Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have a system with a restrictive firewall that will be participating in UDP multicasting (sending and receiving). What's a good set of rules to make the host's firewall allow this?

This is my current setup, using ipf on Solaris:

# Enable UDP multicasting
pass out log quick on INTERFACE proto udp from HOSTIP/32 to 224.0.0.0/4
pass in log quick on INTERFACE proto udp from 224.0.0.0/4 to HOSTIP/32

# Enable multicast ping discovery
pass in log quick on INTERFACE proto icmp from any to 224.0.0.1/32

# Allow pings out.
pass out quick on INTERFACE proto icmp all keep state

The host is expected to participate in exactly one multicast group. Can I replace "224.0.0.0/4" with this specific group (e.g., GROUP/32) without causing problems?

Are there any other openings that should be created?

share|improve this question

1 Answer 1

Yes, you should be able to use the specific multicast address in place of 224.0.0.0 without a problem if you've got a hard-coded multicast address to use. We do it for our multicast setups without a hassle. As far as "what else should I open?", that depends on what you're using -- if you've got some unicast traffic that manages the multicast streams, for example, then you need to allow that traffic to get to where it's going, too. Obviously without knowing what it is that you're doing, I can't give you any advice on that.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.