How to disable completly firewall in Nethserver NG 7 (Madsonic uPnP/DLNA)

can u test something in the real life

put it in /etc/e-smith/events/actions/nethserver-madsonic-find-dlna-port

I let some echo if you want to see the value, this time it handles the ‘zillion’ NIC you need

#!/usr/bin/bash
#I need to do a hack to retrieve the dlna port
#because I don't want to activate the upnp service in shorewall
#the dlna port change randomly at each boot, it is not simple for me :)

#test if madsonic has opened the ports
while :
do
    Test=$(netstat -tlpn | grep $(cat /var/run/madsonic.pid))
    if [ "$Test" ];then
        break
    fi
    if [ "$count" == 30 ]; then
       echo "we cannot wait more for madsonic"
       exit 1
    fi
    sleep 1
    let "count++"
done

#other method, could be interesting also
#TCPPortDlna=$(echo $(netstat -tlpn | 
#grep $(netstat -tlpn | grep 4040 | 
#cut -c 80-84 | awk '{$1=$1};1') | 
#cut -d "." -f 4 | cut -d ":" -f 2))

TCPPortDlna=$(echo $(netstat -tlpn | grep $(cat /var/run/madsonic.pid) | 
    grep -oE "\b([0-9]{1,3}\.){3}[0-9]{1,3}\b:[0-9]+" | 
    sed 's/[0-9]\{1,3\}.[0-9]\{1,3\}.[0-9]\{1,3\}.[0-9]\{1,3\}://g') |
    sed 's/ /,/g')

UDPPortDlna=$(echo $(netstat -ulpn | grep $(cat /var/run/madsonic.pid) | 
    grep -oE "\b([0-9]{1,3}\.){3}[0-9]{1,3}\b:[0-9]+" | 
    sed 's/[0-9]\{1,3\}.[0-9]\{1,3\}.[0-9]\{1,3\}.[0-9]\{1,3\}://g') |
    sed 's/ /,/g')
echo $TCPPortDlna
echo $TCPPortDlna
#make a regex to test if the port is right
re='^[0-9]+$'

#Split the array to find each port and test it
IFS=', ' read -r -a array <<< "$TCPPortDlna"
for element in "${array[@]}"
do
    echo $element
    if ! [[ $element =~ $re ]] || [[ $element -gt 65536 ]]; then
        echo "Madsonic DLNA error: $element Not a TCP Port"
        exit 1
    fi
done

#Split the array to find each port and test it
IFS=', ' read -r -a array <<< "$UDPPortDlna"
for element in "${array[@]}"
do
    echo $element
    if ! [[ $element =~ $re ]] || [[ $element -gt 65536 ]]; then
        echo "Madsonic DLNA error: $element Not a UDP Port"
        exit 1
    fi
done

/usr/sbin/e-smith/config set madsonic-dlna service TCPPorts $TCPPortDlna UDPPorts 1900,$UDPPortDlna access green status enabled
/usr/sbin/e-smith/signal-event firewall-adjust

I’ll test it later this evening and give you a report.

I added another green network and tested your script:

[root@testserver music]# systemctl restart madsonic
[root@testserver music]# /etc/e-smith/events/actions/nethserver-madsonic-find-dlna-port
38512,46193,36790
38512,46193,36790
38512
46193
36790
44939
34121
42749
[root@testserver music]# config show madsonic-dlna
madsonic-dlna=service
    TCPPorts=38512,46193,36790
    UDPPorts=1900,44939,34121,42749
    access=green
    status=enabled

It’s alright now, madsonic DLNA server is browsable by all DLNA clients(LG TV, BubblePNP and HiFi Cast on Android), but there is one problem left: I can’t play music (mp3) on any client. I didn’t find any logfile or some log entries…the mp3 are played via the webapp but not on DLNA clients. It does not help to do a “shorewall clear”. I tried to create another media folder, tried chmod 777 on file and folder but no luck. Do you have any clue? I know that it worked on my last testserver.

no clue, :’(

Everything works now. It was a misconfiguration with a virtual interface. I shouldn’t test a DLNA server on my firewall testing VM. My bad.
The script works as expected. Thank you! :+1: I’ll test if madsonic keeps alive and working…

I love you mr @mrmarkuz

This is a problem, I found out now trying it on a fresh VM. The DLNA clients want to connect to 4040 TCP when playing the file.

