How to disable completly firewall in Nethserver NG 7 (Madsonic uPnP/DLNA)

can u test something in the real life

put it in /etc/e-smith/events/actions/nethserver-madsonic-find-dlna-port

I let some echo if you want to see the value, this time it handles the ‘zillion’ NIC you need

#!/usr/bin/bash
#I need to do a hack to retrieve the dlna port
#because I don't want to activate the upnp service in shorewall
#the dlna port change randomly at each boot, it is not simple for me :)

#test if madsonic has opened the ports
while :
do
    Test=$(netstat -tlpn | grep $(cat /var/run/madsonic.pid))
    if [ "$Test" ];then
        break
    fi
    if [ "$count" == 30 ]; then
       echo "we cannot wait more for madsonic"
       exit 1
    fi
    sleep 1
    let "count++"
done

#other method, could be interesting also
#TCPPortDlna=$(echo $(netstat -tlpn | 
#grep $(netstat -tlpn | grep 4040 | 
#cut -c 80-84 | awk '{$1=$1};1') | 
#cut -d "." -f 4 | cut -d ":" -f 2))

TCPPortDlna=$(echo $(netstat -tlpn | grep $(cat /var/run/madsonic.pid) | 
    grep -oE "\b([0-9]{1,3}\.){3}[0-9]{1,3}\b:[0-9]+" | 
    sed 's/[0-9]\{1,3\}.[0-9]\{1,3\}.[0-9]\{1,3\}.[0-9]\{1,3\}://g') |
    sed 's/ /,/g')

UDPPortDlna=$(echo $(netstat -ulpn | grep $(cat /var/run/madsonic.pid) | 
    grep -oE "\b([0-9]{1,3}\.){3}[0-9]{1,3}\b:[0-9]+" | 
    sed 's/[0-9]\{1,3\}.[0-9]\{1,3\}.[0-9]\{1,3\}.[0-9]\{1,3\}://g') |
    sed 's/ /,/g')
echo $TCPPortDlna
echo $TCPPortDlna
#make a regex to test if the port is right
re='^[0-9]+$'

#Split the array to find each port and test it
IFS=', ' read -r -a array <<< "$TCPPortDlna"
for element in "${array[@]}"
do
    echo $element
    if ! [[ $element =~ $re ]] || [[ $element -gt 65536 ]]; then
        echo "Madsonic DLNA error: $element Not a TCP Port"
        exit 1
    fi
done

#Split the array to find each port and test it
IFS=', ' read -r -a array <<< "$UDPPortDlna"
for element in "${array[@]}"
do
    echo $element
    if ! [[ $element =~ $re ]] || [[ $element -gt 65536 ]]; then
        echo "Madsonic DLNA error: $element Not a UDP Port"
        exit 1
    fi
done

/usr/sbin/e-smith/config set madsonic-dlna service TCPPorts $TCPPortDlna UDPPorts 1900,$UDPPortDlna access green status enabled
/usr/sbin/e-smith/signal-event firewall-adjust
2 Likes

I’ll test it later this evening and give you a report.

1 Like

I added another green network and tested your script:

[root@testserver music]# systemctl restart madsonic
[root@testserver music]# /etc/e-smith/events/actions/nethserver-madsonic-find-dlna-port
38512,46193,36790
38512,46193,36790
38512
46193
36790
44939
34121
42749
[root@testserver music]# config show madsonic-dlna
madsonic-dlna=service
    TCPPorts=38512,46193,36790
    UDPPorts=1900,44939,34121,42749
    access=green
    status=enabled

It’s alright now, madsonic DLNA server is browsable by all DLNA clients(LG TV, BubblePNP and HiFi Cast on Android), but there is one problem left: I can’t play music (mp3) on any client. I didn’t find any logfile or some log entries…the mp3 are played via the webapp but not on DLNA clients. It does not help to do a “shorewall clear”. I tried to create another media folder, tried chmod 777 on file and folder but no luck. Do you have any clue? I know that it worked on my last testserver.

no clue, :’(

Everything works now. It was a misconfiguration with a virtual interface. I shouldn’t test a DLNA server on my firewall testing VM. My bad.
The script works as expected. Thank you! :+1: I’ll test if madsonic keeps alive and working…

2 Likes

I love you mr @mrmarkuz

1 Like

This is a problem, I found out now trying it on a fresh VM. The DLNA clients want to connect to 4040 TCP when playing the file.

