2

This question is probably related to: Fedora firewall with UPnP?

Because newer fedora workstations use firewalld, it's a bit of a different situation.

The problem I'm experiencing is that I can't reliably detect UPnP servers with my fedora workstation unless I disable firewalld altogether. I tried adding 1900/UDP to my active zone as well as the service upnp-client (which is the same thing).

On the server side of things (gerbera), I only opened 1900/UDP and 49152/TCP - this is detected in an instant when the firewall of the client is disabled.

I don't think that the server is at fault as all the other devices do not show up either when firewalld is active - except my router for some reason. (Also, sometimes gerbera showed up after some time without me changing the firewall settings of my workstation).

Wireshark gets me this:

Internet Protocol Version 4, Src: workstation, Dst: server
Internet Control Message Protocol
    Type: 3 (Destination unreachable)
    Code: 13 (Communication administratively filtered)
    Checksum: 0x[...] [correct]
    [Checksum Status: Good]
    Unused: 00000000
    Internet Protocol Version 4, Src: server, Dst: workstation
    User Datagram Protocol, Src Port: 1900, Dst Port: 56198
Simple Service Discovery Protocol
[...]

I'm using gupnp-tools to detect the server.

rudib
  • 1,532
  • 1
  • 13
  • 33
  • There's multicast involved with UPnP. So you should do a capture on all involved points to give back what are the addresses in use (private, multicast ...). firewall and multicast is probably more difficult to make work together – A.B Dec 24 '20 at 11:12
  • The filtered ICMP ones are just the server and the client. Actually client to Server only. When I disable firewalld on the client again, I get no filtered packets. – rudib Dec 24 '20 at 11:18
  • Actually, `ICMP` is only used when `firewalld` is running. If not, I don't get any... – rudib Dec 24 '20 at 11:20
  • Ok but what about my question? – A.B Dec 24 '20 at 11:24
  • I'm not sure what you mean exactly, but there's a multicast from my workstation `MSEARCH` `SSDP` to `239.255.255.250`. Followed by the filtered `ICMP` packets coming from my workstation to all servers. So the initial detetction seems to work fine (otherwise it wouldn't be aware of them?). – rudib Dec 24 '20 at 11:31

0 Answers0