# Shorewall and UPnP/AV [Unsolved]

## Oak

Hi all,

first of all I'm sorry for double posting, but my first instance of this post ended up in the wrong forum.

I'm trying to get my main computer (server) to communicate with my PS3 via UPnP AV, but my knowledge in Shorewall stops me from getting it right.

The server is on 192.168.0.1 and the PS3 is on 192.168.0.5 and everything is setup correctly except Shorewall. If I turn off shorewall and clear all rules from iptables,

everything works just fine. Apparently shorewall is blocking upnp by default, according to iptables output after starting shorewall:

```

root@newt $ cat ~/rules | grep 1900

DROP       udp  --  anywhere             anywhere            udp dpt:1900 

DROP       udp  --  anywhere             anywhere            udp dpt:1900

```

Since these rules are not been created by me, I assume that they are created by default.

After some research I found that these rules are defined in a file called macro.DropUPnP:

```

root@newt $ cat macro.DropUPnP 

#

# Shorewall version 3.4 - DropUPnP Macro

#

# /usr/share/shorewall/macro.DropUPnP

#

#       This macro silently drops UPnP probes on UDP port 1900

#

###############################################################################

#ACTION SOURCE  DEST    PROTO   DEST    SOURCE  ORIGINAL        RATE    USER/

#                               PORT    PORT(S) DEST            LIMIT   GROUP

#Dropping this will cause mediatomb to break... / OakStream

DROP    -       -       udp     1900

#LAST LINE -- ADD YOUR ENTRIES BEFORE THIS ONE -- DO NOT REMOVE

```

If I remove this rule, nothing show up in the iptables output, which is good. However it doesn't fix any of my problem as I still can't find mediatomb from my ps3...

All traffic between the local network (in which my ps3, and of course my server) is resided in, is open on all ports:

```

root@newt $ cat /etc/shorewall/policy 

#

# Shorewall version 3.4 - Policy File

#

# For information about entries in this file, type "man shorewall-policy"

#

# See http://shorewall.net/Documentation.htm#Policy for additional information.

#

###############################################################################

#SOURCE         DEST            POLICY          LOG             LIMIT:BURST

#                                               LEVEL

$FW                     all             ACCEPT

loc                     all             ACCEPT

net                     all             DROP                    ULOG

all                     all             REJECT          ULOG

#LAST LINE -- DO NOT REMOVE

```

Am I missing something here or should I switch firewall script to firestarter or something else?

Any help will be appreciated as I really want to get my ps3 to start acting as a media center as soon as possible, thanks!

----------

## Oak

Sorry for being impatient, but there must be someone here that knows Shorewall better than me?

----------

## Dairinin

What's your routing table, please?

----------

## Oak

```

root@newt $ route

Kernel IP routing table

Destination     Gateway         Genmask         Flags Metric Ref    Use Iface

192.168.0.0     *               255.255.255.0   U     0      0        0 eth0

ua-85-225-112-0 *               255.255.252.0   U     0      0        0 eth1

loopback        *               255.0.0.0       U     0      0        0 lo

default         ua-85-225-112-1 0.0.0.0         UG    0      0        0 eth1

```

----------

## Dairinin

Try to add 239.0.0.0/24 to eth0:

```
route add -net 239.0.0.0/24 eth0
```

----------

## Oak

I read this in the guide for mediatomb. Unfortunately, it didn't change anything.

 :Confused: 

----------

## Dairinin

Do you run linux-igd on the same box?

PS: I presume you have tuned mediatomb for PS3

PPS: Do you have any windows machine in this subnet to test with windows media player? It cannot play from mediatomb, but it sees server at least.

----------

## Oak

Everything is tuned for the PS3 and I don't run linux-igd at all. My girlfriend has a laptop running vista inside this subnet, but I didn't know that wmp

could find upnp servers. I'll try this as soon as I get back home from school and report the result.

[EDIT]

I couldn't get the file sharing in wmp to work so I tried Cidreo on the same windows machine, which found mediatomb instantly.

This is very confusing!

[/EDIT]

----------

## BT

Oak,

I have discovered that the PS3 has problems when connected to a type 3 NAT, which can result in failed connections, lag and disconnections. You can check to see which NAT type you have by doing an Internet Connection Test in the PS3 Network Settings. If you have a type 3 NAT then it requires opening up certain ports to make it a type 2 NAT. This obviously has security implications so you might not want to do this, but you should at least test your NAT to determine it's type. The PS3 documentation has information about the different NAT types and the ports it needs open. I have also found a guide for a Linksys router which might help you with configuring your NAT. I'm not sure if this issue is the cause of your problems, but it's worth a try.

----------

## Oak

It's on type 2 and I'm pretty sure that my network is set up correct, apart from upnp of course.

I'm ready to give up for now, but thank you for trying to help!

----------

## Oak

Hi all,

since I couldn't get this to work, I decided to buy a cheap wireless router instead, which solved everything.

Thanks to all of you who tried to help me!

----------

## johnqdare

I refuse to believe that there isn't some shorewall configuration that will allow upnp for ps3.  I have a server running shorewall which acts as my router and also my upnp server (mediatomb).  With shorewall off, it works.  With shorewall on, it fails.  I'm so spoiled by the features shorewall offers I don't want to go back to a over-the-counter router.  Any help would be greatly appreciated.

----------

## johnqdare

I got my setup to work.  The Details are below if anyone's interested.

System:

Server with 2 network interfaces.   

     eth0 connected to switch...Local Network

     eth1 connected to cable modem....Internet

Running both Shorewall and Mediatomb on the server

I took all the mediatomb rules out of the rules file because they are not needed if you follow this procedure.

I edited my shorewall policy file to ACCEPT from $FW to loc,  and ACCEPT from loc to $FW.

Next when starting mediatomb I passed it the -e flag which lets you specify the interface it binds to.  So my command looked like :

mediatomb -e eth0

Apparently if you have two interfaces, mediatomb tries to bind to the "internet" interface by default which in my case was not suitable.

As soon as I did this the PS3 saw it and everything works great.  Hope this helps somebody.

----------

## eroth

just stumbled across this post today, as I was dealing with similar issues.

johnqdare is correct, but if you are using the mediatomb ebuild from portage, you can specify the MEDIATOMB_INTERFACE in /etc/conf.d/mediatomb

That may be easier for some people.

----------

