UPnP and multiple Xbox 360s (4-8)

forum

it,s a serch on the site. or some swedish det är en sök sida här nånstans. can,t i play with you ? what,s your namne on xbox live ?

xcrustwadx

It is not a big deal the mappings are left in place, except for having that port always being forwarded. I think there is a menu choice in the xbox 360 so you can delete the mapping manually, however it might be easier to just restart the service.

How would I schedule the miniupnpd service to restart at 7:30AM every morning? I would like those upnp entries cleared every morning when no one is playing. I was scared to mess around with the crontab file since it stated that it is best to not edit the file manually.

Would it be something like

minutes - 30
hours 7
day *
month*
etc ?

command = /etc/init.d/miniupnpd restart?
(I'm new to Freebsd)

The reason I am asking is because after there were about 8-10 residual upnp entries for the xbox 360s on my network and after a few days, none of the Xbox 360s were able to connect to Xbox Live (similar to the symptoms I experienced pre-RSW patch to miniupnpd). After I cleared the upnp entries (and the miniupnpd service was restarted) via the web interface and rebooted the Xbox 360s I was OK. I normally manually restart the service but I would like to avoid using the web interface every day to do so.

It also seems like when two or more Xbox 360s are powered on at the same time (or very close together), one or more will fail to connect to Xbox Live the first couple times we try to connect. Is this normal?

Thank you for your help.

rsw686

You would need to backup your config, add the cron item, and then restore your config.

<cron><minute>30</minute>
<hour>7</hour>
<mday></mday>
<month></month>
<wday>*</wday>
<who>root</who>
<command></command>/usr/local/sbin/upnp_support restart</cron>

Since miniupnpd is supported with the livecd there is no rc file as the commands are php functions. You would need to download the following file. I would place it under /usr/local/sbin/. This will allow to interface miniupnpd from the command line.

http://wgnrs.dynalias.com/pfsense/miniupnpd/upnp_support

xcrustwadx

Hey thanks for the script… That's a lot of work for you to write! I will try it tonight and let you know how it works.

rsw686

@xcrustwadx:

Hey thanks for the script… That's a lot of work for you to write! I will try it tonight and let you know how it works.

Your welcome! I am the miniupnpd maintainer and the script was a way for me to easily test out builds.

xcrustwadx

The script seems to be working AOK. However my time/date is set incorrectly. I did "date 0711151223" from SSH to set it to 12:20 11/15 but I'm not sure this is the proper way. What is the proper way to set the time and date in Pfsense?

rsw686

@xcrustwadx:

The script seems to be working AOK. However my time/date is set incorrectly. I did "date 0711151223" from SSH to set it to 12:20 11/15 but I'm not sure this is the proper way. What is the proper way to set the time and date in Pfsense?

The date and time is set automatically via ntp. Make sure your timezone is set correctly on the System -> General page.

xcrustwadx

ok time is now set properly via the general menu. Sorry, I glanced there for a time setting but I missed it. Should have done CTRL+F. Thank you.

xcrustwadx

OK. The script/cron job definately works. I just checked the upnp status and it's completely cleared! This is great.

Are there any plans to build in a timeout for upnp port mappings?

The reason I ask is because it has been said that Xbox never bothers to release the ports when it is powered off (which I can certainly say is true from firsthand experience). I know that this is actually a problem with the implementation on the Xbox's end and not with miniupnpd but restarting the service every morning seems like it may not be the best solution. If there is any way I can help, please let me know.

rsw686

My debate about adding it into miniupnpd is deciding when is the port inactive. I'm not sure how easy it is to see the last activity since once the rule is created pfSense is dealing with the redirects not miniupnpd. I'll contact the miniupnpd author and see what his opinion is on this.

xcrustwadx

1. Can I manually remove one upnp record/mapping without restarting the entire service and clearing ALL mappings?

2. Would it be feasible for me to write a custom script that removes a particular upnp port mapping once the DHCP lease that requested it expires?

Im starting to think… why incorporate a band-aid into the code of miniupnpd, which works fine, that is a workaround for a problem that should be solved on Microsoft's end... ie send the "I'm done with this upnp mapping, you can remove it now." packet. I'd rather make an "external" band-aid to avoid adverse effects on miniupnpd(a script for instance).

