IGMP (SAP Stream) forwarding with iptables

In earlier post, I've shown how to setup internet connection sharing (ICS) with iptables. This is sufficient for standard services sharing, but it won't work for SAP Stream. If you want to setup multicast forwarding, you need to enable igmpproxy.

First thing is to understand the network topology:

We have 2 separate networks: NETWORK1 with SAP Stream and NETWORK2 with ICS. We need to enable IGMP packets on iptables:

iptables -A INPUT -p igmp -j ACCEPT

Without this rule, I was experiencing SAP Stream disconnects.

Next thing is to setup igmpproxy. First we need to force IGMP v2 packets on both interfaces:

echo 2 > /proc/sys/net/ipv4/conf/wlan0/force_igmp_version
echo 2 > /proc/sys/net/ipv4/conf/eth0/force_igmp_version

To make this permanent create /etc/sysctl.d/40-igmpversion.conf:

net.ipv4.conf.eth0.force_igmp_version=2
net.ipv4.conf.wlan0.force_igmp_version=2

igmpproxy setup:
My configuration file looks like this:

##------------------------------------------------------
## Enable Quickleave mode (Sends Leave instantly)
##------------------------------------------------------
quickleave


##------------------------------------------------------
## Configuration for wlan0 (Upstream Interface)
##------------------------------------------------------
phyint wlan0 upstream  ratelimit 0  threshold 1
        altnet 10.254.1.118/32
        altnet 88.212.8.3/32


##------------------------------------------------------
## Configuration for eth1 (Downstream Interface)
##------------------------------------------------------
phyint eth0 downstream  ratelimit 0  threshold 1


##------------------------------------------------------
## Configuration for eth2 (Disabled Interface)
##------------------------------------------------------
phyint eth2 disabled

-upstream is the source interface
-downstream is the destination interface
-altnet are all networks necessary to add to igmpproxy routing table

Finding out altnet networks:
Start igmpproxy with debug option:

igmpproxy -d -vv /etc/igmpproxy.conf 2>&1 | grep "The source"

You will see following output, from which the first IP address is the one you want to add to altnet:

The source address 10.254.1.118 for group 224.2.127.254, is not in any valid net for upstream VIF.