[Android Apps and Games] therealsteelskin:
Linux - opening ports in your firewall automatically for BubbleUPnPServer

Evening All,

I've been a long time user of bubbleupnpserver and the Android app. I run the server on Kubuntu Linux, so this post is probably only going to be of interest to anybody running BubbleUPnPServer on a Linux box AND wanting to have their server firewall ie iptables/UFW fully enabled blocking incoming unless specified ..

So I recently wrote a bash scripts that monitors bubbleupnpserver, minidlna & rygel and opens the ports they want to use automatically and also closes them when they switched to a different port.

The script can be found here https://github.com/PartialVolume/DLNAAutoAddPorts

Here's some info on what it does, hopefully somebody will find it useful, I'm currently running it on five servers and it's working very well ! If you do find it useful let me know and if you find any issues then report an issue over at github (above).

Scope

Any Linux based server running BubbleUPnPServer/minidlna/rygel with IPTABLES and UFW firewall. May also be suitable for use with other DLNA/UPnP servers such as plex (untested). It requires iptables, netstat, cut which are installed as standard on ubuntu.

The Problem This Script Resolves

Firstly, a lot of people like to run a firewall on their Linux server, which, personally I think is a good idea. In most cases the firewall is enabled with all incoming traffic denied. It then becomes routine to manually open a port for a particular service, ie 22 for SSH, 25 for SMTP etc.. so when they install their new DLNA/UPnP media server/transcoder, ie bubbleupnpserver they read the docs & search the internet for what ports they are supposed to open in their firewall. In the case of bubbleupnp that's 1900/udp, 8200/tcp, 58050/tcp and 58051/tcp (unless you have changed those later two ports in /etc/default/bubbleupnpserver). You will start streaming your content but then find that the transcoding that the server is supposed to do ..doesn't, maybe some files won't play on your TV (the transcoder should automatically take care of that ... and so after much searching you realise that it all works properly if you disable your firewall. Or maybe even opened up 20000 ports from 30000-50000. Of course anybody that is a bit particular about which ports are opened, looks upon opening up that many ports just so their DLNA will work properly with horror ! If you're lucky you may have come across a snippet of information that explains the random nature of port usage that DLNA/UPnP untilizes.. and that's the problem. Each time bubbleupnpserver starts, (other DLNA servers do this too) it will use a random port somewhere between ~30000-60000. Reluctantly you realise you need to open a range of ports for it to work. Maybe you've looked at UFW/Iptable or Redhats firewall but couldn't find a means by which they would open a random port for a process, service maybe, but then again fixed ports.. what you need is a process specific firewall that's able to open a port for bubbleupnpserver, unfortunately none seem to do exactly what you want... At least that's what I've found, correct me if you know another way !

So after a couple of years, I'd had enough, I wanted my incoming ports closed except for those services (SSH) that I wanted open and it was OK if bubbleupnpserver opened random ports but I wanted control over it and would only open the specific port it required not a whole range of ports.

So I wrote this script that monitors what ports bubbleupnpserver, minidlna, rygel (& other DLNA servers) use in real time and open and close those ports only for those particular processes. So now I've got control of my firewall while having a fully functional bubbleupnpserver with transcoding that works and proxy servers that I can make use of as required.

So if you find that your DLNA/Chromecast devices don't work or can't be seen when your firewall is enabled, proxy servers that don't appear in your library and all this works fine with your firewall disabled, this script may well be for you.