Anyone have a guide for getting Airplay working across subnets with avahi?



  • Recently locked down my home LAN and created a guest wireless LAN with a separate SSID.  pfSense is doing the routing.  I have two Airport Express devices in the LAN that I use to stream audio around the house.  I'm looking to have these devices available to guests to stream audio.  It's not an uncommon occurrence that I have an impromptu get-together and a guest wants to DJ.  It's easy with iPhones, etc, when they're on the same subnet. But I don't want my guests on my LAN, hence the guest network.

    So I installed avahi, and that has at least enabled me to see (via Airport Utility and Airfoil) the Airport Express devices. I have (for now) all traffic to the Airport Express devices allowed in the pfSense firewall rules.  But that's as far as the connectivity appears to go.  With Airfoil, when I try to stream, I eventually get a connection timeout.  With Airport Utility, I can see the devices but can't configure them.

    Wondering who might have this working and what you had to do to get there.


  • Rebel Alliance Global Moderator

    "Recently locked down my home LAN and created a guest wireless LAN with a separate SSID.  pfSense is doing the routing"

    So how exactly did you do this?  So your SSID on their own vlan with vlan capable AP and switches?  You have the AP with different ssid connected direct to a interface in pfsense?  Something else?

    What exactly are you rules on what interfaces?  What are the networks in play?



  • @johnpoz:

    "Recently locked down my home LAN and created a guest wireless LAN with a separate SSID.  pfSense is doing the routing"

    So how exactly did you do this?  So your SSID on their own vlan with vlan capable AP and switches?  You have the AP with different ssid connected direct to a interface in pfsense?  Something else?

    What exactly are you rules on what interfaces?  What are the networks in play?

    Yes.  I have two private networks, each in its own VLAN.  I'm using managed switches and a Ubituiti AP.  Private LAN is 10.22.44.0/24 and guest lan is 10.22.11.0/26.

    The specific rule I mentioned is on the guest interface and allows all ipv4 traffic from the 10.22.11.0/26 to an alias that contains the ip addresses of the two airport express devices.  It's placed higher in the ruleset than a later rule that blocks all traffic from the guest network to the private network.



  • So, more experimentation.  I've found that I can indeed discover and manage the devices using Airport Utility on my mac from the guest network but not reliably. I can ping them.  Looking at a pcap of an attempted connection from Airfoil I see what appears to me to be an authentication attempt.

    And then I found this:

    "Bonjour (and mDNS) work perfectly well across multiple subnets so long as your router is configured to support (i.e. route) multicast traffic. I use Bonjour on a constant basis across three subnets with both Mac and Windows platforms for a variety of service location purposes (printing, file sharing, streaming media) and have no problems whatsoever.

    The AirTunes limitation you're referring to is an Apple policy decision, not a technical issue. It appears they've restricted iTunes<–>Airport streaming media connectivity to connections that originate and terminate on the same subnet. I assume they feel it's a mechanism to help enforce digital rights management.

    Just to summarize: I routinely print to my Airport Express units across subnets, and share my iTunes music library to non-AirPort devices on different subnets; I just don't (can't) share my iTunes music library to an Airport Express on a different subnet."

    So perhaps it's simply not going to work and I need to look for another solution.



  • @whosmatt:

    "Bonjour (and mDNS) work perfectly well across multiple subnets so long as your router is configured to support (i.e. route) multicast traffic."

    I've ran into something similar when trying to use my child's tablet (on a KidsNet VLAN) to stream videos on a WDTV or Chromecast (Main VLAN). I was able to get it to work using the IGMP Proxy but only tried it as a proof of concept. I do recall it fills the system log with a ton of messages.



  • Thanks. I'll look into it.  Regardless, this topic is probably not suited for the packages forum since avahi appears to be doing its job.  I think it's just the Apple devices throwing some of their proprietary nonsense in to play.  Absolute worst case I can connect them both via wireless (right now one is wired and one is wireless) and just switch them to the guest network when needed, so that they are hanging out in the same subnet as my guest devices.

    Thanks for the help, everyone.


  • Netgate

    Apple chose to send airplay packets with a TTL of 2. That limits airplay to one hop no matter what you do with avahi.



  • Has anyone had success in this kind of scenario using out-of-the-box pfSense, and if so, could they post the exact rules/setup they used to successfully get this situation to work by routing multicast correctly (and modding the TTL if applicable).

    As an aside, I've been playing with a different approach and had some success. To save repetition the details are at https://redmine.pfsense.org/issues/2170 , in a nutshell there's a tiny but active port called "mdns-repeater" which relays mDNS multicasts (used for Airplay discovery) across a set of interfaces, and is ideal for Airplay. Because pfSense reworks the FreeBSD pkg repo system (see release notes) I couldn't install it with pkg install, but it turns out you only need one file from it, so I manually put the file on my router in the correct folder, modified the rules to allow both IFs to receive UDP on 224.0.0.251:5353 (and IPv6 equivalent if needed), and it works fine - all multicasts received on one are sent out from the other. So now I can see friends' iPhones/iPads connected to WLAN/OPT1 seeking printers via Airplay multicast, and getting valid data back from printers on the LAN interface, although they aren't get completing their dialog (TTL issues?). So I am hopeful that with a little more work it'll be fully working. if anyone seeing this can figure out the last part of the puzzle, let me know!