Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Multicast

    NAT
    5
    34
    2178
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • H
      hsv
      last edited by

      Hi
      I have 4 WAN interface and one LAN
      On the LAN side I have a devise which use multicast as it is a lodbalancer.
      I am not ready to switch it to haproxy
      When I try to ping from the Lan default gateway 192.168.0.1 to the host with multicast 192.168.0.10 it do not reply.
      From the out side I have 4 NAT rules to direct the trafic to 192.168.0.10
      When I look in the arp list it says it is Incomplete
      So how do I enable Pfsense to work with multicast.
      I have look at the documentation for IGMP but didnot understand it.

      Regards
      Henning

      DaddyGoD 1 Reply Last reply Reply Quote 0
      • DaddyGoD
        DaddyGo @hsv
        last edited by DaddyGo

        @hsv said in Multicast:

        So how do I enable Pfsense to work with multicast.

        Hi,

        Multicast on the same subnet is more a matter of Layer 2 switch + IGMP snooping cabability...

        in case you want multicast traffic between network segments
        then we can talk about pfSense IGMP proxy

        @hsv "When I try to ping from the Lan default gateway 192.168.0.1 to the host with multicast 192.168.0.10 it do not reply.."

        if it's a windows machine (192.168.0.10) then use this:

        netsh advfirewall firewall add rule name="ICMP Allow incoming V4 echo request" protocol=icmpv4:8,any dir=in action=allow

        Cats bury it so they can't see it!
        (You know what I mean if you have a cat)

        1 Reply Last reply Reply Quote 0
        • H
          hsv
          last edited by

          ICMP is enabled so I can ping it from other servers in the subnet.
          So the problem is that Pfsense do not like multicast.

          DaddyGoD 1 Reply Last reply Reply Quote 0
          • L
            louis2
            last edited by louis2

            I have the same problem. Multicast not working correctly. Not with IGMP-proxy (not at all) and not with PIMD (it works a bit).

            Never the less I would advice the more capable recently introduced PIMD-package. It works "a bit", problem is that it does not recognise all of my vlan-interfaces.

            But your config is of cause different, so may be ..... it works for you ๐Ÿ˜Š

            For info on my system pimd is refusing a lot of vlan interfaces with the following message "Invalid phyint address '<technical interface name>'. I did raise a bugreport for that.

            I hope you are more sucessfull. Let me/us know.

            Louis
            PS of cause the fw-settings sould allow the resulting unicast traffic.

            1 Reply Last reply Reply Quote 0
            • DaddyGoD
              DaddyGo @hsv
              last edited by DaddyGo

              @hsv said in Multicast:

              So the problem is that Pfsense do not like multicast.

              I understand...๐Ÿ˜‰

              We configure multicast traffic on the switches for example for AoIP purposes (IGMP snooping thus, traffic on the same subnet does not need to reach the router).

              f.e.:

              d1e62b8d-b739-4d53-a2f7-020d26c8c021-image.png

              or

              b1194446-b04f-4766-85f0-84b071126a88-image.png

              or

              87a816ff-2b30-41c4-8253-a779a52a8c66-image.png

              BTW:
              Exactly what multicast routing function you want to implement?

              Cats bury it so they can't see it!
              (You know what I mean if you have a cat)

              L n3xus_x3N 2 Replies Last reply Reply Quote 0
              • L
                louis2 @DaddyGo
                last edited by louis2

                @DaddyGo

                To answer that first a rough outline of my network

                • I have two "core switches" one for 1G one for "10G" each carrying multiple vlans
                • in the center pfSense as router and firewall
                • in the rooms small (5/ 8 -port) Netgear managed switches
                • the network is divided in โ€œsecurity-zonesโ€ implemented with vlans

                In the RedZone my server, among other things hosting my (twonky)media-server. In the PC-zone, Guest-zone, and IoT-zone equipment like Hifi-receivers and media-players.

                PIMD should use the IGMP-messages to build routing tables and to forward the multicast broadcast / response messages. If that is successful the Twonky and the โ€œmedia-devicesโ€ know each other. And of course the result is unicast info and data (stream) exchange, which should be allowed by the FW-rules (and if applicable NAT-rules).

