Plex on a different network to media players

Installing and Using OpenWrt
1

I currently have a number of vlans on one router to separate different clients for security. All secure clients (including my plex server) are on 192.168.10.0 and most of my media players are on 192.168.30.0. I'm obviously using the two separate lans as in general I don't want the media players to access the clients on the lan, but I'd like them to have access to just the plex data. I know I could move the plex sever to the media lan, but the server is virtual and lives on the same machine as my lan data server so this isn't that easy.

So when I try to connect to my plex media server (192.168.10.10:32400) from my chromecast (192.168.30.95) it will not find the sever and hence play any media. I'm sure I need to route the traffic in some way but I'm unsure exactly how to set this up in openwrt. I've had a stab at forwarding certain ports suggested in other posts as per the firewall details below, but this doesn't work. Any help would be gratefully received.

config defaults
option input 'REJECT'
option output 'ACCEPT'
option forward 'REJECT'
option synflood_protect '1'

config zone
option name 'lan'
option input 'ACCEPT'
option output 'ACCEPT'
option forward 'ACCEPT'
list network 'lan'

config zone
option name 'wan'
option input 'REJECT'
option output 'ACCEPT'
option forward 'REJECT'
option masq '1'
option mtu_fix '1'
list network 'wan'
list network 'wan6'

config rule
option name 'plex_TCP_UDP_32400'
option src '*'
list dest_ip '192.168.10.10'
option dest_port '32400'
option target 'ACCEPT'
list proto 'tcp'
list proto 'udp'
option src_port '32400'

config rule
option name 'plex_UDP_1900'
option src '*'
list dest_ip '192.168.10.10'
option dest_port '1900'
option target 'ACCEPT'
list proto 'udp'
option src_port '1900'

config rule
option name 'plex_TCP_3005'
option src '*'
list dest_ip '192.168.10.10'
option dest_port '3005'
option target 'ACCEPT'
list proto 'tcp'
option src_port '3005'

config rule
option name 'plex_UDP_5353'
option src '*'
list dest_ip '192.168.10.10'
option dest_port '5353'
option target 'ACCEPT'
list proto 'udp'
option src_port '5353'

config rule
option name 'plex_TCP_8324'
option src '*'
list dest_ip '192.168.10.10'
option dest_port '8324'
option target 'ACCEPT'
list proto 'tcp'
option src_port '8324'

config rule
option name 'plex_TCP_32469'
option src '*'
list dest_ip '192.168.10.10'
option dest_port '32469'
option target 'ACCEPT'
list proto 'tcp'
option src_port '32469'

config rule
option name 'plex_UDP_2410-32414'
option src '*'
list dest_ip '192.168.10.10'
option dest_port '32410-32414'
option target 'ACCEPT'
list proto 'udp'

config rule
option name 'Allow-DHCP-Renew'
option src 'wan'
option proto 'udp'
option dest_port '68'
option target 'ACCEPT'
option family 'ipv4'

config rule
option name 'Allow-Ping'
option src 'wan'
option proto 'icmp'
option icmp_type 'echo-request'
option family 'ipv4'
option target 'ACCEPT'

config rule
option name 'Allow-IGMP'
option src 'wan'
option proto 'igmp'
option family 'ipv4'
option target 'ACCEPT'

config rule
option name 'Allow-DHCPv6'
option src 'wan'
option proto 'udp'
option dest_port '546'
option family 'ipv6'
option target 'ACCEPT'

config rule
option name 'Allow-MLD'
option src 'wan'
option proto 'icmp'
option src_ip 'fe80::/10'
list icmp_type '130/0'
list icmp_type '131/0'
list icmp_type '132/0'
list icmp_type '143/0'
option family 'ipv6'
option target 'ACCEPT'

config rule
option name 'Allow-ICMPv6-Input'
option src 'wan'
option proto 'icmp'
list icmp_type 'echo-request'
list icmp_type 'echo-reply'
list icmp_type 'destination-unreachable'
list icmp_type 'packet-too-big'
list icmp_type 'time-exceeded'
list icmp_type 'bad-header'
list icmp_type 'unknown-header-type'
list icmp_type 'router-solicitation'
list icmp_type 'neighbour-solicitation'
list icmp_type 'router-advertisement'
list icmp_type 'neighbour-advertisement'
option limit '1000/sec'
option family 'ipv6'
option target 'ACCEPT'

