# IGMP Proxy - Internet Group Management Protocol Proxy

> Configure IGMP Proxy on VyOS: multicast routing, upstream/downstream interfaces, IPTV, and video streaming for Yandex Cloud and VK Cloud

Source: https://opennix.org/en/docs/vyos/routing/vyos-igmp/


IGMP Proxy makes it possible to route multicast traffic between different network segments by acting as a proxy for IGMP messages from clients.

## Overview

IGMP (Internet Group Management Protocol) is the protocol used to manage multicast groups in IPv4 networks.

**IGMP Proxy**:
- Sends IGMP host messages on behalf of connected clients
- Provides multicast routing without a full multicast routing protocol
- A simple alternative to PIM (Protocol Independent Multicast)
- Used to distribute IPTV, video streaming, and conferencing

**Standards**:
- **RFC 2236** - IGMPv2
- **RFC 3376** - IGMPv3
- **RFC 9776** - IGMPv3 update (2025)

**Use cases**:
- IPTV services
- Video conferencing
- Multicast streaming video
- Enterprise broadcasting applications
- Financial data (market data feeds)

## How IGMP Works

### IGMP in the Network

**IGMP versions**:

**IGMPv1** (RFC 1112):
- Basic functionality
- Join messages only
- Legacy version

**IGMPv2** (RFC 2236):
- Leave Group messages
- Querier election mechanism
- Max Response Time field
- Fast removal from a group

**IGMPv3** (RFC 3376, RFC 9776):
- Source-Specific Multicast (SSM)
- Include/Exclude modes
- Source filtering

### IGMP Messages

**Membership Query**:
- Sent by the router to discover group members
- General Query - for all groups
- Group-Specific Query - for a specific group

**Membership Report**:
- Sent by a host to join a group
- Periodic refreshes

**Leave Group** (IGMPv2+):
- A host leaves a multicast group
- Fast unsubscription

### Multicast Addresses

**IPv4 multicast range**: 224.0.0.0/4 (224.0.0.0 - 239.255.255.255)

**Special addresses**:
- **224.0.0.1** - All Hosts (all hosts in the subnet)
- **224.0.0.2** - All Routers (all routers)
- **224.0.0.5** - OSPF All Routers
- **224.0.0.6** - OSPF Designated Routers
- **224.0.0.9** - RIPv2
- **224.0.0.22** - IGMP
- **224.0.0.251** - mDNS
- **224.0.0.252** - LLMNR

**Organization-Local**: 239.0.0.0/8 - for private use

**IPTV ranges** (examples):
- 233.0.0.0/8 - SSM range
- 239.x.x.x - Organization-local

## IGMP Proxy Concept

### Architecture

**Upstream Interface** - the incoming interface:
- Connected to the source of multicast traffic
- Communicates with multicast data sources
- There can be only **one** upstream interface
- Usually the WAN interface or the provider-facing interface

**Downstream Interface** - the outgoing interfaces:
- Connected to client networks
- Distribute multicast data to receivers
- There can be **one or more** downstream interfaces
- Usually LAN interfaces

**How the proxy works**:
1. A client sends an IGMP Join on a downstream interface
2. IGMP Proxy receives the Join and records the subscription
3. The proxy sends an IGMP Join on the upstream interface (on its own behalf)
4. The multicast source starts sending traffic
5. The proxy forwards multicast packets to the downstream interfaces that have active subscriptions
6. On an IGMP Leave, the proxy updates the subscriptions

### Benefits

**IGMP Proxy vs Full Multicast Routing** (PIM):

| Characteristic | IGMP Proxy | PIM |
|---------------|------------|-----|
| Configuration complexity | Low | High |
| Resources | Minimal | Significant |
| Topology | Simple | Any |
| Scalability | Limited | High |
| Use case | Edge networks | Core networks |

**When to use IGMP Proxy**:
- Simple topology (one source, several receivers)
- Home/office networks
- IPTV from a provider
- Limited resources

**When to use PIM**:
- Complex topology
- Multiple sources
- Redundancy is required
- Data center multicast

## Basic Configuration

### Simple IGMP Proxy

**Scenario**: IPTV from a provider over eth0 (WAN), clients on eth1 (LAN).

```
set protocols igmp-proxy interface eth0 role upstream
set protocols igmp-proxy interface eth1 role downstream

commit
save
```

**Explanation**:
- **eth0** (upstream) - connected to the IPTV provider
- **eth1** (downstream) - LAN with IPTV clients

### Verifying the Basic Configuration

```
show protocols igmp-proxy
```

Output:
```
interface eth0 {
    role upstream
}
interface eth1 {
    role downstream
}
```