                That is it ๐Ÿ˜Š

                Additional, but necessary in a small network, the switches should be configured for IGMP-snooping, to prevent lots of unnecessary messages.

                That is of cause that is my situation, I do not know what @hsv wants to accomplish

                Louis

                DaddyGoD 1 Reply Last reply Reply Quote 0
                • DaddyGoD
                  DaddyGo @louis2
                  last edited by DaddyGo

                  @louis2 said in Multicast:
                  @louis2 "To answer that first a rough outline of my network"

                  nice system, but it's just in your house๐Ÿ˜‰

                  Additional, but necessary in a small network,

                  this Cisco installment makes up only 2-3% of our system...
                  At 18 radiostations, we serve nearly 300 colleagues in the AoIP system with the appropriate audio materials and broadcast the FM-UHF program from 24 telekom towers, within a radius of 350 km
                  (the entire system includes 44 voice VLANs, connected by 47 Cisco switches and 8 Brocade switches over fiber and Cat6, this is no small system)
                  DANTE protocol (https://www.audinate.com/) ๐Ÿ˜‰

                  we never route the multicast traffic, only the core-switches the IGMP querier(s) in the system and control everything

                  BTW:
                  our own backbone network is 2x40G 2420Km fiber with IEEE 1588 Precision Time Protocol (PTP) across the network

                  I've been crying a lot about multicast, since the system latency can't be more than 1-2ms everywhere
                  (routers raise this value to the skies)

                  +++edit:
                  I work with these multicast addresses / ports..

                  05fa23ab-0a3e-41d0-bc4e-ad6730feb7d7-image.png

                  d459aedf-df13-4d44-b5b7-8f95cf7e1abd-image.png

                  Cats bury it so they can't see it!
                  (You know what I mean if you have a cat)

                  1 Reply Last reply Reply Quote 0
                  • L
                    louis2
                    last edited by

                    If multicast is in and stays(!) in a dedicated vlan, it is not necessary to send it through a router. And I agree completely, you should not do that because of the added latency.

                    However, if the multicast source is in a different vlan as the multicast receiver/destination, than you need to route that. And that will probably be at the users premises and not in the telecom network. ๐Ÿ˜Š

                    Note that my provider is sending the TV-streams in a different vlan than the internet, and that the set-top-box is supposed to be connected to that tv-vlan.

                    Louis

                    DaddyGoD 1 Reply Last reply Reply Quote 0
                    • DaddyGoD
                      DaddyGo @louis2
                      last edited by

                      @louis2 said in Multicast:

                      TV-streams

                      in this case you have to route the traffic

                      Cats bury it so they can't see it!
                      (You know what I mean if you have a cat)

                      1 Reply Last reply Reply Quote 0
                      • johnpozJ
                        johnpoz LAYER 8 Global Moderator
                        last edited by

                        @louis2 said in Multicast:

                        Note that my provider is sending the TV-streams in a different vlan than the internet, and that the set-top-box is supposed to be connected to that tv-vlan.

                        The way I take that... Is you should split that traffic at layer 2 when it comes in. So your STB would not be behind the layer 3 device..

                        Now keep in mind only half way through my first cup of coffee but would you do something like this..

                        Where you split the L2 networks before pfsense.

                        setup.png

                        An intelligent man is sometimes forced to be drunk to spend time with his fools
                        If you get confused: Listen to the Music Play
                        Please don't Chat/PM me for help, unless mod related
                        SG-4860 23.09.1 | Lab VMs 2.7.2, 23.09.1

                        1 Reply Last reply Reply Quote 0
                        • L
                          louis2
                          last edited by

                          John,

                          I think the same with one small difference, being that the Ls2-switch is inside the ISP-device.

                          Not 100% sure, because I have internet and telephone from the ISP and television from the Cable.

                          Louis

                          1 Reply Last reply Reply Quote 0
                          • L
                            louis2
                            last edited by

                            To be even more precise, I have the lan-connection(s) from the ISP-device connected to my 1G-coreswitch. At the entrance port of that switch the lan is transformated to a vlan (PID=internet-vlan-no).

