UPnP support

databeestje

Oh noes!

Do not run the miniupnpd on port 1900!

That's for the MCAST socket. Which is probably the cause of other programs stumbling
A random 2500-5000 high port for the HTTP server should suffice.

start miniupnpd with -i vr0 -a 192.168.42.254 -p 2869

e.g. client send mcast query to port 1900.

miniupnpd responds with location http://$ip:$port

e.g. http://192.168.42.254:2869

Which is correct. So don't start miniupnpd on port 1900!

ZPrime

OK, I'll try this. I just used the copy of system.inc from your website and that was the value defined in it I guess. :)

I'll make the port change tonight and test again.

ZPrime

Changing the port (I used 2898) didn't do anything. Here's another capture after that change. (PCAP format again)

I'm starting to think that the SSDP packets (the response to the "M-SEARCH" queries) aren't thorough enough, since the Linksys provides more data than miniupnpd does.
For instance, the Xbox does a discovery for WANIPConnection:

M-SEARCH * HTTP/1.1
Host: 239.255.255.250:1900
Man: "ssdp:discover"
MX: 2
ST: urn:schemas-upnp-org:service:WANIPConnection:1

And here are the two responses:
PFSense/miniupnpd

HTTP/1.1 200 OK
Cache-Control: max-age=120
ST: upnp:rootdevice
USN: uuid:00000000-0000-0000-0000-000000000000::upnp:rootdevice
EXT:
Server: miniupnpd/1.0
Location: http://192.168.42.1:2898/rootDesc.xml

Linksys

HTTP/1.1 200 OK
ST:urn:schemas-upnp-org:service:WANIPConnection:1
USN:uuid:000f-6657-a36802e44090::urn:schemas-upnp-org:service:WANIPConnection:1
Location: http://192.168.42.254:5431/dyndev/uuid:000f-6657-a36800e44090
Server: Custom/1.0 UPnP/1.0 Proc/Ver
EXT:
Cache-Control:max-age=1800
DATE: Tue, 22 Aug 2006 00:09:47 GMT

As you can see, the Linksys is outputting a few parts differently. On the Linksys, the "ST:" line is identical to the ST that the Xbox was requesting. On PF, it is not (miniupnpd appears to only have one type of response). I think this is the root of the problem - since the answer to the XBox's query doesn't exactly match, it doesn't attempt to connect to the daemon's unicast port and do a normal mapping routine.

Can we change miniupnpd so it parrots back the right response?

Skud

I've tried it out and although I couldn't get the package to work, I did get it working via the manual instructions.

So far I've tested it with:

Limewire 4.12.4 (Rules add and delete properly)
uTorrent (Rules add and delete properly)
Windows Live Messenger (Again, works properly and the connection diagnostics report that I am "Connected to the internet via a uPnP Symmetric NAT"
uPnPTest (All Passed except for rule#6 because I don't use the windows firewall service and have it disabled)

As for the package, it would install and it was listed on the main page. I chose my interface, but nothing would ever appear in the logs. I even ran "miniupnpd with -i xl0 -a 10.1.42.1 -p 2869" and still nothing. So, I did the manual installation and it worked.

Keep it up people!!

Since I don't have paypal (yes, I know I'm weird and all that stuff) I'm going to have bradenmcg paypal it for me and I'll just pay him back since we work together..

Thanks guys!!
Riley

Skud

Spoke too soon.

The mappings still appear to work, but when I view the states in the web interface I get the following error:

"Fatal error: Call to undefined function: gettext() in /usr/local/www/status_upnp.php on line 57"

Riley

sullrich

You need to upgrade to RC2e or later. Search the forum for RC2e.

Skud

Ahh, yeah, that's it..

I had installed 2e a couple of days ago and I bet when I installed the uPnP update manaully, I overwrote some of those files..

It's working now.

Riley

ZPrime

So Windows Messenger likes it, but not the 360. Weird.

I wonder if it would play nice with the original Xbox…

Would this UPnP book from Intel be useful at all? I'd donate a copy to databeestje or any of the other developers if it would help implementation along.

I've also found a "royalty free" UPnP framework from EBS Embedded Software. I'm inquiring about pricing as well as licensing terms - if I can just plunk down cash for a framework that is 100% compliant and it can just be dropped in, this would be fantastic… as PFSense could then lay claim to be the first open firewall that fully supports UPnP. It might be worth doing even if the UPnP subsystem would have to be distributed separately as binaries/no source due to licensing issues. Free/Open and most Linux flavors do this sort of thing already anyway and it doesn't hurt them at all. That part would of course be up to our wonderful dev team though. ;D

ZPrime

Well, EBS's royalty free framework is $12,000. I don't mind dropping some benjamins here and there to help progress along on OSS that i believe in, but I don't have 12k to blow for pfSense, unfortunately. ;D

Skud

I've been doing a little more testing and I found that it's working 100% on my LAN interface, but it's not quite working on my WLAN interface.