Viewing active multicast groups:
```
show igmp groups
```

Output:
```
Interface        Address         Group           Uptime
eth1             192.168.1.254   239.0.1.10      00:05:23
eth1             192.168.1.254   239.0.1.11      00:03:45
```

### Restart IGMP Proxy

After changing the configuration:
```
restart igmp-proxy
```

## Advanced Configuration

### Alternate Subnets

**Purpose**: Defines alternative sources for multicast traffic.

**Use cases**:
- The multicast source is in a different subnet
- Traffic passes through NAT
- Remote multicast sources

**Syntax**:
```
set protocols igmp-proxy interface <interface> alt-subnet <network>
```

**Example**:
```
set protocols igmp-proxy interface eth0 role upstream
set protocols igmp-proxy interface eth0 alt-subnet 10.0.0.0/23
set protocols igmp-proxy interface eth0 alt-subnet 172.16.0.0/16
set protocols igmp-proxy interface eth1 role downstream

commit
save
```

**When to use alt-subnet**:
- The multicast source has an address that is not from a directly connected subnet
- There is a router between the upstream interface and the source
- The IPTV provider uses centralized multicast servers

### Multiple Downstream Interfaces

**Scenario**: Several LAN segments.

```
set protocols igmp-proxy interface eth0 role upstream

set protocols igmp-proxy interface eth1 role downstream
set protocols igmp-proxy interface eth2 role downstream
set protocols igmp-proxy interface eth3 role downstream

commit
save
```

**Use cases**:
- Multiple VLANs for clients
- Different physical segments
- Traffic separation by department

### Threshold (TTL)

**Threshold** - the minimum TTL for forwarding multicast packets to an interface.

**Syntax**:
```
set protocols igmp-proxy interface <interface> threshold <ttl>
```

**Example**:
```
set protocols igmp-proxy interface eth0 role upstream
set protocols igmp-proxy interface eth0 threshold 1

set protocols igmp-proxy interface eth1 role downstream
set protocols igmp-proxy interface eth1 threshold 1

commit
save
```

**TTL values**:
- **1** - local network only (default)
- **32** - within the organization
- **64** - within the region
- **128** - within the continent
- **255** - global

**Use cases**:
- Limiting the spread of multicast traffic
- Preventing leaks into external networks
- Controlling the scope

### Disable Quick Leave

**Quick Leave** - fast removal from a group without additional checks.

**Disabling**:
```
set protocols igmp-proxy disable-quickleave

commit
save
```

**Default**: Quick Leave is enabled.

**When to disable it**:
- Several clients on the same downstream interface
- You need to make sure all clients have left the group
- Preventing premature termination of a stream

**Effect of disabling it**:
- The proxy sends a Group-Specific Query before removing the group
- A delay of a few seconds on Leave

## Configuration Examples

### Example 1: IPTV from a Provider (Yandex Cloud)

**Scenario**:
- VyOS router in Yandex Cloud
- WAN (eth0) - connection to the IPTV provider (external network)
- LAN (eth1) - client network 192.168.1.0/24
- IPTV multicast groups in the 239.0.0.0/8 range

**Topology**:
```
[IPTV Provider] --- eth0 (WAN) --- [VyOS] --- eth1 (LAN) --- [IPTV Clients]
  10.100.0.0/24               192.168.1.0/24
  239.0.1.10 (Channel 1)
  239.0.1.11 (Channel 2)
```

**VyOS configuration**:
```
# Interfaces
set interfaces ethernet eth0 address 10.100.0.10/24
set interfaces ethernet eth0 description 'WAN - IPTV Provider'

set interfaces ethernet eth1 address 192.168.1.1/24
set interfaces ethernet eth1 description 'LAN - IPTV Clients'

# IGMP Proxy
set protocols igmp-proxy interface eth0 role upstream
set protocols igmp-proxy interface eth0 alt-subnet 10.0.0.0/8

set protocols igmp-proxy interface eth1 role downstream

# Firewall for IGMP
set firewall ipv4 input filter rule 100 action accept
set firewall ipv4 input filter rule 100 description 'Allow IGMP'
set firewall ipv4 input filter rule 100 protocol igmp

# Firewall for multicast traffic
set firewall ipv4 input filter rule 110 action accept
set firewall ipv4 input filter rule 110 description 'Allow multicast from provider'
set firewall ipv4 input filter rule 110 source address 10.100.0.0/24
set firewall ipv4 input filter rule 110 destination address 224.0.0.0/4

# NAT (if required)
set nat source rule 100 outbound-interface name eth0
set nat source rule 100 source address 192.168.1.0/24
set nat source rule 100 translation address masquerade
# Exclude multicast from NAT
set nat source rule 90 outbound-interface name eth0
set nat source rule 90 destination address 224.0.0.0/4
set nat source rule 90 translation address 10.100.0.10

# Static routes for multicast (if needed)
set protocols static route 239.0.0.0/8 interface eth0

commit
save
```