                            The Internet VLAN is entering pfSense, the TV-vlan (if present), is passing pfSense / stays level2.

                            Louis

                            1 Reply Last reply Reply Quote 0
                            • johnpozJ
                              johnpoz LAYER 8 Global Moderator
                              last edited by

                              @louis2 said in Multicast:

                              is passing pfSense / stays level2.

                              Doesn't work that way, pfsense is a layer 3 device. Pfsense is not going to pass on vlan tags.. Nor layer 2 traffic..

                              Sniffing on pfsense is seeing the vlan traffic.. Then put switch in front of pfsense to send the STB vlan to the devices that are suppose to be on that vlan..

                              An intelligent man is sometimes forced to be drunk to spend time with his fools
                              If you get confused: Listen to the Music Play
                              Please don't Chat/PM me for help, unless mod related
                              SG-4860 23.09.1 | Lab VMs 2.7.2, 23.09.1

                              L 1 Reply Last reply Reply Quote 0
                              • H
                                hsv
                                last edited by hsv

                                My problem is that it is mail traffic that's coming in and goes to a loadbalancer (MS) this loadbalancer use multicast.
                                So the router need to communicate to this multicast unit.

                                I have tried to look into HAProxy, whit absolut not succes. The documentation I have found do not help me at all.

                                So if som body can point med to a HAproxy description, where you have one front ip number with multiple Ports to 2 or more servers in the backend that could help, as I cannot see pfsense handle this multicast problem.

                                Regards
                                Henning

                                L 1 Reply Last reply Reply Quote 0
                                • L
                                  louis2 @johnpoz
                                  last edited by louis2

                                  @johnpoz

                                  John, I know. The description of my network was over simplified. pfSense is not really in the middle of the 1G and 10G core switches.

                                  I have a 1G-network towards most rooms and towards the ISP-device. That network is handled by the 1G-core. And I have a 10G network which connects my server, my nas and my main-PC.

                                  Both (physical) networks are connected to pfSense for routing between the VLANs independent from the fact if they are located in the 1G or in the 10G domain.

                                  pfSense is connected to the 1G-switch via a 1G-lagg and connected to the 10G-switch via a 10G-up and a 10G-down link. However there is also a direct (physical) connection between those two switches.

                                  To take the TV-VLAN as example, is a vlan starting at the ISP-device, passing the 1G-core ending on one of the small Netgear switches in the living room.

                                  Louis

                                  1 Reply Last reply Reply Quote 0
                                  • L
                                    louis2 @hsv
                                    last edited by

                                    @hsv

                                    I am not an expert related to loadballancers etc, so wait for the reaction form @johnpoz etc, but to me it sounds strange that the devices like that are based on multicast.

                                    I would expect to see some routing protocol there.

                                    Louis

                                    1 Reply Last reply Reply Quote 1
                                    • johnpozJ
                                      johnpoz LAYER 8 Global Moderator
                                      last edited by

                                      Ok that makes sense.

                                      To be honest I have no idea what @hsv is talking about.. Load balancer that uses multicast??

                                      For example

                                      host with multicast 192.168.0.10 it do not reply.

                                      That is NOT a multicast address.. So I have a funny suspicion there is some misuse of terms going on.

                                      An intelligent man is sometimes forced to be drunk to spend time with his fools
                                      If you get confused: Listen to the Music Play
                                      Please don't Chat/PM me for help, unless mod related
                                      SG-4860 23.09.1 | Lab VMs 2.7.2, 23.09.1

                                      DaddyGoD 1 Reply Last reply Reply Quote 1
                                      • DaddyGoD
                                        DaddyGo @johnpoz
                                        last edited by DaddyGo

                                        @johnpoz said in Multicast:

                                        To be honest I have no idea what @hsv is talking about.. Load balancer that uses multicast??

