Which ports on my firewall should I open to let it out?

Moderators: RokuDouglas, RokuShawnS, RokuRyan, RokuJamesL, RokuKen

Which ports on my firewall should I open to let it out?

Postby beedub » Wed May 28, 2008 6:29 pm

I received my box yesterday (YEAH!)

Tried it out at a friend's place - everything worked fine.
(in case you were wondering - just to rule out anything on that side)
------------------------------------------------------------
Anyway, now I have it at my place which is going through a different gateway ( 2Wire 1000 series gateway/firewall/modem), and the firewall appears to be stopping it.

My question is:
What port (or port range) should I open up on the firewall to let it out?

Thanks.
beedub
 
Posts: 17
Joined: Wed May 28, 2008 1:15 am

Postby RokuLyndon » Wed May 28, 2008 6:37 pm

I saw another post on here about problems moving the unit from one network to another easily. I don't know if that applies in your case.

You can try a factory reset, and then trying to connect again, unless you know specifically that your firewall is blocking the player.
RokuLyndon
 

Firewall

Postby beedub » Wed May 28, 2008 7:01 pm

Just for kicks I did a factory reset. - no change

Am I wrong about it needing an open port on the firewall to connect?
beedub
 
Posts: 17
Joined: Wed May 28, 2008 1:15 am

Also....

Postby beedub » Wed May 28, 2008 9:06 pm

I may be going down a bunny-trail here, but when I put a packet-sniffer on the network I see that as it passes the "connecting to your local network" phase the ROKU (0.0.0.0) negotiates with the DHCP server :
DISCOVER > OFFER > REQUEST
(But I see no ACKnowledge from the DHCP afterwards)

If I go to the router/firewall and check under DHCP section, it has in fact allocated an IP address for the ROKU, and marked it as active.

But as I peruse the log I see there are NO packets originating from the "assigned" IP address, and when I hit retry on the ROKU it tries to lease a new IP from the DHCP all over again.

Does this help shed any light on my situation?

Or am I completely lost down this cold and dark bunny-trail?


:?
beedub
 
Posts: 17
Joined: Wed May 28, 2008 1:15 am

Postby RokuLyndon » Thu May 29, 2008 12:14 am

beedub,

I looked at my router logs, and port 80 is the only port used when my player is streaming. That's the same port you use for web browsing.

Which 2-wire gateway do you have? And, what's its current firmware?
RokuLyndon
 

Postby TaylorH » Thu May 29, 2008 1:45 am

The player only uses http port 80 and https port 443.
Port 80 is used for the streaming as Lyndon said.
Port 443 is used to talk to the Netflix control server which is what handles all other functions such as a activation, queue updates, etc.

I have an open issue with one particular Netflix router that for some reason I can not complete a DHCP license renew but only during the initial network setup. Initial DHCP request is no problem. This is something that we're investigating. I'm not sure if it's related to or similar to the to the problem you're having.
Former Roku employee
TaylorH
 
Posts: 248
Joined: Mon May 19, 2008 6:02 pm
Location: Saratoga, CA

Postby devrdander » Thu May 29, 2008 10:12 am

Where/How did you setup the packet sniffer?

If other devices on your network are recieving DHCP leases properly i wouldn't suspect the firewall directly, unless its using some odd format that the Roku device can't handle.

Check your router for stale leases and delete them if you can, also make sure nothing else on your network has the same IP as the one that is trying to be assigned, perhaps there is a conflict? Make sure nothing is statically assigned in the same IP range as your DHCP Pool.
devrdander
 
Posts: 90
Joined: Wed May 28, 2008 11:46 am

Postby RokuAnthony » Thu May 29, 2008 11:27 am

It should not be necessary to set up anything on your firewall. The Netflix Player by Roku uses the same ports as a standard web browser (HTTP and SSL). If you can browse the web, then your netflix player should not be having firewall issues.
User avatar
RokuAnthony
El Jefe
 
Posts: 703
Joined: Fri Aug 20, 2004 12:44 pm
Location: Palo Alto, CA USA

sniffing...packets...and ports...

Postby beedub » Thu May 29, 2008 1:38 pm

Hello everybody,

The gateway is a 2-wire, and on the website it is below the current line, known as the "100/1000 series" The exact model number is 1701HG.
-------------------------

I opened port 443 just for kicks....no difference.
(it sounds like I shouldn't have to anyway)
-------------------------

BTW: My entire network is on STATIC IP addresses, I don't usually use DHCP for anything, I just turned it on for the ROKU. As a test I plugged in a laptop computer that was without a static address, and the DHCP leased the laptop an IP address, and I was able to surf the net with it.

