Project

General

Profile

Actions

Bug #10398

closed

RFC1918 external address in miniupnp does not work after upgrade to 2.4.5

Added by Andy Kwong over 1 year ago. Updated over 1 year ago.

Status:
Needs Patch
Priority:
Normal
Assignee:
-
Category:
UPnP/NAT-PMP
Target version:
-
Start date:
03/31/2020
Due date:
% Done:

0%

Estimated time:
Plus Target Version:
Release Notes:
Affected Version:
2.4.5
Affected Architecture:
All

Description

After upgrading pfSense to 2.4.5, MiniUPnP refuses to assign port mappings when the WAN interface is RFC1918 -

ISP provided outside router is on 192.168.10.254 forwarding all ports to 192.168.10.1.

pfSense -
External WAN interface is 192.168.10.2 (192.168.10.1 CARP)
Internal LAN interface is 192.168.20.2 (192.168.20.1 CARP)

Test host is on 192.168.20.100

On 2.4.4p3 -

# upnpc -a 192.168.20.100 63000 64000 tcp
upnpc : miniupnpc library test client, version 2.1.
 (c) 2005-2018 Thomas Bernard.
Go to http://miniupnp.free.fr/ or https://miniupnp.tuxfamily.org/
for more information.
List of UPNP devices found on the network :
 desc: http://192.168.20.2:2189/rootDesc.xml
 st: urn:schemas-upnp-org:device:InternetGatewayDevice:1

Found a (not connected?) IGD : http://192.168.20.2:2189/ctl/IPConn
Trying to continue anyway
Local LAN ip address : 192.168.20.100
ExternalIPAddress = 192.168.10.2
InternalIP:Port = 192.168.20.100:63000
external 192.168.10.2:64000 TCP is redirected to internal 192.168.20.100:63000 (duration=0)

On 2.4.5 -

# upnpc -a 192.168.20.100 63000 64000 tcp
upnpc : miniupnpc library test client, version 2.1.
 (c) 2005-2018 Thomas Bernard.
Go to http://miniupnp.free.fr/ or https://miniupnp.tuxfamily.org/
for more information.
List of UPNP devices found on the network :
 desc: http://192.168.20.2:2189/rootDesc.xml
 st: urn:schemas-upnp-org:device:InternetGatewayDevice:1

Found a (not connected?) IGD : http://192.168.20.2:2189/ctl/IPConn
Trying to continue anyway
Local LAN ip address : 192.168.20.100
GetExternalIPAddress failed.
AddPortMapping(64000, 63000, 192.168.20.100) failed with code 501 (Action Failed)

It seems that the latest version of miniupnp includes a commit that forbids external addresses as per -

https://github.com/miniupnp/miniupnp/commit/8e10a1aeab9b8cd4d3b2e964b02e9ad409cf3aaa
https://github.com/miniupnp/miniupnp/issues/298
https://github.com/miniupnp/miniupnp/issues/333

One of the solutions recommended is to statically set the ext address in miniupnpd. This is not possible through the pfSence GUI. It's also problematic as the real ext address is assigned by PPPoE (on the outside router) in my setup.

Another thing I attempted is setting the WAN address in the UPnP page specifically to 192.168.10.x, but then the miniupnp daemon dies immediately.

It seems that other projects using miniupnp is also running into the same issue -

https://github.com/RMerl/asuswrt-merlin.ng/issues/444

Actions #1

Updated by Jim Pingle over 1 year ago

  • Category set to UPnP/NAT-PMP
  • Status changed from New to Needs Patch

We've seen this internally as well. This must be solved by miniupnpd.

One of the solutions recommended is to statically set the ext address in miniupnpd. This is not possible through the pfSence GUI.

That's what the "Override WAN address" option does.

Actions #2

Updated by Andy Kwong over 1 year ago

That's what the "Override WAN address" option does.

Thanks. So that's passed through as the ext_ip. I did some additional testing here and it seems -

- With a RFC1918 (or other reserved) address here, the daemon dies immediately
- With a random public address (1.1.1.1), the daemon starts, mappings are created according to the web interface, but no traffic passes

After a bit of digging, this is because of -

#pfctl -a miniupnpd -sr
pass in log quick on igb0.10 inet proto tcp from any to 192.168.20.100 port = 63000 flags S/SA keep state label "libminiupnpc" rtable 0

#pfctl -a miniupnpd -sn
rdr log quick on igb0.10 inet proto tcp from any to 1.1.1.1 port = 64000 keep state label "libminiupnpc" rtable 0 -> 192.168.20.100 port 63000

Which restricts all incoming traffic for the UPnP mapping on the WAN interface to the ext_ip. So even with the ext address configured properly, a double NAT setup will never work as the packets will never arrive on the WAN interface with the public address (because that gets NATed on outside router to the inside router WAN interface).

Even with ext_perform_stun (the other solution recommended), it will still break a double NAT setup.

As an aside, this behaviour of locking down the dst in the pf nat rule was not always the case. It is specifically due to -

https://github.com/miniupnp/miniupnp/issues/231
https://github.com/miniupnp/miniupnp/commit/53e81857252eb6504e878295c04e607a7c4c061e

CARP setups will also break unless the CARP address is public and configured as the "Override WAN Address"/ext_ip.

It seems that asuswrt-merlin made a good call to revert the change preventing private IPs from being external addresses in miniupnp, because this commit effectively breaks a lot of advanced NAT topologies.

Actions #3

Updated by Jim Pingle over 1 year ago

I agree, the changes in miniupnpd are unnecessary and harmful to some use cases. They should at least provide an option to override the behavior rather than preventing it entirely.

But that is a change that needs to be made in miniupnpd -- Advocate for it there.

If we start reverting bits and pieces in the port that puts a lot of technical debt on us to maintain that indefinitely.

Actions #4

Updated by Andy Kwong over 1 year ago

Ok, I opened an issue on the miniupnp tracker for this -

https://github.com/miniupnp/miniupnp/issues/433

Actions #5

Updated by Steve Wheeler over 1 year ago

There us a patch available to remove that behavior in miniupnpd that needs testing:
https://github.com/miniupnp/miniupnp/commit/3f04f7992c4e8f11c2a2f66e678d9e63c8103dea

Actions #6

Updated by Shane Addinall over 1 year ago

Steve Wheeler wrote:

There us a patch available to remove that behavior in miniupnpd that needs testing:
https://github.com/miniupnp/miniupnp/commit/3f04f7992c4e8f11c2a2f66e678d9e63c8103dea

I tried Compiling this but didn't manage,
I'm willing to try it out for people, however I'm doing something wrong so its not working.

Keep getting the following error when I try, and I have tried cloning the repo's a few times.

I know I am doing something wrong, Just don't know what, so If someone perhaps wants to enlighten me I would be delighted to learn :D

make: "/tmp/thisistest/miniupnpd/Makefile" line 39: Could not find bsdmake.inc
make: "/tmp/thisistest/miniupnpd/Makefile" line 88: Malformed conditional ($(FWNAME) == "pf")
make: "/tmp/thisistest/miniupnpd/Makefile" line 160: warning: "which bash || which ksh" returned non-zero status
make: Fatal errors encountered -- cannot continue
make: stopped in /tmp/thisistest/miniupnpd

Thanks.

Actions

Also available in: Atom PDF