Quick rundown

WLAN –> Linksys WRT54G being used as an AP. It's UPnP and DHCP are turned off. The WLAN NIC in the pfsense box is connected to port 1 on the Linksys (not the WAN port)

Here is the log output from a MSN Live messenger sign-on from a laptop connected to the WLAN interface. MSN reports it is connected to the internet through a NON-UPnP symmetric NAT router.

Aug 23 23:06:19 	miniupnpd[541]: SSDP M-SEARCH packet received from 192.168.1.200:62964
Aug 23 23:06:19 	miniupnpd[541]: ST: urn:schemas-upnp-org:service:WANPPPConnection:1
Aug 23 23:06:19 	miniupnpd[541]: SSDP M-SEARCH packet received from 192.168.1.200:62964
Aug 23 23:06:19 	miniupnpd[541]: ST: urn:schemas-upnp-org:service:WANIPConnection:1
Aug 23 23:06:18 	miniupnpd[541]: SSDP M-SEARCH packet received from 192.168.1.200:62964
Aug 23 23:06:18 	miniupnpd[541]: ST: urn:schemas-upnp-org:service:WANPPPConnection:1
Aug 23 23:06:18 	miniupnpd[541]: SSDP M-SEARCH packet received from 192.168.1.200:62964
Aug 23 23:06:18 	miniupnpd[541]: ST: urn:schemas-upnp-org:service:WANIPConnection:1
Aug 23 23:06:18 	miniupnpd[541]: SSDP M-SEARCH packet received from 192.168.1.200:62964
Aug 23 23:06:18 	miniupnpd[541]: ST: urn:schemas-upnp-org:service:WANPPPConnection:1
Aug 23 23:06:18 	miniupnpd[541]: SSDP M-SEARCH packet received from 192.168.1.200:62964
Aug 23 23:06:18 	miniupnpd[541]: ST: urn:schemas-upnp-org:service:WANIPConnection:1
Aug 23 23:06:17 	miniupnpd[541]: SSDP M-SEARCH packet received from 192.168.1.200:62964
Aug 23 23:06:17 	miniupnpd[541]: ST: urn:schemas-upnp-org:service:WANPPPConnection:1
Aug 23 23:06:17 	miniupnpd[541]: SSDP M-SEARCH packet received from 192.168.1.200:62964
Aug 23 23:06:17 	miniupnpd[541]: ST: urn:schemas-upnp-org:service:WANIPConnection:1
Aug 23 23:06:17 	miniupnpd[541]: SSDP M-SEARCH packet received from 192.168.1.200:62964
Aug 23 23:06:17 	miniupnpd[541]: ST: urn:schemas-upnp-org:service:WANPPPConnection:1
Aug 23 23:06:17 	miniupnpd[541]: SSDP M-SEARCH packet received from 192.168.1.200:62964
Aug 23 23:06:17 	miniupnpd[541]: ST: urn:schemas-upnp-org:service:WANIPConnection:1
Aug 23 23:06:16 	miniupnpd[541]: SSDP M-SEARCH packet received from 192.168.1.200:62964
Aug 23 23:06:16 	miniupnpd[541]: ST: urn:schemas-upnp-org:service:WANPPPConnection:1
Aug 23 23:06:16 	miniupnpd[541]: SSDP M-SEARCH packet received from 192.168.1.200:62964
Aug 23 23:06:16 	miniupnpd[541]: ST: urn:schemas-upnp-org:service:WANIPConnection:1

Here is a WORKING sample from a MSN Live messenger sign-on from a PC connected to the LAN side. MSN reports it is connected to the internet through a UPnP Symmetric NAT router. As you can see there is quite a bit more output and more stuff going on.

