I have the unifi server running for all my access points on a network. The controller host sits on a few networks, but only one of them should be used by unifi. Of course, the server has no options to control which interfaces it uses. And it's spilling multicast onto the wrong networks.
I tried just blocking all non-whitelisted multicast like so:
iptables -A OUTPUT -d 22.214.171.124/4 -j DROP
That seems like a no brainer to me, and it works, except that eventually the unifi controller goes into a loop (with no sleep() in it apparently) and keeps trying to stuff the socket for interfaces I don't want it talking on — thank you strace for this revelation. So the server was sitting at 100% CPU, just because of a -j DROP rule in iptables. Neat.
I'm looking for a way to discard the packets without blocking (ie, so unifi thinks the packets went out) or to redirect them to acceptable interfaces. Even if it's sourced poorly, it's better than letting it spill onto the wrong networks.
And to that end, I also tried to mangle and route them to loopback, but the packets went out the wrong interface, ignoring the routes. I figure they open sockets on the interfaces directly or something.
iptables -t mangle -A PREROUTING -d 126.96.36.199/4 -j MARK --set-mark 666 ip rule add fwmark 666 table 666 ip route add 188.8.131.52/4 dev lo table 666
I'm using the route table and the fw marks to make sure I don't null route any wanted multicasts (whitelisted elsewhere).
I think unifi bypasses the routing table alltogether. The set-mark was firing (HUGE packet counts), but the packets continued to go out the unwanted interfaces. Similar rules for other multicasts seem to work fine. It's something horrible unifi is doing (raw ip socket maybe?).
It's really not an important issue. I've simply moved the services to a different vm that only has one interface; but I'd like to know how I could do this for academic reasons. It seems like there should be a way to limit applications to interfaces you want them to be limited to.