upnp.php                100% of 4185  B 1029 kBps
MD5 (/usr/local/sbin/miniupnpd) = d0c92af435c82b52b591527227f07568
Syncing packages: miniupnpd.
« Last Edit: November 10, 2006, 01:12:16 pm by rsw686 »

Offline EldarXP

  • Newbie
  • *
  • Posts: 10
  • Karma: +0/-0
    • View Profile
Re: UPnP support
« Reply #293 on: November 10, 2006, 07:45:20 pm »
Hello,
I try to find out what i'm missing here, i have installed the mini upnp on my pfsense firewall but it seem that nothing is happening (no rules created and upnp status is allways empty)
as i'm trying to play with msn messenger and be able to use voice (computer -> computer).
I always getting a lot of feed from the firwall telling me that it block some UDP or SIP or TCP port.

Exemple port:
    1886: UDP
    1892: UDP

Here is some of my firewall rules

   TCP  LAN net  *  *  1863  *  Allow MSN -> ANY     
 
 
   UDP  LAN net  *  *  2001 - 2120  *  Allow MSN Voice to Phone -> ANY     
 
 
   TCP/UDP  LAN net  *  *  2869  *  Allow UPNP -> ANY     
 
 
   TCP  LAN net  *  *  3689  *  Allow Itune music share -> ANY     
 
 
   TCP/UDP  LAN net  *  *  5060  *  Allow SIP -> ANY     
 
 
   UDP  LAN net  *  *  6801  *  Allow MSN Voice to phone -> ANY     
 
 
   TCP  LAN net  *  *  6891 - 6900  *  Allow MSN File Transfert -> ANY     
 
 
   TCP/UDP  LAN net  *  *  6901  *  Allow MSN Voice to computer -> ANY     
 
 
   TCP/UDP  LAN net  *  *  7001  *  Allow MSN Voice to computer -> ANY   

If any one got an idea :) you are welcome

Offline rsw686

  • Global Moderator
  • Sr. Member
  • *****
  • Posts: 520
  • Karma: +0/-0
    • View Profile
    • The Reptile File
Re: UPnP support
« Reply #294 on: November 10, 2006, 09:40:28 pm »
First off if your using a upnp application you shouldn't manually create the firewall rules. Miniupnpd will automatically create them behind the scenes. Maybe try turning off the winxp firewall if its enabled and see if that makes a difference. Also try out Azureus and see if its port forwards show up in the status. That will give you a starting point.

Offline Superman

  • Full Member
  • ***
  • Posts: 136
  • Karma: +0/-0
    • View Profile
Re: UPnP support
« Reply #295 on: November 11, 2006, 12:26:44 am »
Hello,
I try to find out what i'm missing here, i have installed the mini upnp on my pfsense firewall but it seem that nothing is happening (no rules created and upnp status is allways empty)
as i'm trying to play with msn messenger and be able to use voice (computer -> computer).
I always getting a lot of feed from the firwall telling me that it block some UDP or SIP or TCP port.

Just too make sure, if this is a new install, you will have to go to the Miniupnpd tab under the Services heading (you might need to refresh the browser for it to show up...) and actually set it up to enable it. You'll see the miniupnpd Settings tab, where you choose the interface you want to run on, and a few other options and then click change. Check the Services tab under the Status heading to make sure the service is running...also check the System Logs for any errors. If you've already done all that, then it may be some other problem, but this is something that has caught a few so far...

Hope that's of some use.

Offline EldarXP

  • Newbie
  • *
  • Posts: 10
  • Karma: +0/-0
    • View Profile
Re: UPnP support
« Reply #296 on: November 11, 2006, 01:35:07 am »
Have done all that and more and still not working,
can someone tell me the basic firewall rules and nat to enable to make it work, i'm sure it's some problem around this...

Offline jeroen234

  • Sr. Member
  • ****
  • Posts: 505
  • Karma: +0/-0
    • View Profile
Re: UPnP support
« Reply #297 on: November 11, 2006, 03:14:20 am »
yust the default lan rule
upnp will make all the nat rules for youre pc


Offline EldarXP

  • Newbie
  • *
  • Posts: 10
  • Karma: +0/-0
    • View Profile
Re: UPnP support
« Reply #298 on: November 12, 2006, 07:06:03 pm »
Hey,
I've reset the pfsense and reinstall the upnp,
Default rules are working fine with azerus. but still no msn voice or web cam (file transfert is ok)....

Thanks for your help,

An other question:
Once you've enable upnp you need to block the port you don't whant your user to access (directly from the client if you got a proxy http, or at all if you don't whant them to send or receive email)...
Is it right?

Thanks,

Offline rsw686

  • Global Moderator
  • Sr. Member
  • *****
  • Posts: 520
  • Karma: +0/-0
    • View Profile
    • The Reptile File
Re: UPnP support
« Reply #299 on: November 12, 2006, 07:18:50 pm »
Hey,
I've reset the pfsense and reinstall the upnp,
Default rules are working fine with azerus. but still no msn voice or web cam (file transfert is ok)....

Thanks for your help,

An other question:
Once you've enable upnp you need to block the port you don't whant your user to access (directly from the client if you got a proxy http, or at all if you don't whant them to send or receive email)...
Is it right?

Thanks,


I'm confused by your other question. Upnp only opens ports that the application requests. After you close the application it closes the ports. So no you don't need to block anything. Unless specifically added in the NAT and Firewall Rules everything coming in from the WAN side is blocked by default. Now if you don't want users on the LAN side to access to certain ports then yes you need to block them.

As far as MSN voice and web cam when you try and use them do you see miniupnpd errors in your pfSense system log? If so what are they. If its something like unsupported soap method, etc then there is some incompatibility between miniupnpd and msn messenger.

If that is the case I would recommend emailing Thomas Bernard at miniupnp _AT_ free _DOT_ fr as he is the creator of miniupnpd http://miniupnp.free.fr/