I am using Lede with igmpproxy to view routed IPTV on my television. It is already working, but especially for higher bitrate channels I am getting the occasional stutter even though the connection is otherwise idle. I enabled firewall logging for the zone that is used in my iptv connection and I am seeing packets being rejected which shouldn't be rejected.
iptv interface (iptv comes in as vlan4 tagged from the ISP):
config interface 'iptv'
option proto 'dhcp'
option ifname 'eth0.4'
option classlessroute '1'
option vendorid 'IPTV_RG'
option defaultroute '0'
option peerdns '0'
option gateway '0'
Igmpproxy configuration:
config igmpproxy
option quickleave 1
config phyint
option network iptv
option direction upstream
list altnet 0.0.0.0/0
config phyint
option network lan
option direction downstream
Relevant firewall configuration snippets:
config zone
option name 'iptv'
option forward 'REJECT'
option network 'iptv'
option input 'REJECT'
option log '1'
option output 'ACCEPT'
config rule
option target 'ACCEPT'
option src 'iptv'
option name 'iptv-IGMP'
option family 'ipv4'
option proto 'igmp'
config rule
option target 'ACCEPT'
option dest 'lan'
option family 'ipv4'
option proto 'udp'
option dest_ip '224.0.0.0/4'
option name 'iptv'
option src 'iptv'
My first question: Should masquerading be enabled on the iptv firewall zone? Since traffic only flows from/to the router (to/from igmpproxy) I would assume masquerading isn't needed.
My second question: Should mss clamping be enabled on this zone? Since MTU is properly set to 1500 I would assume no, although I guess it doesn't really hurt to enable it regardless.
My third question pertains some rejected packages I am seeing in that firewall zone:
Fri Mar 23 13:05:43 2018 kern.warn kernel: [ 1748.905498] REJECT(src iptv)IN=eth0.4 OUT= MAC=XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX SRC=213.75.167.58 DST=224.3.2.6 LEN=377 TOS=0x04 PREC=0x00 TTL=14 ID=0 DF PROTO=UDP SPT=56863 DPT=9875 LEN=357
Seeing that the destination is 224.3.2.6 and it is an UDP packet, that last firewall rule should trigger and accept this packet, right? Mind you, the firewall rule is actually doing something. If I disable it, iptv stops working completely. I'm just stumped I am still seeing these rejects. By the way, the rejects only seem to show up when changing channels. Unfortunately, they don't seem to be correlated with the stutters I am seeing. Leaving a single channel on will not show any rejects for longer periods of time (I tested for 20 minutes straight), while I am getting the stutters.
My fourth question: Does anyone happen to know what's causing the occasional stutter, even with an otherwise idle internet connection? Some channels are SD quality, some are HD quality and lastly some are fibre quality, in increasing order of bitrate. SD quality channels are completely smooth, HD quality channels stutter very rarely, while fibre channels stutter occasionally (around once a minute I'd say).
My fifth and final question: Does it even make sense to use a separate firewall zone for my iptv interface? Would putting the iptv interface in the WAN zone make more sense / be more efficient / be best practice?
