Configuring pfSense for IPTV delivered via separate VLAN on WAN link

Question

I am trying to set up pfSense as my primary Internet router, replacing the provider router.

Basic Internet connectivity works as it should: configure the external interface as a DHCP client, configure a DHCP server for the internal clients, configure NAT – all fine.

However, I would also like to use IPTV over the device. My ISP delivers IPTV using a separate VLAN on the WAN line. (Internet traffic uses the native VLAN, so no messing with VLANs required here.)

The ISP router is configured as follows:

• A bridge whose members are the internal ports for connecting the IPTV receiver and termination of the IPTV VLAN on the WAN interface
• The bridge has an IP address bound to it. It is a static RFC1918 address, with apparently no default gateway configured on that interface.
• Furthermore, the device runs an IGMP proxy which has the bridge as its upstream interfaces and the LAN interfaces (even those not intended for IPTV) as downstream interfaces. Fast Leave is enabled, IGMP version 2 is forced on upstream and downstream, and multicast groups are skipped for one particular IP address. Though I do find it strange that upstream is configured to be the whole bridge, not just the VLAN interface – might have to do with the router supporting other uplink conections as well (I am on optical fiber with the ONT connected via Ethernet, apparently the device also supports ATM over Ethernet as well as ADSL).

What I have done in pfSense:

• In Interfaces > VLANs, added a new interface (WANIPTV) with the WAN interface as its parent and the appropriate VLAN ID.
• In Interfaces > Bridges, created a bridge with the WANIPTV interface and an otherwise unused physical interface as its members. The bridge is called BRIDGE0.
• In Interfaces > Assignments, assigned BRIDGE0 as an interface of its own (IPTVBRIDGE) and enabled it, with no IP configuration the same IP config as on the provider-supplied router (RFC1918 address, no gateway).
• In System > Advanced > Tunables, set net.link.bridge.pfil_member to 0 and net.link.bridge.pfil_bridge to 1. For net.link.bridge.pfil_onlyip I left the default of 0 in order to allow non-IP traffic through.
• In Firewall > Rules, I added a pass rule for the IPTVBRIDGE interface, matching IPv4+IPv6, with everything else set to ANY.
• In Services > IGMP Proxy, I have enabled IGMP, added IPTVBRIDGE as the upstream interface and the physical port for the receiver as downstream. I have no idea what I need to enter for Networks on the interfaces; I have just added 0.0.0.0/1 and 128.0.0.0/1 for both.
• I then added any-any filter rules for the interfaces involved (WANIPTV, IPTVBRIDGE and the physical interface for the receiver).

With these setting, I have been able to get a picture for a short period by running the receiver on the ISP router, then plugging the WAN cable and the IPTV receiver into my pfSense. After some time, though, the image froze, and when I rebooted the receiver, it reported that no network connection was available.

How can I find out what networks I have to configure for the IGMP proxy? Or is the issue somewhere else?

Answer 1

After some fiddling and research, I believe I have finally figured it out:

IGMP proxy

For my ISP, where consumer devices appear to be on a switched network, the IGMP proxy does not seem to be necessary at all.

YMMV and you might still need this if you have a routed connection from your IPTV receiver to the upstream servers. In that case, this is how it should work:

Set upstream network to any valid IP address with a mask as long as possible (you want to create one syntactically valid entry that doesn’t actually match any IP address actually used by your service). Then go to Status > System Logs > System > General and filter for igmpproxy. You should see a bunch of messages like:

The source address 10.20.30.40 for group 239.240.241.242, is not in any valid net for upstream VIF. 

Source addresses are the ones you need to allow on the upstream interface. If you’re paranoid, you can add the addresses one by one, or you can just add entire IP ranges.

Find out the IP address of your receiver (you might need to connect it to a working router) and enable that on downstream.

Local IP address

With the IGMP proxy disabled, the local IP address on the IPTVBRIDGE interface is also no longer necessary. After disabling the IGMP proxy, I also removed the IP address.

Filter rules

In the filter rules for the IPTVBRIDGE interface, be sure to expand the advanced options and check “Allow IP options”. Without this box checked, packets with IP options (needed for multicast services, such as IPTV) will be dropped by default.

If, as in my case, you are not running an IGMP proxy and pfSense is configured to apply filter rules at the bridge rather than its member interfaces, you do not need any rules on the external/internal IPTV interfaces.

Conclusion

With this, my IPTV receiver finally picks up the stream, even after a reboot.

After I got everything to work, I removed everything that turned out to be unnecessary (IGMP proxy, local IP config on the IPTVBRIDGE interface and filter rules on the member interfaces of the IPTV bridge). To be sure, I rebooted the IPTV box and left it for ~15 minutes. I can still watch TV, and did not observe any dropped packets on any of the IPTV-related interfaces.