Assign 10.xx.xx.xx IP address to outbound IGMP traffic and no PPPoE tag #86

horolux · 2022-03-04T16:24:51Z

horolux
Mar 4, 2022

Hi,

I don't know if it is a new feature or something already possible or maybe even complicated to implement, but I have the need that my outbound multicast traffic uses a 10.xx.xx.xx IP address as SRC address. In order to get IPTV working for my provider the JOIN request has to be done with a SRC address 10.xx.xx.xx otherwise it won't work. Also this request must not have a PPPoE tag.

I can explain you this in a more detailed way, but I cannot post detailed information here as it I'm not allowed to do so (got some information from the IPTV provider in order to get this working but any publishing of it is forbidden).

So I have a PPPoE connection established by my UDM-SE.
UDM-IPTV is running on it.
The IGMP JOIN request is well routed from internal network to ppp0 but today the SRC address is my official IP Address and
it must be a specific 10.xx.xx.xx address in order to get the "handshake" done or let's say the JOIN request accepted. And as said
this Join request must to be PPPoE tagged.

fabianishere · 2022-03-04T21:17:54Z

fabianishere
Mar 4, 2022
Maintainer

10.0.0.0/8 belongs to the private IP address space, is your ISP able to route these packets back to you when sending with such a source?

Also, how do you determine what the 10.0.0.0/8 address is? Is it assigned to you?

Anyway, if you don’t want to replace the SRC field in the packet with your public address, I believe you need to look into bridged IPTV, as opposed to routed IPTV (which this project does).

20 replies

fabianishere Mar 9, 2022
Maintainer

Awesome! 😀

MFC stands for Multicast forwarding cache and contains the multicast forwarding rules installed by igmpproxy. You could try to see if IPTV still works when setting IPTV_WAN_RANGES to 172.19.0.0/16. With the current config, it will forward multicast traffic originating from any source. However, since the IPTV traffic is routed over a private network, the security risk is small.

horolux Mar 9, 2022
Author

Yep. One reason why the provider routes over a private network is security. By the way, you've got some cups of coffee ;-)
Let me know how (where) to share the wole configuration with you in order to add it to the table on the main page, I'll do that later or tomorrow.

fabianishere Mar 9, 2022
Maintainer

Thanks!

I suppose it is enough to add a new entry to the table in the README with the name of your provider, 0 for WAN VLAN, and 0.0.0.0/0 for WAN ranges. Then in the notes, I would say something like:

Set WAN interface to eth8.35
Assign IP address to this interface on boot: ip addr add 10.10.10.10/24 dev eth8.35

I will probably add some functionality to the script to perform the latter step automatically in the future.

horolux Mar 9, 2022
Author

I just deactivated my FW which is needed in order to get it working (as the traffic coming from 172.19.x.x is neither related nor established there needs to be a rule to let it pass), and the IP address on eth8.35 was gone. I had to set it again and restart everything.

Yes it would be very useful to add an option to UDM-IPTV for such a configuration as mine.

So I need to provide you the exact IPTV provider name, VLAN ID, adress for WAN_Range (after some more tests), firewall rules needed etc. I'll send this in the next days after some more tests. How to you want the information? Here? Other place?

fabianishere Mar 9, 2022
Maintainer

You can provide it here or create a pull request with the necessary information.

horolux · 2022-03-12T09:49:39Z

horolux
Mar 12, 2022
Author

Hi,

So after some tests and different FW setups, watching a couple of days let's move forward and get this added as another profile for this great project:

1. General information

Provider: PostTV
Country: LU

2. The needed information for the profile creation:

=== Configuration ===
WAN Interface: eth8.35
WAN Ranges: 172.19.9.4/32
WAN VLAN: 0 (dev iptv)
WAN DHCP options: 
LAN Interfaces: br20
IGMP Proxy quickleave disabled: false
IGMP Proxy debug: true
=== IP Link and Route ===
28: eth8.35@eth8: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP group default qlen 1000
    inet 10.10.10.10/32 scope global eth8.35
       valid_lft forever preferred_lft forever
=== Service Logs ===

=> this is for WAN1, I think if someone is using WAN2 it should be the same except eth9.35 instead of eth8.35

3. Additionnal configuration needed

Maybe you can in the meantime set this automatically via the new static IP function?

if WAN1 used:
ip addr add 10.10.10.10/32 dev eth8.35

if WAN2 used:
ip addr add 10.10.10.10/32 dev eth9.35

4. Firewall rule

There is a need for a firewall rule as the incoming multicast stream is not covered by the default "established/related" firewall rule. So, as we need to add a rule, let's then try to not open more then
absolutely needed.

(a) Create the following profiles:

IPTV Multicast source : choose IPv4 Address/Subnet and add 172.19.9.4 as address
IPTV Multicast destination : choose IPv4 Address/Subnet and add 224.11.0.0/16 as address/subnet
IPTV Ports : choose Port Group and add 4098, 8008, 50938, 60036 as ports

(b) Create the following firwall rule on INTERNET IN (legacy GUI: WAN IN):

Allow IPTV :
choose "Accept"
choose "UDP" for IPv4 Protocol

  Settings for source:
  choose Source Type "Port/IP Group"
  choose "IPTV Multicast source" for IPv4 Address Group
  choose "IPTV Ports" for "Port Group"
  
  Settings for destination:
  choose Source Type "Port/IP Group"
  choose "IPTV Multicast destination" for IPv4 Address Group
  choose "IPTV Ports" for "Port Group"

5. Final remarks /questions

If something's missing or not clear enough in order to get this added to the projet, let me know ;-)
Once added/implemented, just let me know, I'll then test the next release if it works ;-)

Actual issue: every time I change a something via the GUI related to the firewall settings etc, the IP set for
eth8.35 is gone and I have to redo the procedure manually (add it back, restart UDM-IPTV) in order to get
it working again. Would be great if we get this fixed too as well as ensuring the functionnality after a reboot.

