Igmpproxy noworking
-
you see? you do not have pass out.
Did you copy my files after you reinstalled package? -
I try but I getting errors and there is no automatic routes,… not exactly sure why. I copy both filter.inc and igmpproxy on location that you said.
If I enter "pfctl -sr | grep allow-opts" with version you gave it to me it doesn't show me anything.
igmpproxy, Version 0.1 beta2, Build 090818 Copyright 2005 by Johnny Egeland <johnny@rlo.org> Distributed under the GNU GENERAL PUBLIC LICENSE, Version 2 - check GPL.txt Debu: Searching for config file at '/tmp/igmpproxy.conf' Debu: Config: Quick leave mode enabled. Debu: Config: Got a phyint token. Debu: Config: IF: Config for interface xl0. Debu: Config: IF: Got upstream token. Debu: Config: IF: Got ratelimit token '0'. Debu: Config: IF: Got threshold token '1'. Debu: Config: IF: Got altnet token 172.16.100.0/24. Debu: Config: IF: Altnet: Parsed altnet to 172.16.100/24. Debu: Config: IF: Got altnet token 84.255.209.0/24. Debu: Config: IF: Altnet: Parsed altnet to 84.255.209/24. Debu: Config: IF: Got altnet token 84.255.208.0/24. Debu: Config: IF: Altnet: Parsed altnet to 84.255.208/24. Debu: Config: IF: Got altnet token 172.17.140.0/24. Debu: Config: IF: Altnet: Parsed altnet to 172.17.140/24. Debu: Config: IF: Got altnet token 172.17.141.0/24. Debu: Config: IF: Altnet: Parsed altnet to 172.17.141/24. Debu: IF name : xl0 Debu: Next ptr : 0 Debu: Ratelimit : 0 Debu: Threshold : 1 Debu: State : 1 Debu: Allowednet ptr : 2820c030 Debu: Config: Got a phyint token. Debu: Config: IF: Config for interface rl0. Debu: Config: IF: Got downstream token. Debu: Config: IF: Got ratelimit token '0'. Debu: Config: IF: Got threshold token '1'. Debu: Config: IF: Got altnet token 192.168.0.0/24. Debu: Config: IF: Altnet: Parsed altnet to 192.168.0/24. Debu: IF name : rl0 Debu: Next ptr : 0 Debu: Ratelimit : 0 Debu: Threshold : 1 Debu: State : 2 Debu: Allowednet ptr : 2820c080 Debu: Adding Physical Index value of IF 'xl0' is 1 Debu: buildIfVc: Interface xl0 Addr: 89.212.139.155, Flags: 0xffff8843, Network: 89.212/16 Debu: Adding Physical Index value of IF 'rl0' is 2 Debu: buildIfVc: Interface rl0 Addr: 192.168.0.50, Flags: 0xffff8843, Network: 192.168.0/24 Debu: Adding Physical Index value of IF 'lo0' is 3 Debu: buildIfVc: Interface lo0 Addr: 127.0.0.1, Flags: 0xffff8049, Network: 127/8 Debu: Found config for xl0 Debu: Found config for rl0 Note: adding VIF, Ix 0 Fl 0x0 IP 0x9b8bd459 xl0, Threshold: 1, Ratelimit: 0 Debu: Network for [xl0] : 89.212/16 Debu: Network for [xl0] : 172.16.100/24 Debu: Network for [xl0] : 84.255.209/24 Debu: Network for [xl0] : 84.255.208/24 Debu: Network for [xl0] : 172.17.140/24 Debu: Network for [xl0] : 172.17.141/24 Note: adding VIF, Ix 1 Fl 0x0 IP 0x3200a8c0 rl0, Threshold: 1, Ratelimit: 0 Debu: Network for [rl0] : 192.168.0/24 Debu: Network for [rl0] : 192.168.0/24 Debu: Got 262144 byte buffer size in 0 iterations Debu: Joining all-routers group 224.0.0.2 on vif 192.168.0.50 Note: joinMcGroup: 224.0.0.2 on rl0 Info: sendto to 224.0.0.2 on 192.168.0.50; Errno(1): Operation not permitted Debu: SENT V2 member report from 192.168.0.50 to 224.0.0.2 Info: sendto to 224.0.0.1 on 192.168.0.50; Errno(1): Operation not permitted Debu: SENT Membership query from 192.168.0.50 to 224.0.0.1 Debu: Sent membership query from 192.168.0.50 to 224.0.0.1\. Delay: 10 Debu: Created timeout 1 (#0) - delay 10 secs Debu: (Id:1, Time:10) Debu: Created timeout 2 (#1) - delay 21 secs Debu: (Id:1, Time:10) Debu: (Id:2, Time:21) Debu: About to call timeout 1 (#0) Debu: Aging routes in table. Debu: Current routing table (Age active routes); ----------------------------------------------------- Debu: No routes in table... Debu: ----------------------------------------------------- Debu: About to call timeout 2 (#0) Info: sendto to 224.0.0.1 on 192.168.0.50; Errno(1): Operation not permitted Debu: SENT Membership query from 192.168.0.50 to 224.0.0.1 Debu: Sent membership query from 192.168.0.50 to 224.0.0.1\. Delay: 10 Debu: Created timeout 3 (#0) - delay 10 secs Debu: (Id:3, Time:10) Debu: Created timeout 4 (#1) - delay 21 secs Debu: (Id:3, Time:10) Debu: (Id:4, Time:21) Debu: Got a IGMP request to process... Debu: Packet from 10.0.1.13: proto: 2 hdrlen: 20 iplen: 8 or 2048 Note: RECV Membership query from 10.0.1.13 to 224.0.0.1 (ip_hl 20, data 8) Debu: About to call timeout 3 (#0) Debu: Aging routes in table. Debu: Current routing table (Age active routes); ----------------------------------------------------- Debu: No routes in table... Debu: ----------------------------------------------------- Debu: About to call timeout 4 (#0) Info: sendto to 224.0.0.1 on 192.168.0.50; Errno(1): Operation not permitted Debu: SENT Membership query from 192.168.0.50 to 224.0.0.1 Debu: Sent membership query from 192.168.0.50 to 224.0.0.1\. Delay: 10 Debu: Created timeout 5 (#0) - delay 10 secs Debu: (Id:5, Time:10) Debu: Created timeout 6 (#1) - delay 115 secs Debu: (Id:5, Time:10) Debu: (Id:6, Time:115) Debu: About to call timeout 5 (#0) Debu: Aging routes in table. Debu: Current routing table (Age active routes); ----------------------------------------------------- Debu: No routes in table... Debu: ----------------------------------------------------- ^CWarn: select() failure; Errno(4): Interrupted system call Note: Got a interupt signal. Exiting. Debu: clean handler called Note: All routes removed. Routing table is empty. Info: Shutdown complete....</johnny@rlo.org> -
You did something wrong. Lets proceed off-forum to avoid spamming here. I'd like to see your screen (or connect remotely to your pfsense). I'll e-mail you in approx 2 hours.
-
hi all!
My IGMPProxy is not working too..
I've simply installed the appropriate package, and specify WAN as upstream and LAN as downstream (without any additional options, because I don't understand it). And there is no picture at all. What I made wrong?
-
Hi again,
I testing Eugene's version of IGMPProxy for few days now and is working very well. That version also work well with IGMP v3. I testing this on pfSense 1.2.3-RC3 built on Fri Oct 30 05:27:54 UTC 2009 version.
Thanks Eugene for good work.
-
hi
did a lot of testing and debuging with eugene over the last week, and it's working now, even with the somewhat strange german T-Home setups.
Big thx to Eugene for the great work!
-
Hi,
my pf alow-opts rules looks like this:
is it correct? On wan interface I see only messages: igmp query v2# pfctl -sr | grep allow-op pass out all flags S/SA keep state allow-opts label "let out anything from firewall host itself" pass in quick on rl0 reply-to (rl0 84.240.30.62) inet all flags S/SA keep state allow-opts label "USER_RULE" pass in log quick on nfe0 all flags S/SA keep state allow-opts label "USER_RULE: Default allow LAN to any rule" # tcpdump -ni rl0 igmp tcpdump: verbose output suppressed, use -v or -vv for full protocol decode listening on rl0, link-type EN10MB (Ethernet), capture size 96 bytes 02:38:40.619355 IP 84.240.30.62 > 224.0.0.1: igmp query v2 -
Looks good.
-
Sorry, but I just can't figure this out at all?
Am I stupid or what, but is there anywhere a manual how this IGMPproxy should be configured and do you have to do still rules for igmp ect…? At least the documentation sucks deebly. I just can guess what should be feeded in where and why.
I noticed that there is a webGUI for this but I can see only cli stuff here. Is there any documentation and working samples available anywhere.