Aug 23 23:16:33 	miniupnpd[2952]: SOAPAction: urn:schemas-upnp-org:service:WANIPConnection:1#DeletePortMapping
Aug 23 23:16:33 	miniupnpd[2952]: HTTP REQUEST : POST /control/WANIPConnection (HTTP/1.1)
Aug 23 23:16:33 	miniupnpd[2952]: Port 42193 protocol TCP allready redirected to 10.1.42.100:42193
Aug 23 23:16:33 	miniupnpd[2952]: AddportMapping TCP, for 10.1.42.100, port 42193, description : miniupnpd
Aug 23 23:16:33 	miniupnpd[2952]: SOAPAction: urn:schemas-upnp-org:service:WANIPConnection:1#AddPortMapping
Aug 23 23:16:33 	miniupnpd[2952]: HTTP REQUEST : POST /control/WANIPConnection (HTTP/1.1)
Aug 23 23:16:33 	miniupnpd[2952]: GetSpecificPortMappingEntry : rhost='(null)' 42193 TCP found => 10.1.42.100:42193 desc='miniupnpd'
Aug 23 23:16:33 	miniupnpd[2952]: SOAPAction: urn:schemas-upnp-org:service:WANIPConnection:1#GetSpecificPortMappingEntry
Aug 23 23:16:33 	miniupnpd[2952]: HTTP REQUEST : POST /control/WANIPConnection (HTTP/1.1)
Aug 23 23:16:33 	miniupnpd[2952]: SOAPAction: urn:schemas-upnp-org:service:WANIPConnection:1#GetExternalIPAddress
Aug 23 23:16:33 	miniupnpd[2952]: HTTP REQUEST : POST /control/WANIPConnection (HTTP/1.1)
Aug 23 23:16:33 	miniupnpd[2952]: GetSpecificPortMappingEntry : rhost='(null)' 42193 TCP found => 10.1.42.100:42193 desc='miniupnpd'
Aug 23 23:16:33 	miniupnpd[2952]: SOAPAction: urn:schemas-upnp-org:service:WANIPConnection:1#GetSpecificPortMappingEntry
Aug 23 23:16:33 	miniupnpd[2952]: HTTP REQUEST : POST /control/WANIPConnection (HTTP/1.1)
Aug 23 23:16:33 	miniupnpd[2952]: AddportMapping TCP, for 10.1.42.100, port 42193, description : MSGR
Aug 23 23:16:33 	miniupnpd[2952]: SOAPAction: urn:schemas-upnp-org:service:WANIPConnection:1#AddPortMapping
Aug 23 23:16:33 	miniupnpd[2952]: HTTP REQUEST : POST /control/WANIPConnection (HTTP/1.1)
Aug 23 23:16:33 	miniupnpd[2952]: SOAPAction: urn:schemas-upnp-org:service:WANIPConnection:1#GetSpecificPortMappingEntry
Aug 23 23:16:33 	miniupnpd[2952]: HTTP REQUEST : POST /control/WANIPConnection (HTTP/1.1)
Aug 23 23:16:33 	miniupnpd[2952]: QueryStateVariable(0"><m:varname>ConnectionStatusAug 23 23:16:33 	miniupnpd[2952]: SOAPAction: urn:schemas-upnp-org:control-1-0#QueryStateVariable
Aug 23 23:16:33 	miniupnpd[2952]: HTTP REQUEST : POST /control/WANIPConnection (HTTP/1.1)
Aug 23 23:16:33 	miniupnpd[2952]: QueryStateVariable(0"><m:varname>ConnectionStatusAug 23 23:16:33 	miniupnpd[2952]: SOAPAction: urn:schemas-upnp-org:control-1-0#QueryStateVariable
Aug 23 23:16:33 	miniupnpd[2952]: HTTP REQUEST : POST /control/WANIPConnection (HTTP/1.1)
Aug 23 23:16:33 	miniupnpd[2952]: SSDP M-SEARCH packet received from 10.1.42.100:47879
Aug 23 23:16:33 	miniupnpd[2952]: ST: urn:schemas-upnp-org:service:WANPPPConnection:1
Aug 23 23:16:33 	miniupnpd[2952]: SSDP M-SEARCH packet received from 10.1.42.100:47879
Aug 23 23:16:33 	miniupnpd[2952]: ST: urn:schemas-upnp-org:service:WANIPConnection:1
Aug 23 23:16:33 	miniupnpd[2952]: SSDP M-SEARCH packet received from 10.1.42.100:47879
Aug 23 23:16:33 	miniupnpd[2952]: ST: urn:schemas-upnp-org:service:WANPPPConnection:1
Aug 23 23:16:33 	miniupnpd[2952]: SSDP M-SEARCH packet received from 10.1.42.100:47879
Aug 23 23:16:33 	miniupnpd[2952]: ST: urn:schemas-upnp-org:service:WANIPConnection:1
Aug 23 23:16:32 	miniupnpd[2952]: SSDP M-SEARCH packet received from 10.1.42.100:47879
Aug 23 23:16:32 	miniupnpd[2952]: ST: urn:schemas-upnp-org:service:WANPPPConnection:1
Aug 23 23:16:32 	miniupnpd[2952]: SSDP M-SEARCH packet received from 10.1.42.100:47879
Aug 23 23:16:32 	miniupnpd[2952]: ST: urn:schemas-upnp-org:service:WANIPConnection:1
Aug 23 23:16:32 	miniupnpd[2952]: SSDP M-SEARCH packet received from 10.1.42.100:47879
Aug 23 23:16:32 	miniupnpd[2952]: ST: urn:schemas-upnp-org:service:WANPPPConnection:1
Aug 23 23:16:32 	miniupnpd[2952]: SSDP M-SEARCH packet received from 10.1.42.100:47879
Aug 23 23:16:32 	miniupnpd[2952]: ST: urn:schemas-upnp-org:service:WANIPConnection:1
Aug 23 23:16:31 	miniupnpd[2952]: SSDP M-SEARCH packet received from 10.1.42.100:47879
Aug 23 23:16:31 	miniupnpd[2952]: ST: urn:schemas-upnp-org:service:WANPPPConnection:1
Aug 23 23:16:31 	miniupnpd[2952]: SSDP M-SEARCH packet received from 10.1.42.100:47879
Aug 23 23:16:31 	miniupnpd[2952]: ST: urn:schemas-upnp-org:service:WANIPConnection:1
Aug 23 23:16:31 	miniupnpd[2952]: SSDP M-SEARCH packet received from 10.1.42.100:47879
Aug 23 23:16:31 	miniupnpd[2952]: ST: urn:schemas-upnp-org:service:WANPPPConnection:1
Aug 23 23:16:31 	miniupnpd[2952]: SSDP M-SEARCH packet received from 10.1.42.100:47879
Aug 23 23:16:31 	miniupnpd[2952]: ST: urn:schemas-upnp-org:service:WANIPConnection:1</m:varname></m:varname>

