Configuring UDP Broadcast Relay
-
@RickyBaker said in Configuring UDP Broadcast Relay:
i think it was just from the tutorial that i used
I don't have Chromecast, so I can't go through and evaluate all of it. But just looking quickly at the list, it seems to be a bit of a kitchen sink approach. I.E. these are ports that these devices use in some way, shape or form, so forward them all.
This doesn't mean that it won't work, but that doesn't mean it's a good approach either. It's certainly not the approach a network security engineer would take.
-
@RickyBaker said in Configuring UDP Broadcast Relay:
Logitech Harmony remote
By googling "Logitech Harmony udp broadcast relay port multicast group" I found this port number and multicast group IP...and it worked! So i guess i just need to find that port number and group for any devices not working as expected across vlans. Anyone have any suggestions for tracking down the more obscure ones without a vibrant community?
-
@RickyBaker said in Configuring UDP Broadcast Relay:
Anyone have any suggestions for tracking down the more obscure ones without a vibrant community?
This may be more of an answer than you were looking for...
You can discover the ports in use by sniffing the appropriate interface on your firewall for multicast/broadcast packets originating from the host in question. Example:
tcpdump -i igc0 \( broadcast or multicast \) and host myhostwhere 'igc0' is the interface you want to examine, and 'myhost' is the name of the host you want to see packets for.
Multicast/broadcast discovery is usually unidirectional, meaning the multicast packets go from the server to the client, or from the client to the server server, but not both. In general, I would feel better about forwarding multicast packets from the trusted network to the untrusted network than the reverse.
If your trusted devices are clients in the LAN, start looking there. See if your clients are sending any multicast packets, and if so on what port.
If you don't find anything being sent by the clients, then look for packets being sent by the server on the untrusted network.
Based on what you discover, you will be able to determine which multicast ports need forwarding, which hosts they need forwarding from, and set up your forwarding accordingly.
If you have been hearing Mission Impossible music in your head while reading this, don't sweat it. It really isn't that bad. It may seem tedious at first, but you will learn a lot and have a much better idea of how things work when you are done. And if you add another device in the future, you'll know how to make it work yourself.
NB: don't create a loop by forwarding the same port both directions.
-
@dennypage said in Configuring UDP Broadcast Relay:
If you have been hearing Mission Impossible music in your head while reading this, don't sweat it. It really isn't that bad. It may seem tedious at first, but you will learn a lot and have a much better idea of how things work when you are done. And if you add another device in the future, you'll know how to make it work yourself.
NB: don't create a loop by forwarding the same port both directions.
lol thank you very much, I'm gonna give it a try. I'm def going to straight up ignore a few of them that are just not needed (like the kodak projector that really only gets used OUTSIDE the house)
@dennypage said in Configuring UDP Broadcast Relay:
tcpdump -i igc0 ( broadcast or multicast ) and host myhost
so i'm running this on a terminal of the pfsense? or on any PC that's on the LAN Wifi?
-
@RickyBaker said in Configuring UDP Broadcast Relay:
so i'm running this on a terminal of the pfsense? or on any PC that's on the LAN Wifi?
You would do the sniffing on the firewall. Assuming you have ssh enabled, that would be the best way.
-
@RickyBaker Sorry to wake this topic up but i have added the rules and I am still not able to cast to my fireTV (SSDP) which is on the IOT subnet and my phone is on LAN subnet
-
@iptvcld what interface are these rules on? IoT? Here are my IoT rules in case they are helpful:
-
@RickyBaker thank you! Are you able to share the ports for this alias?
Also have you tested this to see if it works on any Amazon FireTV devices (if you have any) - those devices use SSDP protocol.
This is my IOT - i made an alias with all the IPS that are the CastingDevice and then the CastFromNetwork alias, i just out in the LAN net and Guest Net. But i want to block it a bit better using ports.
-
@iptvcld sure:
Never done anything with a fire, but I did get the Nvidia Shields to be operable across vlans...
-
@RickyBaker thanks. The fire uses something called SSPD and not mdns but cannot locate the ports it needs yet.
-
@iptvcld i'm sure there's a more eloquent and effective way to find out but I've actually just googled and messaged various companies to ask them what the udp forwarding port the app uses and been moderately successful. Can't get the the printer to reliably talk across the vlans but that could be a "printers are terrible" thing
