Disclaimer: I'm aware that having Opnsense box acting like switch (bridge ports) and AP in the same time is not liked scenario, but I'm on home envoironment with light load. So here I am... using Topton box with 3 LAN/bridged ports and Atheros n-Wifi card. 25.7.10 with almost default settings (Dnsmasq + unbound, no ipv6 or any strange config or plugins).
In big picture everything works as normal. Due to my room layout I need to have Chromecast audio connected to my Opnsense box Wifi. It works well and I can stream audio into it from my computer, media server (both connected via cable and another switch to Opnsense) and iPhone, when iPhone is connecting to my other AP on the other side of the house - same 192.168.1.x network, same SSID, channel 6. But when I approach my living room where Opnsense and Chromecast locate and iPhone jumps to Opnsense box channel 1, I can not see Chromecast anymore - basically they can not share same AP). All other services work - Roon, web browsing, email etc. I can see other devices on my network - printer, Opnsense webui, BESIDES BubbleUPnP server installed in my media server. It starts asking password (not set), which acc. to Bubble help means, that "I try to accsess it from another network". But I'm not - all devices in 192.168.1.xxx
If I walk into other AP, all good.
I have done the Bridge and Wifi (part of bridge) following to the letter the Opnsense guide. Nothing I can see here which could create such issue.
I read somewhere that doing Bridge setup wrong, could cause issues with Multicast. Could that be it ? What shall I look for there ?
I was able to solve my main issue with Chromecast by enableing "Allow intra-BSS communication", but connecting to BubbleUPnP still gives error that I want to connect from WAN. Yes I could allow Wan settings from Bubble, but do not want (due security).
What OPNSense does block/filter that connecting via its internal Wifi makes one service in LAN to think that I'm trying to connect from WAN ?
Did you add proper firewall rules to the interfaces to permit UPnP?
In addition to the access to the other LAN devices, it's also required pass the UPnP multicasts to the other interface.
Thanks, looks like it helped. My WLAN connection is part of Bridge (together w/ OPT1, OPT2 and OPT3) and therefore also LAN. Firewall rules were applied only for LAN. Now I made similar Default rules also for WLAN. OPTx connections still are without rules and relay on LAN rules. Everything in other rooms work (via switch, via separate AP, via LAN, via OPT1). Strange that WLAN requires special approach, to me it was just like another port involved in bridge.
Did you add the mandatory tunables for the bridge?
You mean those 2 from Bridge guide:
net.link.bridge.pfil_member and set the value to 0
net.link.bridge.pfil_bridge and set the value to 1
Yes, those were done day 1.
EDIT: this morning BubbleUPnP still asked login. Not that it is very critical, but shows something is wrong in my configuration.
Looks to be working now correctly with 26.1 and new set (migrated) of Firewall rules.
Quote from: viragomann on January 19, 2026, 09:05:20 PMDid you add proper firewall rules to the interfaces to permit UPnP?
In addition to the access to the other LAN devices, it's also required pass the UPnP multicasts to the other interface.
I'm in 26.7.5 now and same issue still persist.
If I connect iPhone to Wifi via Opnsense box own WLAN interface I can not reach BubbleUPnP. I know, small issue, I know opnsense is not intended for Wifi, but it shows something is misconfigured in my network. In principle I do not like it :)
Can you please help to define those rules correctly ?
Quote from: suur13 on October 03, 2026, 02:50:39 PMIf I connect iPhone to Wifi via Opnsense box own WLAN interface I can not reach BubbleUPnP.
Is Multicast DNS allowed on the WiFi Bridge ?!
Perhaps disable IGMP Snooping tuneable or something like that ?
/Just some thoughts...
Quote from: nero355 on October 03, 2026, 08:36:21 PMIs Multicast DNS allowed on the WiFi Bridge ?!
Perhaps disable IGMP Snooping tuneable or something like that ?
Sorry, but I can not even find neither settings
I don't use BubbleUPnP, but I fount out that it uses DLNA and I'm running a miniDLNA and managed to access it from other network interfaces with theese rules:
ksnip_20261004-155102.png
ksnip_20261004-160036.png
10.16.12.5 is my DLNA server.
The "DLNA" port alias only includes port 8200 (DLNA default).
So you need to allow the clients to access port 8200 TCP to the DLNA Server + the clients source port 1900 UDP to the server (I allowed any RFC1918 here).
And the server requires to access port 1900 UDP to the clients (RFC1918 in my rule) + port 1900 UDP to 239.255.255.255 (UPnP multicast group).
Edit:
Forgot to mention, thought you have already done this, but not sure:
You also need a plugin to forward multicasts like "UDP Broadcast Relay", where you configure a multicast group for 239.255.255.250 and port 1900 and add the client and server interface to it.
Sorry guys, I understand I have not been very good explaining my issue. I have DLNA/Upnp itself working very well in my network. I have several servers and clients and control points and they work well behind Opnsense router without any special configuration. I can even reach some needed services outside my network, so firewall also works correctly.
Problem is specific issue with BubbleUPnp. It is kind of control software, a middle-man. One reaches its configuration page by 192.168.1.xxx:58050
I can reach this page from my desktop, laptop or iPhone, when later is connected to random AP in my house. Only when it is connected to Opnsense box Wifi (WLAN which is bridged to lan together with other Ethernet connections opt1, opt2....) I can not reach this page. It blocks me and says external connection not allowed. But obviously I have 192.168.1.y IP on my iPhone.
Opnense Wifi itself also works well. Reason I have it active is that I have some clients in the same room who need it. Even DLNA works via Opnsense box WLAN.
Only thing is missing access to this web page. So it is not DLNA issue, but rather my WLAN configuration (or Firewall).
Quote from: suur13 on October 04, 2026, 08:44:30 PMOne reaches its configuration page by 192.168.1.xxx (https://192.168.1.xxx/):58050
I can not reach this page. It blocks me and says external connection not allowed.
This was really worth to mention.
So presumably BubbleUPnp itself blocks the access.
And this happens only, if the iPhone is connected to the same wifi as BubbleUPnp?
QuoteBut obviously I have 192.168.1.y IP on my iPhone.
So they are in the same subnet?
Seems strange to get this massage then.
Quote from: suur13 on October 04, 2026, 08:44:30 PMOne reaches its configuration page by 192.168.1.xxx (https://192.168.1.xxx/):58050
I can reach this page from my desktop, laptop or iPhone, when later is connected to random AP in my house. Only when it is connected to Opnsense box Wifi (WLAN which is bridged to lan together with other Ethernet connections opt1, opt2....) I can not reach this page. It blocks me and says external connection not allowed. But obviously I have 192.168.1.y IP on my iPhone.
That sounds more like playing around with these options is needed : https://bubblesoftapps.com/bubbleupnpserver2/docs/config_network_and_security.html
Can you simply ping/traceroute the IP Address when connected via OPNsense WLAN ?
Quote from: viragomann on October 04, 2026, 10:11:22 PMSo presumably BubbleUPnp itself blocks the access.
And this happens only, if the iPhone is connected to the same wifi as BubbleUPnp?
So they are in the same subnet?
Yes, same subnet. BubbleUpnP server is connected via LAN (opt1).
Yes, Bubble is blocking, because it thinks I'm coming outside network, but I'm not.
Something between WLAN <-> LAN makes it think it is another network.
Approaching Bubble from other LAN machines is all OK. Also iPhone when I connect via another AP.