Restricting access to dlna(mini)/UPnP Media Server

[Grecu]

Hello all,

I have a local network which is shared with a few neighbours and I would like to have dlna server and samba activated so I can copy movies and so on thorough samba and watch them thorough DLNA on my smart TV (which does not know samba or NFS).
I thought that it should not be too difficult to restrict access to the DLNA server and allow only the TV to access it.
I have tried the solution described in this thread:
https://www.snbforums.com/threads/restricting-upnp-access.17341/
but with no success.

After reboot I have checked the file in /tmp/etc/upnp/config and it has my modifications in it:

allow 1024-65535 192.168.1.11/32 1-65535

But I have checked from a different IP and I can watch movies

I was also thinking it would be nice to have in the config interface an option to allow/deny some IP/MAC addresses access to the media server.

Anyone facing the same problem?

 

[ColinTaylor]

Your problem is that you are modifying the wrong config file. /tmp/etc/upnp/config is for miniupnpd (port forwarding). You need to modify minidlna.

https://github.com/RMerl/asuswrt-merlin/wiki/Minidlna:--Common-Issues-&-Solutions

 

[Grecu]

Ok, but could you be a little more specific? A hint?
I am trying now to understand how miniupnp and minidlna work, so maybe then I will know what to do...

 

[ColinTaylor]

Ok, but could you be a little more specific? A hint?
I am trying now to understand how miniupnp and minidlna work, so maybe then I will know what to do...

I was mearly pointing out that miniupnp has nothing to do with DLNA. I don't use minidlna so can't offer any more help, but if you can't do what you want from within minidlna you might have to block/allow access using iptables.

 

[latenitetech]

I don't think there is any config option in minidlna to restrict access like you want. There is the
'network_interface' option that restricts access to specific network interfaces, but I don't think it'll help.

Here's an idea: are your neighbors connecting to your network strictly via wireless? How about putting them on a guest network, and deny them access to your local LAN. This is built in (and easy to use) functionality of the router out-of-the-box. They would still get free use of your internet connection, but wouldn't be allowed access to any of your LAN resources, including minidlna.