[SOLVED] IGMP Proxy does not work any more after update to OPNsense 16.1.18

[andy.nl]

Hi Folks,

unfortunately I realized the igmp proxy fails to start after the update to 16.1.18.
With the previous version everything worked fine.

Now in the log the error message is:
igmpproxy[86381]: There must be at least 2 Vif's where one is upstream.

Thats very annoying - especially since I didn't change anything.

Any help would be very welcome!

Thanks a lot in advance
Andy

[franco]

Hi Andy,

Which version did you use when the proxy still worked, do you know?

It sounds like a config issue, not code. Very little changed in IGMP proxying, but maybe it's related. Need to know the versions so we can pinpoint. :)


Cheers,
Franco

[andy.nl]

Hi Franco,

thanks for your quick reaction!
It was just the version below when it was still working, thus 16.1.17.

Is there any way to downgrade to specifically 16.1.17 for the time being?
Otherwise I would assume I have to install the last image and avoid any updates, but this of course is not the preferred solution from security point of view.

Besides of this small flaw I have to say its really a great piece of software!

Cheers,
Andy

[franco]

Ok, let's try reverting the GUI package to 16.1.17. What architecture/crypto flavour are you on?

Small flaws in great software makes me sad, let's fix that. And thanks!

[franco]

Doesn't look like 16.1.17 had anything to do with this from the change log.

There's a long trail of comments here, but no visible solution: https://redmine.pfsense.org/issues/6099

[andy.nl]

Ok -- I will try if the downgrade helps. If not I will be back here soon :-)

Cheers,
Andy

[andy.nl]

No improvement unfortunately.
I have also compared the backup xml files from prior the upgrade and after. They are identical.
Maybe something under the hood changed? Kernel,... ?
Sorry my limited capabilities to help but I am not an expert.
Please let me know if you need any further information as input.

Cheers and have a nice evening,
Andy

[franco]

Hi Andy,

I was hoping it wasn't so... Something changed with your provider and/or IP addressing that prevents IGMP-Proxy from picking up the second interface properly. The reports / details elsewhere are fuzzy. Some say that IGMP needs to be fixed, but looks like nobody figured this out.

I am on very short time at the moment, though if you could let me have your ifconfig dump and /usr/local/etc/igmpproxy.conf file I will take a look.


Cheers,
Franco

[andy.nl]

OK sent via PN.


Cheers,
Andy

[andy.nl]

I will wait for the 16.7, hopefully i'll work there again. Lets hope and see  :o

[franco]

Hi Andy,

Sorry, I got severely side-tracked with 16.7. Almost over now. ;)

I looked at all of the info you provided (thanks!) and I found only one spot in the daemon where the interface could be rejected.

Can you install this package and paste the output of the igmpproxy startup with debug flags again? This is for amd64, if you need i386 I'll provide a different package.

# pkg add -f https://pkg.opnsense.org/snapshots/igmpproxy-0.1_2,1.txz

It should light up a new line for your re0_vlan4 now... Fingers crossed.

Not a solution yet but maybe a clue. :)


Cheers,
Franco

[andy.nl]

Hi Franco,

I can imagine the preparations demand loads of energy and time  ;)

And thanks to still hanging on to this topic !

Unfortunately the patch didn't work :-(
Any other options?

Cheers,
Andy

[franco]

The patch is not supposed to work, I need the debug output. :)

[andy.nl]

Avoiding VLAN for IPTV and using a managed switch feeding the IPTV stream separately to the opnsense box by a physical interface worked for me. Thiis workaround is now in place and seems to work stable.
Somehow IGMP Proxy doesn't cooperate with VLAN interfaces any more, but well with physical ones (se bug tracker).

Cheers and thanks a lot for your help,
Andy

[segfault]

Hello everybody,

I'm replying here because I have the feeling this is the same issue I'm facing. I'll promptly open a new thread otherwise.

IGMP Proxy has been working flawlessly until today that I setup OpenVPN server. The issue seems to be that the igmpproxy.conf file doesn't explicitly ignore the ovpns1 virtual interface and thus fails on startup with the following:

Code Select Expand

adding VIF, Ix 0 Fl 0x0 IP 0x0101a8c0 igb0, Threshold: 1, Ratelimit: 0
        Network for [igb0] : 192.168.1/24
        Network for [igb0] : 232/8
adding VIF, Ix 1 Fl 0x0 IP 0x0100000a igb2, Threshold: 1, Ratelimit: 0
        Network for [igb2] : 10.0.0/24
adding VIF, Ix 2 Fl 0x0 IP 0x01000a0a ovpns1, Threshold: 1, Ratelimit: 0
        Network for [ovpns1] : 10.10.0.1/32
There must be at least 2 Vif's where one is upstream.

Disabling the OpenVPN server solves the issue. What's the right way to fix this? What's the right temporary solution without having to disable OpenVPN?

Thank you