[deltatux]

Hi,

I have UPnP enabled on my ASUS RT-N16 router flashed with DD-WRT Build 16214 Mega and I noticed that UPnP is saved to the NVRAM and sometimes it looks like it's going to overflow ... is there a command that I can issue in a cron that I can program to clear the UPnP list at like 5 AM every morning? Usually I have to clear the NVRAM so that my router wouldn't crash from NVRAM exhaustion.

Also, why is the UPnP list saved on NVRAM, wouldn't it make more sense to just store it in regular memory as it should constantly fill and automatically delete entries that are no longer active?

Cheers,
deltatux

[crashfly]

[phuzi0n]

My ttraff variable cleaner script modified for UPnP:

for i in `nvram show | grep forward_port | cut -f1 -d=""`; do nvram unset $i; done

I don't know how well this will actually work though. I'm not sure whether the UPnP daemon or just the GUI uses the variables, but unseting them does make them disappear from the GUI. You might end up having the UPnP daemon forget about them but then have programs re-requesting the mapping even though this will not remove the actual forwards from iptables. ie. you could flood iptables with lots of duplicate rules.

[deltatux]

Ya, that's what I'm afraid of ... is there no commands to unset UPnP? How does the GUI do it when you press the Delete All button? Does it execute commands on the router?

If so, what command is it?

EDIT: I kind of understand that nvram command but if it's only cosmetic then it's kind of useless no?

deltatux

[phuzi0n]

I guess you could also add this to clear the port forwards from iptables after you delete the nvram variables.

startservice wan

[deltatux]

[frater]

uPnP is not only contaminating the nvram space but the FORWARD chain as well.
It should be just 1 entry in the FORWARD chain just like the "Access Restrictions".
Netfilter (iptables) should be used how it is intended!

[oxygenx]

I guess writing the UPNP data optionally to jffs instead of nvram would be a good idea. i also had a case where upnp overflowed the nvram (over 100 rules caused by a misconfigured client)

[phuzi0n]

@deltatux - It starts all the services for the WAN, including rebuilding the firewall which will wipe out the removed UPnP forwards.

The script only deletes UPnP forwards, it doesn't touch the static ones made in the GUI.

@frater - Yes, yes it should... But surely you remember that they tried many different UPnP daemons when the k2.6 builds were introduced and had many more serious problems with them. Right now they're using Broadcom's UPnP daemon which does some bad things but is the lesser of evils that they tried.

@oxygenx - UPnP forwards should only be saved in RAM. There's absolutely no reason to save them on persistent storage because UPnP clients are responsible for making sure their ports stay mapped by the UPnP server.

[oxygenx]

[frater]

[deltatux]

[oxygenx]

[fggs]

@frater: I had that idea when I started messing with iptables. According to official netfilter's faq, using a file with iptables-restore format is safer than scripts that calls iptables on every line. I second your idea of having iptables-save, iptables-save plus iptables-restore would make loading faster and also easier to maintain.

[frater]

I am using iptables-restore with files stored in /opt/etc and symbolic links in /tmp/etc/config
This works great. I have written a lot of scripts (asiablock, worldblock, fixtables, stophack, stophammer,asterisk) that manipulate the DD-WRT firewall dynamically and they all work flawless.

A uPnP-daemon should use a seperate chain and by maintaining a special file in /tmp these entries can be easily managed.

Although oxygenx is correct that /tmp would not be suitable because it doesn't survive a reboot, I think this is going too far. A router reboot should be something that rarely occurs and restoring all these uPnP-entries is really the responsability of the application that initiated them.

nvram-overflow is a serious problem.
losing upnp entries after a reboot is an inconvenience.