Myth Backend and OSX Firewall Problem

[coldcase]

I posted this in the general troubleshooting section, should have posted it here, sorry.

I looked around and didn't see anything on this problem I'm having.

I've been running myth over a year now on a Mac Mini with Mavericks Server installed (10.9.5).I installed myth from the "mythtv-pkg.27-Fixes-0.27.4-20150304" package with mysql-5.6.23-osx10.9-x86_64. I have two separate wired networks connected to the Mac. One is a closed local network with two HDHomerun receivers and a windows media center. The other wired connection is the typical LAN with access to the internet via a router. The router does port forwarding but does not have an ip address blocking function. Myth has been working fine for some time. I do notice that when I stop the mythbackend any time I restart the machine the myth apps seem to be much happier.

I recently wanted to try enabling the built in MacOS firewall PF to filter a few specific IPs from accessing the server. The mini serves a private web page, does backups, and is the house media center. I used the Murus front end GUI to enable PF with everything open. Then I add an IP address or two the block list. PF blocks these just fine but.....

Mythbackend gets unhappy. It seems to bog down and is nearly completely unresponsive. The start/stop app says the backend is running but busy. There is not much CPU load indicated in activity monitor, however. When I disable PF and uninstall Murus, mythbackend is much happier. The myth frontend seem to run OK.

Doesn't seem to be anything unusual in the logs, its not a crash, just seems to be slow. Live TV fails and recordings fail. Before I start digging deeper I wanted to check in here to see if anyone ran across this issue and solved it. It could very well be something about PF or Murus, I dunno. There are probably a dozen other ways to simply block a few IP addresses, this one seemed the simplest for my case.

[pvr4me]

Not sure if I can be of much help, but...

When you say you checked the logs, which logs did you look at? mythbackend? General system logs? Firewall log (does it go to Console.app?)?

The Myth_Start_Stop applescript just calls 'mythshutdown --status' to check on the backend. Perhaps try that directly?

Craig

[coldcase]

The firewall log just shows it being started and when it blocks something ( a specified IP address in this case) and when its disabled, nothing of any errors.

I just quickly searched all the logs (shown in the console app) for myth and didn't see anything unusual, I mean I'm no expert, but didn't see anything that stood out. There was an exit with code 130 and a few throttling respawn entries. There were some complaints about hidden visibility. Some bootstrap port disappearing entries.

There was some mythfrontend stuff, but that doesn't seem to be an issue.


Since its not a crash, I'm not sure I would see many log entries. But I haven't dug much deeper.

[pvr4me]

I was guessing that there might be hundreds (or thousands) of rejected connections.

What about RAM? In Activity Monitor, does the memory tab show a lot of swap being used? Compressed memory? If so, which processes are the biggest RAM users?

I see that Murus has a user forum. You might want to try posting there. Perhaps they can show you how to properly diagnose the problem.

Craig

[coldcase]

Yeah, I was going to do that but Murus is just a GUI front end for the OpenBSD like PF built into MacOS. I wouldn't expect much help there, I'll need to find a PF expert forum. I was hoping someone here may have seen the MacOS PF screw with the Myth backend. Save me some work

I didn't catch the memory usage during the problem unfortunately. The mini has 8GB of RAM. mythbackend uses 36MB unless its recording, where it would jump to 100MB or so. mysqld sits at 160MB.

Thanks, lots of good info here.

[coldcase]

As an update, It looks like port 6543 is getting blocked, which MythTV uses, or something is blocking the MythTV connections.

I get something like this a few seconds after trying to execute mythlink

Couldn't communicate with 10.0.1.19 on port 6543: IO::Socket::INET::MythTV: connect: timeout

As far as I can tell from looking at the PF config file, first all all ports are blocked and then specified ones are opened.... but 6543 doesn't seem to be one of them. When I edit out the block all rule, Myth is happy.

I'm running 0.27 from macports (Feb 2015 time frame), dunno if 0.28 is different in this respect.


I think I should give up on the free GUI, and try setting up PF directly.

[pvr4me]

As an update, It looks like port 6543 is getting blocked, which MythTV uses, or something is blocking the MythTV connections.

I get something like this a few seconds after trying to execute mythlink

Couldn't communicate with 10.0.1.19 on port 6543: IO::Socket::INET::MythTV: connect: timeout

As far as I can tell from looking at the PF config file, first all all ports are blocked and then specified ones are opened.... but 6543 doesn't seem to be one of them. When I edit out the block all rule, Myth is happy.

I'm running 0.27 from macports (Feb 2015 time frame), dunno if 0.28 is different in this respect.


I think I should give up on the free GUI, and try setting up PF directly.

Um, you can't expect Myth to be able to punch holes through your firewall! As you say, "When I edit out the block all rule, Myth is happy." ...

Craig

[coldcase]

Yeah, I wasn't expecting Myth to punch holes, just updating the thread in case anyone runs across a similar problem.