Bug #12797: UPnP+STUN forms invalid outbound NAT rules using the external address discovered from STUN - pfSense - pfSense bugtracker

Custom queries

2.7.0 - Resolved/Closed
2.7.1 - All Open Issues
2.7.1 - Resolved/Closed
2.7.2 - Resolved/Closed
2.8.0 - All Open Bugs
2.8.0 - All Open Features
2.8.0 - All Open Issues
2.8.0 - All Open Regressions
2.8.0 - Feedback
2.8.0 - Needs Attention
2.8.0 - New/Confirmed
2.8.0 - Pull Requests
2.8.0 - Regressions affecting 2.7.0
2.8.0 - Resolved/Closed
23.01 Plus - All Closed Issues
23.01 Target - All Closed Issues
23.05 Plus - All Closed Issues
23.05 Target - All Closed Issues
23.05.1 Plus - All Closed Issues
23.05.1 Target - All Closed Issues
23.09 Plus - All Closed Issues
23.09 Target - All Closed Issues
23.09.1 Plus - All Closed Issues
23.09.1 Target - All Closed Issues
24.03 Plus - All Closed Issues
24.03 Target - All Closed Issues
24.11 Plus - All Closed Issues
24.11 Target - All Closed Issues
25.03 Plus - All Closed Issues
25.03 Plus - All Open Issues
25.03 Plus - Feedback Issues
25.03 Plus - Needs Attention/Work
25.03 Plus - New/Confirmed/In Progress Issues
25.03 Plus - Pull Request Review
25.03 Plus - Waiting on Merge
25.03 Target - All Closed Issues
25.03 Target - All Open Issues
All Open Issues assigned to Me
All Open Pull Requests
Any Target - All Open Regressions
Any Target - Feedback Issues
CE-Next - All Closed Issues (Move to specific target)
CE-Next - All Open Issues
CE-Next - Feedback (Likely needs target changed)
New Issues by Category - Future Target
New Issues by Category - No Target
New Issues by Category - No Target+Future
No Target - All Open Issues (Base Only)
No Target - New Issues (Base Only)
No Target - New Issues (Base and Packages)
Release Notes - Plus Target Version (DO NOT EDIT)
Release Notes - Target Version (DO NOT EDIT)

Actions

Copy link

Bug #12797

open

UPnP+STUN forms invalid outbound NAT rules using the external address discovered from STUN

Added by Bob Dig almost 3 years ago. Updated almost 3 years ago.

Status:

New

Priority:

Normal

Assignee:

Category:

UPnP IGD & PCP

Target version:

Start date:

Due date:

% Done:

Estimated time:

Plus Target Version:

Release Notes:

Default

Affected Version:

Affected Architecture:

Description

With the new release of 22.01 pfSense should be able to use Mini-UPnP, even if it is behind another router as an exposed host, therefore the STUN-Server feature. But it is not working. Because it hasn't working for a long time, I can not tell if this is a bug or a feature still to implement fully.

Forum post:
https://forum.netgate.com/topic/169848/upnp-behind-double-nat-is-not-working-even-with-a-stun-server

History
Notes
Property changes

Actions

Copy link

Updated by Jim Pingle almost 3 years ago

This may be the same issue already being discussed in this forum thread: https://forum.netgate.com/topic/169773/miniupnp-full-cone-double-natincorrectly-adding-rules

You also will need the patch from #7727 (See https://forum.netgate.com/topic/169837/upnp-fix-for-multiple-clients-consoles-playing-the-same-game ) but that alone may not be enough if you hit the same issue the other person in that thread is hitting.

Actions

Copy link

Updated by Jim Pingle almost 3 years ago

Project changed from pfSense Plus to pfSense
Category changed from UPnP/NAT-PMP to UPnP IGD & PCP
Affected Plus Version deleted (~~22.01~~)

Actions

Copy link

Updated by Jim Pingle almost 3 years ago

Subject changed from UPnP behind double NAT is not working, even with a STUN-Server to UPnP+STUN forms invalid outbound NAT rules using the external address discovered from STUN

For inbound connections (rdr), STUN is working and a client can open and successfully test a port with a private WAN with 1:1 setup upstream passing all traffic to it.

The STUN case is forming invalid outbound rules (nat on ...) using the IP address it discovered from STUN. This isn't valid because that address is not present on the firewall, it's an address on an upstream device.

Manually setting the ext IP address should use that IP address in the NAT rules because that feature is intended for using IP alias or CARP VIPs on a WAN interface so that UPnP doesn't need to use the main interface address. This appears to be working OK, it's the STUN+nat on case which is problematic since with STUN that address isn't local like it is with the ext IP address set.

Actions

Copy link

Also available in: Atom PDF

Project

General

Profile

pfSense

Custom queries

Bug #12797

UPnP+STUN forms invalid outbound NAT rules using the external address discovered from STUN

Updated by Jim Pingle almost 3 years ago

Updated by Jim Pingle almost 3 years ago

Updated by Jim Pingle almost 3 years ago