Added chain rule to filter table so udp stun incoming connections rul… #13951
Conversation
|
Not sure why @jjm2473 commit appears on my pull request, nevertheless, I only intended to change firewall.include. I don't know how to fix this in git, can someone help me with some hint? |
|
I think I was able to figure out what I needed to do from here https://openwrt.org/docs/guide-developer/working-with-github-pr . |
|
I added your patch to #13960 . Please test. |
|
#13960 was merged to master. |
|
Eh no. There's a whitespace issue with it. spaces vs tabs. I fixed that in the other PR. Maybe that should be backported instead of this. miniupnpd under 19.07 has been getting backports judging by the history. |
…ections rules works Signed-off-by: Marco Martins <marcomartins86@gmail.com>
|
I am sorry, only today I had the time to fix the space on the commit and test the #13960 on 19.07, and it seems to be working well. |
|
This was merged to 19.07 separately. |
MarcoMartins86
deleted the
openwrt-19.07-fix-miniupnpd-udp-stun-incoming-connections-filter
branch
Maintainer: @neheb @ptpt52
Compile tested: (ath79, tplink_tl-wr941-v2, openwrt-19.07)
Run tested: (ath79, tplink_tl-wr941-v2, openwrt-19.07)
Added to /etc/config/upnpd
option use_stun '1'
option stun_host 'stun.stunprotocol.org'
option stun_port '3478'
Make sure that no UDP rule exists on the firewall to accept all connections and check miniupnpd system logs to see it was successful.
Description:
Fix this issue https://forum.openwrt.org/t/miniupnpd-in-trunk-stun-setup/18688
For the miniupnpd stun protocol to work correctly to find out the external IP address dynamically, it opens rules in the table 'filter' to receive incoming UDP connections for the router IP but there was no chain rule on the zone input referencing the MINIUPNPD table and so it couldn't receive the expected connections.
The fix was to add a chain rule in the zone input to check the MINIUPNPD table before rejecting all connections.
Should I make another pull request for the master branch? I will not be able to test this on the new version.