How do I fix my firewall to enable minimwatch on laptop to talk to NAS

The subscription and notification in UPnP work over TCP. The UDP messages we see are most likely responses to initial discovery (SSDP) which does work over UDP. So we are not there yet at all. The suggested ipset trick only allows UPnP discovery responses. As control messages are sent in direction from client to server over TCP/HTTP and outgoing traffic is normally unrestricted and responses are clearly related, no special firewall settings are needed once discovery completed.

When client subscribes to even notifications it informs server in subscription message about TCP port where server can post events. I do not see how this port can be detected without parsing subscription message.

I would love to see traffic dump between server and client without firewall.

Hi arvidjaar,
I too would like to see the unfiltered traffic as you say. I have been thinking the same thing myself for a while and had been trying to do this using nmap or wireshark. Unfortunately I have not used either for a long time and there is a very steep learning curve. Even if I saw the output I wouldn’t necessarily understand it! If you have any suggestion which might help please let us know as I am sure my problem is not unique.
Regards,
Budge

So save raw packet trace as pcap/pcapng file (depending on your wireshark version) and make result available.

Just lost 10 minutes typing of my procedures on what I did to help understand the capture file trying to sort out susepaste. Will now try and send the file first and then add the explanation.

OK lets see if this paste works:-

https://susepaste.org/d192e9ea

This should make it possible to download the wireshark capture of the minimwatch traffic and help sort out the handshake between laptop and minimserver.
Details of what I did to follow when asked!

No, that won’t work. You didn’t upload the output to susepaste. Instead just a link to an archive file on your local computer.

I feared as much. Will try again but the file is saved in pcapng. How on earth can I put this into susepaste please?

https://www.dropbox.com/s/yu4gxr5q664jsf1/Minimwatch_Capture_1.pcapng?dl=0

This might do the trick. I hope I am not broadcasting to the world here.

On reflection this should have been a PM.
Am I correct?

This item was deleted

Sorry about this, the file should now be with you but I PMd it as I didn;t want to broadcast all my MAC addresses etc. Please could you check and see if you have my file in your PM box.
Regards,
Budge

You already posted them in plain text in this thread.

Please could you check and see if you have my file in your PM box.

I have link to dropbox which says folder is empty.

Hi arvidjaar,
Many thanks. I had deleted the original link and thought I had created a new one which I sent by PM. Will check as I might have made a mistake.

My problem I believe was that my PM box was full of old messages and I had reached my limit. It seems my posts from today had all been buffered so you may get all of my attempts. Please forgive.
I hope now you will receive my PM. If you can confirm you have the link working I can scan again with an agreed testing procedure.

There is no point to scan again (although of course explanation what system has which address would have been useful to put it mildly).

Here is subscription request; the CALLBACK is URL that will be used by your server to send notifications to your client:

320    85.433056055    192.168.169.200    192.168.169.130    TCP    74    39014 → 9791 [SYN] Seq=0 Win=64240 Len=0 MSS=1460 SACK_PERM=1 TSval=3440645726 TSecr=0 WS=128
SUBSCRIBE /1cd1d0b8-534a-4565-a133-0f0015702bbb/jminim.org-Monitor2-2/event
HTTP/1.1 Host: 192.168.169.130:9791
**CALLBACK: <http://192.168.169.200:40813/17/>**
NT: upnp:event
TIMEOUT: Second-1800

HTTP/1.1 200 OK
SERVER: Posix/200809.0 UPnP/1.1 ohNet/1.0
SID: uuid:1cd1d0b8-534a-4565-a133-0f0015702bbb-1643
TIMEOUT: Second-1800
Connection: close

and server attempts to establish connection back to port 40813:

330    85.451656834    192.168.169.130    192.168.169.200    TCP    74    46534 → 40813 [SYN] Seq=0 Win=14600 Len=0 MSS=1460 SACK_PERM=1 TSval=1061378795 TSecr=0 WS=128
331    85.451693892    192.168.169.200    192.168.169.130    ICMP    102    Destination unreachable (Host administratively prohibited)

I have no idea, how your application selects this port. There are three SUBSCRIBE requests (the last one successful) and in all three the same port is used. May be application picks it once on startup.

If your application allows you to configure this port you just need to open it for incoming connection from server. Otherwise I am afraid you will need to at least open wide range of ports (basically all ephemeral ports I presume).

… hmm … it appears that ssdp helper from conntrack-tools does support UPnP SUBSCRIBE requests. And it also supports SSDP itself making ipset trick redundant. It is worth a shot. I am surprised nobody mentioned it so far.

Hi arvidjaar,
I apologise again for my clumsiness which caused me to lose my detailed explanations and am just so pleased you have been able quickly to identify the problem.