Here is the webGUI part to fill up:
WAN
Interface: WAN
Description:ISP
Type:upstream interface
Threshold:
Networks:12.23.45.67/20LAN
Interface: LAN
Description:Lan network
Type:downstream interface
Threshold:
Networks:192.168.1.1/24So whats wrong or missing? Which Ip address and how the mask should be presented here? 12.23.45.67/20 or 12.23.45.67 255.255.240.0. Should this be the wan side network address or my WAN interface address or what?
Networks on LAN side? Same questions as on WAN side - how the ip or networ should be presented exactly whit mask or whit out the mask. Or should here be my setopbox's ip or LAn interface ip or what?
Understand my frustration now? There is no basic hint what to feed in here and as I said before the documentation sucks >:(
Now I and many other IPTV users needs this faq whit good examples! The more print screens the better ;D
-
Howto
I truly belive that if a person understands what he is doing then he is doing much better then stupidly following some procedure without understanding what it is all about. Thus a bit of theory here. If you are not interested go directly to "Setup and configuration procedure".
Theory
On the diagram below PC1 wants to watch IPTV i.e. to receive multicast stream.
(1) player generates IGMP-report saying "I want to receive multicast stream which is being disseminated to some multicast IP (let it be 239.0.0.1). Multicast stream is a stream of UDP packets (in our case of IPTV picture + sound). Different multicast addresses mean different TV channels. This IGMP-report is multicast packet as well and is forwarded to all devices on given local network segment by the switch(es), i.e. all devices on this segment receive this packtes (let's not touch multicast aware switches here).
(2) But all devices do not care about this IGMP-report, only pfSense with running igmpproxy becomes aware that some device (PC1) connected to its lan wants to receive a multicast stream. LAN interface on our diagram according to igmpproxy terminology is "Downstream interface" in other words "Interface where receiver(s) of multicast stream is(are) located". Now pfSense has to get this stream somewhere and it generates IGMP-report on "Upstream interface" (WAN) hoping to get this stream from Provider. Note that there is no routing of packet (1), pf does not route multicast/broadcast traffic, this is brand new packet generated by igmpproxy.
(3) Provider's device (most probably router) after receiving your IGMP-report with group IP 239.0.0.1 starts transmitting udp stream with destination IP 239.0.0.1 towards your pfSense.
(4) pfSense already knows who wants to watch this channel as at the step (2) igmpproxy told kernel that this stream is wanted at LAN interface and BSD kernel without any igmpproxy participation starts routing these packets to LAN where user(s) gets picture and sound in his player.Setup and configuration procedure.
1. Install igmpproxy package from System->Packages
2. Create a rule on LAN interface in Firewall->Rules
Pass Proto=IGMP Source=LANnet Destination=224.0.0.0/4 in AdvancedOptions check "This allows packets with ip options to pass …"
Save/Apply
It will allow igmpproxy to receive IGMP-reports on LAN.
3. Create a rule on WAN interface in Firewall->Rules
Pass Proto=UDP Destination=224.0.0.0/4
Save/Apply
It will allow you to receive multicast stream with any multicast IP.
4. Configure igmpproxy in Services->IGMP proxy. Make LAN Downstream and WAN Upstream interfaces.
5. Check that igmpproxy is running (green) in Status->Services.90% probability that this is it - enjoy.
Optional steps:
6. Extraordinary case one - provider sends packets with source IP which does not belong to your network configured on Upstream-WAN (different from 1.1.1.0/24 on our diagram), for example packets have 3.4.5.42. We need to add this network in igmpproxy config for Upstream interface - add 3.4.5.0/24 in Networks for this interface.
7. Extraordinary case two - you have complex network connected to LAN and there is a router which is capable to route multicast packets and the device that wants to see IPTV is connected not directly to pfSense LAN segment but to other segment (after this router) having IP belonging let's say to 10.10.10.0/24. In this case we need to add this subnet in igmpproxy config for Downstream interface - add 10.10.10.0/24 in Networks. Probably you'll need to create a rule on LAN interface for this subnet as we did for LAN subnet in step 2. I depends how your router is configured.
8. Extraordinary case three - this is when you have extraordinary cases one and two at the same time.Complete both steps 6. and 7.PS: rules must be more strict. All that was created above means the same as "allow all" for ordinary unicast packets.
