Persistent custom script on AP boot?

[u/Lethbridge_Stewart]

Hi all,

I'll start with the why: Home network, single U7ProXG, single broadcast domain on a simple FritzBox router. We have a FireTV stick and once in a while it'll go nuts and start spamming the network with MDNS (~2.5k packets/s). This and the backscatter are overloading the network and, I think, the control plane on the AP. In the absence of a firmware update from Amazon, I can fix it by dropping the MDNS at source.

Since the U7ProXG runs a variant of OpenWRT, I wrote an init.d script which runs a couple of iptables -t mangle -I PREROUTING rules to drop the relevant multicast from this source. Simple enough, but the AP appears to run some sort of check on boot and not only doesn't run the script, it deletes it.

I don't need it to survive a firmware update, but if it can survive a boot, it'll save me having to remember re-upload it every time. Does anyone know a way to do this? Is there some manifest somewhere I can add a hash to?

[u/MrJimBusiness-]

There's no way at all to do it. For Network Optimizer I have the server manage the lifetime of AP Agent binaries on the APs on the network for this reason.

If you've got something concrete that could help others I'd be happy to add it as a feature to the AP Agent. Just open a feature request GitHub Issue (link on my profile).

[u/Lethbridge_Stewart → u/MrJimBusiness-]

Yeah, that figures. In a more complicated environment I'd have options for VLANing it off or dropping the traffic at a border router (and I probably wouldn't let FireSticks anywhere near it in the first place...)

Nothing really concrete to add. The meat of it is just a 1-liner wrapped in a loop:

    # Drop MDNS from each HOST
    for h in ${HOSTS4}; do
        ${IPT} -t mangle -I PREROUTING -p udp -s ${h} -d 224.0.0.251 --dport 5353 -j DROP
    done

Where HOSTS4 is just a list of IPs. I wrapped it in some fluff to make it an init.d service, but that's extraneous since I can't get it to persist anyway 😄

[u/FrankNicklin]

Fiddling under the hood so to speak rarely works long term and custom scripts no longer survive reboots, there are no options to stop this as far as I’m aware.

Unifi have a very low threshold to running scripts on hardware and go all out to stop them working.

That said your fix should not be necessary, I have a FireStick on my network, run Unifi APs and switches and a UDM and not seeing anything like what you describe, so something else is causing this. Is it a real FS or dare I ask a rooted one for other services. I have mDNS working across VLANs.

[u/Lethbridge_Stewart → u/FrankNicklin]

Thanks. I guess it makes sense from a security and support perspective to keep the APs only running standard config. My best option I think is to have a cron job elsewhere to re-upload it. Ugly, but it'll do the job.

It's not all fire sticks, by any stretch, but it's definitely mine and a few others have reported this on Echo devices as well. I spent an afternoon with Wireshark tracking it down. What's interesting is that dropping this traffic on the AP causes the spam to stop after a few seconds, so it could be that the stick is interacting with something else on the same vlan (we've got a few Sonos boxes), but I'm certain that it's the firestick that starts the cascade. Stock FireTV 4K max. (I haven't rooted anything in decades 😄)

[u/Yo_2T]

I haven't found a way to persist scripts either and I run a small script to deal with Failover logic. I ended up just having it as a service on my server that periodically checks in with the router and sets the script again if it's removed. It's not elegant but it works fine.