I tried much yesterday because I couldn’t play a song so I opened 4040 via your script but I thought it worked because I changed network configuration.

So just adding 4040 solves it:

/usr/sbin/e-smith/config set madsonic-dlna service TCPPorts 4040,$TCPPortDlna UDPPorts 1900,$UDPPortDlna access green status enabled

1 Like

I’m sure we will win :smiley:

1 Like

released for ns6 and ns7, the port 4040 is private now

1 Like

Tested the release for ns7 and the script works like a charm. :clap: But one has to execute it manually? It’s only executed with “signal-event nethserver-madsonic-update” but not at system boot or when restarting madsonic.

1 Like

well for NS7, the file /etc/rc.d/rc.local is just there for compatibility purpose, it is recommended to create a systemd service for that.

For ns6 there is a template file for /etc/rc.local, I will launch the script directly .

released for ns6 and ns7, the script /etc/e-smith/events/actions/nethserver-madsonic-find-dlna-port is launched at each boot

1 Like

Thanks! Works as you described, but if I want to just restart the service madsonic the script is not launched. I saw there are two systemd services now, madsonic and madsonic-findDlnaPort. So when I restart both services it works.

What about adding madsonic to madsonic-findDlnaPort with ExecStartPre

[Service]
Type=simple
ExecStartPre=/usr/bin/systemctl restart madsonic
ExecStart=/etc/e-smith/events/actions/nethserver-madsonic-find-dlna-port
StandardOutput=syslog

Result:

[root@testserver madsonic]# config show madsonic-dlna
madsonic-dlna=service
    TCPPorts=4040,37511
    UDPPorts=1900,56160
    access=green
    status=enabled
[root@testserver madsonic]# systemctl restart madsonic-findDlnaPort
[root@testserver madsonic]# config show madsonic-dlna
madsonic-dlna=service
    TCPPorts=4040,32879
    UDPPorts=1900,41928
    access=green
    status=enabled

Maybe renaming service madsonic-findDlnaPort to nethserver-madsonic and disable madsonic service so one can restart it with systemctl restart nethserver-madsonic. Don’t take me wrong, it’s fine as it is now as you usually won’t restart the service, just some crazy idea to make it flexible in any situation.

2 Likes

well the madsonic team doesn’t provide a systemd script, so sure we could write it for them. But after that we have another problem, to start first madsonic, at the good time and after it; start our service to be sure that the ports are opened

The easy way if you want to restart madsonic is

signal-event nethserver-madsonic-update

1 Like

Thanks, that’s working. It’s ok for me but it would be really cool to be able to restart the service in web ui with opening ports afterwards but I don’t know if it’s possible.

The port open script does wait until the ports are open so it will work even if the script is started before madsonic or am I missing something?

we refer after the pid of madsonic, so madsonic service must be started.

What about checking if madsonic has open ports already without using madsonic.pid like

instead of

?

1 Like

yep could be nice, we need to think on it

proposals

write a full systemd service for madsonic
desactivate the old sysvinit script
open 4040 to private by default (needed if you want to find it by grep)
create a script with more time to wait after madsonic and open it

1 Like

Good plan!

They have one:

http://forum.madsonic.org/viewtopic.php?t=1832

This may be enough, but we might also check it in the script because maybe updates activating it again:

chmod -x /etc/init.d/madsonic

It’s found anytime by grep even if it’s not private. It’s not found with “iptables -L | grep port”. We could also use port 9412, so one may still change 4040 if needed.

[root@testserver ~]# netstat -tlpn | grep :::9412
tcp6       0      0 :::9412                 :::*                    LISTEN      2289/java
[root@testserver ~]# netstat -tlpn | grep $(cat /var/run/madsonic.pid)
tcp6       0      0 :::41004                :::*                    LISTEN      2289/java
tcp6       0      0 192.168.1.187:35185     :::*                    LISTEN      2289/java
tcp6       0      0 :::9412                 :::*                    LISTEN      2289/java
tcp6       0      0 :::4040                 :::*                    LISTEN      2289/java

Maybe we don’t need to wait that long with a systemd service:

ExecStart=/usr/bin/madsonic
ExecStartPost=/etc/e-smith/events/actions/nethserver-madsonic-find-dlna-port

What do you think about it?

1 Like