OPNsense Forum

Archive => 16.1 Legacy Series => Topic started by: andy.nl on July 05, 2016, 09:26:19 pm

Title: [SOLVED] IGMP Proxy does not work any more after update to OPNsense 16.1.18
Post by: andy.nl on July 05, 2016, 09:26:19 pm
Hi Folks,

unfortunately I realized the igmp proxy fails to start after the update to 16.1.18.
With the previous version everything worked fine.

Now in the log the error message is:
igmpproxy[86381]: There must be at least 2 Vif's where one is upstream.

Thats very annoying - especially since I didn't change anything.

Any help would be very welcome!

Thanks a lot in advance
Andy
Title: Re: IGMP Proxy does not work any more after update to OPNsense 16.1.18
Post by: franco on July 06, 2016, 04:05:55 pm
Hi Andy,

Which version did you use when the proxy still worked, do you know?

It sounds like a config issue, not code. Very little changed in IGMP proxying, but maybe it's related. Need to know the versions so we can pinpoint. :)


Cheers,
Franco
Title: Re: IGMP Proxy does not work any more after update to OPNsense 16.1.18
Post by: andy.nl on July 06, 2016, 04:10:12 pm
Hi Franco,

thanks for your quick reaction!
It was just the version below when it was still working, thus 16.1.17.

Is there any way to downgrade to specifically 16.1.17 for the time being?
Otherwise I would assume I have to install the last image and avoid any updates, but this of course is not the preferred solution from security point of view.

Besides of this small flaw I have to say its really a great piece of software!

Cheers,
Andy
Title: Re: IGMP Proxy does not work any more after update to OPNsense 16.1.18
Post by: franco on July 06, 2016, 04:20:00 pm
Ok, let's try reverting the GUI package to 16.1.17. What architecture/crypto flavour are you on?

Small flaws in great software makes me sad, let's fix that. And thanks!
Title: Re: IGMP Proxy does not work any more after update to OPNsense 16.1.18
Post by: franco on July 06, 2016, 04:38:00 pm
Doesn't look like 16.1.17 had anything to do with this from the change log.

There's a long trail of comments here, but no visible solution: https://redmine.pfsense.org/issues/6099
Title: Re: IGMP Proxy does not work any more after update to OPNsense 16.1.18
Post by: andy.nl on July 06, 2016, 04:44:40 pm
Ok -- I will try if the downgrade helps. If not I will be back here soon :-)

Cheers,
Andy
Title: Re: IGMP Proxy does not work any more after update to OPNsense 16.1.18
Post by: andy.nl on July 06, 2016, 07:14:23 pm
No improvement unfortunately.
I have also compared the backup xml files from prior the upgrade and after. They are identical.
Maybe something under the hood changed? Kernel,... ?
Sorry my limited capabilities to help but I am not an expert.
Please let me know if you need any further information as input.

Cheers and have a nice evening,
Andy
Title: Re: IGMP Proxy does not work any more after update to OPNsense 16.1.18
Post by: franco on July 08, 2016, 09:00:30 am
Hi Andy,

I was hoping it wasn't so... Something changed with your provider and/or IP addressing that prevents IGMP-Proxy from picking up the second interface properly. The reports / details elsewhere are fuzzy. Some say that IGMP needs to be fixed, but looks like nobody figured this out.

I am on very short time at the moment, though if you could let me have your ifconfig dump and /usr/local/etc/igmpproxy.conf file I will take a look.


Cheers,
Franco
Title: Re: IGMP Proxy does not work any more after update to OPNsense 16.1.18
Post by: andy.nl on July 15, 2016, 09:47:15 am
OK sent via PN.