PPS: UDP-stream IPTV is usually lots of small packets, so this is pretty intensive load on your nics and cpu. If you have bad picture/sound quality the first thing to check is your system load.
PPPS: you can easily create several Downstream interfaces if needed.
P(4)S: remarks and comments are welcome!Recommended reading: IGMP protocol.
-
:D :D :D
This is quite great stuff!! Sounds like some people (including me) can now get rid of their W70x routers and use real hardware instead. I feel like having read a thousand pages on this topic the last days without any solution.
One silly question: Do you remember this one?
new backbone:
everything that has to do with normal web -> pppoe on vlan7
iptv multicast -> dhcp with some strange options on vlan8As I'm new to VLAN and things around I've no clue how to solve the dhcp problem.
@the6thday: Maybe you could also share how you resolved this?
Cheers!
-
One silly question: Do you remember this one?
new backbone:
everything that has to do with normal web -> pppoe on vlan7
iptv multicast -> dhcp with some strange options on vlan8No I do not.
-
@the6thday: Maybe you could also share how you resolved this?
OK heres a litte tutorial for german T-Home IPTV
1)As far as i know the current igmp proxy package is still broken(at least the version number is still the same) @Eugene could you update the package to the latest version?
To resolve this issue i attached a working filter.inc file and a working igmpproxy to this post. !!!!!!!!!remove the .txt extension from the files!!!!!!!!
After you install the package(like you normally would…) you have to upload these two files via sftp to the pfsene box:1.1: login via ssh to the pfsense box and kill the igmpproxy if its running( select shell in the menu and then use the "top" command to check if igmpproxy is running, if it is press "k" and type in the proxy's process id then press enter...)
1.2: login via sftp (you can use filezilla for this) put the filter.inc file in the /etc/inc/ folder and put the igmpproxy file in the /usr/local/sbin folder, make sure to set execution rights to the file(chmod 777 for example)
- Now we need to configure pfsense and igmpproxy:
2.1: Do your normal wan setup (pppoe connection over vlanid 7)
You have to use a VDSL modem (for example Speedport 300HS or Speedport 221) you cannot use any of the vdsl routers (speedport W721/W722/W920) in passtrough mode because they mess up the vlan tags!!!2.2: configure a second opt interface for vlan 8 with dhcp:
Note: you may need to manually configure DNS servers under system->general setup after you did this for your internet connection to work correctly!
2.3: create static routes for the T-Home IPTV networks:
Note: the gatewayIP may be different for your location, i think t-home has diffrent gateways for each city… you can use pfsense's packet capture feature to capture the dhcp response when you enable the opt2(iptv) interface so you can look at it and find out the correct gateway IP.
(t-home uses dhcp options to tell the router what static routes he needs, but the pfsense dhcp client doesn't understand them so you have to set the static routes yourself...)2.4: configure the igmp proxy:
2.5: allow opts / firewall rules:
Now you have to create a firewall rule for the iptv/opt2 interface, to keep it simple just allow everything:
And now you need to allow opts on the LAN and the IPTV interface:
now reboot and it should work…
(igmpproxy is going to spam your logs with useless info but you can ignore that...)edit: forgot the firewall rules part (2.5)
-
I have working IGMPProxy but I having problem with all wireless access points on network. When I start TV all connections on wlan dies. Anyone have same problem?
-
What is your setup? What are upstream and downstream interfaces?
-
@the6thday: Maybe you could also share how you resolved this?
OK heres a litte tutorial for german T-Home IPTV
Thanks for this detailled explanation! This is really helpful. I had to add some reboots after virtually every step to have my internet access working but everything else was fine. :-)
But there are still questions from my side:
a) In 2.5 you say "And now you need to allow opts on the LAN and the IPTV interface:". Does this refer to the new rule described before or is this an additional rule?b) Will the IPTV traffic now on my normal LAN interface which is connected to VLAN agnostic switch? I suppose this will not work. Is there a way to route the VLAN8 traffic to another hardware network interface on my pfsense box?
Thanks again!
-
But there are still questions from my side:
a) In 2.5 you say "And now you need to allow opts on the LAN and the IPTV interface:". Does this refer to the new rule described before or is this an additional rule?b) Will the IPTV traffic now on my normal LAN interface which is connected to VLAN agnostic switch? I suppose this will not work. Is there a way to route the VLAN8 traffic to another hardware network interface on my pfsense box?
