ChugiakTinkerer
New Around Here
Hello folks. I'm scratching my head trying to resolve an issue with my Samsung BD-J5700 blu ray player. It may be that the Samsung update has just hosed the unit but I'd like to see what I can do to at least figure out what the problem is.
The problem manifests with an error response when trying to use any of the apps that says "System time is updating. Please try later." This seems to be a wide-spread recent issue for many owners of this or similar blu-ray player. Solutions seem to be limited and of the I danced widdershins around the router and fixed it variety. The user kmccarr provided the first clue to me as to where the problem lies: https://www.helpowl.com/q/Samsung/BDJ5700/Technical-Support/whats-time-updating-try-later/1004138
I've logged into my RT-AC66U which I regretfully updated to the latest firmware, not realizing I would lock out third party firmware options. Anyhoo, I seem to have gotten a grasp of how the firewall and forwarding system works. Frankly I don't have a lot of faith in the GUI settings and would much rather deal directly with iptables. I don't know it well but it at least seems to have some rigor and structure in how it works.
I have the following configuration for the router:
RT-AC66R (purchased from Office Max)
3.0.0.4.380_3831 firmware
Connect to my DSL modem via PPPoE
Firewall enabled, DoS protection disabled, logging both, no ping
I have Network Service Filter enable, black list, 24/7 and no filter set tup. This allows all outgoing ports from all LAN computers.
Under WAN I have port forwarding set up to forward traffic on port 123 to the blu ray device. This may not be necessary as I understand things.
With all of the above, I have logged outgoing NTP traffic from the blu-ray player. It still has the system time issue. I do not see any log entries showing return packets to the ntp queries. I'd like to figure out to ensure those packets are getting through, and log them if possible. Here's a log snippet from a recent powering up of the blu-ray:
I can see the blu-ray at IP of 192.168.1.224 sending out four NTP queries. I don't see any return UDP packets in the log. I don't know if the port forwarding is even happening. It doesn't look to be. Here's the output from iptables-save I get from telnetting in to the router:
It's not at all obvious to me that there is a rule covering the NPT port 123.
So does anyone have any suggestions on how to configure this stock firmware so that I can allow the blu-ray to complete its NTP time sync efforts? Any help would be much appreciated.
The problem manifests with an error response when trying to use any of the apps that says "System time is updating. Please try later." This seems to be a wide-spread recent issue for many owners of this or similar blu-ray player. Solutions seem to be limited and of the I danced widdershins around the router and fixed it variety. The user kmccarr provided the first clue to me as to where the problem lies: https://www.helpowl.com/q/Samsung/BDJ5700/Technical-Support/whats-time-updating-try-later/1004138
I've logged into my RT-AC66U which I regretfully updated to the latest firmware, not realizing I would lock out third party firmware options. Anyhoo, I seem to have gotten a grasp of how the firewall and forwarding system works. Frankly I don't have a lot of faith in the GUI settings and would much rather deal directly with iptables. I don't know it well but it at least seems to have some rigor and structure in how it works.
I have the following configuration for the router:
RT-AC66R (purchased from Office Max)
3.0.0.4.380_3831 firmware
Connect to my DSL modem via PPPoE
Firewall enabled, DoS protection disabled, logging both, no ping
I have Network Service Filter enable, black list, 24/7 and no filter set tup. This allows all outgoing ports from all LAN computers.
Under WAN I have port forwarding set up to forward traffic on port 123 to the blu ray device. This may not be necessary as I understand things.
