March 9, 2017

Telia IPTV on Ubiquiti EdgeRouter

Network details

eth0 = internet
eth1 = LAN
eth0.252 = IPTV VLAN
LAN subnet = 192.168.1.0/24
 

Steps

1. Add new VLAN interface
clip_image001
2. For interface MAC, set MAC of your Inteno router (not sure if this is needed)

clip_image002
3. For interface DHCP / route settings set the values

clip_image003
4. For firewall create address group IPTV for multicast traffic

address-group IPTV 
{
address 239.16.116.0/24
address 239.16.117.0/24
description ""
}
5. For firewall, create two rules: IPTV_IN and IPTV_LOCAL, assign to eth0.252/in and eth0.252/local

name IPTV_IN 
{ 
default-action drop 
description "" 

rule 10 
{ 
action accept 
description "Allow established/related" 
log disable 
protocol all 
state 
{ 
established enable 
invalid disable 
new disable 
related enable 
}
} 

rule 20 
{ 
action accept 
description "Allow multicast" 
destination { 
group { 
address-group IPTV 
} 
} 
log disable 
protocol udp
} 

rule 30 
{ 
action drop 
description "Drop invalid state" 
log disable 
protocol all 
state { 
established disable 
invalid enable 
new disable 
related disable 
}
} 
} 
name IPTV_LOCAL { 
default-action drop 
description "WAN to router" 

rule 10 
{ 
action accept 
description "Allow established/related" 
log disable 
protocol all 
state { 
established enable 
related enable 
}
} 

rule 20 
{ 
action accept 
description "Allow multicast" 
destination { 
group { 
address-group IPTV
} 
} 
log disable 
protocol udp 
source { 
} 
} 

rule 30 
{ 
action accept 
description "Allow IGMP" 
log disable 
protocol igmp
} 

rule 40 
{ 
action drop 
description "Drop invalid state" 
log disable 
protocol all 
state { 
invalid enable
} 
} 
} 
6. Enable protocols -> igmp-proxy and configure for the two interfaces eth1 and eth0.252


7. Done!

Full(ish) config.boot

firewall {
    all-ping enable
    broadcast-ping disable
    group {
        address-group IPTV {
            address 239.16.116.0/24
            address 239.16.117.0/24
            description ""
        }
    }
    ipv6-receive-redirects disable
    ipv6-src-route disable
    ip-src-route disable
    log-martians enable
    name IPTV_IN {
        default-action drop
        description ""
        rule 10 {
            action accept
            description "Allow established/related"
            log disable
            protocol all
            state {
                established enable
                invalid disable
                new disable
                related enable
            }
        }
        rule 20 {
            action accept
            description "Allow multicast"
            destination {
                group {
                    address-group IPTV
                }
            }
            log disable
            protocol udp
        }
        rule 30 {
            action drop
            description "Drop invalid state"
            log disable
            protocol all
            state {
                established disable
                invalid enable
                new disable
                related disable
            }
        }
    }
    name IPTV_LOCAL {
        default-action drop
        description "WAN to router"
        rule 10 {
            action accept
            description "Allow established/related"
            log disable
            protocol all
            state {
                established enable
                related enable
            }
        }
        rule 20 {
            action accept
            description "Allow multicast"
            destination {
                group {
                    address-group IPTV
                }
            }
            log disable
            protocol udp
            source {
            }
        }
        rule 30 {
            action accept
            description "Allow IGMP"
            log disable
            protocol igmp
        }
        rule 40 {
            action drop
            description "Drop invalid state"
            log disable
            protocol all
            state {
                invalid enable
            }
        }
    }
    name WAN_IN {
        default-action drop
        description "WAN to internal"
        rule 10 {
            action accept
            description "Allow established/related"
            state {
                established enable
                related enable
            }
        }        
        rule 70 {
            action drop
            description "Drop invalid state"
            log enable
            state {
                invalid enable
            }
        }
    }
    name WAN_LOCAL {
        default-action drop
        description "WAN to router"
        rule 10 {
            action accept
            description "Allow established/related"
            state {
                established enable
                related enable
            }
        }        
        rule 60 {
            action accept
            description IGMP
            log disable
            protocol igmp
        }
        rule 70 {
            action drop
            description "Drop invalid state"
            state {
                invalid enable
            }
        }
    }
    receive-redirects disable
    send-redirects enable
    source-validation disable
    syn-cookies enable
}
interfaces {
    ethernet eth0 {
        address dhcp
        description WAN
        duplex auto
        firewall {
            in {
                name WAN_IN
            }
            local {
                name WAN_LOCAL
            }
        }
        poe {
            output off
        }
        speed auto
        vif 252 {
            address dhcp
            description IPTV
            dhcp-options {
                default-route no-update
                default-route-distance 210
                name-server no-update
            }
            firewall {
                in {
                    name IPTV_IN
                }
                local {
                    name IPTV_LOCAL
                }
            }
            mac IN:TE:NO:MA:CC:CC
        }
    }
    ethernet eth1 {
        address 192.168.1.1/24
        description LAN
        duplex auto
        poe {
            output off
        }
        speed auto
    }
    ethernet eth2 {
        disable
        duplex auto
        poe {
            output off
        }
        speed auto
    }
    ethernet eth3 {
        disable
        duplex auto
        poe {
            output off
        }
        speed auto
    }
    ethernet eth4 {
        address 192.168.10.1/24
        description Management
        duplex auto
        poe {
            output off
        }
        speed auto
    }
    ethernet eth5 {
        address dhcp
        description SFP
        duplex auto
        speed auto
    }
    loopback lo {
    }
    switch switch0 {
        description Switch0
        mtu 1500
    }
}
port-forward {
    auto-firewall enable
    hairpin-nat disable
    wan-interface eth0
}
protocols {
    igmp-proxy {
        interface eth0 {
            role disabled
            threshold 1
        }
        interface eth0.252 {
            alt-subnet 0.0.0.0/0
            role upstream
            threshold 1
        }
        interface eth1 {
            alt-subnet 192.168.1.0/24
            role downstream
            threshold 1
        }
    }
    static {
    }
}
service {
    dhcp-server {
        disabled false
        hostfile-update disable
        shared-network-name LAN {
            authoritative enable
            subnet 192.168.1.0/24 {
                default-router 192.168.1.1
                dns-server 208.67.222.222
                dns-server 208.67.220.220
                lease 86400
                start 192.168.1.50 {
                    stop 192.168.1.199
                }
            }
        }        
        use-dnsmasq disable
    }
    dns {        
        forwarding {
            cache-size 150         
            listen-on eth1
        }
    }
    gui {
        http-port 80
        https-port 443
        older-ciphers enable
    }
    nat {
        rule 5010 {
            description "masquerade for WAN"
            outbound-interface eth0
            type masquerade
        }
    }
    ssh {
        port 22
        protocol-version v2
    }
    ubnt-discover {
        disable
    }
}

Keywords: Sonera Viihde, Fibre, Fiber, sonera telia viihde iptv omalla reitittimellä






4 comments:

  1. Hello

    Im trying to follow your guide, but I cant seem to find where to make the changes in step 2 and 3, I dont know if its because i´m on a newer FW or if i´m just stupid or blind (maybe both). Can you please point me in the right direction?

    ReplyDelete
    Replies
    1. Behind Config Tree button second right of main tabs.

      Delete
    2. Added full (removed some non-public details, though) config file, if you compare it side by side with yours you should be able to make relevant changes. I don't have this up and running anymore as gave up with Telia TV, but in case it helps you get it working, you can find me at paypal.me/jussipalo.

      Delete