Cheers,
Andy
Title: Re: IGMP Proxy does not work any more after update to OPNsense 16.1.18
Post by: andy.nl on July 25, 2016, 04:31:47 pm
I will wait for the 16.7, hopefully i'll work there again. Lets hope and see  :o
Title: Re: IGMP Proxy does not work any more after update to OPNsense 16.1.18
Post by: franco on July 25, 2016, 11:16:02 pm
Hi Andy,

Sorry, I got severely side-tracked with 16.7. Almost over now. ;)

I looked at all of the info you provided (thanks!) and I found only one spot in the daemon where the interface could be rejected.

Can you install this package and paste the output of the igmpproxy startup with debug flags again? This is for amd64, if you need i386 I'll provide a different package.

# pkg add -f https://pkg.opnsense.org/snapshots/igmpproxy-0.1_2,1.txz

It should light up a new line for your re0_vlan4 now... Fingers crossed.

Not a solution yet but maybe a clue. :)


Cheers,
Franco
Title: Re: IGMP Proxy does not work any more after update to OPNsense 16.1.18
Post by: andy.nl on July 26, 2016, 07:15:44 pm
Hi Franco,

I can imagine the preparations demand loads of energy and time  ;)

And thanks to still hanging on to this topic !

Unfortunately the patch didn't work :-(
Any other options?

Cheers,
Andy
Title: Re: IGMP Proxy does not work any more after update to OPNsense 16.1.18
Post by: franco on July 27, 2016, 10:20:56 am
The patch is not supposed to work, I need the debug output. :)
Title: Re: IGMP Proxy does not work any more after update to OPNsense 16.1.18
Post by: andy.nl on August 17, 2016, 10:35:18 pm
Avoiding VLAN for IPTV and using a managed switch feeding the IPTV stream separately to the opnsense box by a physical interface worked for me. Thiis workaround is now in place and seems to work stable.
Somehow IGMP Proxy doesn't cooperate with VLAN interfaces any more, but well with physical ones (se bug tracker).

Cheers and thanks a lot for your help,
Andy
Title: Re: [WORKAROUND] IGMP Proxy does not work any more after update to OPNsense 16.1.18
Post by: segfault on December 12, 2016, 02:21:42 pm
Hello everybody,

I'm replying here because I have the feeling this is the same issue I'm facing. I'll promptly open a new thread otherwise.

IGMP Proxy has been working flawlessly until today that I setup OpenVPN server. The issue seems to be that the igmpproxy.conf file doesn't explicitly ignore the ovpns1 virtual interface and thus fails on startup with the following:

Code: [Select]
adding VIF, Ix 0 Fl 0x0 IP 0x0101a8c0 igb0, Threshold: 1, Ratelimit: 0
        Network for [igb0] : 192.168.1/24
        Network for [igb0] : 232/8
adding VIF, Ix 1 Fl 0x0 IP 0x0100000a igb2, Threshold: 1, Ratelimit: 0
        Network for [igb2] : 10.0.0/24
adding VIF, Ix 2 Fl 0x0 IP 0x01000a0a ovpns1, Threshold: 1, Ratelimit: 0
        Network for [ovpns1] : 10.10.0.1/32
There must be at least 2 Vif's where one is upstream.

Disabling the OpenVPN server solves the issue. What's the right way to fix this? What's the right temporary solution without having to disable OpenVPN?

Thank you
Title: Re: [WORKAROUND] IGMP Proxy does not work any more after update to OPNsense 16.1.18
Post by: segfault on December 12, 2016, 04:13:58 pm
Some further information and questions. By looking at the igmpproxy opnsense port, it seems we're using the official v0.1 release https://github.com/opnsense/ports/blob/master/net/igmpproxy/distinfo.

