Issue with igmpproxy in separated guest network

Hello everyone,
I set up an openwrt device to share an internet connection and IPTV between two apartments. The device is a FritzBox 7362 SL running OpenWrt 19.07.7. The "main" interface (main apartment) is using switch ports LAN 2..4 with untagged VLAN 2. On this interface the openwrt device gets an IP from the main router via dhcp in the 192.168.2.x range. A WiFi AP is bridged to the same interface. LAN port 1 is assigned to untagged VLAN 1. On this "guest" (guest apartment) interface the openwrt device has a static IP 192.168.1.1 and serves DHCP and DNS. There are firewall configs for NAT and for preventing access to the main network from the guest network. I roughly followed this guide. This all works flawlessly and I learned a lot setting it up.

The remaining issue is with IPTV (Deutsche Telekom Magenta), which does not work in the guest network. You can browse channels and start watching but after five seconds of watching the stream switches from unicast to multicast, the picture stutters and comes to a halt. I have installed and configured igmpproxy and I can see the IPTV receiver talking to the openwrt device as well as the openwrt device relaying the igmp into the main network. But the logs and packets are confusing too me. It looks like the receiver tries again and again to join the multicast group?!

The issue is visible in the following logs. In the guest network the IPTV receiver is 192.168.1.191 and the openwrt device is 192.168.1.1. In the main network the openwrt device is 192.168.2.180 and the main router (connected to the internet) is 192.168.2.1.

I would greatly appreciate your help in figuring this out!
Stefan

network config

root@OpenWrt:~# cat /etc/config/network

[...]

config switch
        option name 'switch0'
        option reset '1'
        option enable_vlan '1'

config switch_vlan
        option device 'switch0'
        option vlan '1'
        option vid '1'
        option ports '4 6t'

config switch_vlan
        option device 'switch0'
        option vlan '2'
        option vid '2'
        option ports '0 1 2 6t'

config interface 'if_main'
        option proto 'dhcp'
        option type 'bridge'
        option ipv6 '0'
        option igmp_snooping '1'
        option ifname 'eth0.2'

config interface 'if_guest'
        option ifname 'eth0.1'
        option proto 'static'
        option ipaddr '192.168.1.1'
        option netmask '255.255.255.0'
        option ipv6 '0'

firewall config

root@OpenWrt:~# cat /etc/config/firewall

config defaults
        option input 'ACCEPT'
        option output 'ACCEPT'
        option forward 'REJECT'
        option synflood_protect '1'

config include
        option path '/etc/firewall.user'

config zone
        option network 'if_main'
        option input 'ACCEPT'
        option name 'fw_main'
        option output 'ACCEPT'
        option forward 'ACCEPT'

config zone
        option network 'if_guest'
        option input 'ACCEPT'
        option name 'fw_guest'
        option output 'ACCEPT'
        option forward 'REJECT'

config forwarding
        option dest 'fw_main'
        option src 'fw_guest'

config nat
        option src 'fw_main'
        option name 'guest_internet'
        option target 'MASQUERADE'
        list proto 'all'

config rule
        option src 'fw_guest'
        option name 'guest_no_main'
        option dest 'fw_main'
        option target 'DROP'
        list dest_ip '192.168.2.1/24'
        list proto 'all'

wireless config

config wifi-device 'radio0'
	option type 'mac80211'
	option hwmode '11g'
	option path 'pci0000:00/0000:00:00.0/0000:01:00.0'
	option htmode 'HT40'
	option channel 'auto'

config wifi-iface 'default_radio0'
	option device 'radio0'
	option mode 'ap'
	option network 'if_main'
	option key [...]
	option ssid [...]
	option encryption 'psk2'

igmpproxy config

config igmpproxy
        option quickleave 1
#       option verbose 3
#       option verbose [0-3](none, minimal[default], more, maximum)

config phyint
        option network 'if_main'
        option zone 'fw_main'
        option direction upstream
        list altnet 0.0.0.0/0

config phyint
        option network 'if_guest'
        option zone 'fw_guest'
        option direction downstream

Even if you do not know the solution, any tips on what else to check or other places to ask for help are appreciated, thank you!

Start with a tcpdump on the upstream interface, see if you are getting the multicast packets delivered to the upstream side. If so you may need to adjust the TTL field of these packets so they can be routed down to the guest side