Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a system with a restrictive firewall that will be participating in UDP multicasting (sending and receiving). What's a good set of rules to make the host's firewall allow this?

This is my current setup, using ipf on Solaris:

# Enable UDP multicasting
pass out log quick on INTERFACE proto udp from HOSTIP/32 to
pass in log quick on INTERFACE proto udp from to HOSTIP/32

# Enable multicast ping discovery
pass in log quick on INTERFACE proto icmp from any to

# Allow pings out.
pass out quick on INTERFACE proto icmp all keep state

The host is expected to participate in exactly one multicast group. Can I replace "" with this specific group (e.g., GROUP/32) without causing problems?

Are there any other openings that should be created?

share|improve this question

Yes, you should be able to use the specific multicast address in place of without a problem if you've got a hard-coded multicast address to use. We do it for our multicast setups without a hassle. As far as "what else should I open?", that depends on what you're using -- if you've got some unicast traffic that manages the multicast streams, for example, then you need to allow that traffic to get to where it's going, too. Obviously without knowing what it is that you're doing, I can't give you any advice on that.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.