10.79.197.208 blocked in WLAN

[manilx]

Hi

I have the block private networks set in wlan. I notice in the firewall log address 10.79.197.208 being blocked going to 224.0.0.1, lots of blocks.
When I disable the block private networks it gets caught in a firewall rule checking against https://iplists.firehol.org/files/firehol_level1.netset

I don't have the slightest clue what this adress is. But it belongs to the OPNsense install as pings to it stop once I shut down the OPNsense VM...

Anyone has a clue what this is?

thx in advance

[Patrick M. Hausen]

224.0.0.1 is the all hosts multicast group. Are the packets TCP (probably SYN, then) or UDP? Which target port? If it's UDP 5353 it's probably multicast DNS. You can use a "mdns browser" on a system connected to that WLAN to find out more.

There's "Discovery" for Mac OS and iOS. Don't know about Android or Windows, sorry.

[manilx]

Here is a line of the log:

wan      2022-07-02T19:58:44   10.79.197.208   224.0.0.1   igmp   Block private networks from WAN

Can't see a port here.

[manilx]

I think I found it:

The ISP router has an IPTV option, which is on and it has this IP (10.79.197.208)...

So I think I'll just add a firewall rule to let this pass.

[manilx]

Fixed.....

Used IP in rule, alias wasn't working. But it is now passing.