                                        from the beginning I have the same feeling John ๐Ÿ˜‰

                                        192.168.0.10 RFC1918

                                        this has nothing to do with multicast

                                        +++edit:

                                        for @hsv :
                                        https://en.wikipedia.org/wiki/Multicast_address

                                        Cats bury it so they can't see it!
                                        (You know what I mean if you have a cat)

                                        1 Reply Last reply Reply Quote 0
                                        • johnpozJ
                                          johnpoz LAYER 8 Global Moderator
                                          last edited by johnpoz

                                          Maybe if he sends some traffic to this device at 192.168.0.10, it multicasts the traffic that is sends on?

                                          @hsv really going to need a bit more info.. What is this device, or what software are you running on 192.168.0.10.. What sort of traffic is it?

                                          If you can not arp from pfsense, for this 192.168.0.10 address - then no your never going to be able to send it traffic.. To do anything with..

                                          From the out side I have 4 NAT rules to direct the trafic to 192.168.0.10

                                          Can you post those, so we can maybe glean some insight into what your trying to do exactly.

                                          An intelligent man is sometimes forced to be drunk to spend time with his fools
                                          If you get confused: Listen to the Music Play
                                          Please don't Chat/PM me for help, unless mod related
                                          SG-4860 23.09.1 | Lab VMs 2.7.2, 23.09.1

                                          1 Reply Last reply Reply Quote 0
                                          • DaddyGoD
                                            DaddyGo
                                            last edited by

                                            @hsv said in Multicast:

                                            loadbalancer (MS)

                                            it could be something like that if we go after it better:

                                            https://docs.microsoft.com/en-us/windows-server/networking/technologies/network-load-balancing

                                            73d9b899-2ed2-4e76-bdca-7c466be69cfb-image.png

                                            e6cc0fa2-20dd-4a70-9fc1-4ccc2ff74669-image.png

                                            Cats bury it so they can't see it!
                                            (You know what I mean if you have a cat)

                                            1 Reply Last reply Reply Quote 0
                                            • H
                                              hsv
                                              last edited by

                                              Hi
                                              Yes the diagram is correct, but I only have 4 WAN, but I guess the problem will be the same.

                                              And yes pfsense can not resolve it to a MAC adresse.
                                              Why I do not know.

                                              I have no problem on a windows client make arp -a and see the mac address to be:
                                              03-bf-c0-a8-0b-e1

                                              Regards
                                              Henning

                                              DaddyGoD 1 Reply Last reply Reply Quote 0
                                              • johnpozJ
                                                johnpoz LAYER 8 Global Moderator
                                                last edited by johnpoz

                                                If pfsense can not arp then you have a connectivity issue..

                                                How do you have this actually connected to pfsense.

                                                If what your trying to do is the above, that has ZERO to do with multicast and pfsense.. What you loadbalancer does with unicast your traffic coming from the internet has nothing to do with pfsense talking to the LB..

                                                You need to figure out what the problem is with basic connectivity from pfsense 192.168.0.1 and this IP at 192.168.0.10 which is your LB.. If pfsense can not even arp for that IP then they are not actually connected via the same L2 network, ie switch cable plugged into pfsense port?

                                                How is 192.168.0.10 connected to this 192.168.0 network?

                                                Now if this 192.168.0.10 is some sort of VIP? If pfsense can not arp for that IP, then it is impossible for it to send it traffic If your saying its just not arping - then setup a static arp entry for it on pfsense.. this 03-bf-c0-a8-0b-e1 mac

                                                But there should be unicast mac for your cluster.. Why can you not use that?

                                                Some details of how you have everything connected will help us help you.

                                                An intelligent man is sometimes forced to be drunk to spend time with his fools
                                                If you get confused: Listen to the Music Play
                                                Please don't Chat/PM me for help, unless mod related
                                                SG-4860 23.09.1 | Lab VMs 2.7.2, 23.09.1

                                                1 Reply Last reply Reply Quote 0
                                                • H
                                                  hsv
                                                  last edited by

                                                  Hi

                                                  How do I add a static arp to the arp list?

                                                  The setup is 3 virtual host where pfsense and a test windows server is placed on ESXi0 on ESXi1 and 2 the mail setup are running.
                                                  From the test server I can ping and resolve the LB but on Pfsense I cannot.

