RouterOS v6.36rc11 & PAT & NAT-PMP & UPNP

RouterOS Beginner Basics
1

Hi All!
Just a newbie question: is there an option to prevent assigning of duplicates for the same external/internal ports entries ?
I just see a next situation : two internal PC can add entries (by NAT-PMP or UPNP) for the same port internal port (it’s expected) but with the same external port. I suspect that the router OS should be prevent so duplicates.


TIA.
PS: I have a Wi-Fi router with Tomato firmware and see “Security option” in NAT/PAT configuration section which is disallow to create duplicate port translation (forwarding) from different IP.

2

@6.37.2, it’s not possible to add mappings for same public port. Router returns UPnP error 718 - ConflictInMappingEntry.

Device 1 (192.168.88.197)

POST /upnp/control/eayprlmqrn/wanipconn-1 HTTP/1.1
Content-Type: text/xml; charset="utf-8"
SOAPACTION: "urn:schemas-upnp-org:service:WANIPConnection:1#AddPortMapping"
Host: 192.168.88.1:2828
Content-Length: 651
Expect: 100-continue
Connection: Close

<s:Envelope 
   xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" 
   s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/">
   <s:Body>
	  <u:AddPortMapping xmlns:u="urn:schemas-upnp-org:service:WANIPConnection:1">
		 <NewRemoteHost></NewRemoteHost>
		 <NewExternalPort>1331</NewExternalPort>
		 <NewProtocol>TCP</NewProtocol>
		 <NewInternalPort>1234</NewInternalPort>
		 <NewInternalClient>192.168.88.197</NewInternalClient>
		 <NewEnabled>1</NewEnabled>
		 <NewPortMappingDescription>test 1 port 1331</NewPortMappingDescription>
		 <NewLeaseDuration>0</NewLeaseDuration>
	  </u:AddPortMapping>
   </s:Body>
</s:Envelope>

HTTP/1.1 200 OK
CONTENT-LENGTH: 282
CONTENT-TYPE: text/xml; charset="utf-8"
DATE: Thu, 24 Nov 2016 10:00:12 GMT
EXT: 
SERVER: RouterOS/6.37.2UPnP/1.0 MikroTik UPnP/1.0

<s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/">
  <s:Body>
    <u:AddPortMappingResponse xmlns:u="urn:schemas-upnp-org:service:WANIPConnection:1"></u:AddPortMappingResponse>
  </s:Body>
</s:Envelope>

Device 2 (192.168.88.198)

POST /upnp/control/eayprlmqrn/wanipconn-1 HTTP/1.1
Content-Type: text/xml; charset="utf-8"
SOAPACTION: "urn:schemas-upnp-org:service:WANIPConnection:1#AddPortMapping"
Host: 192.168.88.1:2828
Content-Length: 651
Expect: 100-continue
Connection: Close

<s:Envelope 
   xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" 
   s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/">
   <s:Body>
	  <u:AddPortMapping xmlns:u="urn:schemas-upnp-org:service:WANIPConnection:1">
		 <NewRemoteHost></NewRemoteHost>
		 <NewExternalPort>1331</NewExternalPort>
		 <NewProtocol>TCP</NewProtocol>
		 <NewInternalPort>1235</NewInternalPort>
		 <NewInternalClient>192.168.88.198</NewInternalClient>
		 <NewEnabled>1</NewEnabled>
		 <NewPortMappingDescription>test 2 port 1331</NewPortMappingDescription>
		 <NewLeaseDuration>0</NewLeaseDuration>
	  </u:AddPortMapping>
   </s:Body>
</s:Envelope>

HTTP/1.1 500 Internal Server Error
CONTENT-LENGTH: 506
CONTENT-TYPE: text/xml; charset="utf-8"
DATE: Thu, 24 Nov 2016 10:00:12 GMT
EXT: 
SERVER: RouterOS/6.37.2UPnP/1.0 MikroTik UPnP/1.0

<s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/">
  <s:Body>
    <s:Fault>
      <faultCode>s:Client</faultCode>
      <faultString>UPnPError</faultString>
      <detail>
        <UPnPError xmlns="urn:schemas-upnp-org:control-1-0">
          <errorCode>718</errorCode>
          <errorDescription>ConflictInMappingEntry</errorDescription>
        </UPnPError>
      </detail>
    </s:Fault>
  </s:Body>
</s:Envelope>
3

Thx! Will planing upgrade.

4

Since you’re on a rc, upgrade is recommended :slight_smile:

However, it shouldn’t really matter much.

If the router does accept duplicate UPnP mappings for the same external port, it simply will create additional dstnat rules in the firewall which will never get hit, so only the first mapping will work.

5

Just upgraded - all fine now. Thanks!