4 replies

horolux Mar 20, 2022
Author

Hi Fabian, how shall we proceed to get this added?

horolux Apr 11, 2022
Author

@fabianishere hi, how can I create a pull request or how can we work together in order to integrade the above configuration as a profile into udm-iptv? As it needs to add a static IP address to a specific device (here eth8.35), it would also be great that (a) udm-iptv sets this address (defined via the profile) and checks regulary if it is still set, if not should set it. This in unfortunately necessary as each firewall or network change via the UDM GUI unconfigures the static IP address from eth8.35 so IPTV is not working and one has to reconfigure it manually.

fabianishere Apr 12, 2022
Maintainer

@horolux I have created a pull request with the new profile: #107

The project now also supports watching the network configuration for changes, so it should re-apply the IP address if it is removed.

yreiser Jun 7, 2022

Tried this with my UDM-Pro this weekend. Works fine with my Post LU IPTV. Many thanks!!!
I didn't have to setup any firewall rules though, immediately worked without!?

Redbullux · 2024-06-25T19:40:34Z

Redbullux
Jun 25, 2024

Hello everyone,
Until recently, the Post LU (Luxembourg) configuration worked perfectly without even adding rules on the firewall. A few days ago, the provider Post Luxembourg updated its TV boxes and since then I no longer have any TV stream reception. Here is the result of the diagnostic command:

root@Dream-Machine-Special-Edition:~# udm-iptv diagnose
Please share the following output with the developers:
=== Configuration ===
WAN Interface: eth8.35
WAN VLAN: 0 (dev iptv mac d0:21:f9:XX:XX:XX)
WAN DHCP: false (options "-O staticroutes")
WAN Static IP: 10.10.10.10/32
WAN Ranges: 172.19.9.0/24
LAN Interfaces: br0
IGMP Proxy quickleave disabled: false
IGMP Proxy debug: true
=== IP Link and Route ===
24: eth8.35@eth8: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP group default qlen 1000
inet 10.10.10.10/32 scope global eth8.35
valid_lft forever preferred_lft forever
=== Service Logs ===
Jun 25 21:35:30 Dream-Machine-Special-Edition udm-iptvd[1166241]: DEBUG[init_int erface@208]: if_mtu = 1500
Jun 25 21:35:30 Dream-Machine-Special-Edition udm-iptvd[1166241]: DEBUG[init_int erface@214]: if_falgs = 4163
Jun 25 21:35:30 Dream-Machine-Special-Edition udm-iptvd[1166241]: DEBUG[init_int erface@178]: eth8.35's ipv4 address is 10.10.10.10
Jun 25 21:35:30 Dream-Machine-Special-Edition udm-iptvd[1166241]: DEBUG[init_int erface@195]: if_index = 24
Jun 25 21:35:30 Dream-Machine-Special-Edition udm-iptvd[1166241]: DEBUG[init_int erface@208]: if_mtu = 1500
Jun 25 21:35:30 Dream-Machine-Special-Edition udm-iptvd[1166241]: DEBUG[init_int erface@214]: if_falgs = 4163
Jun 25 21:35:30 Dream-Machine-Special-Edition udm-iptvd[1166241]: ERROR[main@619 ]: exiting.........
Jun 25 21:35:30 Dream-Machine-Special-Edition IMPROXY[1166241]: ERROR[main@619]: exiting.........
Jun 25 21:35:30 Dream-Machine-Special-Edition systemd[1]: udm-iptv.service: Main process exited, code=exited, status=1/FAILURE
Jun 25 21:35:30 Dream-Machine-Special-Edition systemd[1]: udm-iptv.service: Fail ed with result 'exit-code'.

Can you help me?

0 replies

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Assign 10.xx.xx.xx IP address to outbound IGMP traffic and no PPPoE tag #86

{{title}}

Replies: 3 comments 24 replies

{{title}}

{{title}}

{{title}}

{{title}}

{{title}}

{{title}}

{{title}}

{{editor}}'s edit

{{editor}}'s edit

{{title}}

{{title}}

{{title}}

{{title}}

{{title}}

{{editor}}'s edit

{{editor}}'s edit

Select a reply

Assign 10.xx.xx.xx IP address to outbound IGMP traffic and no PPPoE tag #86

horolux Mar 4, 2022

Replies: 3 comments · 24 replies

fabianishere Mar 4, 2022 Maintainer

fabianishere Mar 9, 2022 Maintainer

horolux Mar 9, 2022 Author

fabianishere Mar 9, 2022 Maintainer

horolux Mar 9, 2022 Author

fabianishere Mar 9, 2022 Maintainer

horolux Mar 12, 2022 Author

horolux Mar 20, 2022 Author

horolux Apr 11, 2022 Author

fabianishere Apr 12, 2022 Maintainer

yreiser Jun 7, 2022

Redbullux Jun 25, 2024

horolux
Mar 4, 2022

Replies: 3 comments 24 replies

fabianishere
Mar 4, 2022
Maintainer

fabianishere Mar 9, 2022
Maintainer

horolux Mar 9, 2022
Author

fabianishere Mar 9, 2022
Maintainer

horolux Mar 9, 2022
Author

fabianishere Mar 9, 2022
Maintainer

horolux
Mar 12, 2022
Author

horolux Mar 20, 2022
Author

horolux Apr 11, 2022
Author

fabianishere Apr 12, 2022
Maintainer

Redbullux
Jun 25, 2024