Task: set up and configure a UPnP system based on iptables in Linux Debian, so that outbound ports are automatically opened for internal network users. For example, for software with dynamic ports.
This kind of task is handled by UPnP technology, which we'll now implement on top of the de facto firewall in Linux - iptables.
1) Install the required package
$ sudo aptitude install linux-igd
2) Configure the daemon
Go to /etc/default/ and open the linux-igd file for editing.
In it, look for the lines: EXTIFACE and INTIFACE and substitute the required values.
EXTIFACE = eth1
INTIFACE = eth0
In this example eth1 is our "hole" to the internet, and "eth0" is the local network behind the firewall (the private network).
If these parameters are not specified - the daemon won't start.
Look further into the file and configure it to your liking, if needed.
3) Add the following rules to iptables:
iptables -N UPNP
iptables -N UPNP iptables -A FORWARD -j UPNP
4) Now start the daemon
$ sudo /etc/init.d/linux-igd start
5) From here everything should start working.
Also don't forget that the software trying to get through your firewall configured with UPnP must also understand UPnP, and this option must be enabled in the program.
VerificationNow try out a program that reaches outward and uses UPnP in the process. Then check the firewall rules - you'll see dynamically added entries:
-A FORWARD -d 192.168.0.70/32 -p tcp -m tcp --dport 12345 -j ACCEPT
-A PREROUTING -i eth1 -p tcp -m tcp --dport 12345 -j DNAT --to-destination 192.168.0.70:12345
If entries are being added for internal addresses - everything is fine, UPnP is working on your gateway.
Applies to: Linux Debian 5+
Comments