IPv6 Multicast with mrd6?

dlakelan · February 8, 2019, 8:41pm

Suppose you have a switch with MLD then, here's what needs to happen, and I think you'll need to figure it out on your own because I'm not going to chase down your switch config manuals etc.

When VLC on the LAN starts up listening for a stream it sends a MLD report to ff02::16 saying it wants to receive the stream
The router will receive this on its LAN.
The router should forward this to its WAN:
ip -6 route add multicast ff02::16 dev eth0.2
You may need a firewall rule to pass these packets, though by default LAN to WAN is allowed, so you might not.

Then the switch should see the MLD report and open up the flood to your router's WAN.

Unlike the need for igmpproxy which needs to listen on LAN and re-broadcast on WAN because IGMP is a separate protocol with no notion of routing, in IPv6 the MLD is just an ipv6 packet using icmpv6 and can be routed like this.

mickey84 · February 8, 2019, 8:43pm

ok thanks a lot

dlakelan · February 8, 2019, 8:44pm

You're welcome, I hope you get it working, and if you are able to get MLD working on your switch and test the whole thing, would you come back and give some details of how it worked? I will use those to update the wiki.

mickey84 · February 8, 2019, 8:48pm

I have the newest firmware but mld is missing. I probably won't get it to work without further help. but without MLD snooping i doesn't make sense anyway.

dlakelan · February 8, 2019, 8:51pm

Right you need to have that because the whole point is to deal with the case where the UDP stream isn't already coming to your WAN port. You can perhaps call your switch manufacturer's tech support line or change switches, maybe buy a used sg300 cisco switch off Ebay or a new sg350-10 off amazon

lleachii · February 8, 2019, 10:30pm

I can only suggest testing without that switch before making a purchase.

dlakelan · February 8, 2019, 10:41pm

yes @mickey84 you should get the HL set to 2 and make sure your routing etc works, and then figure out which switch you need for MLD. It looks like this inexpensive tp-link one has MLD snooping: https://www.amazon.com/dp/B016M1QTS2 but I'd be sure to read the manual pages etc before buying.

mickey84 · February 9, 2019, 12:02pm

ok thanks, I'll try without the switch first.

mickey84 · February 9, 2019, 1:51pm

could you please tell me how to set this up correctly ? I set up mc forward already.
I'm also connected directly to the router. No switch involved.

also do I have to change something here maybe ? mld

lleachii · February 9, 2019, 2:02pm

Wait...you haven't done this yet!?!?

You do realize, that's likely your issue. You have a habit of not following all steps, in order.

Also, I noticed my test router had a firewall rule created by pimbd from the last time I assisted you. I altered the zones, the original rule was zone-any/any:

In /etc/config/firewall:

config rule                                     
        option name 'ipv6 multicast forward for ff00::/8'   
        option family 'ipv6'                             
        option proto 'udp'                                  
        option dest_ip 'ff00::/8'                        
        option target 'ACCEPT'                 
        option src 'wan'                                 
        option dest 'lan'

In /etc/config/network:

config route6               
        option interface 'lan'
        option target 'ff00::/8'
        option type 'multicast'

mickey84 · February 9, 2019, 2:06pm

Sorry for confusing you guys. ok now I did this on a freshly rebooted router.nothing else configured besides these changes you just posted plus the sysconfig.
I will now also install kmod and iptables6 and setup the HL. is that correct ?

lleachii · February 9, 2019, 2:13pm

What is HL (no yet)???
On v17 and 18 of OpenWrt, iptables6 should be installed

If you have a "freshly booted router" (I assume reset to default) - just make the changes above. Let us know your results.

mickey84 · February 9, 2019, 2:14pm

I thought I need to set this up too.

lleachii · February 9, 2019, 2:17pm

This is why I thought it be best for @dlakelan to assist you. He suggested you mangle a packet - because the TTL was 1, not me.

If you fixed that (by making the TTL 2 on VLC player), then this becomes unnecessary.

You have a habit of not following why someone told you to do something to your router, as well.

dlakelan · February 9, 2019, 2:22pm

Because supposedly his version of vlc crashes when he sets TTL=2... Sigh..

lleachii · February 9, 2019, 2:23pm

@mickey84 try TTL=3

(You may need to run it as superuser to do that!)

mickey84 · February 9, 2019, 2:24pm

these are my firewall and network settings. Can't view the stream.

Summary

This text will be hidden

root@OpenWrt:~# cat /etc/config/firewall
config defaults
        option syn_flood        1
        option input            ACCEPT
        option output           ACCEPT
        option forward          REJECT
# Uncomment this line to disable ipv6 rules
#       option disable_ipv6     1

config rule
        option name 'ipv6 multicast forward for ff00::/8'
        option family 'ipv6'
        option proto 'udp'
        option dest_ip 'ff00::/8'
        option target 'ACCEPT'
        option src 'wan'
        option dest 'lan'
config zone
        option name             lan
        list   network          'lan'
        option input            ACCEPT
        option output           ACCEPT
        option forward          ACCEPT

config zone
        option name             wan
        list   network          'wan'
        list   network          'wan6'
        option input            REJECT
        option output           ACCEPT
        option forward          REJECT
        option masq             1
        option mtu_fix          1

config forwarding
        option src              lan
        option dest             wan

# We need to accept udp packets on port 68,
# see https://dev.openwrt.org/ticket/4108
config rule
        option name             Allow-DHCP-Renew
        option src              wan
        option proto            udp
        option dest_port        68
        option target           ACCEPT
        option family           ipv4