I tried much yesterday because I couldn’t play a song so I opened 4040 via your script but I thought it worked because I changed network configuration.

So just adding 4040 solves it:

/usr/sbin/e-smith/config set madsonic-dlna service TCPPorts 4040,$TCPPortDlna UDPPorts 1900,$UDPPortDlna access green status enabled

I’m sure we will win :smiley:

released for ns6 and ns7, the port 4040 is private now

Tested the release for ns7 and the script works like a charm. :clap: But one has to execute it manually? It’s only executed with “signal-event nethserver-madsonic-update” but not at system boot or when restarting madsonic.

well for NS7, the file /etc/rc.d/rc.local is just there for compatibility purpose, it is recommended to create a systemd service for that.

For ns6 there is a template file for /etc/rc.local, I will launch the script directly .

released for ns6 and ns7, the script /etc/e-smith/events/actions/nethserver-madsonic-find-dlna-port is launched at each boot

Thanks! Works as you described, but if I want to just restart the service madsonic the script is not launched. I saw there are two systemd services now, madsonic and madsonic-findDlnaPort. So when I restart both services it works.

What about adding madsonic to madsonic-findDlnaPort with ExecStartPre

[Service]
Type=simple
ExecStartPre=/usr/bin/systemctl restart madsonic
ExecStart=/etc/e-smith/events/actions/nethserver-madsonic-find-dlna-port
StandardOutput=syslog

Result:

[root@testserver madsonic]# config show madsonic-dlna
madsonic-dlna=service
    TCPPorts=4040,37511
    UDPPorts=1900,56160
    access=green
    status=enabled
[root@testserver madsonic]# systemctl restart madsonic-findDlnaPort
[root@testserver madsonic]# config show madsonic-dlna
madsonic-dlna=service
    TCPPorts=4040,32879
    UDPPorts=1900,41928
    access=green
    status=enabled

Maybe renaming service madsonic-findDlnaPort to nethserver-madsonic and disable madsonic service so one can restart it with systemctl restart nethserver-madsonic. Don’t take me wrong, it’s fine as it is now as you usually won’t restart the service, just some crazy idea to make it flexible in any situation.

well the madsonic team doesn’t provide a systemd script, so sure we could write it for them. But after that we have another problem, to start first madsonic, at the good time and after it; start our service to be sure that the ports are opened

The easy way if you want to restart madsonic is

signal-event nethserver-madsonic-update

Thanks, that’s working. It’s ok for me but it would be really cool to be able to restart the service in web ui with opening ports afterwards but I don’t know if it’s possible.

The port open script does wait until the ports are open so it will work even if the script is started before madsonic or am I missing something?

we refer after the pid of madsonic, so madsonic service must be started.

What about checking if madsonic has open ports already without using madsonic.pid like

instead of

?

yep could be nice, we need to think on it

proposals

write a full systemd service for madsonic
desactivate the old sysvinit script
open 4040 to private by default (needed if you want to find it by grep)
create a script with more time to wait after madsonic and open it

Good plan!

They have one:

http://forum.madsonic.org/viewtopic.php?t=1832

This may be enough, but we might also check it in the script because maybe updates activating it again:

chmod -x /etc/init.d/madsonic

It’s found anytime by grep even if it’s not private. It’s not found with “iptables -L | grep port”. We could also use port 9412, so one may still change 4040 if needed.

[root@testserver ~]# netstat -tlpn | grep :::9412
tcp6       0      0 :::9412                 :::*                    LISTEN      2289/java
[root@testserver ~]# netstat -tlpn | grep $(cat /var/run/madsonic.pid)
tcp6       0      0 :::41004                :::*                    LISTEN      2289/java
tcp6       0      0 192.168.1.187:35185     :::*                    LISTEN      2289/java
tcp6       0      0 :::9412                 :::*                    LISTEN      2289/java
tcp6       0      0 :::4040                 :::*                    LISTEN      2289/java

Maybe we don’t need to wait that long with a systemd service:

ExecStart=/usr/bin/madsonic
ExecStartPost=/etc/e-smith/events/actions/nethserver-madsonic-find-dlna-port

What do you think about it?