With all of the above, I have logged outgoing NTP traffic from the blu-ray player. It still has the system time issue. I do not see any log entries showing return packets to the ntp queries. I'd like to figure out to ensure those packets are getting through, and log them if possible. Here's a log snippet from a recent powering up of the blu-ray:
Code:
Jul 9 21:02:24 kernel: ACCEPT <4>ACCEPT IN=br0 OUT=ppp0 <1>SRC=192.168.1.224 DST=157.55.184.57 <1>LEN=60 TOS=0x00 PREC=0x00 TTL=63 ID=7027 DF PROTO=TCP <1>SPT=49740 DPT=443 SEQ=3232292409 ACK=0 WINDOW=14600 RES=0x00 SYN URGP=0 OPT (020405AC0402080AFFFBC54A0000000001030306)
Jul 9 21:02:24 kernel: ACCEPT <4>ACCEPT IN=br0 OUT=ppp0 <1>SRC=192.168.1.224 DST=199.102.46.73 <1>LEN=76 TOS=0x00 PREC=0x00 TTL=63 ID=59552 DF PROTO=UDP <1>SPT=123 DPT=123 LEN=56
Jul 9 21:02:24 kernel: ACCEPT <4>ACCEPT IN=br0 OUT=ppp0 <1>SRC=192.168.1.224 DST=204.9.54.119 <1>LEN=76 TOS=0x00 PREC=0x00 TTL=63 ID=31053 DF PROTO=UDP <1>SPT=123 DPT=123 LEN=56
Jul 9 21:02:25 kernel: ACCEPT <4>ACCEPT IN=br0 OUT=ppp0 <1>SRC=192.168.1.224 DST=208.53.158.34 <1>LEN=76 TOS=0x00 PREC=0x00 TTL=63 ID=47554 DF PROTO=UDP <1>SPT=123 DPT=123 LEN=56
Jul 9 21:02:25 kernel: ACCEPT <4>ACCEPT IN=br0 OUT=ppp0 <1>SRC=192.168.1.224 DST=157.55.184.57 <1>LEN=60 TOS=0x00 PREC=0x00 TTL=63 ID=59642 DF PROTO=TCP <1>SPT=37428 DPT=80 SEQ=2967613257 ACK=0 WINDOW=14600 RES=0x00 SYN URGP=0 OPT (020405AC0402080AFFFBC7B30000000001030306)
Jul 9 21:02:25 kernel: DROP <4>DROP IN=ppp0 OUT= MAC= <1>SRC=207.244.70.169 DST=x.x.x.x <1>LEN=40 TOS=0x00 PREC=0x00 TTL=239 ID=54321 PROTO=TCP <1>SPT=40422 DPT=143 SEQ=3833198176 ACK=0 WINDOW=65535 RES=0x00 SYN URGP=0
Jul 9 21:02:25 kernel: ACCEPT <4>ACCEPT IN=br0 OUT=ppp0 <1>SRC=192.168.1.224 DST=108.61.56.35 <1>LEN=76 TOS=0x00 PREC=0x00 TTL=63 ID=49897 DF PROTO=UDP <1>SPT=123 DPT=123 LEN=56
Jul 9 21:02:25 kernel: ACCEPT <4>ACCEPT IN=br0 OUT=ppp0 <1>SRC=192.168.1.224 DST=157.55.184.57 <1>LEN=60 TOS=0x00 PREC=0x00 TTL=63 ID=20678 DF PROTO=TCP <1>SPT=37429 DPT=80 SEQ=3961952276 ACK=0 WINDOW=14600 RES=0x00 SYN URGP=0 OPT (020405AC0402080AFFFBC8D20000000001030306)
Jul 9 21:03:01 kernel: ACCEPT <4>ACCEPT IN=br0 OUT=ppp0 <1>SRC=192.168.1.40 DST=31.13.76.84 <1>LEN=60 TOS=0x00 PREC=0x00 TTL=63 ID=22926 DF PROTO=TCP <1>SPT=33069 DPT=443 SEQ=2149871764 ACK=0 WINDOW=65535 RES=0x00 SYN URGP=0 OPT (020405AC0402080A0004291A0000000001030307)
Jul 9 21:03:10 kernel: ACCEPT <4>ACCEPT IN=br0 OUT=ppp0 <1>SRC=192.168.1.121 DST=208.75.88.4 <1>LEN=76 TOS=0x00 PREC=0xC0 TTL=63 ID=0 DF PROTO=UDP <1>SPT=123 DPT=123 LEN=56
Jul 9 21:03:20 kernel: ACCEPT <4>ACCEPT IN=br0 OUT=ppp0 <1>SRC=192.168.1.54 DST=72.165.61.187 <1>LEN=108 TOS=0x00 PREC=0x00 TTL=63 ID=18035 DF PROTO=TCP <1>SPT=54528 DPT=27017 SEQ=1825703550 ACK=2186408317 WINDOW=23580 RES=0x00 ACK PSH URGP=0 OPT (0101080A064235800CBFCF26)I can see the blu-ray at IP of 192.168.1.224 sending out four NTP queries. I don't see any return UDP packets in the log. I don't know if the port forwarding is even happening. It doesn't look to be. Here's the output from iptables-save I get from telnetting in to the router:
Code:
admin@RT-AC66R:/tmp/home/root# iptables-save
# Generated by iptables-save v1.3.8 on Sun Jul 10 07:44:12 2016
*nat
:PREROUTING ACCEPT [461:34800]
:POSTROUTING ACCEPT [171:20968]
:OUTPUT ACCEPT [244:26976]
:LOCALSRV - [0:0]
:PCREDIRECT - [0:0]
:VSERVER - [0:0]
:VUPNP - [0:0]
:YADNS - [0:0]
-A PREROUTING -d x.x.x.x -j VSERVER
-A PREROUTING -d 192.168.1.2 -j VSERVER
-A POSTROUTING -s ! x.x.x.x -o ppp0 -j MASQUERADE
-A POSTROUTING -s ! 192.168.1.2 -o eth0 -j MASQUERADE
-A POSTROUTING -s 192.168.1.0/255.255.255.0 -d 192.168.1.0/255.255.255.0 -o br0 -j MASQUERADE
-A VSERVER -j VUPNP
COMMIT
# Completed on Sun Jul 10 07:44:12 2016
# Generated by iptables-save v1.3.8 on Sun Jul 10 07:44:12 2016
*mangle
:PREROUTING ACCEPT [4489:603008]
:INPUT ACCEPT [3427:535544]
:FORWARD ACCEPT [1020:61453]
:OUTPUT ACCEPT [3835:2230464]
:POSTROUTING ACCEPT [4860:2299161]
-A FORWARD -s 192.168.1.0/255.255.255.0 -d 192.168.1.0/255.255.255.0 -o br0 -j MARK --set-mark 0x1
COMMIT
# Completed on Sun Jul 10 07:44:12 2016
# Generated by iptables-save v1.3.8 on Sun Jul 10 07:44:12 2016
*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [3386:2115712]
:FUPNP - [0:0]
:PControls - [0:0]
:SECURITY - [0:0]
:logaccept - [0:0]
:logdrop - [0:0]
-A INPUT -i ppp0 -p icmp -m icmp --icmp-type 8 -j logdrop
-A INPUT -m state --state RELATED,ESTABLISHED -j logaccept
-A INPUT -m state --state INVALID -j logdrop
-A INPUT -i br0 -m state --state NEW -j ACCEPT
-A INPUT -i lo -m state --state NEW -j ACCEPT
-A INPUT -p udp -m udp --sport 67 --dport 68 -j logaccept
-A INPUT -p icmp -m icmp ! --icmp-type 8 -j logaccept
-A INPUT -j logdrop
-A FORWARD -p tcp -m tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu
-A FORWARD -m state --state RELATED,ESTABLISHED -j logaccept
-A FORWARD -i ! br0 -o ppp0 -j logdrop
-A FORWARD -i ! br0 -o eth0 -j logdrop
-A FORWARD -m state --state INVALID -j logdrop
-A FORWARD -i br0 -o br0 -j logaccept
-A FORWARD -i br0 -o ppp0 -j logaccept
-A FORWARD -m conntrack --ctstate DNAT -j logaccept
-A PControls -j logaccept
-A SECURITY -p tcp -m tcp --tcp-flags FIN,SYN,RST,ACK SYN -m limit --limit 1/sec -j RETURN
-A SECURITY -p tcp -m tcp --tcp-flags FIN,SYN,RST,ACK SYN -j logdrop
-A SECURITY -p tcp -m tcp --tcp-flags FIN,SYN,RST,ACK RST -m limit --limit 1/sec -j RETURN
-A SECURITY -p tcp -m tcp --tcp-flags FIN,SYN,RST,ACK RST -j logdrop
-A SECURITY -p icmp -m icmp --icmp-type 8 -m limit --limit 1/sec -j RETURN
-A SECURITY -p icmp -m icmp --icmp-type 8 -j logdrop
-A SECURITY -j RETURN
-A logaccept -m state --state NEW -j LOG --log-prefix "ACCEPT " --log-tcp-sequence --log-tcp-options --log-ip-options
-A logaccept -j ACCEPT
-A logdrop -m state --state NEW -j LOG --log-prefix "DROP " --log-tcp-sequence --log-tcp-options --log-ip-options
-A logdrop -j DROP
COMMIT
# Completed on Sun Jul 10 07:44:12 2016It's not at all obvious to me that there is a rule covering the NPT port 123.
So does anyone have any suggestions on how to configure this stock firmware so that I can allow the blu-ray to complete its NTP time sync efforts? Any help would be much appreciated.