I'm not too clear on how DHCP protocol works but the pfsense web UI seems to know when a host is down and no longer using its lease.

rsw686

@xcrustwadx:

1. Can I manually remove one upnp record/mapping without restarting the entire service and clearing ALL mappings?

2. Would it be feasible for me to write a custom script that removes a particular upnp port mapping once the DHCP lease that requested it expires?

Miniupnpc is the client which can talk to miniupnpd. You would need to compile this for pfSense. Then it could be used to tell miniupnpd to remove a mapping. This is something that could be added to the pfSense UPnP implementation. I could see this being useful for others.

The easiest way to compile for the pfSense platform is to use the pfSense Developers edition. I think you can still get this on the snapshot server.

@xcrustwadx:

I'm not too clear on how DHCP protocol works but the pfsense web UI seems to know when a host is down and no longer using its lease.

True, but that is a bandaid fix as well. Not everyone is going to want or need that feature. The DHCP protocol marks the lease as inactive when its renewal time expires and the host has not renewed the lease. However some people set this time limit to days.

rsw686

I forgot to mention that if you use Windows XP you can remove the mappings by going to the Network Connections folder. Right click on Internet Connection click Properties, click Settings, and you can delete individual mappings.

xcrustwadx

Thanks for the tip. You need the Windows XP uPnP UI installed on the XP machine first and then this will work. I have just used it. Im currently using VM to install pfsense dev beta 1 and I will attempt to compile the miniupnpc.

rsw686

@xcrustwadx:

Thanks for the tip. You need the Windows XP uPnP UI installed on the XP machine first and then this will work. I have just used it. Im currently using VM to install pfsense dev beta 1 and I will attempt to compile the miniupnpc.

I just built miniupnpc successfully use gmake. You'll need to add gmake using

pkg_add -r gmake

To build

/usr/local/bin/gmake

From here you could add check boxes next to the mappings on the UPnP Status page and a remove button. You could even write a script to search the current mappings and then remove any with xbox in them at 7:30 in the morning. Or if you want to get detailed write the script to compare the mappings with the dhcp leases and remove the inactive ones.

rsw686

@rsw686:

From here you could add check boxes next to the mappings on the UPnP Status page and a remove button. You could even write a script to search the current mappings and then remove any with xbox in them at 7:30 in the morning. Or if you want to get detailed write the script to compare the mappings with the dhcp leases and remove the inactive ones.

Turns out that the new version of miniupnpd can clean out old mappings. I have compiled the binary and updated the webgui. The other improvement is called secure mode which locks down clients to only creating mappings to their IP. If anybody would like to test it out and let me know how it works that would be great. I plan on adding this into the cvs for 1.3, but for now you can update your 1.2 version with the following.


cd /tmp
fetch http://wgnrs.dynalias.com/pfsense/miniupnpd/upnp_support
chmod +x upnp_support
./upnp_support update

Afterwards you'll need to reconfigure upnp via the webgui. Please note that if you don't like the new version you'll have to manually restore the old files.

hoba

@rsw686:

Afterwards you'll need to reconfigure upnp via the webgui. Please note that if you don't like the new version you'll have to manually restore the old files.

Or reapply the 1.2 release full update that will reset all files back to release versions ;)

xcrustwadx

RSW686: I just saw your post sorry it took so long. I check back here occasionally. I have applied the patch you posted on March 17 and I will test this weekend for sure at my secondary location. I will also attempt to try at my other location which has the multiple Xbox 360s.

Does the "upnp bypassing the traffic shaper problem" still happen in 1.2 final? If so is this in the works for 1.3?

rsw686

@xcrustwadx:

Does the "upnp bypassing the traffic shaper problem" still happen in 1.2 final? If so is this in the works for 1.3?

There is a way to compile miniupnpd to use an ALTQ queue. I'm not sure how this would tie in with the traffic shaper.

eri--

Well what i recommend is to add an option to tag packets that match the miniupnp nat/rdr/filter rules and not make them terminating ie not use quick.

This is the same at what ftp-proxy on latest openbsd does and it helps a lot catching things up queueing them and so on.

Please suggest to the author of miniupnpd to make this change and be done with it.
One pfSense 1.3 you can match tags from the filter rules created in the gui.

This is the best design and would make miniupnd compeletely standalone and not watching at other information it does not need to.

I do not know if PNP protocol supports classes but if it does it would be nice to allow the option to specify one tag to be applied to specific traffic served by this daemon and then matched by tag from the user so to shape or not allow it at all.

I hope this helps you somewhat.
As for the change iirc it is just ~10 lines of changes max.