**Verification**:
```
show protocols igmp-proxy
show igmp groups
show igmp interface eth1

# On the client
# Subscribe to a channel: igmp join 239.0.1.10 eth1
# Check the stream: tcpdump -i eth1 -n host 239.0.1.10
```

**Result**:
- Clients in 192.168.1.0/24 can subscribe to IPTV channels
- Multicast traffic passes through the proxy
- Optimized delivery (active subscriptions only)

### Example 2: Enterprise Video Broadcasting (VK Cloud)

**Scenario**:
- VyOS in VK Cloud as a multicast router
- Video server in the DMZ (eth0): 10.50.0.0/24
- Office 1 (eth1): 192.168.10.0/24
- Office 2 (eth2): 192.168.20.0/24
- Video conferences in the 239.255.0.0/16 range

**Topology**:
```
[Video Server] --- eth0 (DMZ) --- [VyOS] --- eth1 (Office 1) --- [Users]
  10.50.0.10                             |
  239.255.1.100                          |
                                         --- eth2 (Office 2) --- [Users]
```

**VyOS configuration**:
```
# Interfaces
set interfaces ethernet eth0 address 10.50.0.1/24
set interfaces ethernet eth0 description 'DMZ - Video Servers'

set interfaces ethernet eth1 address 192.168.10.1/24
set interfaces ethernet eth1 description 'Office 1 - Users'

set interfaces ethernet eth2 address 192.168.20.1/24
set interfaces ethernet eth2 description 'Office 2 - Users'

# IGMP Proxy
set protocols igmp-proxy interface eth0 role upstream
set protocols igmp-proxy interface eth0 threshold 1

set protocols igmp-proxy interface eth1 role downstream
set protocols igmp-proxy interface eth1 threshold 1

set protocols igmp-proxy interface eth2 role downstream
set protocols igmp-proxy interface eth2 threshold 1

# Disable Quick Leave (multiple clients)
set protocols igmp-proxy disable-quickleave

# Firewall for IGMP
set firewall ipv4 name LAN-TO-ROUTER rule 100 action accept
set firewall ipv4 name LAN-TO-ROUTER rule 100 description 'Allow IGMP from clients'
set firewall ipv4 name LAN-TO-ROUTER rule 100 protocol igmp

set firewall ipv4 input filter rule 100 action accept
set firewall ipv4 input filter rule 100 description 'Allow IGMP'
set firewall ipv4 input filter rule 100 protocol igmp

# Firewall for multicast streams
set firewall ipv4 name DMZ-TO-LAN rule 100 action accept
set firewall ipv4 name DMZ-TO-LAN rule 100 description 'Allow multicast video'
set firewall ipv4 name DMZ-TO-LAN rule 100 source address 10.50.0.0/24
set firewall ipv4 name DMZ-TO-LAN rule 100 destination address 239.255.0.0/16

# QoS for video traffic (optional)
set qos policy shaper VIDEO-SHAPER bandwidth 100mbit
set qos policy shaper VIDEO-SHAPER default bandwidth 50%
set qos policy shaper VIDEO-SHAPER default queue-type fair-queue

set qos policy shaper VIDEO-SHAPER class 10 bandwidth 30%
set qos policy shaper VIDEO-SHAPER class 10 description 'Multicast Video'
set qos policy shaper VIDEO-SHAPER class 10 match MULTICAST ip destination address 239.255.0.0/16
set qos policy shaper VIDEO-SHAPER class 10 priority 1

set qos interface eth1 egress VIDEO-SHAPER
set qos interface eth2 egress VIDEO-SHAPER

commit
save
```

**Verification**:
```
show protocols igmp-proxy
show igmp groups
show igmp interface
show igmp statistics

# QoS statistics
show qos interface eth1
show qos interface eth2
```

**Monitoring multicast traffic**:
```
# On the router
tcpdump -i eth0 -n host 239.255.1.100

# Interface statistics
show interfaces ethernet eth0
show interfaces ethernet eth1
show interfaces ethernet eth2
```

### Example 3: IGMP over a VPN Tunnel

**Scenario**:
- Main office with a multicast source
- Remote office over an IPsec VPN
- IGMP over a VTI interface

**Topology**:
```
[Multicast Source] --- eth1 --- [HQ VyOS] --- vti0 (VPN) --- [Remote VyOS] --- eth1 --- [Clients]
  10.10.0.0/24                    172.16.0.1/30              172.16.0.2/30        192.168.100.0/24
```

