路由器下电脑为实现互联网端到端的连接需要配置DNAT(端口映射),UPNP就相当于自动化DNAT的实现,路由和客户端软件都需支持UPNP。
Openwrt路由下安装UPNP服务:
#https://www.haiyun.me
opkg update
opkg install miniupnpd
配置Iptables UPNP链,用于发现UPNP后在此链自动添加端口映射。
#允许特定转发
iptables -N MINIUPNPD
iptables -I FORWARD -i pppoe-wan -o br-lan -j MINIUPNPD
#DNAT端口映射
iptables -t nat -N MINIUPNPD
iptables -t nat -I PREROUTING -i pppoe-wan -j MINIUPNPD
UPNP配置文件:
cat /var/etc/miniupnpd.conf
#https://www.haiyun.me
ext_ifname=pppoe-wan
listening_ip=192.168.1.1
port=5000
enable_natpmp=yes
enable_upnp=yes
secure_mode=yes
system_uptime=yes
bitrate_down=28672000
bitrate_up=2867200
uuid=a107991c-8b19-4ce4-a525-36bd2c814165
allow 1024-65535 0.0.0.0/0 1024-65535
deny 0-65535 0.0.0.0/0 0-65535
开启UPNP服务:
/etc/init.d/miniupnpd enable
/etc/init.d/miniupnpd start
使用迅雷开启UPNP测试,查看日志UPNP服务已为迅雷添加端口映射:
Sep 7 19:06:01 OpenWrt daemon.info miniupnpd[7232]: HTTP connection from 192.168.1.16:45067
Sep 7 19:06:01 OpenWrt daemon.info miniupnpd[7232]: HTTP REQUEST : POST /ctl/IPConn (HTTP/1.1)
Sep 7 19:06:01 OpenWrt daemon.info miniupnpd[7232]: SOAPAction: urn:schemas-upnp-org:service:WANIPConnection:1#AddPortMapping
Sep 7 19:06:01 OpenWrt daemon.info miniupnpd[7232]: AddPortMapping: ext port 65379 to 192.168.1.16:65379 protocol TCP for: Thunder5
Sep 7 19:06:01 OpenWrt daemon.debug miniupnpd[7232]: UPnP permission rule 0 matched : port mapping accepted
Sep 7 19:06:01 OpenWrt daemon.info miniupnpd[7232]: redirecting port 65379 to 192.168.1.16:65379 protocol TCP for: Thunder5
Sep 7 19:06:01 OpenWrt daemon.info miniupnpd[7232]: HTTP connection from 192.168.1.16:45068
Sep 7 19:06:01 OpenWrt daemon.info miniupnpd[7232]: HTTP REQUEST : POST /ctl/IPConn (HTTP/1.1)
Sep 7 19:06:01 OpenWrt daemon.info miniupnpd[7232]: SOAPAction: urn:schemas-upnp-org:service:WANIPConnection:1#AddPortMapping
Sep 7 19:06:01 OpenWrt daemon.info miniupnpd[7232]: AddPortMapping: ext port 65379 to 192.168.1.16:15301 protocol UDP for: Thunder5
Sep 7 19:06:01 OpenWrt daemon.debug miniupnpd[7232]: UPnP permission rule 0 matched : port mapping accepted
Sep 7 19:06:01 OpenWrt daemon.info miniupnpd[7232]: redirecting port 65379 to 192.168.1.16:15301 protocol UDP for: Thunder5
查看Iptables链UPNP添加的规则:
iptables -L MINIUPNPD -nv
Chain MINIUPNPD (1 references)
pkts bytes target prot opt in out source destination
26245 18M ACCEPT tcp -- * * 0.0.0.0/0 192.168.1.16 tcp dpt:65379
18182 4423K ACCEPT udp -- * * 0.0.0.0/0 192.168.1.16 udp dpt:15301
iptables -t nat -L MINIUPNPD -nv
Chain MINIUPNPD (1 references)
pkts bytes target prot opt in out source destination
676 61598 DNAT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:65379 to:192.168.1.16:65379
316 22320 DNAT udp -- * * 0.0.0.0/0 0.0.0.0/0 udp dpt:65379 to:192.168.1.16:15301