Documentation
VyOS Documentation
VyOS Services
UDP Broadcast Relay

UDP Broadcast Relay

UDP Broadcast Relay is a service for forwarding UDP broadcast packets between different network segments and VLANs.

Overview

UDP Broadcast Relay solves the problem of broadcast domain isolation, allowing services that rely on UDP broadcast for discovery to work across network boundaries.

Key features

  • Forwarding UDP broadcast between interfaces and VLANs
  • Support for up to 99 independent relay configurations
  • Filtering by UDP port
  • Protection against broadcast storms
  • Ability to specify a source IP for outgoing packets
  • Independent enabling/disabling of a relay without deleting its configuration

Typical use cases

  1. DHCP Relay - forwarding DHCP requests between subnets
  2. NETBIOS/WINS - discovering Windows network resources
  3. Wake-on-LAN (WoL) - remotely powering on computers across VLANs
  4. SONOS/UPnP/SSDP - discovering media devices on multicast networks
  5. Network equipment - discovering printers, IP cameras, and access points
  6. Game consoles - discovering games and devices on the local network

How it works

  1. VyOS listens for UDP broadcast on the specified interfaces
  2. When a broadcast packet is received on the specified port, it is retransmitted to all other interfaces in the group
  3. The packet is sent as a broadcast on each interface
  4. A protection mechanism prevents retransmission loops

Basic configuration

Command structure

set service broadcast-relay id <relay-id>
  ├── description <text>
  ├── interface <interface>
  ├── port <udp-port>
  └── address <source-ip>

Minimal configuration

The simplest relay between two interfaces:

set service broadcast-relay id 1 interface eth0
set service broadcast-relay id 1 interface eth1
set service broadcast-relay id 1 port 9
commit

Configuration parameters

Relay ID

A unique identifier for the relay group (1-99):

set service broadcast-relay id 1

You can create up to 99 independent relay configurations.

Interfaces

Interfaces used for retransmitting broadcast packets:

set service broadcast-relay id 1 interface eth0
set service broadcast-relay id 1 interface eth1
set service broadcast-relay id 1 interface eth0.10
set service broadcast-relay id 1 interface eth0.20

Supported types:

  • Physical interfaces (eth0, eth1)
  • VLAN interfaces (eth0.10, eth0.100)
  • Bridge interfaces (br0)
  • Bonding interfaces (bond0)

UDP port

Specifying a UDP port for filtering:

set service broadcast-relay id 1 port 67

The relay will process only broadcast traffic on the specified UDP port.

Description

A text description for the relay group:

set service broadcast-relay id 1 description 'DHCP Relay between VLANs'

Source Address (optional)

Specifying a source IP for outgoing packets:

set service broadcast-relay id 1 address 192.168.1.1

Useful for controlling the packet source in routed networks.

Disabling without deleting

Temporarily disabling a relay:

set service broadcast-relay id 1 disable

The configuration is preserved, but the relay is inactive.

Common configurations

DHCP Relay

Forwarding DHCP requests (ports 67/68) between VLANs:

# DHCP Server Request (port 67)
set service broadcast-relay id 1 description 'DHCP Relay'
set service broadcast-relay id 1 interface eth0.10
set service broadcast-relay id 1 interface eth0.20
set service broadcast-relay id 1 interface eth0.30
set service broadcast-relay id 1 port 67
commit

Important: For a full-featured DHCP relay, it is recommended to use the built-in service dhcp-relay:

set service dhcp-relay interface eth0.10
set service dhcp-relay interface eth0.20
set service dhcp-relay server 192.168.1.1

NETBIOS Name Service

Discovering Windows resources (port 137):

set service broadcast-relay id 2 description 'NETBIOS Name Service'
set service broadcast-relay id 2 interface eth0
set service broadcast-relay id 2 interface eth1
set service broadcast-relay id 2 interface eth2
set service broadcast-relay id 2 port 137
commit

Wake-on-LAN (WoL)

Forwarding magic packets for remote power-on (port 9):

set service broadcast-relay id 3 description 'Wake-on-LAN'
set service broadcast-relay id 3 interface eth0.10
set service broadcast-relay id 3 interface eth0.20
set service broadcast-relay id 3 interface eth0.30
set service broadcast-relay id 3 port 9
commit