Digging through the code I figured that the disabled interface state is completely ignored and that the default state is downstream. This seems to have been fixed after the v0.1 release in this commit: https://github.com/pali/igmpproxy/commit/85e240727305b156097ee7aa0f0c4473a136291f
Title: Re: [WORKAROUND] IGMP Proxy does not work any more after update to OPNsense 16.1.18
Post by: franco on January 11, 2017, 01:13:57 pm
Anyone feeling lucky? :)

AMD64 test package with a promising fix that was incorporated in pfSense dev recently, but still not in FreeBSD:

# pkg add -f https://pkg.opnsense.org/snapshots/igmpproxy-0.1_3,1.txz


Cheers,
Franco
Title: Re: [WORKAROUND] IGMP Proxy does not work any more after update to OPNsense 16.1.18
Post by: ch3p on February 14, 2017, 10:28:59 pm
Quick Question:

Is this already fixed in the current version 17.1? This would be currently the only reason to switch from pfSense to your OPNsense. I've already read, I can't import my pfSense config so this would end up in 2 or 3 hours of work.

pfSense was moving it on the roadmap from version to version and the bug with the VLANs was reported 10 months ago. But I need a working solution for my IPTV.


Thanks,
ch3p
Title: Re: [WORKAROUND] IGMP Proxy does not work any more after update to OPNsense 16.1.18
Post by: franco on February 16, 2017, 07:24:34 am
The patch is in since 17.1, and we haven't heard a complaint since. Sadly no positive feedback as well.


Cheers,
Franco
Title: Re: [WORKAROUND] IGMP Proxy does not work any more after update to OPNsense 16.1.18
Post by: Mech on March 02, 2017, 06:39:39 pm
The patch is in since 17.1, and we haven't heard a complaint since. Sadly no positive feedback as well.


Cheers,
Franco

Hi Franco,

I'm on 17.1 i386 and don't seem to have the new package, if I do "pkg search igmpproxy" all I have available and installed is igmpproxy-0.1_2,1 and v3,1 isn't there?

Can you help?

Thanks
Title: Re: [WORKAROUND] IGMP Proxy does not work any more after update to OPNsense 16.1.18
Post by: franco on March 02, 2017, 09:09:14 pm
Hi Mech,

We didn't bump the port revision. An option was added instead:

# pkg info igmpproxy | grep VLANFIX


Cheers,
Franco
Title: Re: [WORKAROUND] IGMP Proxy does not work any more after update to OPNsense 16.1.18
Post by: Mech on March 03, 2017, 01:42:33 am
Hi Mech,

We didn't bump the port revision. An option was added instead:

# pkg info igmpproxy | grep VLANFIX


Cheers,
Franco

Thanks for that Franco,

It turns out my issue was not that IGMP proxy wasn't working, but that it was ignoring the IGMP packets because they came back on the wrong interface.  The root cause was my switch which is quite old doing IGMP snooping, but instead of returning the IGMP on the VLAN it came from, it was putting it on the bare interface instead.  Incorrect logic, but it is over 10 years old now.

"sudo /usr/local/sbin/igmpproxy -d -v /usr/local/etc/igmpproxy.conf" was very useful in determining this for anyone who may read this thread in the future.  That turns on debugging and verbosity.  Make sure to stop igmpproxy in the WebGUI first.
Title: Re: [SOLVED] IGMP Proxy does not work any more after update to OPNsense 16.1.18
Post by: franco on March 03, 2017, 06:18:10 am
Alright, cheers for the explanation on how to debug and happy that this works as expected now. Marking it solved. :)
Title: Re: [SOLVED] IGMP Proxy does not work any more after update to OPNsense 16.1.18
Post by: Mech on March 03, 2017, 01:57:33 pm
It's also worth noting this:

If you have more than one interface in a subnet, then BOTH of those interfaces have to be downstream interfaces in igmpproxy for it to not say "Membership report was recieved on a disabled interface. Ignoring." and "The found if for XXX.XXX.XXX.XXX was not downstream. Ignoring leave request."  I don't know if that is intentional but it seems to only check the first match, not all matches.  Interesting behaviour worth knowing about anyway.  In my case I had a dedicated management interface on the same subnet as my LAN, I just moved this to its own subnet and that cured that issue.

Still solved. I just want to give as much detail as possible for anyone else.