2

This question is probably related to: Fedora firewall with UPnP?

Because newer fedora workstations use firewalld, it's a bit of a different situation.

The problem I'm experiencing is that I can't reliably detect UPnP servers with my fedora workstation unless I disable firewalld altogether. I tried adding 1900/UDP to my active zone as well as the service upnp-client (which is the same thing).

On the server side of things (gerbera), I only opened 1900/UDP and 49152/TCP - this is detected in an instant when the firewall of the client is disabled.

I don't think that the server is at fault as all the other devices do not show up either when firewalld is active - except my router for some reason. (Also, sometimes gerbera showed up after some time without me changing the firewall settings of my workstation).

Wireshark gets me this:

Internet Protocol Version 4, Src: workstation, Dst: server
Internet Control Message Protocol
    Type: 3 (Destination unreachable)
    Code: 13 (Communication administratively filtered)
    Checksum: 0x[...] [correct]
    [Checksum Status: Good]
    Unused: 00000000
    Internet Protocol Version 4, Src: server, Dst: workstation
    User Datagram Protocol, Src Port: 1900, Dst Port: 56198
Simple Service Discovery Protocol
[...]

I'm using gupnp-tools to detect the server.

rudib
  • 1,602
  • There's multicast involved with UPnP. So you should do a capture on all involved points to give back what are the addresses in use (private, multicast ...). firewall and multicast is probably more difficult to make work together – A.B Dec 24 '20 at 11:12
  • The filtered ICMP ones are just the server and the client. Actually client to Server only. When I disable firewalld on the client again, I get no filtered packets. – rudib Dec 24 '20 at 11:18
  • Actually, ICMP is only used when firewalld is running. If not, I don't get any... – rudib Dec 24 '20 at 11:20
  • Ok but what about my question? – A.B Dec 24 '20 at 11:24
  • I'm not sure what you mean exactly, but there's a multicast from my workstation MSEARCH SSDP to 239.255.255.250. Followed by the filtered ICMP packets coming from my workstation to all servers. So the initial detetction seems to work fine (otherwise it wouldn't be aware of them?). – rudib Dec 24 '20 at 11:31

0 Answers0