Thanks again!
a: you normally have only one rule on the iptv and the lan interface… (allows everything in any direction) so you have to enable allow opts in this rule...
b: i don't understand the question... the iptv traffic will be on your normal lan interface or whatever you set as downstream interface in the igmp config...
since you have a t-home connection i assume you are german so maybe you should send me a PM in german...btw: i've updated the igmpproxy attachment in the last post with the new version that currently is included in pfsense 2.0 beta1
In pfsense 2.0 igmp is finally working as it should (igmp leave works)...
In pfsense 1.2.3 igmp leaves are not processed correctly (the same igmpproxy version was used to test this, its not igmpproxy's fault) which could cause problems if you switch channels very often in a short period of time, (but with a vdsl 50mbit connection thats currently not an issue for normal tv use...) -
@the6thday: Maybe you could also share how you resolved this?
OK heres a litte tutorial for german T-Home IPTV
1)As far as i know the current igmp proxy package is still broken(at least the version number is still the same) @Eugene could you update the package to the latest version?
To resolve this issue i attached a working filter.inc file and a working igmpproxy to this post. !!!!!!!!!remove the .txt extension from the files!!!!!!!!
After you install the package(like you normally would…) you have to upload these two files via sftp to the pfsene box:The igmpproxy binary can't load on nanobsd.
from shell:
[root@pfSense.local]/root(6): igmpproxy
ELF interpreter not found
AbortThx from germany.
Edit: i have build the igmpproxy on virtual freebsd mashine and copy to pfsense, now is igmpproxy runing, are iptv is nothing going. the filter.inc build a firewall-ruleset with syntax errors on pfsense 1.2.3 (see in system-log).
-
Howto
….....
Setup and configuration procedure.
1. Install igmpproxy package from System->Packages
2. Create a rule on LAN interface in Firewall->Rules
Pass Proto=IGMP Source=LANnet Destination=224.0.0.0/4 in AdvancedOptions check "This allows packets with ip options to pass …"
Save/Apply
It will allow igmpproxy to receive IGMP-reports on LAN.
3. Create a rule on WAN interface in Firewall->Rules
Pass Proto=UDP Destination=224.0.0.0/4
Save/Apply
It will allow you to receive multicast stream with any multicast IP.
4. Configure igmpproxy in Services->IGMP proxy. Make LAN Downstream and WAN Upstream interfaces.
5. Check that igmpproxy is running (green) in Status->Services.90% probability that this is it - enjoy.
Optional steps:
6. Extraordinary case one - provider sends packets with source IP which does not belong to your network configured on Upstream-WAN (different from 1.1.1.0/24 on our diagram), for example packets have 3.4.5.42. We need to add this network in igmpproxy config for Upstream interface - add 3.4.5.0/24 in Networks for this interface.
7. Extraordinary case two - you have complex network connected to LAN and there is a router which is capable to route multicast packets and the device that wants to see IPTV is connected not directly to pfSense LAN segment but to other segment (after this router) having IP belonging let's say to 10.10.10.0/24. In this case we need to add this subnet in igmpproxy config for Downstream interface - add 10.10.10.0/24 in Networks. Probably you'll need to create a rule on LAN interface for this subnet as we did for LAN subnet in step 2. I depends how your router is configured.
8. Extraordinary case three - this is when you have extraordinary cases one and two at the same time.Complete both steps 6. and 7.
....Thanks Eugene!
Now finally It works! Basic setup and configuration plus that I had your mentioned "Extraordinary case one". Your picture is good help for understanding of how IGMP works! This kind of basic tutorial is needed on help!Thanks again Eugene !! ;D
-
hello, i read through the posts (and some articles on the web too) but still have problems with the setup i intend. what i'm about to do is forward multicast communication from eth0 to openVPN's tun0 device to another computer. it looks as follows:
/ISP providing multicast stream/ –- /my multicast-capable router/ -- /laptop A with linux on it, if: eth0 & tun0 / - - - /remote laptop B connected via tun0/
Laptop A:
eth0 192.168.1.104
tun0 172.16.0.1Laptop B:
eth0 x.x.x.x
tun0 172.160.0.2igmpproxy.conf on laptop A looks as follows:
phyint eth0 upstream ratelimit 0 threshold 1
phyint tun0 downstream ratelimit 0 threshold 1there's no firewall in the way.
now i have a problem understanding whether i should do a NAT on laptop A using iptables (masquerade) and/or what should be the routing table on laptopA/B look like. can you please give me some assistance?
thank you very much in advance,
jose
