Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Sonos and VLANs

    Scheduled Pinned Locked Moved General pfSense Questions
    14 Posts 9 Posters 6.8k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • D
      darrendavid
      last edited by

      • Primary LAN (with Sonos speakers) is 10.0.1.1/24

      • Guest VLAN (wireless network via Ubiquiti Unifi AP and pfSense) is 10.0.100.1/24

      • https://en.community.sonos.com/troubleshooting-228999/multiple-subnets-vlans-and-sonos-workable-clavister-solution-30950

      • https://community.ubnt.com/t5/UniFi-Wireless/Enabling-Sonos-UPnP-IGMP-traffic-across-restricted-guest-network/td-p/1553168

      • allow TCP port 1400 from LAN to VLAN

      • allow TCP port 3400, 3500 from VLAN to LAN

      • allow UDP port 1900-1905 from VLAN to LAN

      • set up IGMP proxy to enable multicast of 239.255.255.250 across the two networks

      • make sure I've got a switch that allows IGMP snooping (I do)

      • WAN upstream 10.0.1.1/24, 10.0.100.1/24

      • LAN downstream 10.0.1.1/24

      • GUESTVLAN downstream 10.0.100.1/24

      1 Reply Last reply Reply Quote 0
      • S
        Syndrose
        last edited by

        I personally don't have a Sonos, but there might be a simpler way.
        I am assuming that Guest VLAN doesn't have access to your Primary LAN.
        Since this is a home setup, I also assume that your security can be a little more relaxed than an enterprise environment.
        What I would try  is make sure the Primary LAN can access the Guest VLAN, meaning don't create any rules to block it. After all it is your trusted network.
        Give your Sonos a static IP address either manually or with a DHCP reservation. For the sake of an example say it is 10.0.1.5
        Keep your IGMP settings as they are.
        Then on your Guest VLAN firewall settings at the top create a rule:
        Address Family: IPv4
        Protocol: TCP/UDP
        Source: Guest VLAN
        Destination: Single Host/Alias  10.0.1.5 (or whatever you ended up making the Sonos Speaker).

        That in theory should allow access from the Guest VLAN to only the Sonos speaker and not the rest of your primary VLAN.

        1 Reply Last reply Reply Quote 0
        • D
          darrendavid
          last edited by

          Appreciate the response. That's essentially what I have set up right now - Sonos units have static IPs and for purposes of testing I have given Guest VLAN complete and unfettered access to the LAN just to eliminate the firewall as a variable. Gust VLAN clients can successfully access hosts on LAN. All that said, the Sonos app does not discover the Sonos unit(s) from a client connected on the Guest VLAN. My gut tells me it's something with IGMP proxy since everything else is unblocked. Thoughts?

          1 Reply Last reply Reply Quote 0
          • jahonixJ
            jahonix
            last edited by

            Device discovery might be something simple like a broadcast, which by its nature does not traverse subnets.

            Your trusted search engine might come up with this result as well: https://github.com/gotwalt/sonos/wiki/Discovery

            1 Reply Last reply Reply Quote 0
            • D
              darrendavid
              last edited by

              @jahonix:

              Device discovery might be something simple like a broadcast, which by its nature does not traverse subnets.

              My impression from reading the work of others trying to solve the same problem was that IGMP Proxy would handle rebroadcasting across the subnets. Is this  n errant interpretation of IGMP Proxy?

              1 Reply Last reply Reply Quote 0
              • jahonixJ
                jahonix
                last edited by

                IGMP takes care of Multicasts, what we have is a Broadcast
                https://en.wikipedia.org/wiki/Internet_Group_Management_Protocol

                1 Reply Last reply Reply Quote 0
                • D
                  darrendavid
                  last edited by

                  OK, fair enough. Is there a simpler way to do this? Is there a way to lump folks on my guest wifi network into a specific block of IP addresses that I can set up specific firewall rules with? Using a VLAN was my first thought, but as mentioned this is a home network and ultimately if there's someone in my house they technically have physical access to all machines. I'm just trying to have a modicum of safety and would prefer to limit access to certain IPs from unknown visitors.

                  I guess one way to do it would be to set up static DHCP assignments to all /known/ clients and then any random IPs could get firewalled appropriately.

                  Thoughts?