--------------------------

For packet sniffing I am using Ethereal, just a simple packet analyzer. and I set it to the mode so it logs every packet (all protocols are enabled, so it should see most everything)

BeeDub
beedub
 
Posts: 17
Joined: Wed May 28, 2008 1:15 am

DHCP pool..

Postby beedub » Thu May 29, 2008 1:39 pm

And yes, the DHCP pool is FAR away from the static IPs - no conflicts there.
beedub
 
Posts: 17
Joined: Wed May 28, 2008 1:15 am

Postby devrdander » Thu May 29, 2008 1:58 pm

I would assume that the Roku allows ICMP and you can ping the device once its online. Before i go crazy and have you doing deep packet inspection here, check out what IP it is supposedly recieving in your routers DHCP lease table. Can you ping it? If yes, then its getting an IP if not then you can keep digging deeper into this DHCP packet capture.

On a switched network you will only see packets destined to your mac address. So you will see the broadcast request for a DHCP address but the resulting reply will not be seen by your computer as it will be switched privately to the Roku. You either need a "dumb hub" which doesn't switch the traffic, or you need a switch that will let you do port mirroring (usually a feature of a managed or "smart" switch). So if your device says "Switch" which most these days do, then that explains what you prob saw on your capture.

You could run a local DHCP server on your PC and attach the Roku via a cross over cable, this will give you a fully detailed packet capture. tftpd32 is a simple app that also does DHCP and is free for windows. If you are on linux you have a slew of options for DHCP services.
devrdander
 
Posts: 90
Joined: Wed May 28, 2008 11:46 am

I can ping it

Postby beedub » Thu May 29, 2008 2:40 pm

OK..... I CAN ping it.....So.....that whole theory is blown... :/
beedub
 
Posts: 17
Joined: Wed May 28, 2008 1:15 am

Diagnostics.......RECAP

Postby beedub » Thu May 29, 2008 2:50 pm

Here's a question:

Is there any way for the ROKU to go into some kind of "Verbose" mode for troubleshooting?

----------------------------------------

JUST TO RECAP:

The Roku box worked perfectly from another location.

At this new location, I did a factory reset.

I am still using a wired network, and as I go through the setup it gets stuck at the "connecting to the Internet" stage.

I started the DHCP server on my gateway, set the pool to a non-conflicting area, and tested the DHCP leasing of IPs with a laptop.

Verified the laptop and the ROKU both have valid IPs (in the pool) and both can be pinged.

The laptop can reach the Internet, but the ROKU cannot.

----------------------------------------------------------------
beedub
 
Posts: 17
Joined: Wed May 28, 2008 1:15 am

Postby devrdander » Thu May 29, 2008 4:05 pm

and you are 100% positive nothing else has that IP address already? start a continuous ping (ping -t ip.ad.ddr.ess on windows) and then unplug the device and make sure they drop/time out... Can you do netflix streaming from a windows PC? I wonder if the roku uses a fixed DNS server, do you have udp port 53 open? from a windows PC you can try to run a NSlookup:

~$ nslookup
> server 4.2.2.1
Default server: 4.2.2.1
Address: 4.2.2.1#53
> forums.rokulabs.com
Server: 4.2.2.1
Address: 4.2.2.1#53

Non-authoritative answer:
Name: forums.rokulabs.com
Address: 209.200.238.95
>

See if it gets out. at this point I would really want to try a Packet Capture to see what is failing... But that would be best done with it actively on the network (no crossover cable) to see what is and isn't working. Unless the Roku guys can bust out a special diagnostic page on the device you can get to, try pressing ↑ ↑ ↓ ↓ â†
devrdander
 
Posts: 90
Joined: Wed May 28, 2008 11:46 am

hmm..

Postby beedub » Thu May 29, 2008 4:33 pm

O.k....

First of all....Yes I am 100% sure nothing else is using that address.
----------------------------
I did the continuous ping.....ran it for a couple of mins - pulled the cable - it timed out - replaced the cable - it picks it up again and continues....
----------------------------

"nslookup forums.rokulabs.com" from my PC yields:

Server: forums.rokulabs.com
Address: 209.200.238.95
...
served by:
- i.root-servers.net
192.58.128.30

- j.root-servers.net
- k.root-servers.net
etc...

----------------------------
beedub
 
Posts: 17
Joined: Wed May 28, 2008 1:15 am

Next

Return to Roku Streaming Player General Discussion

Who is online

Users browsing this forum: belltown, Cosmacter, Deborahroy1 and 12 guests