**HQ Router**:
```
# VTI interface for the VPN
set interfaces vti vti0 address 172.16.0.1/30

# IGMP Proxy
set protocols igmp-proxy interface eth1 role upstream
set protocols igmp-proxy interface eth1 alt-subnet 10.10.0.0/24

set protocols igmp-proxy interface vti0 role downstream
set protocols igmp-proxy interface vti0 threshold 64

commit
save
```

**Remote Router**:
```
# VTI interface for the VPN
set interfaces vti vti0 address 172.16.0.2/30

# IGMP Proxy
set protocols igmp-proxy interface vti0 role upstream
set protocols igmp-proxy interface vti0 alt-subnet 10.10.0.0/24

set protocols igmp-proxy interface eth1 role downstream

commit
save
```

**IPsec configuration** (on both routers):
```
# Phase 1 (IKE)
set vpn ipsec ike-group IKE-GROUP proposal 1 encryption aes256
set vpn ipsec ike-group IKE-GROUP proposal 1 hash sha256
set vpn ipsec ike-group IKE-GROUP lifetime 28800

# Phase 2 (ESP)
set vpn ipsec esp-group ESP-GROUP proposal 1 encryption aes256
set vpn ipsec esp-group ESP-GROUP proposal 1 hash sha256
set vpn ipsec esp-group ESP-GROUP lifetime 3600

# Site-to-Site VPN with VTI
set vpn ipsec site-to-site peer 203.0.113.2 authentication mode pre-shared-secret
set vpn ipsec site-to-site peer 203.0.113.2 authentication pre-shared-secret 'SecureKey123!'
set vpn ipsec site-to-site peer 203.0.113.2 ike-group IKE-GROUP
set vpn ipsec site-to-site peer 203.0.113.2 vti bind vti0

commit
save
```

### Example 4: IGMP with VLANs

**Scenario**:
- Provider on VLAN 100
- Clients on VLAN 10, 20, 30

**VyOS configuration**:
```
# VLAN interfaces
set interfaces ethernet eth0 vif 100 address 10.100.0.10/24
set interfaces ethernet eth0 vif 100 description 'VLAN 100 - Provider'

set interfaces ethernet eth1 vif 10 address 192.168.10.1/24
set interfaces ethernet eth1 vif 10 description 'VLAN 10 - Office A'

set interfaces ethernet eth1 vif 20 address 192.168.20.1/24
set interfaces ethernet eth1 vif 20 description 'VLAN 20 - Office B'

set interfaces ethernet eth1 vif 30 address 192.168.30.1/24
set interfaces ethernet eth1 vif 30 description 'VLAN 30 - Office C'

# IGMP Proxy
set protocols igmp-proxy interface eth0.100 role upstream
set protocols igmp-proxy interface eth0.100 alt-subnet 10.0.0.0/8

set protocols igmp-proxy interface eth1.10 role downstream
set protocols igmp-proxy interface eth1.20 role downstream
set protocols igmp-proxy interface eth1.30 role downstream

commit
save
```

## Operational Commands

### Show Commands

**IGMP Proxy configuration**:
```
show protocols igmp-proxy
```

Output:
```
interface eth0 {
    alt-subnet 10.0.0.0/23
    role upstream
    threshold 1
}
interface eth1 {
    role downstream
    threshold 1
}
```

**IGMP Groups**:
```
show igmp groups
```

Output:
```
Interface        Address         Group           Uptime    Expires
eth1             192.168.1.1     239.0.1.10      00:10:15  00:04:23
eth1             192.168.1.1     239.0.1.11      00:05:33  00:04:45
eth2             192.168.2.1     239.0.1.10      00:08:42  00:04:18
```

**IGMP Interface**:
```
show igmp interface
```

Output:
```
Interface  State  Address      V  Querier  Query Timer  Uptime
eth0       up     10.100.0.10  3  local    00:00:58     00:15:23
eth1       up     192.168.1.1  3  local    00:00:45     00:15:23
eth2       up     192.168.2.1  3  local    00:00:52     00:15:23
```

**Interface details**:
```
show igmp interface eth1
```

Output:
```
Interface eth1:
  State: up
  Address: 192.168.1.1
  Version: 3
  Querier: local
  Query Interval: 125s
  Query Timer: 00:00:58
  Other Querier Present Timer: 00:00:00
  Uptime: 00:15:23
  Multicast routing: enabled
```

**IGMP Statistics**:
```
show igmp statistics
```

Output:
```
Interface eth1:
  IGMP queries sent: 152
  IGMP queries received: 0
  IGMP reports sent: 45
  IGMP reports received: 287
  IGMP leaves sent: 12
  IGMP leaves received: 35
  IGMP v1 reports received: 0
  IGMP v2 reports received: 156
  IGMP v3 reports received: 131
```