As I have explained before, I am well outside my experience and understanding. I do wonder why the ipset trick is not working but I shall now look for the ssdp helper for UPnP subscribe.

Many thanks for your explanation.

Regards,
Budge

I have been searching for threads which might help me to use conntrack-tools and SSDP to sort out the UPnP connection.
Sadly not a clue so far. I shall keep looking but hope somebody can help please.
Budge

Firewalld has connection tracking helpers…

…however, I’m not convinced that firewalld caters for sddp connection tracking.

I did find some upnp discussions such as this one…
conntrackd helpers · Issue #5 · firewalld/firewalld · GitHub
which describe using ‘nfct’ (part of ‘conntrack-tools’) to provide user-space connection tracking. I can only provide general advice here…

Initiated with

nfct add helper ssdp inet udp

and suitable iptables rule eg

iptables --verbose -I OUTPUT -t raw -p udp --dport 1900 -j CT --helper ssdp

Depending on nfct version, it might be possible to do something like

nfct add rule filter ct state new tcp dport 1900 ct helper set "ssdp"

More info

man nfct

Hi Deano,
I too have been reading and recognise some of the suggestions you mention.

Before doing more I am pondering a couple of questions:

Why the original fix didn’t work. I wonder if I should persevere with getting that “work around” to work and if not, whether I should undo that fix before trying other solutions.

I also wonder if I should leave the backend set to iptables or revert to nftables. I was under the impression that even with the nftables backend set, iptable settings would still take precedence.

In my ignorance and given the complexity of the problem I wonder if I should try and go back to my original configuration before starting down a new path. How can I do that?

Well, you may try this, it worked for me (i.e. - I verified that incoming connections to ports in question succeed). YMMV.

  1. Enable ssdp user helper in conntrackd.conf:
General {
    HashSize 32768
    HashLimit 131072
    Syslog on
    LockFile /var/run/lock/conntrackd.lock


    UNIX {
        Path /var/run/conntrackd.sock
    }


    SocketBufferSize 262142
    SocketBufferSizeMaxGrown 655355




    # default SUSE systemd service unit file is of Type=notify
    Systemd off
}


Stats {
    LogFile on
}


Helper {
    Type ssdp inet udp {
        QueueNum 5
        QueueLen 10240
        Policy ssdp {
            ExpectMax 8
            ExpectTimeout 300
        }
    }
    Type ssdp inet tcp {
        QueueNum 5
        QueueLen 10240
        Policy ssdp {
            ExpectMax 8
            ExpectTimeout 300
        }
    }
}
  1. Register ssdp helper in kernel:
nfct add helper ssdp inet tcp
nfct add helper ssdp inet udp
  1. Connect user helper to kernel:
systemctl start conntrackd.service
  1. Add rules to invoke ssdp helper:
iptables -t raw -A OUTPUT -p udp --dport 1900 -j CT --helper ssdp
iptables -t raw -A OUTPUT -p tcp --dport 9791 -j CT --helper ssdp

Both UDP and TCP work. Below are created “expectations” (“client” is 192.168.1.1, “server” is 192.168.1.2).

For UDP (SSDP discovery):

296 proto=17 src=0.0.0.0 dst=192.168.1.1 sport=0 dport=12345 mask-src=0.0.0.0 mask-dst=0.0.0.0 sport=0 dport=65535 master-src=192.168.1.1 master-dst=239.255.255.250 sport=12345 dport=1900 PERMANENT class=0 helper=ssdp

It simply tells kernel that incoming packets to UDP (protocol 17) port 12345 are related to existing connection which was to multicast address 239.255.255.250 from port 12345 and so should be accepted as long as firewall rules allow “related” packets (is normal default case).

For TCP (event notification subscription):

296 proto=6 src=192.168.1.2 dst=192.168.1.1 sport=0 dport=40813 mask-src=0.0.0.0 mask-dst=0.0.0.0 sport=0 dport=65535 master-src=192.168.1.1 master-dst=192.168.1.2 sport=58078 dport=9791 class=0 helper=ssdp

It is more or less the same. It says that incoming TCP (protocol 6) connections to port 40813 from host 192.168.1.2 are related to existing connection from host 192.168.1.1 to host 192.168.1.2 port 9791 and so should be accepted as “related”. Note that original connection was from port 58078 (randomly selected) and port 40813 was extracted from SUBSCRIBE packet.

