UPNP getting blocked?

Discussion in 'ESET Smart Security' started by annakova, Feb 25, 2009.

Thread Status:
Not open for further replies.
  1. annakova

    annakova Registered Member

    Joined:
    Feb 25, 2009
    Posts:
    7
    I am running ESS under windows XP SP3 on a computer attached to a home network that also has a separate music server and a music player attached. When setting up ESS on my computer, I checked "Allow UPNP in trusted Zone" and things basically worked OK. But then I started getting a bunch of these messages in the log:

    Time: 5 times every minute
    Event: Communication allowed by rule
    Source 10.0.0.6:1900 (That's my music server)
    Target: 239.255.255.250:1900
    Protocol: UDP
    Rule Name: Allow UDP traffic from musicserver

    And then every ten minutes I get:
    Time: 11 times in 3seconds, every ten minutes
    Event: Communication denied by rule
    Source 10.0.0.2:50003 (That's my router)
    Target: 239.255.255.250:1900
    Protocol: UDP
    Rule Name: Block incoming SSDP (UPNP) requests

    so these long series of log messages are logging traffic from my router and music server. I figured UPNP was somehow getting blocked, so I looked again and the "allow UPNP in trusted zone" was still checked. But I unchecked it and then checked it again, and these logging messages stopped. But a few days later they started up again, and I did the same thing and they stopped again.

    So is ESS somehow resetting itself without updating the "allow UPNP" flag? Maybe when the program modules update or something?

    Also, I looked in the list of rules, and there are two rules evidently entered automatically by the system that block TCP and UDP traffic on port 1900 for all addresses of all applications. This are set even though I have checked "allow UPNP in trusted zone".

    Can someone explain what is going on here? (And despite the logging traffic, the music server <---> player connection keeps working, So really, I just want to know what ESS is logging here.)

    Thanks,
    Anna
     
  2. funkydude

    funkydude Registered Member

    Joined:
    Apr 5, 2004
    Posts:
    6,855
    Hello Anna, are you by any chance running old firmware on the router? Is so, try updating it.

    If not, wait until the issue happens again, then try rebooting the router instead of changing ess settings. Did that fix the issue?
     
  3. annakova

    annakova Registered Member

    Joined:
    Feb 25, 2009
    Posts:
    7
    Thanks - I haven't touched the router since i bought it three years ago. I'll see if there is new firmware and give it a try.

    Anna
     
  4. annakova

    annakova Registered Member

    Joined:
    Feb 25, 2009
    Posts:
    7
    Well, I found the latest firmware (2.1.5) for my Zoom X6 modem/router and upgraded it. It fixed the problem I had been having, but it introduced some major connection problems where my music player would just stop after 15 minutes or so and when I tried to get it restarted, I just got the error message that it couldn't find the server. So I went back to the earlier firmware(1.0.6). Oh well... the music is more important than a clean firewall log...

    Anna
     
  5. funkydude

    funkydude Registered Member

    Joined:
    Apr 5, 2004
    Posts:
    6,855
    Thanks for the reply Anna. Considering the massive leap in version number between the old and new firmware, I would seriously advise you to keep the latest for security reasons.

    The problem with the music may be solved alternatevely, or may even be caused by something else.

    Is the music hosted on a local server you stream to your pc? If so, make sure you are allowing sharing on the network in your ESS settings, and that it's not on strict protection.

    You can also try making sure your music player isn't in the list of web browsers, and if it is, click the box until an X is in it(exclude).

    Also you can enable the maintain inactive TCP connections in the firewall settings.
     
  6. annakova

    annakova Registered Member

    Joined:
    Feb 25, 2009
    Posts:
    7
    Thanks. Theoretically, I think my music traffic does not touch my Windows XP computer that is running ESS. I have a separate server (no keyboard or monitor, running Linux which I know nothing about) wired to the router, and then have a wireless connection from the router to a Logitech Squeezebox that plugs into my stereo system. That setup has generally been very solid, impressively so, (although who knows what the linux box is doing with my router..).

    So as far as I understand, although my Windows computer running ESS is wired into that router, it shouldn't be involved in any of the actual music/radio streaming activity which goes Server - wired to router - wireless to Squeezebox. That streaming works just fine even when my computer is turned off. So I assumed all that log traffic involving my server and Squeezebox that I had been seeing on the Windows+ESS computer is from some form of UPNP discovery going on that wasn't working properly due to ESS.

    The router firmware upgrade interfered somehow with the Squeezebox <--> Router <--> Server connection that had been working fine. I don't have much control over those two devices, so I can't really investigate that much further. I do have a web browser interface to the router but not much control there over whatever kind of firewall protection is going on in the router.

    So while I like your suggestion to keep the newer router firmware update, I'm sort of at a blind wall about fixing the music connection that it breaks.

    Anna
     
Thread Status:
Not open for further replies.