UPnP not working

johnpoz

This works just fine... Here I did a tcp forward, vs that udp - because easier to test tcp..

So used that tool, requested port, from status on pfsense it opened the port..

Now while sniffing on lan, to validate pfsense sends the port on, I did a can you see me..

Pfsense sent on the traffic, so clearly upnp is working as it should.

Even the tool shows that the UPnP is up on pfsense

dsam

@johnpoz Is it possible to reset the UPnP service configuration? I tried to look for miniupnpd.conf, but could not find anything.

Bob.Dig

This post is deleted!

johnpoz

Well then you should open a thread for 2.5 development.. Its quite possible there is some issue with 2.5..

All I can tell you is sure looks to be working as designed on 2.4.5..

There should be no reason to reset it... I would suggest you just disable it and then re-enable it... This is what I did to enable it... I always have that shit protocol OFF ;) heheh

dsam

This post is deleted!

kiokoman

This post is deleted!

johnpoz

Well that was prob just it saying I'm out of here - not going to run this crap protocol ;) heheh

Guys its quite possible there are issues with upnp on 2.5 - it not released, you guys could be on different snaps even.. If you have issues or think you have issues with 2.5 and upnp you should bring it up in the 2.5 section.

Edit: Guys please edit your 2.5 stuff there is zero reason post that here, it only distracts.. If you do not edit it, I will..

kiokoman

i don't use it anyway, not a problem for me

dsam

UPDATE: Someone on Reddit recently said that, "miniupnpd decided they wouldn't allow mapping to RFC1918 addresses any more." In my case, this is true; my pfSense is connected to the ISP's modem and set up in the DMZ. That might be the problem, since the modem gives it a private IP. And that might explain why UPnP worked with @johnpoz since he obviously has his pfSense directly connected to the internet, indicated by the black dash on his IP.

kiokoman

ok so after finding why my upnp made my system crash, i was able to test this on a virtual machine in a double nat situation,
it does not work

upnpc -a 192.168.123.2 1234 5678 tcp
GetExternalIPAddress failed
Addportmapping failed with code 501 (Action Failed)

if i set "Override WAN address" and put a non rfc1918 it work.
if i try this without double nat, it work

this was pfsense 2.4.5

[2.4.5-RELEASE][root@pfSense.localdomain]/root: miniupnpd -d -f /var/etc/miniupnpd.conf
miniupnpd[43089]: version 2.1 starting NAT-PMP/PCP UPnP-IGD ext if vmx0 BOOTID=1585742590
miniupnpd[43089]: Reserved / private IP address 192.168.10.28 on ext interface vmx0: Port forwarding is impossible
miniupnpd[43089]: You are probably behind NAT, enable option ext_perform_stun=yes to detect public IP address
miniupnpd[43089]: HTTP listening on port 2189
miniupnpd[43089]: no HTTP IPv6 address, disabling IPv6
miniupnpd[43089]: Listening for NAT-PMP/PCP traffic on port 5351

dsam

@kiokoman said in UPnP not working:

miniupnpd[43089]: Reserved / private IP address 192.168.10.28 on ext interface vmx0: Port forwarding is impossible
miniupnpd[43089]: You are probably behind NAT, enable option ext_perform_stun=yes to detect public IP address

I have never come across this error in my testing, which sucks since it could have saved me time. Anyway, how can we enable the "ext_perform_stun=yes" to fix the issue (hopefully)?

kiokoman

@kiokoman said in UPnP not working:

Override WAN address

i tested it also, but found random stuff on google,
you can use Override WAN address
or
you need to modify /var/etc/miniupnpd.conf and add
ext_perform_stun=yes
ext_stun_host=stun.onesuite.com
and manually launch miniupnpd -d -f /var/etc/miniupnpd.conf

please take in mind that i don't know what/who onesuite.com is, it report your wan ip address.
anothe public stun server is stun.stunprotocol.org
STUN=
Session Traversal Utilities for NAT (STUN) is a protocol that serves
as a tool for other protocols in dealing with Network Address
Translator (NAT) traversal. It can be used by an endpoint to
determine the IP address and port allocated to it by a NAT

maybe we can add this options to miniupnp webgui if it's missing and it's needed, idk

viktor_g

@kiokoman said in UPnP not working:

Session Traversal Utilities for NAT (STUN) is a protocol that serves
as a tool for other protocols in dealing with Network Address
Translator (NAT) traversal. It can be used by an endpoint to
determine the IP address and port allocated to it by a NAT

maybe we can add this options to miniupnp webgui if it's missing and it's needed, idk

You can create feature request on the redmine.pfsense.org for this.
it's easy to add to WebGUI, and it may be useful for some ISPs issues.

but https://redmine.pfsense.org/issues/10398 needs to be resolved first