I know they are some topics about multicast and DLNA but it's don't work for me.
My smcroute.conf :
mgroup from DMZ group 239.255.255.250
mgroup from HOME group 239.255.255.250
mroute from DMZ group 239.255.255.250 to HOME
mroute from HOME group 239.255.255.250 to DMZ
My firewall.user :
iptables -t mangle -A PREROUTING -i HOME -d 224.0.0.0/4 -j TTL --ttl-inc 1
iptables -t mangle -A PREROUTING -i DMZ -d 224.0.0.0/4 -j TTL --ttl-inc 1
iptables -t mangle -A PREROUTING -i HOME -d 239.255.255.250 -j TTL --ttl-inc 1
iptables -t mangle -A PREROUTING -i DMZ -d 239.255.255.250 -j TTL --ttl-inc 1
My smcroutectl show routes :
(*,G) Template Rules
ROUTE (S,G) IIF OIFS
(*, 239.255.255.250) DMZ HOME
(*, 239.255.255.250) HOME DMZ
Kernel MFC Table
ROUTE (S,G) IIF OIFS
(10.0.0.3, 239.255.255.250) DMZ HOME
(10.0.1.1, 239.255.255.250) HOME DMZ
(10.0.1.251, 239.255.255.250) HOME DMZ
(10.0.1.252, 239.255.255.250) HOME DMZ
(10.0.0.2, 239.255.255.250) DMZ HOME
(10.0.1.11, 239.255.255.250) HOME DMZ
Thanks for you reply, my version : OpenWrt 22.03.1 r19777-2853b6d652 /
I have set my firewall to accept all to my DMZ and my HOME interface for tests.
I have found a problem :
root@OpenWrt:~# smcrouted -n
smcroute[12386]: SMCRoute v2.5.5
smcroute[12386]: IPv4 multicast routing API already in use: Address in use
smcroute[12386]: /etc/smcroute.conf line 69: mroute: inbound DMZ is not a known phyint
smcroute[12386]: /etc/smcroute.conf line 70: mroute: inbound HOME is not a known phyint
smcroute[12386]: Parse error in /etc/smcroute.conf
smcroute[12386]: Ready, waiting for client request or kernel event.
phyint HOME enable
phyint DMZ enable
mgroup from DMZ group 239.255.255.250
mgroup from HOME group 239.255.255.250
mroute from DMZ group 239.255.255.250 to HOME
mroute from HOME group 239.255.255.250 to DMZ
root@OpenWrt:~# smcrouted -n
smcroute[16793]: SMCRoute v2.5.5
smcroute[16793]: Ready, waiting for client request or kernel event.
And when I start it :
root@OpenWrt:~# smcrouted -n
smcroute[16893]: SMCRoute v2.5.5
smcroute[16893]: IPv4 multicast routing API already in use: Address in use
smcroute[16893]: /etc/smcroute.conf line 69: mroute: inbound DMZ is not a known phyint
smcroute[16893]: /etc/smcroute.conf line 70: mroute: inbound HOME is not a known phyint
smcroute[16893]: Parse error in /etc/smcroute.conf
smcroute[16893]: Ready, waiting for client request or kernel event.
It's strange that error is pointing to line 69 when you only approx 6 lines in your smcroute.conf.
Worth double checking you haven't got some previous text in the file or maybe even make a copy of that file and create a new smcroute.conf file and try it again
Mmmmm.....having said that I've just run smcrouted -n on my system and I also get similar error about interfaces not known as physical interfaces. However, the error does reference valid lines in my config file, plus my multicast routing is working ok.