### Management Commands

**Restart IGMP Proxy**:
```
restart igmp-proxy
```

**Clear IGMP groups** (reset subscriptions):
```
# There is no direct command in VyOS, use restart
restart igmp-proxy
```

## Troubleshooting

### Clients Are Not Receiving Multicast Traffic

**Problem**: Subscribing to a multicast group does not work.

**Checks**:

1. **IGMP Proxy is running**:
   ```
   show protocols igmp-proxy
   ```

2. **Interfaces are configured correctly**:
   ```
   show igmp interface
   ```

   Make sure that:
   - There is only one upstream interface
   - The downstream interfaces have the correct role
   - Multicast routing is enabled

3. **IGMP groups are visible**:
   ```
   show igmp groups
   ```

   There should be active subscriptions.

4. **Multicast traffic reaches the upstream**:
   ```
   tcpdump -i eth0 -n host 239.0.1.10
   ```

5. **Firewall rules**:
   ```
   show firewall
   ```

   Verify that IGMP and multicast traffic is allowed:
   ```
   set firewall ipv4 input filter rule 100 action accept
   set firewall ipv4 input filter rule 100 protocol igmp

   set firewall ipv4 input filter rule 110 action accept
   set firewall ipv4 input filter rule 110 destination address 224.0.0.0/4

   commit
   ```

6. **Routing for multicast**:
   ```
   show ip route 239.0.1.10
   ```

   A static route may be required:
   ```
   set protocols static route 239.0.0.0/8 interface eth0
   commit
   ```

### IGMP Join Does Not Reach the Upstream

**Problem**: The IGMP proxy is not sending a Join on the upstream interface.

**Checks**:

1. **The downstream receives a Join from the client**:
   ```
   tcpdump -i eth1 -n igmp
   ```

   You should see an IGMP Membership Report.

2. **The upstream sends a Join**:
   ```
   tcpdump -i eth0 -n igmp
   ```

   An IGMP Join for the group should be sent.

3. **Alternate subnet is configured** (if the source is in a different subnet):
   ```
   set protocols igmp-proxy interface eth0 alt-subnet 10.0.0.0/8
   commit
   ```

4. **Restart the proxy**:
   ```
   restart igmp-proxy
   ```

5. **System logs**:
   ```
   show log | match igmp
   ```

### Multicast Source in a Different Subnet

**Problem**: The multicast source has an IP that is not from the directly connected network of the upstream interface.

**Solution**: Use `alt-subnet`.

**Example**:
```
# Upstream interface: 10.100.0.10/24
# Multicast source: 172.16.50.100

set protocols igmp-proxy interface eth0 alt-subnet 172.16.0.0/16
commit
save
```

**Verification**:
```
show protocols igmp-proxy interface eth0
```

### Delay on Leave Group

**Problem**: After a Leave Group, traffic keeps flowing for a few seconds.

**Cause**: Quick Leave is disabled, or there are multiple clients on the interface.

**Solution 1** - Enable Quick Leave (single client only):
```
delete protocols igmp-proxy disable-quickleave
commit
```

**Solution 2** - Adjust the IGMP Query Interval (reduce the interval):
```
# This is done on the provider's upstream router
# VyOS IGMP Proxy has no direct Query Interval settings
```

**Workaround** - Restart the proxy after bulk changes:
```
restart igmp-proxy
```

### High Load from Multicast Traffic

**Problem**: Excessive multicast traffic is overloading the network.

**Solution**:

1. **Threshold to limit propagation**:
   ```
   set protocols igmp-proxy interface eth1 threshold 1
   commit
   ```

2. **QoS for prioritization**:
   ```
   set qos policy shaper MULTICAST-LIMIT bandwidth 50mbit
   set qos policy shaper MULTICAST-LIMIT class 10 bandwidth 20mbit
   set qos policy shaper MULTICAST-LIMIT class 10 match VIDEO ip destination address 239.0.0.0/8

   set qos interface eth1 egress MULTICAST-LIMIT
   commit
   ```

3. **Firewall rate limiting**:
   ```
   set firewall ipv4 name LAN-LOCAL rule 100 action accept
   set firewall ipv4 name LAN-LOCAL rule 100 destination address 224.0.0.0/4
   set firewall ipv4 name LAN-LOCAL rule 100 limit rate 10/second

   set firewall ipv4 input filter rule 100 jump-target LAN-LOCAL
   commit
   ```