                                                  So the network is working. I have for testing setup the Windows Test server with VLAN also so looked from VMware the 2 server are setup the same way.

                                                  Regards
                                                  Henning

                                                  1 Reply Last reply Reply Quote 0
                                                  • DaddyGoD
                                                    DaddyGo @hsv
                                                    last edited by

                                                    @hsv said in Multicast:

                                                    es the diagram is correct,

                                                    I used to deal with MS load balancer (especially multicast), long time ago...
                                                    (we always use a hardware base load balancer, HA proxy )

                                                    but I am interested in this topic... ๐Ÿ˜‰

                                                    no this will not work under pfSense.... (100%)
                                                    bring the theme under linux...

                                                    https://github.com/google/seesaw

                                                    Cats bury it so they can't see it!
                                                    (You know what I mean if you have a cat)

                                                    1 Reply Last reply Reply Quote 0
                                                    • H
                                                      hsv
                                                      last edited by

                                                      Hi
                                                      I have also come to the same conclusion that multicast and Pfsense is not the way to go, and start to setup HAProxy.

                                                      But thanks for you suggestions.

                                                      Regards
                                                      Henning

                                                      DaddyGoD 1 Reply Last reply Reply Quote 0
                                                      • DaddyGoD
                                                        DaddyGo @hsv
                                                        last edited by DaddyGo

                                                        @hsv said in Multicast:

                                                        Pfsense is not the way to go, and start to setup HAProxy.

                                                        it took me a long time to understand what do you mean by original post, I apologize ๐Ÿ˜‰
                                                        just the way, it works...HA proxy ๐Ÿ‘ โœ‹

                                                        +++edit:
                                                        @hsv "but I only have 4 WAN, but I guess the problem will be the same."

                                                        this does not matter

                                                        Cats bury it so they can't see it!
                                                        (You know what I mean if you have a cat)

                                                        1 Reply Last reply Reply Quote 0
                                                        • n3xus_x3N
                                                          n3xus_x3 @DaddyGo
                                                          last edited by

                                                          @daddygo do you have any tutorial on how I can configure Multicast? I have CISCO SG300 with 2 Vlan
                                                          thanks

                                                          L DaddyGoD 2 Replies Last reply Reply Quote 0
                                                          • L
                                                            louis2 @n3xus_x3
                                                            last edited by

                                                            @n3xus_x3 Note that

                                                            • if source and destination is in the same vlan/subnet, it simply works. In case you have a bigger subnet and advanced switches you could/should use IGMP Snooping to prevent unnecessary traffic
                                                            • is your multicast source is in a different vlan/subnet, than:
                                                            • you need an application which forward the multicast messages between the involved vlan's. That is also where the problem is, since neither the actual IMGP-proxy nor the Netgate provided PIMD-version2 works!
                                                            • assuming you manage to get a working multicast deamon, you should configure pfSense to pass the related unicast traffic between the involved VLAN's

                                                            Personally I have multicast working between VLAN's based on an upcomming beta PIMD-version which I did compile myself (Trogobit (https://github.com/troglobit/pimd). So not so easy at all. I hope there will be a released and Netgate supported version in the future.

                                                            For info and in case you have the knowledge and are very brave, sources are on Trogobit (https://github.com/troglobit/pimd).

                                                            • Troglobit is working on an improved PIMD-version at the moment. It is beta and not supported by Netgate or Trogobit (not for FreeBSD), however in opposite to the actual pfSence IMGP-proxy and PIMD-version, it does work!
                                                            • To make it work you need some courage, knowledge, pfSence 2.5 and a FreeBSD development machine. If that is present, you can download the pimd source from github compile it and install it on your pfSense system from the commandline.
                                                            • To make it even more complex, .... the pfSense pimd application has two components beeing: the pfSense PIMD control/GUI- application and PIMD it-self. You also have to make some small changes to that pfSense PIMD control/GUI.
                                                            • Because it is still early beta!! and I do want to interfere with Troglobit or Netgate, I am >not< going to release my personal pimd-package in this stage. So for now you are on own.

