UPnP and multiple Xbox 360s (4-8)

xcrustwadx

We now have 7 xbox 360s on my network behind a pfsense box all working with upnp. average upstream with all on xbox live is ~ 78-82KB/s… although i am using remote desktop from another location so this may be lower since RDP uses some upstream.
CPU usage is never more than 5%, avg 0-3% on:
AMD athlon 1.5ghz skt A
512mb (2x256) registered DDR 266
ASUS mboard
8gb 5400rpm hard drive
generic compaq atx psu
3com 3c network cards
interfaces: lan, wan, opt1 and opt2

Thank you so much for your upnp help and the great router distro!

forum

it,s a serch on the site. or some swedish det är en sök sida här nånstans. can,t i play with you ? what,s your namne on xbox live ?

xcrustwadx

It is not a big deal the mappings are left in place, except for having that port always being forwarded. I think there is a menu choice in the xbox 360 so you can delete the mapping manually, however it might be easier to just restart the service.

How would I schedule the miniupnpd service to restart at 7:30AM every morning? I would like those upnp entries cleared every morning when no one is playing. I was scared to mess around with the crontab file since it stated that it is best to not edit the file manually.

Would it be something like

minutes - 30
hours 7
day *
month*
etc ?

command = /etc/init.d/miniupnpd restart?
(I'm new to Freebsd)

The reason I am asking is because after there were about 8-10 residual upnp entries for the xbox 360s on my network and after a few days, none of the Xbox 360s were able to connect to Xbox Live (similar to the symptoms I experienced pre-RSW patch to miniupnpd). After I cleared the upnp entries (and the miniupnpd service was restarted) via the web interface and rebooted the Xbox 360s I was OK. I normally manually restart the service but I would like to avoid using the web interface every day to do so.

It also seems like when two or more Xbox 360s are powered on at the same time (or very close together), one or more will fail to connect to Xbox Live the first couple times we try to connect. Is this normal?

Thank you for your help.

rsw686

You would need to backup your config, add the cron item, and then restore your config.

<cron><minute>30</minute>
<hour>7</hour>
<mday></mday>
<month></month>
<wday>*</wday>
<who>root</who>
<command></command>/usr/local/sbin/upnp_support restart</cron>

Since miniupnpd is supported with the livecd there is no rc file as the commands are php functions. You would need to download the following file. I would place it under /usr/local/sbin/. This will allow to interface miniupnpd from the command line.

http://wgnrs.dynalias.com/pfsense/miniupnpd/upnp_support

xcrustwadx

Hey thanks for the script… That's a lot of work for you to write! I will try it tonight and let you know how it works.

rsw686

@xcrustwadx:

Hey thanks for the script… That's a lot of work for you to write! I will try it tonight and let you know how it works.

Your welcome! I am the miniupnpd maintainer and the script was a way for me to easily test out builds.

xcrustwadx

The script seems to be working AOK. However my time/date is set incorrectly. I did "date 0711151223" from SSH to set it to 12:20 11/15 but I'm not sure this is the proper way. What is the proper way to set the time and date in Pfsense?

rsw686

@xcrustwadx:

The script seems to be working AOK. However my time/date is set incorrectly. I did "date 0711151223" from SSH to set it to 12:20 11/15 but I'm not sure this is the proper way. What is the proper way to set the time and date in Pfsense?

The date and time is set automatically via ntp. Make sure your timezone is set correctly on the System -> General page.

xcrustwadx

ok time is now set properly via the general menu. Sorry, I glanced there for a time setting but I missed it. Should have done CTRL+F. Thank you.

xcrustwadx

OK. The script/cron job definately works. I just checked the upnp status and it's completely cleared! This is great.

Are there any plans to build in a timeout for upnp port mappings?

The reason I ask is because it has been said that Xbox never bothers to release the ports when it is powered off (which I can certainly say is true from firsthand experience). I know that this is actually a problem with the implementation on the Xbox's end and not with miniupnpd but restarting the service every morning seems like it may not be the best solution. If there is any way I can help, please let me know.

rsw686

My debate about adding it into miniupnpd is deciding when is the port inactive. I'm not sure how easy it is to see the last activity since once the rule is created pfSense is dealing with the redirects not miniupnpd. I'll contact the miniupnpd author and see what his opinion is on this.

xcrustwadx

1. Can I manually remove one upnp record/mapping without restarting the entire service and clearing ALL mappings?

2. Would it be feasible for me to write a custom script that removes a particular upnp port mapping once the DHCP lease that requested it expires?