### IGMP Versions Do Not Match

**Problem**: Clients use IGMPv3, the provider uses IGMPv2.

**Solution**: VyOS IGMP Proxy supports automatic version conversion.

**Check the version**:
```
show igmp interface eth0
```

The output shows:
```
Version: 2
```

or
```
Version: 3
```

**Compatibility**:
- IGMPv3 is backward compatible with IGMPv2
- IGMPv2 is backward compatible with IGMPv1
- The proxy adapts automatically

### Multicast over NAT

**Problem**: Multicast does not work over NAT.

**Solution**: Exclude multicast from NAT, use alt-subnet.

**Configuration**:
```
# Exclude multicast from NAT
set nat source rule 90 outbound-interface name eth0
set nat source rule 90 destination address 224.0.0.0/4
set nat source rule 90 translation address <router-wan-ip>

# Main NAT rule
set nat source rule 100 outbound-interface name eth0
set nat source rule 100 source address 192.168.1.0/24
set nat source rule 100 translation address masquerade

# Alt-subnet for the upstream
set protocols igmp-proxy interface eth0 alt-subnet 10.0.0.0/8

commit
save
```

## Monitoring and Logging

### Continuous Monitoring

**Monitoring IGMP groups**:
```
watch -n 5 'show igmp groups'
```

**Monitoring multicast traffic**:
```
# Inbound on the upstream
tcpdump -i eth0 -n multicast

# Outbound on the downstream
tcpdump -i eth1 -n multicast

# A specific group
tcpdump -i eth1 -n host 239.0.1.10
```

**Bandwidth monitoring**:
```
# Install bmon
sudo apt update
sudo apt install bmon

# Run
bmon -p eth0,eth1

# Or use iftop
sudo iftop -i eth1 -f 'dst net 224.0.0.0/4'
```

### Logging

**System logs**:
```
show log tail 100 | match igmp
```

**Syslog for IGMP**:
```
set system syslog global facility protocols level info
commit
```

**External syslog server**:
```
set system syslog host 192.168.1.100 facility protocols level info
set system syslog host 192.168.1.100 port 514
commit
```

**Viewing logs**:
```
show log | match igmp
show log tail 50 | match "multicast|igmp"
```

## Best Practices

### Configuration

1. **Single upstream interface**:
   - IGMP Proxy requires exactly one upstream
   - For redundancy, use VRRP + IGMP Proxy on both routers

2. **Alt-subnet for providers**:
   - Always configure alt-subnet if the source is not in a directly connected network
   - Include wide ranges (10.0.0.0/8)

3. **Threshold management**:
   - Use threshold 1 for local networks
   - Increase it for WAN tunnels

4. **Quick Leave**:
   - Leave it enabled for home networks (single client)
   - Disable it for enterprise networks (multiple clients)

5. **Firewall**:
   - Always allow the IGMP protocol
   - Allow multicast addresses (224.0.0.0/4)
   - Use rate limiting for protection

### Security

1. **Firewall for IGMP**:
   ```
   set firewall ipv4 input filter rule 100 action accept
   set firewall ipv4 input filter rule 100 protocol igmp
   set firewall ipv4 input filter rule 100 source address 192.168.0.0/16
   ```

2. **Restricting multicast groups**:
   ```
   set firewall ipv4 input filter rule 110 action accept
   set firewall ipv4 input filter rule 110 destination address 239.0.0.0/16
   set firewall ipv4 input filter rule 110 description 'Allow only company multicast'
   ```

3. **Rate limiting IGMP**:
   ```
   set firewall ipv4 input filter rule 100 limit rate 10/second
   ```

4. **Drop unknown multicast**:
   ```
   set firewall ipv4 input filter rule 999 action drop
   set firewall ipv4 input filter rule 999 destination address 224.0.0.0/4
   set firewall ipv4 input filter rule 999 description 'Drop unknown multicast'
   ```

### Performance

1. **QoS for video**:
   ```
   set qos policy shaper VIDEO bandwidth 100mbit
   set qos policy shaper VIDEO class 10 bandwidth 50%
   set qos policy shaper VIDEO class 10 match MULTICAST ip destination address 239.0.0.0/8
   set qos policy shaper VIDEO class 10 priority 1

   set qos interface eth1 egress VIDEO
   commit
   ```

2. **Bandwidth monitoring**:
   - Regularly check usage via `show interfaces`
   - Use external monitoring (Zabbix, Prometheus)

3. **Hardware acceleration**:
   - Use hardware offloading if available
   - Check `ethtool -k eth0` for offload options

### Scaling

1. **Number of groups**:
   - IGMP Proxy supports hundreds of groups
   - For thousands of groups, use PIM

2. **Number of downstream interfaces**:
   - There is no hard limit
   - Limited by the router's performance

