![r/networking icon](data:image/svg+xml,<svg xmlns="http://www.w3.org/2000/svg" width="256" height="256"><rect fill-opacity="0"/></svg>){kind=small}
Multicast and VPNs
Troubleshooting
Hi my fellow networking friends. I am fairly new to this field, and very new to anything using multicast. However we have two servers using multicast across a customer provided network. Our vendor states not all of the multicast traffic is getting through, and that the customer is blocking this somewhere. Our customer claims they are not blocking anything.
When we put in a VPN tunnel between the connection, everything flows through just fine. When we remove it, it fails.
Is it possible multicast would require a VPN over a point to point connection? Thanks in advance
Sort by:
Best
Open comment sort options
Comments Section
From personal experience a lot of VPN's do not support multicast. We have a requirement to pass multicast over VPN internally and the only thing that works right is strongswan and it's not even 'official' but it works. Just very cpu intensive.
What VPN are you using?
That's what's strange, the multicast only works when we put the VPN in place. Our customer is providing us with what they say is a direct connection, but multicast is still failing. Only works when we put the VPN up. I would have to check details on the VPN as it was provided by our vendor.
Are there specific multicast IPs that the servers are using? Make sure that these IP are allowed on both ends of the network (not sure how your connection is like). If the customer claims that they are not blocking anything, have them put a rule on their firewall allowing multicast IP/s to the other end of the network. Do the same on the other end
Multicast is limited to a LAN, or with the support of your routers to your site. If you use a VPN based on GRE that is not encrypted by default you can encapsulate multicast packets. If you need encryption you can encrypt your GRE packets with IPSec. You can also use Wireguard tunnels instead of GRE+IPSec.
I have seen this before and it was caused by IGMP snooping on a providers switch pruning the multicast group. This was for IPTV stream and nothing was joining the feed on the multicast group from the other end of the PtP circuit. As a result the provider switch was pruning the multicast feed from its uplink port. They noticed it because the port connected to the broadcast server was taking 2G of traffic, but nothing was leaving the uplink port on their switch in the same Vlan. Disable igmp snooping on that Vlan and it started flowing.