I will do a little bit more testing in case it might actually be the Linksys that I am using as an AP. Maybe it is trying to proxy the UPnP packets even though it's UPnP is turned off.

I was originally using my pfsense box as an AP with a wireless card, but it started dropping packets tonight and I needed it. So I hooked up the linksys to use as an AP instead.

Thanks!!
Riley

sullrich

Unfortunately right now the package is limited to LAN. We can expand it down the road once we verify it works correctly on the LAN interface.

Skud

@sullrich:

Unfortunately right now the package is limited to LAN. We can expand it down the road once we verify it works correctly on the LAN interface.

Gotcha..

Riley

sullrich

Anyone else tested UPnP?

Superman

I have it running!

It's been working fine since I got direction how to enable it. The few applications I use that employ it have worked fine so far. But without more extensive logging (I have the package version) I'm unable to tell if Microsoft Live Messenger is working or not, or if any communication is being made. My client works fine, it always did, uPnP or not.

Anyway all seems well so far!

Thanks! :D

Superman

Okay a further update.

I could not get Windows Live Messenger to work properly. Just regular chat works fine, but video/audio doesn't. I saw in the status page that port 0 had been opened to my internal IP, which of course didn't work. Nothing more was in the regular system log, so I don't have any more information to give.

Just that when I received an invite and accepted it didn't show that I had on the other end, when I made an invite the invite wasn't even showing on the other end…

Thanks.

ZPrime

Can you try nuking the package and installing the standalone by hand? there have been some updates made to the miniupnpd binary and it's possible that whoever made the original package didn't update it when DB (i can't spell his handle right now) updated the binary on his site… ?

Superman

Interestingly, just as I was about to try the above suggestion, a new version of Windows Live Messenger came down the pipe. It still opens port "0" in miniupnpd but it works. At least it worked when testing it out talking to my brother who interestingly is also behind a pfSense firewall, but without miniupnpd installed! I'll have to try it out with some of my friends who are behind Linksys/D-Link or whatever variety of home routers and see if it works with them too. I think M$ must of fixed/changed something with it's upnp protocol in the newest client…

(Just in case I wasn't clear enough, this is still with the package version installed.)

databeestje

joy!

rsw686

@sullrich:

Anyone else tested UPnP?

I tested it out on my embedded box. I used the links for the files on page 1 and 2 but those files appeared out of date. After some diff comparisons I changed the files on my RC2h box and got it working. Azerus successfully works with upnp. Only thing is I'm not seeing any logs in the system log and my firewall log is filled with accepted packets.

Its late here so tomorrow if I get some free time I'm going to try and figure this out better. Anybody have the correct files for RC2h. I just don't want to overwrite bug fixes. I'll make a list of the upnp changes I found and made and see if I missed something.

ZPrime

databeestje, any changes/updates in response to my XBox problems?