miniupnp.tuxfamily.org

AndyF · Joined: 17 Nov 2015 Posts: 12

Hi, Does miniupnpd support what the IGD2 specs call port triggering.

I mean when a client requests a different internal port to external port then the reverse is also set up so the source port gets changed on outgoing packets.

Section 2.5.16 figure 2.2 in

UPnP-gw-WANIPConnection-v2-Service.pdf

I am using Linux/netfilter

TIA.

miniupnp · Site Admin Joined: 14 Apr 2007 Posts: 1589

I don't think so.

can you provide iptables rules that you use to do port triggering ?
_________________
Main miniUPnP author.
https://miniupnp.tuxfamily.org/

AndyF · Joined: 17 Nov 2015 Posts: 12

It was early days of me trying to solve an issue when I posted.

The term port triggering in the UPnP docs somewhat confuses me as to what they exactly mean as other definitions I've read do indeed seem to be "impossible" with iptables.

I did manage to solve my issue, but I was/am using igd2-for-linux.

The issue is three xbox ones with the game black ops 3.

Previously we had 3 xbox 360s which have now been traded in.

The 360s were easy to get open nat as they would ask for udp 3074 and if they couldn't have it they would ask for and use another port - the "and use" being important here. Games would also use this new port and would have open nat.

The xbox one its self behaves the same = tries for 3074 if it can't have it it gets another port and uses it ( so it will have open nat even on old IGD). Games (well BO3 is only tested so far) are different, they also try for a port = 3075 for BO3 but if they can't have it they will ask for another but still want to use 3075 internally.

So with IGDv1 behavior the xbox ones ones will show open nat but at least 2 out of 3 games will have moderate nat.

I use linux from scratch and a little DC PC as a router and other things.

The "fix" for me was a lazy and so far incomplete copy & paste hack to the idg2-for-linux code, which is only really going to work for me on my setup.

The hack is that when the game asks to open a port I also set up a masq rule for outbound connections from that internal host:port that maps to the new external port. This seems to be what IGD2 requires - and it certainly gets me open nat for BO3 all 3 consoles.

Here's how it looks from logs the line starting ADF is my "hack".

miniupnp · Site Admin Joined: 14 Apr 2007 Posts: 1589

OK, I see what should be done.
_________________
Main miniUPnP author.
https://miniupnp.tuxfamily.org/

miniupnp · Site Admin Joined: 14 Apr 2007 Posts: 1589

see https://github.com/miniupnp/miniupnp/issues/166
_________________
Main miniUPnP author.
https://miniupnp.tuxfamily.org/

miniupnp · Site Admin Joined: 14 Apr 2007 Posts: 1589

Wont it work with

miniupnp · Site Admin Joined: 14 Apr 2007 Posts: 1589

miniupnp · Site Admin Joined: 14 Apr 2007 Posts: 1589

i'm not even sure addpeernatrule() works ...
_________________
Main miniUPnP author.
https://miniupnp.tuxfamily.org/

AndyF · Joined: 17 Nov 2015 Posts: 12

Bit late - I didn't get any mail notifications for the latest posts.

On SNAT vs MASQUERADE, I did MASQUERADE because that's what I use as my IP address is dynamic. I used to have a static with a previous ISP and would have used SNAT if I were still with them.

I don't know about PCP-PEER or if xbox would use PCP at all.

I notice that the example appends -A, but you would really need to insert -I anything in POSTROUTING or the connection would get caught by the normal/resident SNAT/MASQUERADE rule that will typically be there already.

miniupnp · Site Admin Joined: 14 Apr 2007 Posts: 1589

I implemented the MASQUERADING rule :
https://github.com/miniupnp/miniupnp/tree/postrouting
_________________
Main miniUPnP author.
https://miniupnp.tuxfamily.org/

miniupnp · Site Admin Joined: 14 Apr 2007 Posts: 1589

I'm adding a specific chain for miniupnpd rules

AndyF · Joined: 17 Nov 2015 Posts: 12

Cool, I can't say when exactly but I will test (after re-reading the other xbox one thread) sometime.

I think the new table will need to be inserted rather than appended.

Edit I mean the jump to the new chain.

miniupnp · Site Admin Joined: 14 Apr 2007 Posts: 1589

AndyF · Joined: 17 Nov 2015 Posts: 12

Yes, you are right - I guess it could be quite a pain/source of error for you having to support varied platforms and needing to know what they do and in what order.

As an LFS user I don't have/use all these "normal" scripts so I get to break/mend my own stuff Smile

So yea when I get to test I will just adjust my setup to suit.

Currently using hacked/IGD2 I need to insert as I am working directly in POSTROUTING. I will need miniupnpd to come up before my iptables to use as is.

AndyF · Joined: 17 Nov 2015 Posts: 12

I got to test today, didn't try anything "special" with the build used the default config.h and only changed a few things in miniupnpd.conf. Adjusted iptables_init.sh to fit with my existing setup.

The .conf diff is just as below (posted in case I did something stupid being a total beginner with miniupnpd!

In summary it works OK - the xboxes and the game open the ports/react to taken ports just as with my existing setup but there is one potential issue.

The xbones themselves seem to be consistent in what port they ask for (I guess because they are getting the same IP from DHCP) if their first choice is gone.

The game (black ops 3) isn't. It requests 3075 and if if it's gone it requests some other apparently random port 3xxx.

Why is this an issue - well it may not be by luck for this game (need more time to test) but this is what I get when I tested by bringing up XB_1+ the game then bringing up XB_2 + the game.