Im starting to think… why incorporate a band-aid into the code of miniupnpd, which works fine, that is a workaround for a problem that should be solved on Microsoft's end... ie send the "I'm done with this upnp mapping, you can remove it now." packet. I'd rather make an "external" band-aid to avoid adverse effects on miniupnpd(a script for instance).

I'm not too clear on how DHCP protocol works but the pfsense web UI seems to know when a host is down and no longer using its lease.

rsw686

@xcrustwadx:

1. Can I manually remove one upnp record/mapping without restarting the entire service and clearing ALL mappings?

2. Would it be feasible for me to write a custom script that removes a particular upnp port mapping once the DHCP lease that requested it expires?

Miniupnpc is the client which can talk to miniupnpd. You would need to compile this for pfSense. Then it could be used to tell miniupnpd to remove a mapping. This is something that could be added to the pfSense UPnP implementation. I could see this being useful for others.

The easiest way to compile for the pfSense platform is to use the pfSense Developers edition. I think you can still get this on the snapshot server.

@xcrustwadx:

I'm not too clear on how DHCP protocol works but the pfsense web UI seems to know when a host is down and no longer using its lease.

True, but that is a bandaid fix as well. Not everyone is going to want or need that feature. The DHCP protocol marks the lease as inactive when its renewal time expires and the host has not renewed the lease. However some people set this time limit to days.

rsw686

I forgot to mention that if you use Windows XP you can remove the mappings by going to the Network Connections folder. Right click on Internet Connection click Properties, click Settings, and you can delete individual mappings.

xcrustwadx

Thanks for the tip. You need the Windows XP uPnP UI installed on the XP machine first and then this will work. I have just used it. Im currently using VM to install pfsense dev beta 1 and I will attempt to compile the miniupnpc.

rsw686

@xcrustwadx:

Thanks for the tip. You need the Windows XP uPnP UI installed on the XP machine first and then this will work. I have just used it. Im currently using VM to install pfsense dev beta 1 and I will attempt to compile the miniupnpc.

I just built miniupnpc successfully use gmake. You'll need to add gmake using

pkg_add -r gmake

To build

/usr/local/bin/gmake

From here you could add check boxes next to the mappings on the UPnP Status page and a remove button. You could even write a script to search the current mappings and then remove any with xbox in them at 7:30 in the morning. Or if you want to get detailed write the script to compare the mappings with the dhcp leases and remove the inactive ones.

rsw686

@rsw686:

From here you could add check boxes next to the mappings on the UPnP Status page and a remove button. You could even write a script to search the current mappings and then remove any with xbox in them at 7:30 in the morning. Or if you want to get detailed write the script to compare the mappings with the dhcp leases and remove the inactive ones.

Turns out that the new version of miniupnpd can clean out old mappings. I have compiled the binary and updated the webgui. The other improvement is called secure mode which locks down clients to only creating mappings to their IP. If anybody would like to test it out and let me know how it works that would be great. I plan on adding this into the cvs for 1.3, but for now you can update your 1.2 version with the following.


cd /tmp
fetch http://wgnrs.dynalias.com/pfsense/miniupnpd/upnp_support
chmod +x upnp_support
./upnp_support update

Afterwards you'll need to reconfigure upnp via the webgui. Please note that if you don't like the new version you'll have to manually restore the old files.

hoba

@rsw686:

Afterwards you'll need to reconfigure upnp via the webgui. Please note that if you don't like the new version you'll have to manually restore the old files.

Or reapply the 1.2 release full update that will reset all files back to release versions ;)

xcrustwadx

RSW686: I just saw your post sorry it took so long. I check back here occasionally. I have applied the patch you posted on March 17 and I will test this weekend for sure at my secondary location. I will also attempt to try at my other location which has the multiple Xbox 360s.

Does the "upnp bypassing the traffic shaper problem" still happen in 1.2 final? If so is this in the works for 1.3?

rsw686

@xcrustwadx:

Does the "upnp bypassing the traffic shaper problem" still happen in 1.2 final? If so is this in the works for 1.3?

There is a way to compile miniupnpd to use an ALTQ queue. I'm not sure how this would tie in with the traffic shaper.