Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    23.01.b.20230106.0600 IGMP proxy stops TV stream

    Scheduled Pinned Locked Moved General pfSense Questions
    139 Posts 18 Posters 60.4k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • H
      haraldinho @michiel
      last edited by haraldinho

      @michiel I dove into the issue and I think I might have found a solution.

      0c58ca29-9607-40de-b40f-27ce785a3bf9-image.png

      These are my adjusted mappings under NAT --> Outbound based on the blogpost I found from the travelling tech guy, where his NAT rules were different than mine.

      https://travellingtechguy.blog/using-your-own-pfsense-router-with-kpn-fiber-and-kpn-itv/

      Initially I had only the bottom mapping. I disabled it, and replaced them with the three topmost rules based on the blog post. Until now this seems to have fixed the issue for me, but I need some more testing. Can't do too much testing now as the Misses is also watching tv with me ๐Ÿ˜‰ .

      Obviously you should replace 192.168.70.0/24 with your specific subnet.

      T M 2 Replies Last reply Reply Quote 0
      • T
        thebear @haraldinho
        last edited by

        @haraldinho indeed the NAT is wrong in the first guide, that's what I mentioned with reversed engineered...everyone is making a guide for the clickbait with good intentions.

        Still the second guide is not 100% correct, in that guide are the commonly used proxy upstream address used in the NAT config. The correct configuration for the proxy is the one from the first guide (in fact 0.0.0.0/0 splitter over two subnets).

        The correct NAT rule is the one below, you only need to NAT the traffic to the route you receive from the DHCP advertisement from KPN. And that's a single subnet.

        With these both configuration parts you are more persistent to future changes from the ISP side.

        bc5bfe43-2412-473f-bdc0-a01a1d076b6c-image.png

        75a158a7-4973-4e1a-b3dd-8de269af54a4-image.png

        1 Reply Last reply Reply Quote 0
        • M
          michiel @haraldinho
          last edited by michiel

          @haraldinho Thank you for diving into this. I added these rules to NAT --> Outbound, but still have the same issue. So I tried the option of @thebear but also that is not working. Live TV pauses and restarts. Recorded programs don't.

          D9136E8C-87AF-4666-9322-0A5BF277D198_4_5005_c.jpeg

          769D32B7-CC8B-4837-891E-2340FC3FC843_4_5005_c.jpeg

          I do see these entries in my logging....

          F30354E1-8591-406B-9B21-35D40B7A044F.jpeg

          H 1 Reply Last reply Reply Quote 0
          • H
            haraldinho @michiel
            last edited by

            @michiel I celebrated too soon. After some testing this morning, the problem of resuming recordings appears to still exist. I also applied the settings from @thebear and still the problem exists... Now I'm quite determined to get this solved ๐Ÿ˜ 

            H 1 Reply Last reply Reply Quote 0
            • H
              haraldinho @haraldinho
              last edited by

              Now what I did not do yesterday evening because the family was watching tv, I did do this morning: reboot the firewall. But first I changed my settings to those of @thebear from his previous post. And guess what: it appears to work now. I did three tests: pause 5 seconds, pause 5 minutes and pause for 10 minutes. All successfully restarted the recorded stream. @michiel did you do a reboot after changing your settings and if not, can you try that?

              M 1 Reply Last reply Reply Quote 0
              • H
                haraldinho
                last edited by haraldinho

                Found some more evidence of what went wrong in the firewall logs:
                f474eb5e-809f-4e97-bb38-164e4bd2007b-image.png

                I rebooted my device around 11:21. Before the reboot, you see that some address in the 213.75.112.x range is getting blocked. After the reboot, this block does not appear anymore. I was doing my testing after this period.

                Unfortunately and in all honesty, I don't fully grasp all the settings that are required for IPTV, but it appears that the changes I made based on @thebear's settings made a change after the reboot.

                I wonder though what the https request are that the box is trying to do and that get blocked... What functionality does this block? Anybody any clue?

                H 1 Reply Last reply Reply Quote 0
                • H
                  haraldinho @haraldinho
                  last edited by haraldinho

                  Ok, pasting 45.57.40.1:443 into a browser leads to a site with a blocked Netflix certificate. So that gives some idea into what the box tries to do. The other IP, 52.19.109.21:443 does not reveal any information as far as I can see.

                  T 1 Reply Last reply Reply Quote 0
                  • M
                    michiel @haraldinho
                    last edited by michiel

                    @haraldinho I did several reboots. I noticed earlier that reboots help in applying the firewall rules. I think (not sure) that is has to do with the stating tables?
                    However, reboot did not solve it. I just applied the exact same settings as @thebear and will reboot later this day. Kids are online now :).

                    You did change the IP addresses to your own VLAN? So where the bear says 127*, you are using 192* in outbound rules and downstream proxy?

                    T 2 Replies Last reply Reply Quote 0
                    • T
                      thebear @michiel
                      last edited by

                      Can you guys build the firewall rules like this:

                      IPTV_WAN
                      f466c9d3-dd92-429a-9c7a-2e086c9fcc16-image.png

                      IPTV_LAN
                      2922b990-f743-440e-9643-8e22a94a8748-image.png

                      The screenshot showing that regular internet traffic is blocked, so also your DNS and TCP traffic which is needed to communicate with the streaming platform.

