Centos 6.3 Server ignoring IGMP Queries

Question

I am using a CentOS 6.3 server to subscribe to UDP multicast data, and I noticed that my server doesn't answer the IGMP queries sent by the switch it is connected to.

As a result, when I open my multicast socket, I start receiving multicast data, but this stops when my IGMP subscription times out. The server doesn't renew its IGMP subscriptions, so the switch cuts off the multicast stream.

(To insure that the problem doesn't come from any code of mine, I am using smcroute to open multicast subscriptions.)

Here is a screenshot of the IGMP communications on any interface of my server:

http://img521.imageshack.us/img521/9953/capture10y.png

As we can see, my server first sends 2 IGMP joins, but a few minutes later when the switch sends the IGMP group membership query, the kernel doesn't answer.

The version of the IGMP protocol set for the affected interface is V2:

[root@localhost ~]# cat /proc/net/igmp
Idx Device    : Count Querier   Group    Users Timer    Reporter
1   lo        :     0      V2
                010000E0     1 0:00000000       0
2   eth0      :     5      V2
                FB0000E0     1 0:00000000       1
                010000E0     1 0:00000000       0
5   tap0      :     5      V3
                FB0000E0     1 0:00000000       0
            010000E0     1 0:00000000       0
7   eth1.371:    13      V2
            414000E0     1 0:00000000       1
            404000E0     1 0:00000000       1
            3F4000E0     1 0:00000000       1
            504000E0     1 0:00000000       1
            524000E0     1 0:00000000       1
            494000E0     1 0:00000000       1
            4A4000E0     1 0:00000000       1
            4B4000E0     1 0:00000000       1
            FB0000E0     1 0:00000000       0
            010000E0     1 0:00000000       0

The rp_filter is disabled on this interface:

[root@localhost ~]# cat /proc/sys/net/ipv4/conf/eth1.371/rp_filter 
0

Warren Young · Answer 1 · 2014-06-12T20:53:33.363

I saw the same symptom — kernel apparently ignoring IGMP group membership queries from the router — on a CentOS 5 server. I tracked the problem down to a "deny by default" firewall configuration.

You, like me, probably didn't sit down and think about IGMP when implementing your firewall. The CentOS system-config-firewall tool doesn't even ask about IGMP, much less give you a way to configure the firewall's response to IGMP packets.

The problem is this: If you have your firewall configured to reject everything not specifically permitted, the firewall will block inbound IGMP group membership queries from the LAN's gateway router and/or IGMP-aware switches. The kernel doesn't get to peek around the firewall and see these packets, so it never responds to them if you don't let them through. The switch/router thus decides after some time that no one on your leg of the network is listening to this multicast stream, so it stops forwarding to that leg.

To fix it, you need to add the following line to your /etc/sysconfig/iptables file, somewhere in the middle of the file, between the definitions at the top and the REJECT rules at the bottom:

-A INPUT -p igmp -j ACCEPT

This says all IGMP packets are allowed, without restriction.

Say service iptables restart to make the new rule take effect.

A quick way to test whether my solution can work for you is to say service iptables stop, and see if IGMP suddenly starts working correctly. Obviously you can only do this on a peaceful network, where dropping the firewall briefly is not a serious security risk.

Centos 6.3 Server ignoring IGMP Queries

1 Answers1