Community discussions

MikroTik App
 
mecseid
just joined
Topic Author
Posts: 2
Joined: Thu Nov 10, 2022 8:32 pm

IGMP Proxy not working after cannot leave multicast group

Thu Nov 10, 2022 8:52 pm

Hello,

I have a RB3011UiAS with RouterOS v7.6, and I have an IGMP Proxy configuration with ether1 as upstream, and bridge as downstream.
After some time, I get the following error, and my IPTV not working anymore until I don't disable the downstream settings and reenable it:
	Leave multicast group failed on ether1 - telekom group=239.255.255.250:
My configuration:
[admin@MikroTik] > /routing/igmp-proxy/export  
# nov/10/2022 19:47:09 by RouterOS 7.6
# software id = 37BV-L28B
#
# model = RB3011UiAS
# serial number = 783D07722B8F
/routing igmp-proxy
set quick-leave=yes
/routing igmp-proxy interface
add alternative-subnets=0.0.0.0/0 interface="ether1 - telekom" upstream=yes
add interface=bridge
The interesting part for me that after the error the downstream interface (bridge) querier value will be set to false.

My bridge settings:
[admin@MikroTik] > /interface/bridge/print  
Flags: X - disabled, R - running 
 0 R ;;; defconf
     name="bridge" mtu=auto actual-mtu=1500 l2mtu=1598 arp=enabled arp-timeout=auto mac-address=64:D1:54:F4:E3:38 protocol-mode=rstp fast-forward=yes igmp-snooping=yes multicast-router=temporary-query multicast-querier=yes startup-query-count=2 last-member-query-count=2 last-member-interval=1s 
     membership-interval=4m20s querier-interval=4m15s query-interval=2m5s query-response-interval=10s startup-query-interval=31s250ms igmp-version=3 mld-version=2 auto-mac=no admin-mac=64:D1:54:F4:E3:38 ageing-time=5m priority=0x8000 max-message-age=20s forward-delay=15s transmit-hold-count=6 
     vlan-filtering=no dhcp-snooping=no 
 
Quasar
newbie
Posts: 32
Joined: Sun Oct 05, 2014 1:11 pm

Re: IGMP Proxy not working after cannot leave multicast group

Mon Nov 21, 2022 11:10 pm

I'm experiencing IGMP proxy issues as well (v7.6/v7.7beta6) on hAP ax². It proxies the downstream request just fine and starts forwarding multicast traffic, but whenever the upstream router sends a Membership Query it goes unanswered. This means the multicast stream will drop out after ~4 min because upstream assumes nobody cares anymore.

Config is simple and ported from a working (!) setup on hAP ac:
/routing igmp-proxy interface
add interface=br-lan
add alternative-subnets=217.166.0.0/16,213.75.160.0/19 interface=vlan-iptv upstream=yes
I have a firewall rule which matches incoming membership queries:
/ip firewall filter add action=accept chain=input dst-address=224.0.0.0/8 in-interface=vlan-iptv log=yes log-prefix=IGMP protocol=igmp
Which is hit according to the logs:
21:54:16 firewall,info IGMP input: in:vlan-iptv out:(unknown 0), connection-state:new src-mac 18:4a:6f:99:1c:f2, proto 2, 10.xx.yy.1->224.0.0.1, prio 7->0, len 36
Yet there's no response from the IGMP Proxy at all - whereas I believe it should at least print a debug log message upon receiving such messages (I enabled logs for IGMP Proxy and other verbose logging shows up fine).

The incoming query doesn't make it to the IGMP Proxy somehow? Looks like it might be similar to the problem TS is having?

@mecseid: try using the packet sniffer to see if it's the same in your case - or add a log rule like mine and enable verbose igmp-proxy logging.

EDIT: also submitted as ticket SUP-98496, but I haven't got a reply yet
 
mecseid
just joined
Topic Author
Posts: 2
Joined: Thu Nov 10, 2022 8:32 pm

Re: IGMP Proxy not working after cannot leave multicast group

Tue Nov 29, 2022 10:52 am

Hey @Quasar,
Sorry for the late response, I didn't get any notification about your post (looks like I'm a newbie to using this forum engine properly :D ).

I will add the log rule and enable the debug messages for igmp-proxy, and will check what happens.
Meanwhile, do you have any news about SUP-98496, or do you know v7.5 contains this issue as well?
(As I saw viewtopic.php?t=190351#p968970, the IGMP Proxy not working with v7.7beta8 :( ).
 
Quasar
newbie
Posts: 32
Joined: Sun Oct 05, 2014 1:11 pm

Re: IGMP Proxy not working after cannot leave multicast group

Fri Dec 02, 2022 9:40 pm

I managed to debug and solve my issue, turns out it was (ever so subtle) user error.

I had an (unrelated) IPsec policy which happened to match on the IGMP querier source address. As a result, IGMP queries passed the firewall but are then still dropped due to the policy.

Unfortunately that means your issue is different to mine. The debugging steps might still be helpful - I suspect in your case the query also doesn't make it to the IGMP proxy; perhaps it's as simple as lacking a firewall rule to allow IGMP on the INPUT chain?

Who is online

Users browsing this forum: No registered users and 3 guests