                  1 Reply Last reply Reply Quote 0
                  • DerelictD
                    Derelict LAYER 8 Netgate
                    last edited by

                    Any scheme like that would provide only an illusion of security since MAC addresses are so easily-spoofable. Better to give the password to a network that is allowed to access the private devices to those whom you want to be able to access them.

                    Alternately you could use 802.1x and set a dynamic VLAN for users based on what you want them to be able to access. Your gear would have to support it and you would need to know how to make that gear do that. It wouldn't be the firewall's job.

                    Seems like Sonos has some work to do.

                    Chattanooga, Tennessee, USA
                    A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                    DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                    Do Not Chat For Help! NO_WAN_EGRESS(TM)

                    1 Reply Last reply Reply Quote 0
                    • D
                      dglacey
                      last edited by

                      In case it helps others, I got this working by using the IGMP Proxy feature of pfSense

                      I have my SONOS players on the LAN and wanted to control them from an iPhone on a separate VLAN.

                      This is what I did:

                      1. go to Services/IGMP Proxy on pfSense
                      2. Click Add
                      3. Interace = WAN, Type = downstream interface, Network = 192.168.1.1/24 (this is my LAN subnet)
                      4. Click Save
                      2. Click Add
                      6. Interface = WAN, Type = upstream interface, Network = 192.168.2.1/24 (this is the VLAN subnet)
                      7. Add a rule to the VLAN subnet to allow all traffic.

                      This worked so long as the Gateway in the VLAN rule was set to Default. It would not work if I set the Gateway to a specific WAN interface.

                      I could now run the SONOS app on my iPhone connected to the VLAN and operate my SONOS players that were on the LAN.

                      1 Reply Last reply Reply Quote 0
                      • R
                        ResIpsa
                        last edited by

                        I'm interested in getting this to work as well, but I am getting an error from igmpproxy.  Can you confirm that you set the Interface for both to WAN?  I have followed everything else in your example, but I get the following error:

                        Mar 14 22:00:27 igmpproxy 89344 There must be at least 2 Vif's where one is upstream.

                        igmpproxy will start if I change one of the interfaces away from WAN, but then Sonos doesn't work.

                        D 1 Reply Last reply Reply Quote 0
                        • D
                          Duckmuck @ResIpsa
                          last edited by

                          @resipsa

                          This thread is old. Just for reference, I got this to work.
                          My vlans have their own interfaces.

                          So create Proxy for:

                          Upstream for interface LAN
                          Interface =LAN
                          Type=upstream
                          Network=10.0.1.0/24

                          and downstreams for VLANS (ecxample vlan 20 and 100)

                          Interface =VL20_VPN
                          Type=downstream
                          Network=10.0.20.0/24

                          Interface=VL100_GUEST
                          Type=downstream
                          Network=10.0.100.0/24

                          Regards, D

                          M 1 Reply Last reply Reply Quote 0
                          • R
                            Rai80
                            last edited by

                            You can also try pimd:

                            https://forum.netgate.com/topic/138242/dlna-across-vlan-subnets-with-igmp-proxy-not-working/12

                            1 Reply Last reply Reply Quote 0
                            • D
                              Duckmuck
                              last edited by

                              Hi!

                              Still trying to find a optimal solution.

                              So using igmp proxy I get android device to succesfully use the sonos app, but IOS devices aren't working.
                              Using pimd I get both android and IOS devices to work, but Spotify Connect is not working.

                              Right now I'm back to putting all my sonos devices on the same vlan as my phones (removed from the IOT vlan). If anyone has gotten Spotify Connect to wrok with sonos across vlans it would be great to know how you did it.
                              I've seen a solution for unifi secure gateway, but can't get this to work with pfsense.

                              1 Reply Last reply Reply Quote 0
                              • M
                                m4ttb1ss @Duckmuck
                                last edited by

                                @Duckmuck hey, I'm also trying to get my Sonos Setup working in different VLANs.

                                My Speakers are in VLAN IOT, subnet 10.0.2.0/24 (not really, but let's assume)
                                My phone which is supposed to be the controller is in LAN, subnet 10.0.1.0/24.

                                Which one do I have to setup as upstream and which one as downstream and which subnet has to be entered in which Interface. I see IGMP traffic in the general system logs, like group membership requests, but at the same time I see "IGMP came from myself, ignoring".

                                Would be appreciated if you could help out

                                1 Reply Last reply Reply Quote 0
                                • First post
                                  Last post
                                Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.