After wrestling with this for several hours , I finally have EE TV IPTV running smoothly through OPNsense on EE TV Pro and EE TV Edge boxes without relying on the EE Broadband router. There really isn't an awful lot of information about this out there, so I've consolidated what I've done into a walkthrough of what worked for me. Hopefully it saves you a few evenings of trial and error.
You'll need an EE Broadband subscription for this as EE TV won't work on others.
1️⃣ Set Up Your WAN (PPPoE) - I assume you already have done this and the PPPoE link is working correctly, but listed here for completeness.
EE uses PPPoE for broadband.
WAN Interface Settings (Interfaces → Devices → Point-to-Point)
Link type: PPPoE
Link interface: The port that's connected to your ONT
Description: EE Broadband
Username: bthomehub@btbroadband.com
Password: bt
I would recommend following @meyergru's (https://forum.opnsense.org/index.php?action=profile;u=28013) excellent guide on properly configuring PPPoE here (https://forum.opnsense.org/index.php?topic=45658.0).
2️⃣ Create a Dedicated IPTV Interface
EE sends IPTV traffic to the ONT physical interface and NOT returning over the PPPoE link. This is the part that is missing from all other instructions.
Add the IPTV Interface
Go to Interfaces → Assignments → Add a new interface
Device: your physical WAN NIC - the same as the PPPoE interface is bound to
Description: IPTV
Click Add and Save.
Enable the Interface
Click the IPTV interface in "Interfaces"
Tick Enable
IPv4 Configuration: Static IPv4
Static IPv4 configuration
IPv4 address: 10.20.30.1/24 (this can be anything private but make sure that it's a subnet not currently in use)
IPv6 Configuration: None
This interface is purely for passing multicast traffic.
3️⃣ Enable IGMP Proxy
EE TV relies on multicast. Without IGMP Proxy, the box won't get channel streams.
Install IGMP Proxy
System → Firmware → Plugins
Tick "Show community plugins"
Find os-igmp-proxy and click "+" to install
Configure IGMP Proxy
Refresh the OPNsense page
Go to Services → IGMP Proxy
Add an Upstream interface:
Interface: IPTV
Network: 224.0.0.0/4
Network: 109.159.247.0/24 - this is EE's source for IPTV
** Note, the OPNsense UI will not allow two different Network entries with different CIDR values. If you try to add using the CIDR dropdown, the next entry will have the same CIDR entry and you cannot change it. The workaround is to add the networks as above (including the /4 and /24) without choosing a CIDR value. When you save and edit the interface again, it will be listed correctly. **
Click save
Add a Downstream interface:
Interface: your LAN
Network: your LAN subnet (e.g., 192.168.1.0/24)
Apply changes.
If you have more subnets, add them and apply changes.
4️⃣ Firewall Rules
You need to allow UDP and IGMP traffic through.
In my testing, and for simplicity, I created an allow all rule for traffic flowing in to the LAN interface - if you have other subnets you added in the downstream interface in step 3, create firewall rules for those also. The critical setting here is you must allow options. Edit the rule, click advanced mode and tick "Allow options".
Once this is working for you, I would suggest restricting this to the traffic that you require.
On the IPTV interface, create two new firewall rules:
Screenshot_20260306_223047.png
For both, ensure "Allow options" is enabled.
5️⃣ Enable IGMP Snooping on Your Switch
IGMP Snooping allows the switch to restrict stream traffic to only the ports that have requested the stream, rather than every port on the switch.
This is very much vendor dependent and may be a simple setting change on the management page of your switch or through a console session. For my HP Procurve 3500yl, I enabled this through the management page of the switch.
If your switch supports it:
Turn on IGMP Snooping
If available, enable Fast Leave
Test your new EE TV boxes and you should have full live TV :-)
After monitoring outbound traffic whilst streaming channels using the firewall live view, note the ports and destinations in use and create allow rules for them to replace the LAN allow all rule used for testing.