Caveats

  1. In TW conntrackd is configured as Type=notify systemd service. It does not work (conntrackd loops consuming 100% of CPU). When changed to “simple” it works.
  2. There is no start-up service to register user helpers. If you want to automate it you need to write your own service.
  3. conntrackd must
    be started after all helpers in its configuration file have been registered in kernel, otherwise it fails to start. 1. iptables rules must
    be configured after helpers have been registered in kernel, otherwise iptables invocation fails. 1. When firewalld is stopped it removes all netfilter rules and registered helpers. So you cannot simply restart firewall. I think when firewalld is reloaded (using firewall-cmd --reload) helpers are preserved, but I am not sure and I am not going to test it (my curiosity is satisfied so far).
  4. Assuming firewalld preserves user helpers on startup, it is possible to use direct rules. In this case helpers must be registered before
    firewalld is started, otherwise iptables invocation fails. conntrackd itself may be started at any time (as long as it is not started helpers simply will not work). 1. For TCP part you also need to somehow examine incoming packets (notifications) to renew expectation, otherwise it will timeout. But there is no way to match notifications in advance. So either you need to pass every incoming packet to ssdp helper (with obvious performance hit) or jump through the hoops by creating additional rule after SUBSCRIBE packet was parsed and incoming port is known.
  5. Finally - I have no idea whether port 9791 is always correct. UPnP is most firewall-unfriendly protocol I have ever seen. In particular, the actual URL that client must use to subscribe to notifications is part of device description; client gets URL to this description in discovery response, it needs to fetch and parse it. So if you are going to take this route you really need to ask maintainer of your software whether the same fixed port is always used for this purpose. This was the port in your packet capture and this is one of ports mentioned on application site.

What is “original fix”? You do realize that in this 6 pages thread nobody understands anymore to which exact post you refer, do not you?

I was under the impression that even with the nftables backend set, iptable settings would still take precedence.

That’s wrong. Direct rules will be processed by kernel before other nftables rules added by firewalld, that’s correct. Whether they “take precedence” depends on what exactly you mean. For most people this means “I want to allow something that cannot be allowed by firewalld configuration”. I already wrote in multiple threads here that it is impossible to allow anything that is not allowed by firewalld configuration using direct rules with nftables backend. That is how kernel netfilter works.

Hi arvidjaar,
Very many thanks for your detailed reply. Clearly you have done a good deal of work on my behalf and I would like to thank you again. Results so far:-

Minimserver is working correctly and I have a bright green icon in my tray.
A reboot required me to:-

re-register the SSDP helper in kernel,
restart the conntrackd service and
add the rules to invoke the helper.

After a brief pause the icon turned to green.

With respect to your caveats:-

  1. I note systemd off here. Don’t understand why this equates to simple but clearly it worked.
  2. Clearly a start-up service would be helpful but writing this is beyond me without tons of help!
  3. Can registering helpers be included in a start-up script?
  4. Can iptables rules be similarly included in start-up script?
  5. I can try myself and see how I get on but whatever the case needs to be taken into account in the start-up script.
  6. Similarly once detailed behaviour has been confirmed the start-up script can be designed to suit.
  7. Well over my head. I had the impression that once the initial connection had been established, it remained connected but as stated, well over my head! Are there checks I should be doing to ensure we are not getting the performance hit to which you refer?
  8. As far as I am aware TCP ports 9790 and 9791 seem to be standard for this application. I can try and put all of this to Simon the app author who may understand it all but firewalld is quite new and I believe he works mostly in windows.

Please forgive my loose reference to “original fix.” I was referring to these commands:-

firewall-cmd --permanent --new-ipset=upnp --type=hash:ip,port --option timeout=3
firewall-cmd --permanent --direct --add-rule ipv4 filter OUTPUT 0 -d 239.255.255.250/32 -p udp -m udp --dport 1900 -j SET --add-set upnp src,src --exist
firewall-cmd --permanent --direct --add-rule ipv4 filter INPUT 0 -p udp -m set --match-set upnp dst,dst -j ACCEPT

I am trying to remove what has been added but is no longer required and clean up my network configuration by removing the above incorrect commands. I do not know how permanent these are.

Similarly Deano asked my to remove a rule which was not required:-

BTW, you can get rid of this rule (not that it will impact here)
     Code:

     SET        udp  --  anywhere             192.168.169.128/25   udp dpt:ssdp add-set upnp src,src exist 

I have removed it a couple of times but it reappears. No idea where it comes from.

Finally I had already changed the backend to nftables but ask you please to confirm if this was correct. My thinking here was to move forward not back and TW firewall is moving forward all the time and nftables seem to be the new default!

I cannot thank you enough for helping me here. It has been a steep learning experience for me but rather satisfying, given the successful outcome. It has also confirmed my deeply held suspicion of UPnP. Perhaps a better system will be developed one day.
Regards,
Budge