Text only | Text with Images

OPNsense Forum

English Forums => 26.7 Series => Topic started by: sjjh on July 30, 2026, 05:37:18 PM

Title: mDNS forwarding between two VLANs - Why is failing?/How to debug?
Post by: sjjh on July 30, 2026, 05:37:18 PM
A user with an Apple Mac (VLAN 70; IP 10.70.0.1) wants to print on a printer (VLAN 65; IP 10.64.65.203) in a different VLAN. The printer only supports Airprint (using mdns) for Mac OS (no specific printer driver, using a generic one does not print images). I installed the os-mdns-repeater and also tried the os-udpbroadcastrelay but fail to get it working. Can someone please support in how to debug. What I tried so far/my current config & information level:
Client:
$ avahi-browse -art | grep "Brother MFC-L" within the VLAN 65 provides output, within the VLAN 70 does not. Ping from client in VLAN 70 to printer in VLAN 65 works.

OPNsense:
mDNS-Repeater
GUI config
Via ssh
Code Select
# cat /etc/rc.conf.d/mdns_repeater
mdns_repeater_enable="YES"
mdns_repeater_interfaces="ix0_vlan65 vlan0.70

# ps aux | grep -i mdns
root          48892   0.0  0.0   14088    2628  2  S+   17:04       0:00.00 grep -i mdns
root@fw:/home/simon.harhues # ps aux | grep -i mdns
root          51533   0.0  0.0   14004    2488  -  Ss   17:04       0:00.00 /usr/local/bin/mdns-repeater -p /var/run/mdns-repeater.pid ix0_vlan65 vlan0.70
root          57371   0.0  0.0   14088    2632  2  S+   17:04       0:00.00 grep -i mdns

# sockstat -l | grep 5353
root          mdns-repea 62350  3 udp4    *:5353                *:*                 
root          mdns-repea 62350  4 udp4    10.64.65.254:5353     *:*                 
root          mdns-repea 62350  5 udp4    10.70.255.254:5353    *:*

# ifconfig | grep -E "ix0_vlan65|vlan0.70"
ix0_vlan65: flags=1008843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST,LOWER_UP> metric 0 mtu 1500
vlan0.70: flags=1008843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST,LOWER_UP> metric 0 mtu 1500

# tcpdump -i ix0_vlan65 -n 'udp port 5353' -v | grep "Brother MFC-L"
tcpdump: listening on ix0_vlan65, link-type EN10MB (Ethernet), snapshot length 262144 bytes
    10.64.65.203.5353 > 224.0.0.251.5353: 0*- [0q] 1/0/1 Brother MFC-L9570CDW series._uscans._tcp.local. (Cache flush) TXT "txtvers=1" "vers=2.62" "adminurl=https://BROTHERMFCL9570CDW.local./net/net/airprint.html" "representation=https://BROTHERMFCL9570CDW.local./icons/device-icons-128.png" "rs=eSCL" "ty=Brother MFC-L9570CDW series" "note=Stiftung" "pdl=application/pdf,image/jpeg" "UUID=e3248000-80ce-11db-8000-b42200665636" "cs=binary,grayscale,color" "is=adf,platen" "duplex=T" (435)
16:50:36.026741 IP6 (hlim 255, next-header UDP (17), payload length 443) fe80::b622:ff:fe66:5636.5353 > ff02::fb.5353: [udp sum ok] 0*- [0q] 1/0/1 Brother MFC-L9570CDW series._uscans._tcp.local. (Cache flush) TXT "txtvers=1" "vers=2.62" "adminurl=https://BROTHERMFCL9570CDW.local./net/net/airprint.html" "representation=https://BROTHERMFCL9570CDW.local./icons/device-icons-128.png" "rs=eSCL" "ty=Brother MFC-L9570CDW series" "note=Stiftung" "pdl=application/pdf,image/jpeg" "UUID=e3248000-80ce-11db-8000-b42200665636" "cs=binary,grayscale,color" "is=adf,platen" "duplex=T" (435)
    10.64.65.203.5353 > 224.0.0.251.5353: 0*- [0q] 2/0/3 _ipp._tcp.local. PTR Brother MFC-L9570CDW series._ipp._tcp.local., _ipps._tcp.local. PTR Brother MFC-L9570CDW series._ipps._tcp.local. (1437)
16:54:01.317889 IP6 (hlim 255, next-header UDP (17), payload length 1445) fe80::b622:ff:fe66:5636.5353 > ff02::fb.5353: [udp sum ok] 0*- [0q] 2/0/3 _ipp._tcp.local. PTR Brother MFC-L9570CDW series._ipp._tcp.local., _ipps._tcp.local. PTR Brother MFC-L9570CDW series._ipps._tcp.local. (1437)
###SHORTEND###
^C58979 packets captured
7589695 packets received by filter
0 packets dropped by kernel

# tcpdump -i vlan0.70 -n 'udp port 5353' -v | grep "Brother MFC-L"
tcpdump: listening on vlan0.70, link-type EN10MB (Ethernet), snapshot length 262144 bytes
^C511099 packets captured
13203846 packets received by filter
0 packets dropped by kernel

Running mdns-repeater manually in the foreground (mdns-repeater -f ix0_vlan65 vlan0.70) did not make a difference. It showed forwarding lots of packages from VLAN 70, but non from VLAN 65.


Firewall rules
positioned as top most interface rules:
1) rule VLAN 65

2) rule VLAN 70

info to each rule (live log) shows 0 hits.
Title: Re: mDNS forwarding between two VLANs - Why is failing?/How to debug?
Post by: Patrick M. Hausen on July 30, 2026, 05:43:16 PM
Try source/destination any/any. mDNS is multicast.
Title: Re: mDNS forwarding between two VLANs - Why is failing?/How to debug?
Post by: viragomann on July 30, 2026, 06:10:38 PM
Quote from: sjjh on Today at 05:37:18 PMFirewall rules
positioned as top most interface rules:
1) rule VLAN 65
    • target: 70ClientIntern network
    • target port: single port -> 5353
The target of the mDNS packets is the multicast IP 224.0.0.251. So you have to allow this here.
Title: Re: mDNS forwarding between two VLANs - Why is failing?/How to debug?
Post by: Patrick M. Hausen on July 30, 2026, 06:18:11 PM
@viragomann Probably better than "any" - thanks!
Title: Re: mDNS forwarding between two VLANs - Why is failing?/How to debug?
Post by: IsaacFL on July 30, 2026, 07:33:01 PM
You will also need firewall rules to allow printing in addition to the MDNS. MDNS just locates the printers address.
Title: Re: mDNS forwarding between two VLANs - Why is failing?/How to debug?
Post by: sjjh on July 30, 2026, 09:26:48 PM
Thanks for all your replies!

Quote from: viragomann on Today at 06:10:38 PM
Quote from: sjjh on Today at 05:37:18 PMFirewall rules
positioned as top most interface rules:
1) rule VLAN 65
    • target: 70ClientIntern network
    • target port: single port -> 5353
The target of the mDNS packets is the multicast IP 224.0.0.251. So you have to allow this here.

Makes sense. So I changed it to:

Unfortunately it still doesn't work. tcpdump and avahi-browse show the same result as before. I'm probably overlooking something very obvious here... :-/

I temporarily tried out to broaden the rule to:

But even then it did not work... So should I look somewhere else?


Quote from: IsaacFL on Today at 07:33:01 PMYou will also need firewall rules to allow printing in addition to the MDNS. MDNS just locates the printers address.
Yes, I already have a more generic rule, which I assume should work (just added the other rule as I wanted to rule out other side effects):
Text only | Text with Images