3. **Bandwidth**:
   - Keep in mind that multicast is multiplied by the number of downstream interfaces
   - A 10 Mbps stream over 5 interfaces = 50 Mbps from the router

## Integration with Other Protocols

### IGMP Proxy + OSPF

**Scenario**: IGMP Proxy on an edge router, OSPF for unicast routing.

```
# OSPF
set protocols ospf parameters router-id 10.0.0.1
set protocols ospf area 0 network 192.168.0.0/16

# IGMP Proxy
set protocols igmp-proxy interface eth0 role upstream
set protocols igmp-proxy interface eth1 role downstream

commit
```

**Important**: IGMP Proxy operates independently of OSPF.

### IGMP Proxy + BGP

**Scenario**: BGP for the Internet, IGMP for multicast from the provider.

```
# BGP
set protocols bgp system-as 65001
set protocols bgp neighbor 203.0.113.1 remote-as 65000

# IGMP Proxy
set protocols igmp-proxy interface eth0 role upstream
set protocols igmp-proxy interface eth1 role downstream

commit
```

### IGMP Proxy + VPN (IPsec)

**Scenario**: Multicast over a VPN tunnel.

See Example 3 above - IGMP over VTI.

**Key points**:
- Use VTI (not a policy-based VPN)
- Configure alt-subnet for the remote network
- Increase the threshold for the VPN interface

### IGMP Proxy + VRRP

**Scenario**: Redundancy with VRRP, IGMP Proxy on both routers.

**Router 1**:
```
# VRRP
set high-availability vrrp group 1 interface eth0
set high-availability vrrp group 1 vrid 1
set high-availability vrrp group 1 virtual-address 192.168.1.254/24
set high-availability vrrp group 1 priority 200

# IGMP Proxy
set protocols igmp-proxy interface eth0 role upstream
set protocols igmp-proxy interface eth1 role downstream

commit
```

**Router 2**:
```
# VRRP
set high-availability vrrp group 1 interface eth0
set high-availability vrrp group 1 vrid 1
set high-availability vrrp group 1 virtual-address 192.168.1.254/24
set high-availability vrrp group 1 priority 100

# IGMP Proxy
set protocols igmp-proxy interface eth0 role upstream
set protocols igmp-proxy interface eth1 role downstream

commit
```

**Note**: Both routers run IGMP Proxy, but only the master is active.

## Comparison with PIM

### IGMP Proxy vs PIM-SM

| Characteristic | IGMP Proxy | PIM-SM |
|---------------|------------|---------|
| Complexity | Low | High |
| Configuration | Minimal | Extensive |
| Topology | Simple (tree) | Any (mesh) |
| Redundancy | Limited | Full |
| Scalability | Up to hundreds of groups | Thousands of groups |
| RP (Rendezvous Point) | Not required | Required |
| Multiple sources | Limited | Full support |
| CPU/Memory | Low | Medium |
| Use case | Edge networks | Core networks |

### When to Use Which

**IGMP Proxy**:
- Home/office networks
- IPTV from a provider
- Simple topology (single source)
- Limited resources

**PIM-SM**:
- Data center multicast
- Multiple sources and receivers
- Redundancy is critical
- Complex topology

## Diagnostics from the Client Side

### Linux Client

**Subscribing to a group**:
```bash
# Install smcroute
sudo apt install smcroute

# Subscribe
sudo smcroute -j eth0 239.0.1.10

# View subscriptions
ip maddr show dev eth0
```

**Listening to multicast**:
```bash
# Using socat
socat UDP4-RECV:5000,ip-add-membership=239.0.1.10:eth0 STDOUT

# Using VLC
vlc udp://@239.0.1.10:5000
```

**Sending multicast** (testing):
```bash
# Send packets
echo "Test multicast" | socat - UDP4-DATAGRAM:239.0.1.10:5000,bind=:0
```

### Windows Client

**Viewing multicast groups**:
```cmd
netsh interface ipv4 show joins
```

**Testing with VLC**:
1. Open VLC Media Player
2. Media → Open Network Stream
3. Enter: `udp://@239.0.1.10:5000`
4. Play

### Packet Capture

**tcpdump for IGMP**:
```bash
# All IGMP messages
sudo tcpdump -i eth1 -vv igmp

# IGMP with details
sudo tcpdump -i eth1 -vv -n igmp

# Save to a file
sudo tcpdump -i eth1 -w igmp-capture.pcap igmp
```

**tcpdump for a multicast stream**:
```bash
# A specific group
sudo tcpdump -i eth1 -n host 239.0.1.10

# All multicast
sudo tcpdump -i eth1 -n 'dst net 224.0.0.0/4'

# With a packet count
sudo tcpdump -i eth1 -n host 239.0.1.10 -c 100
```