                      M H 2 Replies Last reply Reply Quote 0
                      • T
                        thebear @michiel
                        last edited by

                        @michiel said in 23.01.b.20230106.0600 IGMP proxy stops TV stream:

                        @haraldinho I did several reboots. I noticed earlier that reboots help in applying the firewall rules. I think (not sure) that is has to do with the stating tables?

                        You can press the X next to a FW rule, to release the current state and rebuild the traffic without a reboot.

                        1 Reply Last reply Reply Quote 2
                        • T
                          thebear @haraldinho
                          last edited by thebear

                          @haraldinho said in 23.01.b.20230106.0600 IGMP proxy stops TV stream:

                          Ok, pasting 45.57.40.1:443 into a browser leads to a site with a blocked Netflix certificate. So that gives some idea into what the box tries to do. The other IP, 52.19.109.21:443 does not reveal any information as far as I can see.

                          Indeed see my post above where I ask you to use my FW rules and delete all other rules for these two interfaces. You are blocking too much traffic which causes different issues. NTP, DNS issues but also proven by the logs that Netflix traffic is denied.

                          1 Reply Last reply Reply Quote 0
                          • M
                            michiel @thebear
                            last edited by

                            @thebear @haraldinho
                            It seems I got it to work; both live TV and recordings can be paused now! See the screenshots of my settings. I will keep these settings, and see if they remain working :).

                            I disabled the rule in IPTV VLAN to LAN net. Can I put that back, and only grant access to "This firewall" and ports 53 (DNS) and 123 (NTP)?

                            Schermafbeelding 2023-04-23 om 13.50.41.png Schermafbeelding 2023-04-23 om 13.52.29.png Schermafbeelding 2023-04-23 om 13.52.50.png Schermafbeelding 2023-04-23 om 13.54.32.png

                            1 Reply Last reply Reply Quote 0
                            • H
                              haraldinho @thebear
                              last edited by

                              @thebear Thanks for the settings! I was busy in the past days, but this afternoon I changed my settings to match the above. I struggled a bit with the "IP Options": it took me some time to realise I had to enable those for the lines with the settings wheel in front of them to get it to work. I am currently testing to see if this resolves my issue that after some time you cannot unpause paused recordings. And I am monitoring my logs to look out for blocked calls.
                              Question for @thebear: it seems to me the way you have set your rules up is allowing basically all IGMP and UDP traffic into the IPTV_WAN interface, rather than from specific IP ranges? I understand it is more future proof but isn't that a security risk?

                              1 Reply Last reply Reply Quote 0
                              • H
                                haraldinho
                                last edited by haraldinho

                                @thebear Hmm, still quite some blocks in the logs...

                                972f5690-2a2b-4492-8cff-c24a8a3cccfe-image.png

                                522b4e3f-2128-4894-a4d9-c287a98a0fb1-image.png

                                My settings are like suggested by @thebear. What am I missing? Anybody any clues?
                                @michiel are your logs clean now?

                                M 1 Reply Last reply Reply Quote 0
                                • H
                                  haraldinho
                                  last edited by

                                  Is the 213.76.112.0/21 too limited?

                                  cc4043e0-5e7b-4722-94bf-1f81c6ed0489-image.png

                                  T 1 Reply Last reply Reply Quote 0
                                  • T
                                    thebear @haraldinho
                                    last edited by thebear

                                    @haraldinho firewall and nat are two separate things.

                                    Can you post your FW rules for IPTV WAN and IPTV LAN?

                                    Via IGMP is the box requesting streams, the streams could be source from multiple subnets. Therefore its way to complex to filter on the sources, software updates comes from 10.a.b.c. and streams from other sources.

                                    Regarding security, it's not the internet. It's a private IPTV vlan within your ISP. That reduces the risk for an attack with a million percentage. But yes hack could occur always, every minute your pfSense instance is attacked on the WAN internet interface.

                                    H 1 Reply Last reply Reply Quote 0
                                    • M
                                      michiel @haraldinho
                                      last edited by

                                      @haraldinho My logs are clean now, no IPTV WAN and VLAN anymore. Pausing of live TV and recorded programma is working. But not at home (holidays...) so no recent experience to share.
                                      The "cat sitter" is mostly streaming YT :).

                                      1 Reply Last reply Reply Quote 1
                                      • H
                                        haraldinho @thebear
                                        last edited by

                                        @thebear thanks for the help, below are my rules

                                        WAN IPTV rules
                                        5395f9f7-2a68-4213-98c2-e8fcc56a287e-image.png

                                        LAN IPTV rules
                                        cdb9521b-30f6-41c0-a05d-15e6fe98fe86-image.png

                                        M 1 Reply Last reply Reply Quote 0
                                        • M
                                          michiel @haraldinho
                                          last edited by

                                          @haraldinho Same as my settings. Are your settings at NAT and IGMP also like mine (I posted them a few days ago).

                                          H 1 Reply Last reply Reply Quote 0
                                          • H
                                            haraldinho @michiel
                                            last edited by haraldinho

                                            @michiel

                                            53fae905-1e97-411f-8510-ba4d6f976094-image.png

                                            cc4043e0-5e7b-4722-94bf-1f81c6ed0489-image.png

                                            T 1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.