# smcroute.conf example
#
# The configuration file supports joining multicast groups, to use
# Layer-2 signaling so that switches and routers open up multicast
# traffic to your interfaces. Leave is not supported, remove the
# mgroup and SIGHUP your daemon, or send a specific leave command.
#
# NOTE: Use of the mgroup command should be avoided if possible.
# Instead configure "router ports" or similar on the switches
# or bridges on your LAN. This to have them direct all the
# multicast to your router, or select groups if they have
# such capabilities. Usually MAC multicast filters exist.
#
# Some switch manufacturers support mrdisc, RFC4286, which
# SMCRoute can use to advertise itself on source interfaces.
# If availble, use that instead of mgroup.
#
# Similarly supported is setting mroutes. Removing mroutes is not
# supported, remove/comment out the mroute from the .conf file, or
# send a remove command with smcroutectl.
#
# Syntax:
# phyint IFNAME <enable|disable> [mrdisc] [ttl-threshold <1-255>]
# mgroup from IIF [source ADDR[/LEN]] group GROUP[/LEN]
# mroute from IIF [source ADDR[/LEN]] group GROUP[/LEN] to OIF [OIF ...]
# include /path/to/*.conf
# This example assumes smcrouted was started with the `-N` flag.
# Only enable interfaces required for inbound and outbound traffic.
#phyint eth0 enable ttl-threshold 11
#phyint eth1 enable ttl-threshold 3
#phyint eth2 enable ttl-threshold 5
#phyint virbr0 enable ttl-threshold 5
# Instruct the kernel to join the multicast group 225.1.2.3 on interface
# eth0. Then add an mroute of the same multicast stream, from the host
# 192.168.1.42 on interface eth0 and forward to eth1 and eth2.
#mgroup from eth0 group 225.1.2.3
#mroute from eth0 source 192.168.1.42 group 225.1.2.3 to eth1 eth2
# Similar example, but using source-specific group join
#mgroup from virbr0 source 192.168.123.110 group 225.1.2.4
#mroute from virbr0 source 192.168.123.110 group 225.1.2.4 to eth0
# Allow multicast for group 225.3.2.1, from ANY source, ingressing on
# interface eth0 to be forwarded to eth1 and eth2. When the kernel
# receives a frame from unknown multicast sender, it asks smcrouted who
# use this "template" to match against, if the ingressing interface and
# group matches, smcrouted installs an (S,G) route in the kernel MFC.
#mgroup from eth0 group 225.3.2.1
#mroute from eth0 group 225.3.2.1 to eth1 eth2
# The previous is an example of the (*,G) support. It is also possible
# to specify a range of such rules.
#mgroup from eth0 group 225.0.0.0/24
#mroute from eth0 group 225.0.0.0/24 to eth1 eth2
# Include any snippet in /etc/smcroute.d/, but please remember that
# all phyint statements must be read first.
include /etc/smcroute.d/*.conf
phyint HOME enable
phyint DMZ enable
mgroup from DMZ group 239.255.255.250
mgroup from HOME group 239.255.255.250
mroute from DMZ group 239.255.255.250 to HOME
mroute from HOME group 239.255.255.250 to DMZ
Can you show me your iptables and firewall settings ?
phyint br-home.10 enable ttl-threshold 1
phyint br-home.20 enable ttl-threshold 1
# phyint br-home.30 enable ttl-threshold 1
mgroup from br-home.20 group 239.255.255.250
mgroup from br-home.20 group 239.255.255.249
mgroup from br-home.20 group 239.255.90.90
mgroup from br-home.10 group 239.255.255.250
mgroup from br-home.10 group 239.255.255.249
mgroup from br-home.10 group 239.255.90.90
# mgroup from br-home.30 group 239.255.255.250
# mgroup from br-home.30 group 239.255.255.249
# mgroup from br-home.30 group 239.255.90.90
mroute from br-home.20 source 192.168.2.40 group 239.255.255.250 to br-home.10
mroute from br-home.20 source 192.168.2.40 group 239.255.255.249 to br-home.10
mroute from br-home.20 source 192.168.2.40 group 239.255.90.90 to br-home.10
# mroute from br-home.20 source 192.168.2.40 group 239.255.255.250 to br-home.30
# mroute from br-home.20 source 192.168.2.40 group 239.255.255.249 to br-home.30
# mroute from br-home.20 source 192.168.2.40 group 239.255.90.90 to br-home.30
# Asset Configuration
mroute from br-home.20 source 192.168.2.62 group 239.255.255.250 to br-home.10
# Bubble Configuration
# mroute from br-home.20 source 192.168.2.28 group 239.255.255.250 to br-home.10
# this rule is an attempt to get bubble working...re Linn Kazoo saying waiting for NDS
# mroute from br-home.20 source 192.168.2.25 group 239.255.255.250 to br-home.10
mroute from br-home.10 source 192.168.1.0/24 group 239.255.255.250 to br-home.20
mroute from br-home.10 source 192.168.1.0/24 group 239.255.255.249 to br-home.20
mroute from br-home.10 source 192.168.1.0/24 group 239.255.90.90 to br-home.20
# mroute from br-home.10 source 192.168.1.0/24 group 239.255.255.250 to br-home.30
# mroute from br-home.10 source 192.168.1.0/24 group 239.255.255.249 to br-home.30
# mroute from br-home.10 source 192.168.1.0/24 group 239.255.90.90 to br-home.30
include /etc/smcroute.d/*.conf
You realize that the version of OpenWrt you are using doesn't use iptables any more? You can can still use the firewall.user file but you have to specify the following in /etc/config/firewall
config include
option path '/etc/firewall.user'
option fw4_compatible '1'
I have actually used nft rules rather than iptables for my multicast set up but yours should work if you have compatability set in /etc/config/firewall
Here's an extract from my firewall file that addresses the multicast traffic rules``
config rule
option name 'Allow Multicast#1'
list proto 'udp'
option src 'HIFI'
list src_ip '192.168.2.40'
list dest_ip '239.255.255.250'
list dest_ip '239.255.255.249'
list dest_ip '239.255.90.90'
option dest_port '1900'
option target 'ACCEPT'
option family 'ipv4'
option dest 'HOME'
config rule
option name 'Allow Multicast#2'
option family 'ipv4'
list proto 'udp'
option src 'HIFI'
list src_ip '192.168.2.40'
list dest_ip '239.255.255.250'
list dest_ip '239.255.255.249'
list dest_ip '239.255.90.90'
option dest_port '9003'
option target 'ACCEPT'
option dest 'HOME'
Just for clarification my HOME network (192.168.1.0/24) can send anything it wants into the HIFI network but the HIFI network (192.168.2.0/24) needs specific rules to communicate back into HOME
If after addressing all the above it still doesn't work then try changing the iptables ttl rule from "--ttl-inc 1" to "--ttl-set 34" as I seem to recall maybe I had an issue with inc command?