**Wireshark filters**:
```
igmp
ip.dst == 239.0.1.10
ip.dst >= 224.0.0.0 and ip.dst <= 239.255.255.255
```

## Automation and Scripts

### Monitoring Script

**Bash script to check IGMP groups**:
```bash
#!/bin/bash

# igmp-monitor.sh
# Monitor IGMP groups

EXPECTED_GROUPS="239.0.1.10 239.0.1.11"
LOG_FILE="/var/log/igmp-monitor.log"

check_groups() {
    local missing=0

    for group in $EXPECTED_GROUPS; do
        if ! sudo vtysh -c "show igmp groups" | grep -q "$group"; then
            echo "$(date): WARNING - Group $group is missing" >> "$LOG_FILE"
            missing=1
        fi
    done

    if [ $missing -eq 0 ]; then
        echo "$(date): OK - All groups present" >> "$LOG_FILE"
    fi

    return $missing
}

# Run the check
check_groups

# Print statistics
echo "Current IGMP groups:"
sudo vtysh -c "show igmp groups"
```

**Adding to cron**:
```bash
# Every 5 minutes
*/5 * * * * /usr/local/bin/igmp-monitor.sh
```

### Auto-restart Script

**Script for automatic restart**:
```bash
#!/bin/bash

# igmp-watchdog.sh
# Automatically restart IGMP Proxy

MAX_RETRY=3
RETRY_COUNT=0

check_igmp() {
    # Check that IGMP Proxy is running
    if pgrep -x "igmpproxy" > /dev/null; then
        return 0
    else
        return 1
    fi
}

while [ $RETRY_COUNT -lt $MAX_RETRY ]; do
    if check_igmp; then
        echo "$(date): IGMP Proxy is running"
        exit 0
    else
        echo "$(date): IGMP Proxy not running, restarting..."
        sudo /opt/vyatta/bin/vyatta-op-cmd-wrapper restart igmp-proxy
        RETRY_COUNT=$((RETRY_COUNT + 1))
        sleep 10
    fi
done

echo "$(date): ERROR - Failed to restart IGMP Proxy after $MAX_RETRY attempts"
exit 1
```

## References and Resources

### RFC Documents

- **RFC 1112** - Host Extensions for IP Multicasting (IGMPv1)
- **RFC 2236** - Internet Group Management Protocol, Version 2
- **RFC 3376** - Internet Group Management Protocol, Version 3
- **RFC 9776** - Internet Group Management Protocol, Version 3 (2025 update)
- **RFC 4605** - Internet Group Management Protocol (IGMP) / Multicast Listener Discovery (MLD)-Based Multicast Forwarding ("IGMP/MLD Proxying")

### VyOS Documentation

- [VyOS IGMP Proxy Documentation](https://docs.vyos.io/en/latest/configuration/protocols/igmp-proxy.html)
- [VyOS Multicast Routing](https://docs.vyos.io/en/latest/configuration/protocols/multicast.html)
- [VyOS PIM Configuration](https://docs.vyos.io/en/latest/configuration/protocols/pim.html)

### Useful Tools

- **igmpproxy** - IGMP Proxy daemon (used by VyOS)
- **smcroute** - Multicast routing tool
- **VLC** - Media player with multicast support
- **iperf** - Network performance testing (multicast mode)
- **tcpdump** - Packet capture
- **Wireshark** - Packet analyzer

### Community

- [VyOS Forum](https://forum.vyos.io/)
- [VyOS Phabricator](https://vyos.dev/)
- [GitHub VyOS](https://github.com/vyos)

## Next Steps

After configuring IGMP Proxy, we recommend exploring:

- **[PIM (Protocol Independent Multicast)](/docs/vyos/routing/vyos-pim)** - for complex multicast topologies
- **[QoS (Quality of Service)](/docs/vyos/qos/)** - for prioritizing multicast traffic
- **[Firewall](/docs/vyos/firewall/vyos-firewall/)** - for protecting multicast networks
- **[VPN (IPsec/WireGuard)](/docs/vyos/vpn/)** - for multicast over tunnels
- **[VRRP](/docs/vyos/ha/)** - for redundancy

## Conclusion

IGMP Proxy is an effective solution for distributing multicast traffic in simple topologies. Proper configuration of upstream/downstream interfaces, along with the use of alt-subnet and firewall rules, ensures stable operation of IPTV and video streaming in Yandex Cloud and VK Cloud networks.

**Key points**:
- One upstream, one or more downstream
- Alt-subnet for remote sources
- Firewall for IGMP and multicast
- QoS for prioritizing video traffic
- Monitoring of groups and bandwidth