ArduinoOTA ESP8266 which port to unblock on firewall?

Projects Networking, Protocols, and Devices
1

Hi,

I am using an ESP8266, I can upload successfully over the air if I disable my firewall in my Linux distribution.

But if I enable my firewall i get ...

[ERROR]: No response from device

Does anyone know what ports to unblock ?

Thanks

2

The default is 8266.

3

Hi,

Yes I thought that was, this is how I configured my firewall, not sure if I have done it correctly ?

23
23745×561 39.5 KB

But with these settings it fails ?

Thanks

4

What does the log say? Do you see blocked requests?

5

Hi,

There was nothing in the firewall Log ?

But you did make me think and I looked in my Ksystem log and found this

[UFW BLOCK] IN=eno1 OUT= MAC=a8:a1:59:5f:d7:06:5c:cf:7f:0b:94:dc:08:00 SRC=192.168.1.19 DST=192.168.1.67 LEN=44 TOS=0x00 PREC=0x00 TTL=128 ID=349 PROTO=TCP SPT=25882 DPT=17939 WINDOW=5840 RES=0x00 SYN URGP=0

Also this

[UFW BLOCK] IN=eno1 OUT= MAC=01:00:5e:00:00:01:a8:9a:93:2d:14:0c:08:00 SRC=192.168.1.254 DST=224.0.0.1 LEN=36 TOS=0x00 PREC=0xC0 TTL=1 ID=0 DF PROTO=2

Not sure what it all means bit I am trying to upload to 192.168.1.19 and it does mention this and also ports?

192.168.1.254 is my router.

Thanks

6

224.x.x.x is a multicast address, if I had to guess I would say this is mDNS traffic.

The first entry has it's source in 192.168.1.19. If that's your ESP, I wonder why it tries to request something from 192.168.1.67. What is that address BTW? There is no known service on port 17939.

7

Hi,
192.168.1.67 is the PC I am working on and I an uploading from this to the ESP via my router ?

I tried to connect again and go this

[UFW BLOCK] IN=eno1 OUT= MAC=a8:a1:59:5f:d7:06:5c:cf:7f:0b:94:dc:08:00 SRC=192.168.1.19 DST=192.168.1.67 LEN=44 TOS=0x00 PREC=0x00 TTL=128 ID=620 PROTO=TCP SPT=4967 DPT=54134 WINDOW=5840 RES=0x00 SYN URGP=0

SPT and DPT seem to change randomly ?

Thanks

8

Hi,

I have this working, with adding this rule via terminal.

sudo ufw allow in on eno1 from 192.168.1.0/24 to any

Ideally I would like to be the range 192.168.1.0 to 192.168.1.110 but I am not sure how to do this ?

Also if I do sudo ufw allow in on eno1 from 192.168.1.0/24 to any port 8266

This does not work ?

Any ideas

Thanks

9

This would be enough if you upload manually but to let the IDE identify the ESP on the network you have to enable mDNS. mDNS uses multicast UDP packets to port 5353 to advertise the service. This should be enough for that feature to work. Using mDNS the ESP may advertise any port for the OTA update which is quite difficult to configure in the firewall.

The way you open your firewall shouldn't be a big security problem given your WiFi network isn't open for public access.

10

Hi,

Thanks for all your help, you have been a great help and given me helpful information. :grinning:

Thanks Gaz