Home / ubuntu / Questions / 260754
In Process
user74039
Asked: 2013-02-25 10:20:05 +0800 CST

Securing mini-dlna?

  • 772

I've been trying to setup a DLNA service to share my media from my PC to my laptop and occasionally my phone and tablet. After a lot of messing around I found mini-dlna which works well, the problem is, everyone on my network can see my shares and I don't want this. Does anyone have a way of securing it? I thought maybe using iptables but I don't have any experience with it and I don't want to setup a whole load of firewall exceptions for everything that I have running on the PC such as ssh and web servers etc, I'd want to just restrict DLNA access. I use DHCP reservations for my devices.

Or is DLNA the wrong way to do it? Is there a better solution? I don't care about windows clients, just Linux and Android. I want to stream audio and video.

Also, if DLNA is the best way, can anyone recommend a Linux client? I can get clients in Android streaming fine, it's just the security issue, I can't find a working client in Linux though, VLC doesn't work, it sees my server but clicking it, double clicking it, adding to playlist doesn't do anything.

dlna

2 Answers

  1. For the first part of your question, you might want to take a look at Serviio. In the payed version, it permits you to set sources as "restricted" (the free version comes with a 14 day trial). More details can be found in my answer to minidlna and samsung tv file format doesn't support.

    For the second part, take a look at UPNP / DLNA (client) player recommendations?

    • 0

  2. Simple iptables rules

    #by default, drop incoming requests
:INPUT DROP [0:0]
#by default, drop forwards
:FORWARD DROP [0:0]
#by default, accept any outgoing traffic
:OUTPUT ACCEPT [0:0]

#Allow traffic to port 8200 (DLNA) to specific IPs
-A INPUT -p tcp -i <interface> -s <allowed device ip> --dport 8200 -j ACCEPT
-A INPUT -p tcp -i <interface> -s <allowed device ip> --dport 8200 -j ACCEPT
-A INPUT -p tcp -i <interface> -s <allowed device ip> --dport 8200 -j ACCEPT
#Deny traffic to 8200 from all others
-A INPUT -p tcp -i <interface> --dport 8200 -j DROP

#Go back to permitting all other traffic
-A INPUT -i <interface> -j ACCEPT
-A FORWARD -i <interface> -j ACCEPT

    The second part of your question sounds like a permissions issue.

    • 0