@Duckmuck hey, I'm also trying to get my Sonos Setup working in different VLANs. My Speakers are in VLAN IOT, subnet 10.0.2.0/24 (not really, but let's assume) My phone which is supposed to be the controller is in LAN, subnet 10.0.1.0/24. Which one do I have to setup as upstream and which one as downstream and which subnet has to be entered in which Interface. I see IGMP traffic in the general system logs, like group membership requests, but at the same time I see "IGMP came from myself, ignoring". Would be appreciated if you could help out

@stephenw10 I've tried every imaginable configuration possible that made sense and some that didn't. in firewall rules source any destination tv ip included and reverse. I appreciate the help though. I know from my postings I probably sound like I don't know at all what I'm doing. :P I wish you all could try it for yourself to see I'm not crazy.

@mannyjacobs73 said in Multi IGMP Proxy Behaviour: lthough I understand there is a difference between IGMP Snooping and IGMP Proxy, I do not completely understand how the IGMP Proxy service should be behaving when configured correctly... and especially with multiple devices / additional Virtual IP assigned. Hi, I'll re-write my query and hopefully someone can put me in the right direction... Basically I am wanting to know if there is any documentation or notes available regarding the behavior of the IGMP Proxy protocol which is found in pfsense (query timings, priority etc.) . Specifically when two devices are running IGMP Proxy on the same LAN, but even any pointers to more in-depth documentation as to how this service runs on a stand alone box, would be appreciated. Thank you

@tony77 As mentioned above, WiFi calling uses IPSec. Look into why that's failing. Packet capture helps here. If the VPN stays up, it's not a pfSense problem. BTW, I've never had an issue with Wifi calling here.

@stephenw10 Thanks, found that this function of size limiting was not in my version of suricata, an update was pending...

It might do. You certainly won't get that working with a subnet conflict. Steve

ip route show table 0 will give you the current routes in Android. At least it does on my older device. Had you done that you would have found 192.168.1.0/24 via the openvpn server IP was missing. Adding it as a local network there is what causes the server to pass that route to the clients. Glad you found it. Steve

You can't have two mobile IPSec servers, no. But this is OpenVPN, you can have as many instances as you have ports/resources.

the solution was reverse php version to 5.6 on the vhost in www/mailserver so not related to pFsense

There's no easy way to do that really. If I was doing it I would probably edit the config file directly and reboot to load it. Your WAN should look like: <wan> <if>pppoe0</if> <descr><![CDATA[PPPoEWAN]]></descr> <blockpriv></blockpriv> <blockbogons></blockbogons> <enable></enable> <ipaddr>pppoe</ipaddr> </wan> And you'll need a PPP section like: <ppps> <ppp> <ptpid>0</ptpid> <type>pppoe</type> <if>pppoe0</if> <ports>em0</ports> <username>your_username</username> <password>base64_encoded_password</password> <descr><![CDATA[WAN]]></descr> <provider>Your_ISP</provider> </ppp> </ppps> Or similar with your details in it. Steve

Yeah that's where inverted rules can bite you. !LAN net or !WIFI net is effectively everywhere. Your 'Wide Open' rule is actually only to the WAN subnet which is probably only small subnet with your public IP in it. You probably want destination 'any' there to allow traffic to any external IP. Steve

Because if it changes we want people to know about that change. You can edit the file to change the interval if you want or prevent access to the fqdn so it never sees any changes. Steve

Hmm, not sure why you would have to do that. You could just add them as static leases so they always get the same IP. Steve

@stephenw10 Nervermind, Thanks anyways, I just a bought ethernet switch, no need bridge and working fine now.

So you are authenticating using Radius from pfSense to the Synology device? Does it resturn groups locally correctly? Why are you using LDAP and Radius? Steve

Exactly what VPN type are you using here? I don't really see why you could not use certs signed by another CA as long as the server and clients were both using it. Though I'm not sure I've ever tried that myself, for mobile IPSec at least. Steve

Indeed. If @eiger3970 is seeing this in 2.1 then upgrade! If it's in 2.4.4 then it's almost certainly unrelated to whatevet was happening here and a new thread is more appropriate. Steve

@gboone I preferred the previous spelling. I thought it was more accurate.

Aw, interesting. Yes that file is there. I removed it and the notices have gone away. Thanks!