IGMP snooping in pfSense can be used to improve multicast performance on a network. Read the article to learn more about the process. Bobcares, as a part of our pfSense Support Services offers solutions to every query that comes our way.

Overview

1. IGMP Snooping in pfSense
2. Understanding IGMP Snooping and Querier Role
3. Configuration Overview
4. Case Study
5. Conclusion

IGMP Snooping in pfSense

What is IGMP Snooping?

IGMP (Internet Group Management Protocol) snooping is crucial for managing multicast traffic within a network. It ensures that multicast data, like IPTV streams, only reaches to devices that need it. This prevents unnecessary traffic from flooding the entire network. However, correctly configuring IGMP snooping, especially in a complex setup involving pfSense, Proxmox, and managed switches, can be challenging. Here’s a guide based on a real-world scenario.

Role of pfSense in IGMP Snooping

pfSense can route multicast traffic using the IGMP Proxy service, which is essential for scenarios where multicast streams need to cross network boundaries (e.g., from a WAN to a LAN). However, the actual IGMP snooping functionality to limit multicast traffic within a VLAN is typically handled by a managed switch. Using IGMP Proxy in pfSense includes:

1. IGMP Proxy Service: pfSense includes an IGMP Proxy service that can forward multicast traffic between interfaces. This is commonly present in setups where IPTV or other multicast services need to be routed from one network segment to another.

2. Configuration: To use the IGMP Proxy in pfSense, we need to configure the upstream and downstream interfaces. The upstream interface then connects to the multicast source (like an ISP), and the downstream interfaces are the networks that should receive the multicast traffic.

3. Limitations: While pfSense can forward multicast traffic, it doesn’t manage multicast at Layer 2. This means that pfSense won’t control which devices on the LAN receive multicast traffic—that’s where IGMP snooping on a switch comes into play.

An Example

• Setup: Imagine we have an IPTV service provided by the ISP that uses multicast. The pfSense router is configured to forward this multicast traffic from the ISP to the internal network.
• Problem Without IGMP Snooping: Without IGMP snooping, all devices on the LAN might receive the multicast stream, even those that don’t need it, causing network congestion.
• Solution with IGMP Snooping: By enabling IGMP snooping on the switches, only the devices that are actively using the IPTV service will receive the multicast stream. This reduces unnecessary network traffic.

Understanding IGMP Snooping and Querier Role

IGMP snooping operates by “listening” to IGMP conversations between devices and the multicast router. It learns which devices (clients) are interested in specific multicast groups and ensures that multicast traffic is only forwarded to those devices.

Querier Role: Typically, a router sends IGMP general queries to identify all multicast group members in a VLAN. However, if there’s no router in the network, switches can be configured to perform this role. The switch will send these queries, and all devices must reply, ensuring that the switch knows which ports should receive multicast traffic.

Configuration Overview

In this setup, two switches are setup to handle IGMP snooping:

1. IGMP Snooping and Querier Enabled: Both switches have IGMP snooping and IGMP querier enabled to manage multicast traffic efficiently within VLANs.

2. VLAN Configuration: The switches have IGMP snooping enabled in specific VLANs, with the IGMP querier configured to use IGMPv2.

3. Switch Settings: The switches can auto-learn multicast router ports, disable immediate leave, and use specific IGMP settings to ensure robustness in querying.

Case Study

The Issue: IPTV Stream Stopping with IGMP Snooping Enabled

A user running a pfSense firewall within a Proxmox environment encountered an issue where IPTV streams stopped working after enabling IGMP snooping on the network switch. The setup worked fine before enabling IGMP snooping, but with it enabled, the pfSense logs only showed IGMP leave packets from the client, with no member reports from the switch or the client.

Root Cause and Solution

After thorough checking, we find that the problem is from Proxmox itself. By default, Proxmox blocks multicast traffic to virtual machines, which is necessary for IGMP snooping to function correctly.

Solution:

To resolve this issue, the user needed to disable multicast snooping on the Proxmox bridge interface. We can do this using the following command:

bash

echo 0 > /sys/class/net/vmbrX/bridge/multicast_snooping

Replace vmbrX with the appropriate bridge interface on the Proxmox host.

[Want to learn more? Click here to reach us.]

Conclusion

IGMP snooping can greatly improve network efficiency by controlling multicast traffic, but it requires proper configuration across all network devices, including virtual environments like Proxmox. When using pfSense as a firewall/router in such setups, we must ensure that Proxmox is setup to allow multicast traffic to reach the virtual machines. By following the correct steps and commands, as shown above, multicast-dependent services like IPTV can function seamlessly in a network with IGMP snooping enabled.