1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
|
---
lastproofread: '2023-11-13'
---
(igmp-proxy)=
# IGMP Proxy
{abbr}`IGMP (Internet Group Management Protocol)` proxy sends IGMP host messages
on behalf of a connected client. The configuration must define one, and only one
upstream interface, and one or more downstream interfaces.
## Configuration
```{cfgcmd} set protocols igmp-proxy interface \<interface\> role \<upstream | downstream\>
* **upstream:** The upstream network interface is the outgoing interface
which is responsible for communicating to available multicast data sources.
There can only be one upstream interface.
* **downstream:** Downstream network interfaces are the distribution
interfaces to the destination networks, where multicast clients can join
groups and receive multicast data. One or more downstream interfaces must
be configured.
```
```{cfgcmd} set protocols igmp-proxy interface \<interface\> alt-subnet \<network\>
Defines alternate sources for multicasting and IGMP data. The network address
must be on the following format 'a.b.c.d/n'. By default, the router will
accept data from sources on the same network as configured on an interface.
If the multicast source lies on a remote network, one must define from where
traffic should be accepted.
This is especially useful for the upstream interface, since the source for
multicast traffic is often from a remote location.
<<<<<<< HEAD
This option can be supplied multiple times.
=======
You can configure multiple remote subnets for an **upstream** IGMP proxy
interface.
Upstream interfaces frequently require this configuration because multicast
sources typically reside on external subnets. ISPs frequently send IPTV
streams from remote private subnets. The set of source subnets can change
without notice.
```
Example:
```none
set protocols igmp-proxy interface eth0 alt-subnet 10.0.0.0/8
```
```{cfgcmd} set protocols igmp-proxy interface \<interface\> whitelist \<network\>
**Configure a permitted destination network for multicast traffic requests
on the specified IGMP proxy interface.**
By default, the IGMP proxy accepts requests for all multicast destination
networks. When you define a whitelist, the IGMP proxy forwards requests only
for the specified multicast networks.
You can configure multiple whitelist entries per **downstream** IGMP proxy
interface.
```
Example:
```none
set protocols igmp-proxy interface eth1 whitelist 239.0.0.0/8
```
```{cfgcmd} set protocols igmp-proxy interface \<interface\> threshold \<1-255\>
**Configure the Time-to-Live (TTL) threshold for the specified IGMP proxy
interface.**
The IGMP proxy drops any multicast packet with a TTL value lower than the
configured threshold.
```
Example:
```none
set protocols igmp-proxy interface eth0 threshold 5
>>>>>>> dad76493 (docs: igmp-proxy: document firewall requirements and operational commands (#2174))
```
```{cfgcmd} set protocols igmp-proxy disable-quickleave
Disables quickleave mode. In this mode the daemon will not send a Leave IGMP
message upstream as soon as it receives a Leave message for any downstream
interface. The daemon will not ask for Membership reports on the downstream
interfaces, and if a report is received the group is not joined again the
upstream.
If it's vital that the daemon should act exactly like a real multicast client
on the upstream interface, this function should be enabled.
Enabling this function increases the risk of bandwidth saturation.
```
```{cfgcmd} set protocols igmp-proxy disable
Disable this service.
```
(igmp-proxy-example)=
### Example
Interface eth1 LAN is behind NAT. In order to subscribe 10.0.0.0/23 subnet
multicast which is in eth0 WAN we need to configure igmp-proxy.
```none
set protocols igmp-proxy interface eth0 role upstream
set protocols igmp-proxy interface eth0 alt-subnet 10.0.0.0/23
set protocols igmp-proxy interface eth1 role downstream
```
## Operation
```{opcmd} restart igmp-proxy
Restart the IGMP proxy process.
<<<<<<< HEAD
```
=======
```
```{opcmd} show ip multicast interface
Display per-interface multicast packet and byte counters.
~~~none
vyos@vyos:~$ show ip multicast interface
Interface PktsIn PktsOut BytesIn BytesOut Local
----------- -------- --------- --------- ---------- --------------
eth0 11528936 0 14.54 GB 0 B 10.222.175.251
eth1 0 11528936 0 B 14.54 GB 192.168.0.1
~~~
On a healthy proxy, the upstream and downstream counters increase
together. If the proxy replicates traffic to multiple downstream
interfaces, the output counters can exceed the input counters. If the
upstream counters increase but the downstream counters do not, the
router receives the streams but does not forward them. A missing
``forward`` firewall rule or the absence of downstream membership
causes this condition.
```
```{opcmd} show log igmp-proxy
Display the log messages of the IGMP proxy process. Common messages:
- ``No interfaces found for source 0.0.0.0``: This message is harmless.
General membership queries use an unspecified source address.
- ``Too many origins for route 239.192.0.2; replacing 10.237.1.165
with 10.237.1.168``: This message is harmless. The multicast source
uses more origin servers than the IGMP proxy tracks for one route.
The IGMP proxy replaces the oldest entry and does not interrupt the
stream.
```
## Firewall considerations
The IGMP proxy joins the requested multicast groups. The router
therefore receives the IGMP signaling and the multicast streams
locally. Multicast traffic traverses the ``input`` hook, not only the
``forward`` hook. A firewall with a default-drop ``input`` chain must
accept this traffic:
- IGMP (protocol ``igmp``) on the upstream interface and on each
downstream interface, in the ``input`` hook. Downstream clients
address membership reports to multicast groups, not to the router.
The proxy must receive these reports to learn which streams to join.
- Traffic to multicast destinations (``224.0.0.0/4``) that arrives on
the upstream interface, in the ``input`` hook.
- Traffic to multicast destinations (``224.0.0.0/4``) from the
upstream interface to the downstream networks, in the ``forward``
hook.
## Example
In this example, the local LAN on interface eth1 operates behind NAT. To allow
local clients to receive multicast traffic originating from the 198.51.100.0/24
source network on the WAN interface (eth0), configure the IGMP proxy as
follows:
```none
set protocols igmp-proxy interface eth0 role upstream
set protocols igmp-proxy interface eth0 alt-subnet 198.51.100.0/24
set protocols igmp-proxy interface eth1 role downstream
```
>>>>>>> dad76493 (docs: igmp-proxy: document firewall requirements and operational commands (#2174))
|
