miniupnpd stale EXTIP

Miniupnpd comes with the script iptables_init.sh, which among other things adds an iptables rule:

#adding the rule to MINIUPNPD
$IPTABLES -t nat -A PREROUTING -d $EXTIP -i $EXTIF -j MINIUPNPD

Unfortunately, this rule isn’t replaced when the connection is dropped (and the router gets a new dynamic IP). OpenWRT does have a hotplug script:

[ "$ACTION" = "ifup" -a "$INTERFACE" = "wan" ] && \
/etc/init.d/miniupnpd enabled && \
/etc/init.d/miniupnpd restart

Problem here is that /etc/init.d/miniupnpd enabled returns false! It’s a function defined in /etc/rc.common that checks for /etc/rc.d/S95miniupnpd. So the solution is:

ln -s /etc/init.d/miniupnpd ./S95miniupnpd

Realistically, the ipkg should come with this file (effectively enabling miniupnpd by default). A more robust solution would be to modify the hotplug script so that it restarts the daemon without the enabled check, and rely on the restart function not to start the daemon if it wasn’t already running.

Tags: , ,

3 Responses to “miniupnpd stale EXTIP”

  1. d43m0n says:

    I have PPPoE WAN connection, and the above does not seem to work for me. /etc/hotplug.d/iface/20-miniupnpd script works only when the interface is called “wan”, however this is not the case for ppp connections. (At least when other endpont terminates or you send a HUP signal to your pppd.)
    [ "$ACTION" = "ifup" -a "$INTERFACE" = "wan" ] && /etc/init.d/miniupnpd enabled
    However take a look at /usr/bin/iptables_init.sh , there the
    $IPTABLES -t nat -A PREROUTING -d $EXTIP -i $EXTIF -j MINIUPNPD
    line, where -d $EXTIP does not seem to be necessary. I’ve changed that line to
    $IPTABLES -t nat -A PREROUTING -i $EXTIF -j MINIUPNPD
    and it seems to work well.
    Take a look at Kamikaze’s default firewall setup
    iptables -t nat -L -v
    and the prerouting_wan chain there, that neither includes your external IP. So it might better fit Kamikaze’s concept this way.
    Please note that miniupnpd won’t be restarted at IP change this way, I don’t know whether it’s important for the UPnP clients to know the external IP, and how they will get aware of it without kicking them out via a restart.
    (sorry for my bad English)

  2. Dean says:

    The $EXTIP check does seem to be unwarranted.

    The $INTERFACE variable in the hotplug script is coming in from scripts such as /sbin/ifdown, which take the “interface” name from /etc/config/network. See for example /etc/hotplug.d/iface/00-netstate and then cat /var/state/network: the $INTERFACE is definitely getting passed as “lan”, “wan” etc. rather than the physical interface like eth0 or ppp0.

  3. d43m0n says:

    You are right Dean. I totally misunderstood it. Now I see that miniipnpd gets restarted for me too.

    So either don’t do my suggested modification, or do it also on the other side:
    in /usr/bin/iptables_removeall.sh from:
    $IPTABLES -t nat -D PREROUTING -d $EXTIP -i $EXTIF -j MINIUPNPD
    to:
    $IPTABLES -t nat -D PREROUTING -i $EXTIF -j MINIUPNPD
    Else your pre-routing table will fill up with several jumps to miniupnp table after a few reconnect, degrading the performance of the firewall.

Leave a Reply

Your email address will not be published.

*

You may use these HTML tags and attributes: <a href="" title=""> <abbr title=""> <acronym title=""> <b> <blockquote cite=""> <cite> <code> <del datetime=""> <em> <i> <q cite=""> <strike> <strong>