pimd with VLANs on opnSense/pfSense

[jw-rav]

Hello all,

A while ago, I started to reorganize my network (with pfsense as primary router and WAN gateway) into VLANs in order to improve security.

Then I noticed, that some IoT devices stopped working when they need to communicate across VLAN boundaries.

My test environment is:

VLAN1:  192.168.1.0/24
VLAN10: 192.168.10.0/24
VLAN12: 192.168.12.0/24

I can do unicast between those networks in any direction.

To have some test data flowing, I start a video stream server on 192.168.12.101:
cvlc BigBuckBunny_320x180.mp4 --sout "#rtp{dst=239.255.1.2,port=5004,ttl=10,mux=ts,sap,name=Bunny}" --no-sout-all --sout-keep --loop

When I run a client on the same VLAN like this:

vlc rtp://239.255.1.2:5004

I can see mDNS SSDP and the video stream. So I set up PIMD (2.3.2) with this config:

phyint re2 enable     # VLAN1, 192.168.1.1/24
phyint re2.10 enable  # VLAN1, 192.168.1.1/24
phyint re2.12 enable  # VLAN1, 192.168.1.1/24
rp-address 192.168.1.1 224.0.0.0/4

And add firewall rules on all those interfaces to pass everything, including "allow TCP options".

So, I'd assume nothing would be blocked and MC traffic should be routed across those VLANs.

I can see the group in PIMD's status:

Virtual Interface Table ======================================================
Vif  Local Address    Subnet              Thresh  Flags      Neighbors
---  ---------------  ------------------  ------  ---------  -----------------
  0  192.168.1.1      192.168.1                1  DR NO-NBR
  1  192.168.2.1      192.168.2                1  DISABLED
  2  192.168.10.1     192.168.10               1  DR NO-NBR
  3  192.168.12.1     192.168.12               1  DR NO-NBR
  4  79.239.182.225   79.239.182.225/32        1  DISABLED
  5  192.168.1.1      register_vif0            1 

 Vif  SSM Group        Sources             

Multicast Routing Table ======================================================
----------------------------------- (S,G) ------------------------------------
Source           Group            RP Address       Flags
---------------  ---------------  ---------------  ---------------------------
192.168.12.101   239.255.1.2      192.168.12.1     CACHE SG
Joined   oifs: .....j              
Pruned   oifs: ......              
Leaves   oifs: ......              
Asserted oifs: ......              
Outgoing oifs: .....o              
Incoming     : ...I..              

TIMERS:  Entry    JP    RS  Assert VIFS:  0  1  2  3  4  5
           205    60     0       0        0  0  0  0  0  0
----------------------------------- (S,G) ------------------------------------
Source           Group            RP Address       Flags
---------------  ---------------  ---------------  ---------------------------
192.168.12.101   239.255.255.255  192.168.12.1     CACHE SG
Joined   oifs: .....j              
Pruned   oifs: ......              
Leaves   oifs: ......              
Asserted oifs: ......              
Outgoing oifs: .....o              
Incoming     : ...I..              

TIMERS:  Entry    JP    RS  Assert VIFS:  0  1  2  3  4  5
           205    60     0       0        0  0  0  0  0  0
--------------------------------- (*,*,G) ------------------------------------
Number of Groups: 4
Number of Cache MIRRORs: 8
------------------------------------------------------------------------------

And I can see IGMP reports from the client to enter the group:

22:31:55.963481 IP (tos 0xc0, ttl 1, id 0, offset 0, flags [DF], proto IGMP (2), length 40, options (RA))
    192.168.1.196 > 224.0.0.22: igmp v3 report, 1 group record(s) [gaddr 239.255.1.2 to_in { }]

22:31:56.735594 IP (tos 0xc0, ttl 1, id 0, offset 0, flags [DF], proto IGMP (2), length 40, options (RA))
    192.168.1.196 > 224.0.0.22: igmp v3 report, 1 group record(s) [gaddr 239.255.1.2 to_in { }]

22:31:57.327523 IP (tos 0xc0, ttl 1, id 0, offset 0, flags [DF], proto IGMP (2), length 40, options (RA))
    192.168.1.196 > 224.0.0.22: igmp v3 report, 1 group record(s) [gaddr 239.255.1.2 to_ex { }]

22:31:57.827784 IP (tos 0xc0, ttl 1, id 0, offset 0, flags [DF], proto IGMP (2), length 48, options (RA))
    192.168.1.196 > 224.0.0.22: igmp v3 report, 2 group record(s) [gaddr 239.255.1.2 is_ex { }] [gaddr 224.0.0.251 is_ex { }]

22:31:57.955683 IP (tos 0xc0, ttl 1, id 0, offset 0, flags [DF], proto IGMP (2), length 40, options (RA))
    192.168.1.196 > 224.0.0.22: igmp v3 report, 1 group record(s) [gaddr 239.255.1.2 to_ex { }]

22:32:11.647572 IP (tos 0xc0, ttl 1, id 0, offset 0, flags [DF], proto IGMP (2), length 48, options (RA))
    192.168.1.196 > 224.0.0.22: igmp v3 report, 2 group record(s) [gaddr 239.255.1.2 is_ex { }] [gaddr 224.0.0.251 is_ex { }]

But no video packets get through.

IGMP Snooping on the switch (D-Link 1520) is deactivated.

Also tried on opnSense, but still no go.

What am I missing? Any hints how to debug this further?

Thanks!

[troglobit]

Check the TTL.

[jw-rav]

server is sending with ttl=10:

cvlc BigBuckBunny_320x180.mp4 --sout "#rtp{dst=239.255.1.2,port=5004,ttl=10,mux=ts,sap,name=Bunny}" --no-sout-all --sout-keep --loop