config rule
option name 'Allow-ICMPv6-Forward'
option src 'wan'
option dest '*'
option proto 'icmp'
list icmp_type 'echo-request'
list icmp_type 'echo-reply'
list icmp_type 'destination-unreachable'
list icmp_type 'packet-too-big'
list icmp_type 'time-exceeded'
list icmp_type 'bad-header'
list icmp_type 'unknown-header-type'
option limit '1000/sec'
option family 'ipv6'
option target 'ACCEPT'

config rule
option name 'Allow-IPSec-ESP'
option src 'wan'
option dest 'lan'
option proto 'esp'
option target 'ACCEPT'

config rule
option name 'Allow-ISAKMP'
option src 'wan'
option dest 'lan'
option dest_port '500'
option proto 'udp'
option target 'ACCEPT'

config redirect
option dest 'lan'
option target 'DNAT'
option src 'wan'
option src_dport '80'
option dest_ip '192.168.10.12'
option dest_port '80'

config redirect
option dest 'lan'
option target 'DNAT'
option src 'wan'
option src_dport '443'
option dest_ip '192.168.10.12'
option dest_port '443'

config include 'pbr'
option fw4_compatible '1'
option type 'script'
option path '/usr/share/pbr/firewall.include'

config forwarding
option src 'lan'
option dest 'wan'

config zone
option name 'iot'
option input 'ACCEPT'
option output 'ACCEPT'
option forward 'REJECT'
list network 'iot'

config zone
option name 'media'
option input 'ACCEPT'
option output 'ACCEPT'
option forward 'REJECT'
list network 'media'

config forwarding
option src 'media'
option dest 'wan'

config forwarding
option src 'lan'
option dest 'iot'

config forwarding
option src 'lan'
option dest 'media'

config forwarding
option src 'iot'
option dest 'wan'

config rule
option name 'mDNS'
list proto 'udp'
option src '*'
option src_port '5353'
list dest_ip '224.0.0.251'
option dest_port '5353'
option target 'ACCEPT'

config rule
option name 'sonos'
option src '*'
list dest_ip '192.168.10.15'
option dest_port '1400'
option target 'ACCEPT'
option src_port '1400'
2

It is not correct to use src_port in the rules, as you cannot know which port the client will use to connect to the Plex server.
Start with something simple, one IP from vlan30 to the IP of Plex, verify that it works, then move to further tighten the rules.

1 Like
3

Further to what @trendy has said, change option src_port to option src_dport, remove list proto 'udp', and add option dest 'lan' in the following rule:

Change the destination zone to the correct one if it's not lan. Remove/disable the other Plex rules.

4

That doesn't seem correct. src_dport is used in DNAT to identify the pre-NAT destination port.

You are right, I missed that and all those rules are meant for incoming traffic.

5

You're right. It's only necessary in a redirect, rather than a rule. The entire line (option src_port ’32400’) should be deleted entirely.

1 Like
6

Thank-you both. Between the two of you, you seem to have fixed my issue but if its ok I'd like to understand how. Initially I was confused that the two answers sort of contradict each other, by stating to remove src_port and then later to change src_port to src_dport. I started just as trendy suggested and initially no luck. But after adding src_dport and dest 'lan' it does work. So can you please explain what src_dport is, as I don't really get it; a "source destination port" don't the src_port and dest_port already cover this? Also as I largely use the LUCI GUI for settings where would this setting appear as I can't see it at all when setting up firewall traffic rules.
Lastly the option dest 'lan' doesn't seem necessary as long as the dest_ip is added, at least as far as my testing shows. So do you think its actually necessary and potentially when everything is rebooted later then it may stop working again without the lan destination specified?
Thanks

7

As @trendy pointed out, src_dport is used when NAT is being used. It identifies the port the packets had originally been destined for, before they are then rewritten to the correct internal port. It doesn't have any impact on your situation.

If you don't have a destination zone in the rule then it's treated as an input rule, i.e. it is applied to traffic that is meant for the router. If you want the rule to apply to forwarded traffic (which you do as it's going between two zones) you need to have a destination zone in the rule.

It will stop working.

1 Like
8

Thanks again to you both

1 Like
9

This topic was automatically closed 10 days after the last reply. New replies are no longer allowed.