I am running MiniUPnP (as a client) on an Ubuntu 14.04.5 server connected to an internet-connected router. If I completely disable all iptables rules, upnpc -m 192.168.1.100 -l finds a valid IGD device, lists all of its info like so:$ upnpc -m 192.168.1.100 -lupnpc : miniupnpc library test client. (c) 2006-2011 Thomas BernardGo to http://miniupnp.free.fr/ or http://miniupnp.tuxfamily.org/for more information.List of UPNP devices found on the network : desc: http://192.168.1.1:5431/dyndev/uuid:xxx st: urn:schemas-upnp-org:device:InternetGatewayDevice:1Found valid IGD : http://192.168.1.1:5431/uuid:xxx/WANPPPConnection:1Local LAN ip address : 192.168.1.100Connection Type : IP_RoutedStatus : Connected, uptime=50601s, LastConnectionError :   Time started : Mon Oct 10 19:42:40 2016MaxBitRateDown : 16623000 bps (16.6 Mbps)   MaxBitRateUp 1020000 bps (1.0 Mbps)ExternalIPAddress = A.B.C.DGetGenericPortMappingEntry() returned 713 (SpecifiedArrayIndexInvalid)(I've redacted the UUID and external IP. Note that the router is 192.268.1.1 on the LAN, and the server is 192.168.1.100.)When I re-enable my usual iptables rules and reboot (I use iptables-persistent), suddenly upnpc can't see anything:$ upnpc -m 192.168.1.100 -lupnpc : miniupnpc library test client. (c) 2006-2011 Thomas BernardGo to http://miniupnp.free.fr/ or http://miniupnp.tuxfamily.org/for more information.No IGD UPnP Device found on the network !This FAQ claims that ports 80, 1900, 5000, 5431 and 49152 are used. 80 is already being forwarded on this server for HTTP, but I don't think that matters here (since it's also being used when iptables is flushed and upnpc works). Opening all of these ports still doesn't allow upnpc to work.$ sudo iptables -L -n -v4   752 ACCEPT     udp  --  *      *       0.0.0.0/0            0.0.0.0/0            udp dpt:19000     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcp dpt:19000     0 ACCEPT     udp  --  *      *       0.0.0.0/0            0.0.0.0/0            udp dpt:50000     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcp dpt:50000     0 ACCEPT     udp  --  *      *       0.0.0.0/0            0.0.0.0/0            udp dpt:54310     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcp dpt:54310     0 ACCEPT     udp  --  *      *       0.0.0.0/0            0.0.0.0/0            udp dpt:491520     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcp dpt:49152$ upnpc -m 192.168.1.100 -lupnpc : miniupnpc library test client. (c) 2006-2011 Thomas BernardGo to http://miniupnp.free.fr/ or http://miniupnp.tuxfamily.org/for more information.No IGD UPnP Device found on the network !With iptables flushed, I've tried using Wireshark to see what's being received. But there's a lot of traffic, and it's hard to isolate uPnP traffic without knowing what it should look like. I did see some SSDP packets inbound on port 53147... but this isn't listed in any resource about uPnP, so I don't know whether it's fixed or dynamic.Are there more comprehensive instructions on how to allow uPnP traffic through a firewall without completely disabling it?Extra debuggingEnabling logging on packets dropped by iptables is giving me a bit more information. When I repeatedly make uPnP requests in one terminal, my kernel log will show lines like:IPTables-Dropped: IN=eth0 OUT= MAC=xxx SRC=192.168.1.1 DST=192.168.1.100 LEN=359 TOS=0x00 PREC=0x00 TTL=64 ID=0 DF PROTO=UDP SPT=1900 DPT=49585 LEN=339IPTables-Dropped: IN=eth0 OUT= MAC=xxx SRC=192.168.1.1 DST=192.168.1.100 LEN=359 TOS=0x00 PREC=0x00 TTL=64 ID=0 DF PROTO=UDP SPT=1900 DPT=57962 LEN=339 IPTables-Dropped: IN=eth0 OUT= MAC=xxx SRC=192.168.1.1 DST=192.168.1.100 LEN=359 TOS=0x00 PREC=0x00 TTL=64 ID=0 DF PROTO=UDP SPT=1900 DPT=42736 LEN=339IPTables-Dropped: IN=eth0 OUT= MAC=xxx SRC=192.168.1.1 DST=192.168.1.100 LEN=351 TOS=0x00 PREC=0x00 TTL=64 ID=0 DF PROTO=UDP SPT=1900 DPT=53912 LEN=331 These are just the entries where the source port is 1900. Four different ports, and I can't find any of them listed in any uPnP documentation.
What ports do I need to open for a uPnP client?
iptables;upnp