                                                            My advice: unless someone has an alternative solution, I can only advice to wait or to place source and destination in the same vlan.

                                                            Louis

                                                            n3xus_x3N 1 Reply Last reply Reply Quote 1
                                                            • n3xus_x3N
                                                              n3xus_x3 @louis2
                                                              last edited by n3xus_x3

                                                              @louis2 Hi Louis2
                                                              thank you for the explanation . sorry but i'm slightly confused , I explain what I want to do

                                                              My pfsense configuration

                                                              Vlan50 192.168.50.0/24 (WiFi devices)
                                                              Vlan60 192.168.60.0/24 (CCTV)
                                                              LAN 192.168.1.0/24 ( IPTV , Emby)
                                                              LAN2 192.168.10.0/24 (wired systems)
                                                              DMZ 10.10.50.0/24

                                                              Currently only some devices that are in VLAN50 , have access to some IP addresses that are on the network VLAN60 and LAN

                                                              My question is , do I need to configure pFsense and the switch (Cisco SG300) for Multicast to work properly? i want multicast between VLAN50 , VLAN60 , LAN .

                                                              I apologize if I have been confused
                                                              Thanks
                                                              Mark

                                                              L 1 Reply Last reply Reply Quote 0
                                                              • L
                                                                louis2 @n3xus_x3
                                                                last edited by

                                                                @n3xus_x3

                                                                Since source and destination are in different VLAN's/subnets, without additional measures the communication will never work!

                                                                The source generates "hello I am a source" messages and distribute those in its own subnet/vlan. Those messages will never reach the client in the other subnet/vlan. So the client will not be aware of the source.

                                                                To change that you need an application which bridge the vlan's in regard to the multicast messages. And at this moment in time there is no working app available for pfSence to provide that function.

                                                                The only option I am aware of is the beta pimd version. But I would not advice to try that in your case.

                                                                Sincerely,

                                                                Louis

                                                                n3xus_x3N 1 Reply Last reply Reply Quote 1
                                                                • n3xus_x3N
                                                                  n3xus_x3 @louis2
                                                                  last edited by

                                                                  @louis2
                                                                  You have been very clear, Thanks for your help. I will wait for the Trogobit project to be ready

                                                                  cheers
                                                                  Mark

                                                                  1 Reply Last reply Reply Quote 0
                                                                  • DaddyGoD
                                                                    DaddyGo @n3xus_x3
                                                                    last edited by

                                                                    @n3xus_x3 said in Multicast:

                                                                    do you have any tutorial on how I can configure Multicast? I have CISCO SG300

                                                                    Hi,

                                                                    can also be solved on SG300, but MULTICAST handles it a little differently on it, I suggest the SG350 series it is a little more painless

                                                                    BTW:
                                                                    otherwise what are you using multicast for

                                                                    Cats bury it so they can't see it!
                                                                    (You know what I mean if you have a cat)

                                                                    n3xus_x3N 1 Reply Last reply Reply Quote 0
                                                                    • n3xus_x3N
                                                                      n3xus_x3 @DaddyGo
                                                                      last edited by

                                                                      @daddygo
                                                                      Hello , I use multicast for IPTV reception, and for Emby Server for local and remote transmission (VPN) of video content .
                                                                      i try to find some tutorials for my SG300

                                                                      DaddyGoD 1 Reply Last reply Reply Quote 0
                                                                      • DaddyGoD
                                                                        DaddyGo @n3xus_x3
                                                                        last edited by

                                                                        @n3xus_x3 said in Multicast:

                                                                        I use multicast for IPTV reception

                                                                        there are still 2 - 3 pieces of SG300-10 in our (AoIP system + multicast) system,... yet

                                                                        how can I help?
                                                                        describe it exactly

                                                                        BTW:
                                                                        IPTV in this regard, is deadly, ISP dependent...

                                                                        Cats bury it so they can't see it!
                                                                        (You know what I mean if you have a cat)

                                                                        1 Reply Last reply Reply Quote 0
                                                                        • First post
                                                                          Last post