Inbound IGMP Multicast for BT TV Inconsistantly Terminates

[ipanda]

I am a FTTC BT customer with a custom home setup involving an Opnsense firewall with IGMP proxying enabled. This system has been working for a few months without issues but recently I have noticed that some IGMP streams are not terminating properly. I have left some traffic logging running and have captured the following data over the course of an hour or so.

As the first image indicates, there is a constant stream from the multicast address of 234.81.132.95

This has been occurring more and more as of recently and last night I saw that there were 3 streams all consuming about 3MB/s (24Mbps) each. I believe the line I am currently using is only rated for 75Mbps which caused my line to become saturated and internet access to become slow (speed tests suggested 1-2Mbps compared to the 75Mbps I am promised).

From what I can tell, it looks like the BT Youview box doesn't seem to be terminating the connections properly and this is a probable cause of the saturation - leaving the UDP/IGMP streams running and consuming bandwidth.

From reading BT SIN 511, it appears that the TV streams come in as unencapsulated packets injected from the cabinet. Therefore, my firewall is set up to forward these packets to an IPTV interface (shown in the graph above) and then IGMP proxy them to the BT Youview box. This has been a working setup.

I am wanting to know if there are any known settings or issues that will cause these streams to continue being sent and whether this can be fixed. I spoke to BT earlier and, after running some tests, they couldn't reach a conclusion and wanted to send an engineer out.

Any help would be appreciated.

Thanks,

Ben

[gavinlambourne]

Hi Ben,

I'm not aware of any known issues in this space - at least with our combination of set-top boxes and home hubs.

Are you sure the device proxying the IGMP is processing the IGMP leave requests sent from set-top box correctly when you tune away from an IP channel, an IP channel recording stops or the box goes into standby etc.?

Thanks
Gavin

[ipanda]

Thanks for your reply.

Can you confirm how the leave requests are sent? The join requests seem to be working fine. Here are the IGMP proxy settings I am using:

I have just added a firewall rule to allow any -> (BT TV Multicast Range) to see if this helps (bottom entry):

[ipanda]

I have taken a screenshot of the same log but with more IP addresses being connected to and used:

As you can see, multiple multicast IP addresses are using the bandwidth available to me. Can anyone give me further guidance on this?

[ipanda]

For anyone coming across this in the future, I fixed this by adding my BT Home Hub 4 between the firewall and the modem and placed the firewall in a DMZ and disabled the Home Hub's firewall.

I then connected the BT YouView box into the Home Hub which magically seemed to work. Seems suspicious that the Hub works with seemingly the same settings the firewall was using but there we have it. Bit disappointed that the way BT send the TV packets isn't conventional but at least it's working in some sort of fashion.

[tdeg20]

I'm having similar issues but haven't even managed to get the multicast through to my TV box via Opnsense.

I had an Asus router a while ago which worked brilliantly simply ticking a box in the settings, this is rather more convoluted!!

I'd really rather avoid using the HH if I can, it seems to defeat the object but interesting how you've got it to work - is this a "double NAT" situation? As I read it your set up is ONT --> HH ---> Opnsense from one port and TV box from another port on the HH?

I haven't yet found anyone else who's managed this and is using Opnsense - most of the guides online are on PFsense. The stuff I've read suggests you need a "new" interface for the WAN (I've called it IPTV_WAN) and I've then set up an IPTV_LAN interface on a spare port in the Opnsense box which is directly connected to the BT TV box. I was hoping to manage this with VLAN but no such luck.

The IPTV_LAN interface is working fine, the BT box is online with the expected network settings and IP address, I just can't figure out how to get the IGMP passed through to it. Would you mind sharing how you managed to get this working in the first place?

Thanks in advance

Tom

[ipanda · Accepted solution]

Hey - glad someone else is using Opnsense!

This issue was caused by an issue with the Opnsense version I was running. After moving to 20.7.3, the problem disappeared.

I'll give you my current setup details. Hopefully that'll help you.

Physical:

Line in -> Modem -> Opnsense box > Network

Logical:

I have two interfaces on the WAN port (igb0). One is set up with PPPoE (WAN) and the other with a static IP address of 10.123.123.123/32 (IPTVWAN)

I then have igmpproxy (you have to install this package separately) with the following settings:

LAN - downstream - <iptv_network_range>

IPTVWAN - upstream - 109.159.247.0/24, 224.0.0.0/4

The most complicated part of this is the firewall settings (which I haven't cracked yet but I'm working on it to find out how to lock this down properly). I have an alias of BTIPTV that links to 224.0.0.0/4, 109.159.247.0/24:

IPTVWAN rules:

Protocol	Source	Port	Destination	Port
IPv4 *	BTIPTV	*	*	*
IPv4 *	*	*	BTIPTV	*

On the LAN interface (I dont have any VLANs as of yet) I just have allow LAN net any.

This setup is working great for me so far. Let me know if you have any other questions and I'd be happy to help

Regards,

Ben

[tdeg20]

That's amazing, thank you - am trying it now. It was the alias bit that I didn't understand where that was coming from.

WIll give it a go and see what happens....!

[ipanda]

I'd also like to mention that the static IP of the IPTVWAN interface has absolutely no bearing on anything as it should never be contacted. I used one in the private range just in case.

[ipanda]

The 109.159.247.0/24 range is used by BT to provide their IPTV services. Effectively, an IP in that range sends packets to the 224.0.0.0/8 range. IGMPProxy picks up on this traffic and passes it to the downstream.
Any switches between the Opnsense box and the BT TV box will need to have IGMP Snooping enabled on it. This allows the switch to watch the traffic and pass multicast packets on to the right device.

Edit:

The reason for the separate interface is that BT send their packets separately to the PPPoE packets. Understanding this takes a bit of work but it looks like there's almost two separate packet streams. One for PPPoE and one for IP packets. Since the PPPoE interface on Opnsense only picks up PPPoE packets, you need to create a second interface to handle the IP packets for the TV. These packets then get proxied by igmpproxy to the downstream interface.