phyint HOME enable ttl-threshold 1
phyint DMZ enable ttl-threshold 1
mgroup from DMZ group 239.255.255.250
mgroup from HOME group 239.255.255.250
mroute from DMZ group 239.255.255.250 to HOME
mroute from HOME group 239.255.255.250 to DMZ
I have add config on my firewall to use iptables but if they is not use I don't want to keep it.
My firewall :
config rule
option src 'DMZ'
option dest 'HOME'
option target 'ACCEPT'
config rule
option name 'TEST'
option src 'HOME'
option dest 'DMZ'
option target 'ACCEPT'
For test and it's don't work anyway.
What is the best way to use firewall without iptables ? Can you help me to convert my iptables to nft ?
# nft add rules to inet family of fw4 table of prerouting chain to manipulate ttl value
nft add rule inet fw4 prerouting iifname "br-home.10" ip daddr 239.255.255.250 ip ttl set 34
nft add rule inet fw4 prerouting iifname "br-home.20" ip daddr 239.255.255.250 ip ttl set 34
nft add rule inet fw4 prerouting iifname "br-home.10" ip daddr 239.255.255.249 ip ttl set 34
nft add rule inet fw4 prerouting iifname "br-home.10" ip daddr 239.255.255.249 ip ttl set 34
nft add rule inet fw4 prerouting iifname "br-home.10" ip daddr 239.255.90.90 ip ttl set 34
nft add rule inet fw4 prerouting iifname "br-home.10" ip daddr 239.255.90.90 ip ttl set 34
I'm pretty sure you won't get mDNS working through smcroute. Try changing your firewall specific rule to be SSDP specific
# nft add rules to inet family of fw4 table of prerouting chain to manipulate ttl value
nft add rule inet fw4 prerouting iifname "HOME" ip daddr 239.255.255.250 ip ttl set 34
nft add rule inet fw4 prerouting iifname "DMZ" ip daddr 239.255.255.250 ip ttl set 34
The end to my firewall settings :
config rule
option src 'DMZ'
option dest 'HOME'
option target 'ACCEPT'
config rule
option name 'TEST'
option src 'HOME'
option dest 'DMZ'
option target 'ACCEPT'
config rule
option name 'Allow-mDNS'
list proto 'udp'
option src 'HOME'
option src_port '5353'
option dest 'DMZ'
list dest_ip '224.0.0.251'
option dest_port '5353'
option target 'ACCEPT'
config include
option path '/etc/firewall.user'
option fw4_compatible '1'
And smcroute.conf :
phyint HOME enable ttl-threshold 1
phyint DMZ enable ttl-threshold 1
mgroup from DMZ group 239.255.255.250
mgroup from HOME group 239.255.255.250
mroute from DMZ group 239.255.255.250 to HOME
mroute from HOME group 239.255.255.250 to DMZ
My HOME and DMZ are a bridged interface with IGMP_snooping true.
Ok so DLNA uses SSDP (Simple Service Discovery Protocol) to discover end points for streaming and advertising services. It uses the multicast address 239.255.255.250 to announce services. This is always done over UDP/1900
So I would play with your firewall traffic rules to see if you can get it to work by specifying some specific hosts. I wouldn't assume that just because you have a forwarding rule between 2 zones that the multicasts will automatically get through. They might but I've never tried it I always specify exact addresses to be allowed through firewall
Might be worth running tcpdump on the different interfaces to see what's going on both sides of the firewall
phyint HOME enable ttl-threshold 1
phyint DMZ enable ttl-threshold 1
mgroup from DMZ group 239.255.255.250
mgroup from HOME group 239.255.255.250
mroute from DMZ source 10.0.0.2 group 239.255.255.250 to HOME
mroute from HOME group source 10.0.1.0/24 239.255.255.250 to DMZ
10.0.0.2 is my DLNA server and 10.0.1.0 my lan with client.
Don't work too...
I would let all multicast, can I change 239.255.255.250 by 224.0.0.0/4 ?
Assuming you allow all traffic to flow from your HOME network into the DMZ then you will need the following rule in your firewall config...
config rule
option family 'ipv4'
list proto 'udp'
option src 'DMZ'
list src_ip '10.0.0.2'
option dest 'HOME'
list dest_ip '239.255.255.250'
option dest_port '1900'
option target 'ACCEPT'
option name 'Multicast Test'