# Allow IPv4 ping
config rule
        option name             Allow-Ping
        option src              wan
        option proto            icmp
        option icmp_type        echo-request
        option family           ipv4
        option target           ACCEPT

config rule
        option name             Allow-IGMP
        option src              wan
        option proto            igmp
        option family           ipv4
        option target           ACCEPT

# Allow DHCPv6 replies
# see https://dev.openwrt.org/ticket/10381
config rule
        option name             Allow-DHCPv6
        option src              wan
        option proto            udp
        option src_ip           fc00::/6
        option dest_ip          fc00::/6
        option dest_port        546
        option family           ipv6
        option target           ACCEPT

config rule
        option name             Allow-MLD
        option src              wan
        option proto            icmp
        option src_ip           fe80::/10
        list icmp_type          '130/0'
        list icmp_type          '131/0'
        list icmp_type          '132/0'
        list icmp_type          '143/0'
        option family           ipv6
        option target           ACCEPT

# Allow essential incoming IPv6 ICMP traffic
config rule
        option name             Allow-ICMPv6-Input
        option src              wan
        option proto    icmp
        list icmp_type          echo-request
        list icmp_type          echo-reply
        list icmp_type          destination-unreachable
        list icmp_type          packet-too-big
        list icmp_type          time-exceeded
        list icmp_type          bad-header
        list icmp_type          unknown-header-type
        list icmp_type          router-solicitation
        list icmp_type          neighbour-solicitation
        list icmp_type          router-advertisement
        list icmp_type          neighbour-advertisement
        option limit            1000/sec
        option family           ipv6
        option target           ACCEPT

# Allow essential forwarded IPv6 ICMP traffic
config rule
        option name             Allow-ICMPv6-Forward
        option src              wan
        option dest             *
        option proto            icmp
        list icmp_type          echo-request
        list icmp_type          echo-reply
        list icmp_type          destination-unreachable
        list icmp_type          packet-too-big
        list icmp_type          time-exceeded
        list icmp_type          bad-header
        list icmp_type          unknown-header-type
        option limit            1000/sec
        option family           ipv6
        option target           ACCEPT

config rule
        option name             Allow-IPSec-ESP
        option src              wan
        option dest             lan
        option proto            esp
        option target           ACCEPT

config rule
        option name             Allow-ISAKMP
        option src              wan
        option dest             lan
        option dest_port        500
        option proto            udp
        option target           ACCEPT

# include a file with users custom iptables rules
config include
        option path /etc/firewall.user


### EXAMPLE CONFIG SECTIONS
# do not allow a specific ip to access wan
#config rule
#       option src              lan
#       option src_ip   192.168.45.2
#       option dest             wan
#       option proto    tcp
#       option target   REJECT

# block a specific mac on wan
#config rule
#       option dest             wan
#       option src_mac  00:11:22:33:44:66
#       option target   REJECT

# block incoming ICMP traffic on a zone
#config rule
#       option src              lan
#       option proto    ICMP
#       option target   DROP

# port redirect port coming in on wan to lan
#config redirect
#       option src                      wan
#       option src_dport        80
#       option dest                     lan
#       option dest_ip          192.168.16.235
#       option dest_port        80
#       option proto            tcp

# port redirect of remapped ssh port (22001) on wan
#config redirect
#       option src              wan
#       option src_dport        22001
#       option dest             lan
#       option dest_port        22
#       option proto            tcp

### FULL CONFIG SECTIONS
#config rule
#       option src              lan
#       option src_ip   192.168.45.2
#       option src_mac  00:11:22:33:44:55
#       option src_port 80
#       option dest             wan
#       option dest_ip  194.25.2.129
#       option dest_port        120
#       option proto    tcp
#       option target   REJECT

#config redirect
#       option src              lan
#       option src_ip   192.168.45.2
#       option src_mac  00:11:22:33:44:55
#       option src_port         1024
#       option src_dport        80
#       option dest_ip  194.25.2.129
#       option dest_port        120
#       option proto    tcp

lleachii · February 9, 2019, 2:28pm

I don't see any network settings...nor your sysctrl.conf...just firewall.
Nor did you tell us if the TTL was fixed.

mickey84 · February 9, 2019, 2:31pm

Summary

root@OpenWrt:~# cat /etc/config/network

config interface 'loopback'
        option ifname 'lo'
        option proto 'static'
        option ipaddr '127.0.0.1'
        option netmask '255.0.0.0'

config route6
        option interface 'lan'
        option target 'ff00::/8'
        option type 'multicast'
config globals 'globals'
        option ula_prefix 'fdb9:4de9:6222::/48'

config interface 'lan'
        option type 'bridge'
        option ifname 'eth1.1'
        option proto 'static'
        option ipaddr '192.168.1.1'
        option netmask '255.255.255.0'
        option ip6assign '60'

config interface 'wan'
        option ifname 'eth0'
        option proto 'dhcp'

config interface 'wan6'
        option ifname 'eth0'
        option proto 'dhcpv6'

config switch
        option name 'switch0'
        option reset '1'
        option enable_vlan '1'

config switch_vlan
        option device 'switch0'
        option vlan '1'
        option ports '1 2 0t'





root@OpenWrt:~# cat /etc/sysctl.conf
# Defaults are configured in /etc/sysctl.d/* and can be customized in this file
net.ipv4.conf.all.mc_forwarding = 1
net.ipv6.conf.all.mc_forwarding = 1

lleachii · February 9, 2019, 2:35pm

Why is your sysctl.conf COMPLETELY EMPTY AGAIN EXCEPT FOR THE 2 LINES!?!?!

THIS was your exact issue in the previous thread about IPv4 multicast!

Start again with a reset, please ask if you need help editing files.