Firewall rules for IPTV

Hello community,
I’ve got VyOS up adn running, configured igmp-proxy fitting my needs but now I’m stuck at creating the correct firewall rules. I’m coming from pfSense and want to achieve the following ruleset:

But I’m a bit lost how these rules have to look and if anything additional/else is needed. I would really appreciate some help with this.

Source (netgate forums)

Hi, do you have any firewall rules?
In this case, you need set firewall as local for new firewall rules

set interfaces ethernet eth0 firewall local name <NAME>
firewall {
all-ping enable
broadcast-ping disable
config-trap disable
ipv6-receive-redirects disable
ipv6-src-route disable
ip-src-route disable
log-martians enable
name WAN-IN {
    default-action drop
    rule 1000 {
        action accept
        destination {
            address 224.0.0.0/4
      }
        protocol igmp
    }
    rule 1001 {
        action accept
        destination {
            address 224.0.0.0/4
        }
        protocol udp
    }
    rule 1010 {
        action accept
        state {
            established enable
            related enable
        }
    }
}
name WAN-LOCAL {
    default-action drop
    rule 1000 {
        action accept
        destination {
            address 224.0.0.0/4
        }
        protocol all
    }
    rule 1010 {
        action accept
        state {
            established enable
            related enable
        }
    }
    rule 1020 {
        action accept
        icmp {
            type-name echo-request
        }
        protocol icmp
        state {
            new enable
        }
    }
}
receive-redirects disable
send-redirects disable
source-validation disable
syn-cookies enable
twa-hazards-protection disable

}

These are my current firewall rules. If needed, I can post the full config.boot file. With the current ruleset it’s not working as expected but I’m a bit further now. With MagentaTV from Deutsche Telekom the stream starts as unicast and after 10-20 seconds it switches to multicast. Unicast works fine, I can see a stream as expected. But after the switch to multicast traffic, the stuttering starts.

I’m not sure if this is still a firewall issue (because I can see a stream for a few seconds) or more an issue with igmp-proxy. All I can tell right now is, that it is working nicely with pfsense. But maybe we can get it to work with VyOS, too. :slight_smile:

Can I propose to disable the firewall for testing?