UPnP not working



  • Recently I discovered that UPnP, while enabled, is not actually working. I used the miniupnp client to make sure of that. UPnP is correctly configured with no default deny just to make sure. I then checked the logs and found out that it denies my computer's request because it does not belong to the LAN, even though it is indeed in the LAN specified in the configuration. I searched online and found that another person had the same issue and that apparently it was old yet patched. Am I missing anything here?


  • LAYER 8 Global Moderator

    Says it not in the lan because of - lets see these logs.. Is it trying to open something to a 169.254.x.x address?

    Why do you have this in routing and multiwan?

    Do you have multiple wans - and your trying to get it open the ports on specific wan?



  • This post is deleted!


  • @johnpoz Sorry, but where should this be?


  • LAYER 8 Global Moderator

    Well it is isn't routing, and do you have multi wan? I would put in general or firewall questions.

    Going to move it to general right now. While I test this.. I have zero use or love of UPnP at all.. But sure will try and test it.. to validate it working..



  • This post is deleted!


  • @johnpoz Thank you. I do not like UPnP, but some games do require UPnP to function properly, especially if I need two instances of the same game running on different machines with NAT reflection and UPnP on.


  • LAYER 8 Global Moderator

    Trying to figure how to get this minupnppc to work... I can get a status now that enabled..

    status.jpg

    Give me a minute on reading the info on this - not a UPnP user ;) and never used this application before, etc.


  • LAYER 8 Global Moderator

    sure looks to be working

    working.jpg



  • @johnpoz This is the output I get from the same command.alt text


  • LAYER 8 Global Moderator

    Well looks like you have multiple devices what is this 192.168.0.4 device? I assume pfsense is 192.168.0.1



  • @johnpoz Yes, pfsense is .0.1. The other one is a router in the same network with UPnP turned off. Even when it did not show up, there was a problem. I had a problem where another router was taking the UPnP requests. So I decided to turn off UPnP on all routers acting as access points.



  • This post is deleted!

  • LAYER 8 Global Moderator

    This works just fine... Here I did a tcp forward, vs that udp - because easier to test tcp..

    So used that tool, requested port, from status on pfsense it opened the port..

    Now while sniffing on lan, to validate pfsense sends the port on, I did a can you see me..

    Pfsense sent on the traffic, so clearly upnp is working as it should.

    working.jpg

    Even the tool shows that the UPnP is up on pfsense

    toolshows.jpg



  • @johnpoz Is it possible to reset the UPnP service configuration? I tried to look for miniupnpd.conf, but could not find anything.



  • This post is deleted!

  • LAYER 8 Global Moderator

    Well then you should open a thread for 2.5 development.. Its quite possible there is some issue with 2.5..

    All I can tell you is sure looks to be working as designed on 2.4.5..

    There should be no reason to reset it... I would suggest you just disable it and then re-enable it... This is what I did to enable it... I always have that shit protocol OFF ;) heheh

    settings.jpg



  • This post is deleted!

  • LAYER 8

    This post is deleted!

  • LAYER 8 Global Moderator

    Well that was prob just it saying I'm out of here - not going to run this crap protocol ;) heheh

    Guys its quite possible there are issues with upnp on 2.5 - it not released, you guys could be on different snaps even.. If you have issues or think you have issues with 2.5 and upnp you should bring it up in the 2.5 section.

    Edit: Guys please edit your 2.5 stuff there is zero reason post that here, it only distracts.. If you do not edit it, I will..


  • LAYER 8

    i don't use it anyway, not a problem for me 😌



  • UPDATE: Someone on Reddit recently said that, "miniupnpd decided they wouldn't allow mapping to RFC1918 addresses any more." In my case, this is true; my pfSense is connected to the ISP's modem and set up in the DMZ. That might be the problem, since the modem gives it a private IP. And that might explain why UPnP worked with @johnpoz since he obviously has his pfSense directly connected to the internet, indicated by the black dash on his IP.


  • LAYER 8

    ok so after finding why my upnp made my system crash, i was able to test this on a virtual machine in a double nat situation,
    it does not work 🤔

    upnpc -a 192.168.123.2 1234 5678 tcp
    GetExternalIPAddress failed
    Addportmapping failed with code 501 (Action Failed)
    

    if i set "Override WAN address" and put a non rfc1918 it work.
    if i try this without double nat, it work

    this was pfsense 2.4.5

    [2.4.5-RELEASE][root@pfSense.localdomain]/root: miniupnpd -d -f /var/etc/miniupnpd.conf
    miniupnpd[43089]: version 2.1 starting NAT-PMP/PCP UPnP-IGD ext if vmx0 BOOTID=1585742590
    miniupnpd[43089]: Reserved / private IP address 192.168.10.28 on ext interface vmx0: Port forwarding is impossible
    miniupnpd[43089]: You are probably behind NAT, enable option ext_perform_stun=yes to detect public IP address
    miniupnpd[43089]: HTTP listening on port 2189
    miniupnpd[43089]: no HTTP IPv6 address, disabling IPv6
    miniupnpd[43089]: Listening for NAT-PMP/PCP traffic on port 5351
    


  • @kiokoman said in UPnP not working:

    miniupnpd[43089]: Reserved / private IP address 192.168.10.28 on ext interface vmx0: Port forwarding is impossible
    miniupnpd[43089]: You are probably behind NAT, enable option ext_perform_stun=yes to detect public IP address
    

    I have never come across this error in my testing, which sucks since it could have saved me time. Anyway, how can we enable the "ext_perform_stun=yes" to fix the issue (hopefully)?


  • LAYER 8

    @kiokoman said in UPnP not working:

    Override WAN address

    i tested it also, but found random stuff on google,
    you can use Override WAN address
    or
    you need to modify /var/etc/miniupnpd.conf and add
    ext_perform_stun=yes
    ext_stun_host=stun.onesuite.com
    and manually launch miniupnpd -d -f /var/etc/miniupnpd.conf

    please take in mind that i don't know what/who onesuite.com is, it report your wan ip address.
    anothe public stun server is stun.stunprotocol.org
    STUN=
    Session Traversal Utilities for NAT (STUN) is a protocol that serves
    as a tool for other protocols in dealing with Network Address
    Translator (NAT) traversal. It can be used by an endpoint to
    determine the IP address and port allocated to it by a NAT

    maybe we can add this options to miniupnp webgui if it's missing and it's needed, idk



  • @kiokoman said in UPnP not working:

    Session Traversal Utilities for NAT (STUN) is a protocol that serves
    as a tool for other protocols in dealing with Network Address
    Translator (NAT) traversal. It can be used by an endpoint to
    determine the IP address and port allocated to it by a NAT

    maybe we can add this options to miniupnp webgui if it's missing and it's needed, idk

    You can create feature request on the redmine.pfsense.org for this.
    it's easy to add to WebGUI, and it may be useful for some ISPs issues.

    but https://redmine.pfsense.org/issues/10398 needs to be resolved first


Log in to reply