23.01.b.20230106.0600 IGMP proxy stops TV stream
-
@michiel said in 23.01.b.20230106.0600 IGMP proxy stops TV stream:
@thebear I understand. And what is defined in LAN_v4_v6? My idea was to allow DNS (53) and then block LAN-net…
In that alias are all my other lan subnets v4 and v6.
The STB communicates with the KPN NTP and DNS servers and that’s handled via the last rule. My STB is not using any pfsense service like NTP or DNS. The DHCP sever for this VLAN is handing out the KPN dns servers :)
-
@thebear @michiel I think I figured it out. For some reason asymetric routing seems to happen. So some packets sent by the box through route A return to the box through route B. No clue why. But after reading about this issue in this article on the Netgate website I enabled "Bypass firewall rules for traffic on the same interface". For now, it seems that the logs are now clean.
-
@haraldinho do you have multiple routers in your network?
-
@thebear Nope, only multiple VLANs. The comment with this option is "This option only applies if one or more static routes have been defined. If it is enabled, traffic that enters and leaves through the same interface will not be checked by the firewall. This may be desirable in some situations where multiple subnets are connected to the same interface."
-
@haraldinho do you be sure you did not disable the whole security layer?
Is it a router with one or two ports?
This option only applies if one or more static routes have been defined. Is that your case?
-
This post is deleted! -
@thebear It's a Netgate 6100 with 8 ports. I myself did not define any static routes. I was thinking that might come from KPN DHCP. In all honesty I do not oversee the exact consequences of disabling this option, however from the Netgate pfSense docs I understood that sometimes this option needs to be checked when asymmetric routing is happening... The way they describe it, it came across as quite benign.
-
@thebear As soon as I block "Lan net" in the firewall rules of IPTV VLAN, pausing recorded programs stops working. I defined DNS servers in the IPTV VLAN. Any idea what goes wrong?
You block your other LAN subnets; does that include your default LAN range (in my case: 192.168.1.0/24)?
-
@thebear said in 23.01.b.20230106.0600 IGMP proxy stops TV stream:
I have added some more security to the ruleset, there is no traffic allowed to the other LAN components when "the hacker" has access to the STB.
WAN
LAN
@michiel said in 23.01.b.20230106.0600 IGMP proxy stops TV stream:
@thebear As soon as I block "Lan net" in the firewall rules of IPTV VLAN, pausing recorded programs stops working. I defined DNS servers in the IPTV VLAN. Any idea what goes wrong?
You block your other LAN subnets; does that include your default LAN range (in my case: 192.168.1.0/24)?Yes it include all RFC1918 address. Did you pay attention to the order, the top down order is relevant. Attached my earlier post as reference.
-
@thebear Ah, the order was incorrect! Could have known that :(. Changed the order and will do some further testing; let you know!
-
This post is deleted!