Port 7 is also supported (used by some WoL implementations):

set service broadcast-relay id 4 description 'Wake-on-LAN (port 7)'
set service broadcast-relay id 4 interface eth0.10
set service broadcast-relay id 4 interface eth0.20
set service broadcast-relay id 4 port 7
commit

SONOS Discovery

Discovering SONOS audio systems (port 1900 - SSDP):

set service broadcast-relay id 5 description 'SONOS Discovery'
set service broadcast-relay id 5 interface eth3
set service broadcast-relay id 5 interface eth4
set service broadcast-relay id 5 interface eth5
set service broadcast-relay id 5 port 1900
commit

UPnP/SSDP

Universal Plug and Play discovery (port 1900):

set service broadcast-relay id 6 description 'UPnP/SSDP Discovery'
set service broadcast-relay id 6 interface eth0.100
set service broadcast-relay id 6 interface eth0.200
set service broadcast-relay id 6 port 1900
commit

Chromecast Discovery

Google Chromecast uses mDNS (port 5353):

set service broadcast-relay id 7 description 'Chromecast mDNS'
set service broadcast-relay id 7 interface eth0.10
set service broadcast-relay id 7 interface eth0.20
set service broadcast-relay id 7 port 5353
commit

Printers and scanners

Discovering network printers (SNMP trap - port 161):

set service broadcast-relay id 8 description 'Network Printers'
set service broadcast-relay id 8 interface eth0.50
set service broadcast-relay id 8 interface eth0.60
set service broadcast-relay id 8 port 161
commit

Practical scenarios

Scenario 1: Corporate network with VLANs

Goal: Enable DHCP and Wake-on-LAN across departmental VLANs.

Topology:

  • VLAN 10 - Management (192.168.10.0/24)
  • VLAN 20 - Development (192.168.20.0/24)
  • VLAN 30 - Production (192.168.30.0/24)
  • DHCP server: 192.168.10.5

Configuration:

# DHCP Relay between all VLANs
set service broadcast-relay id 1 description 'Corporate DHCP Relay'
set service broadcast-relay id 1 interface eth0.10
set service broadcast-relay id 1 interface eth0.20
set service broadcast-relay id 1 interface eth0.30
set service broadcast-relay id 1 port 67

# Wake-on-LAN between VLANs
set service broadcast-relay id 2 description 'Corporate WoL'
set service broadcast-relay id 2 interface eth0.10
set service broadcast-relay id 2 interface eth0.20
set service broadcast-relay id 2 interface eth0.30
set service broadcast-relay id 2 port 9

commit

Scenario 2: Home multimedia network

Goal: SONOS, Chromecast, and Smart TVs must be discoverable between the guest and home networks.

Topology:

  • VLAN 100 - Home (192.168.100.0/24)
  • VLAN 200 - Guest (192.168.200.0/24)
  • VLAN 300 - IoT (192.168.300.0/24)

Configuration:

# SONOS Discovery
set service broadcast-relay id 10 description 'SONOS Audio'
set service broadcast-relay id 10 interface eth0.100
set service broadcast-relay id 10 interface eth0.300
set service broadcast-relay id 10 port 1900

# Chromecast mDNS
set service broadcast-relay id 11 description 'Chromecast'
set service broadcast-relay id 11 interface eth0.100
set service broadcast-relay id 11 interface eth0.200
set service broadcast-relay id 11 interface eth0.300
set service broadcast-relay id 11 port 5353

# UPnP for Smart TVs
set service broadcast-relay id 12 description 'Smart TV UPnP'
set service broadcast-relay id 12 interface eth0.100
set service broadcast-relay id 12 interface eth0.300
set service broadcast-relay id 12 port 1900

commit

Scenario 3: Data center with isolated zones

Goal: Enable centralized management through Wake-on-LAN and PXE boot.

Topology:

  • VLAN 500 - Management (10.0.0.0/24)
  • VLAN 501 - DMZ Servers (10.0.1.0/24)
  • VLAN 502 - Internal Servers (10.0.2.0/24)
  • VLAN 503 - Database Zone (10.0.3.0/24)

Configuration:

# Wake-on-LAN for all server zones
set service broadcast-relay id 20 description 'Datacenter WoL'
set service broadcast-relay id 20 interface eth0.500
set service broadcast-relay id 20 interface eth0.501
set service broadcast-relay id 20 interface eth0.502
set service broadcast-relay id 20 interface eth0.503
set service broadcast-relay id 20 port 9
set service broadcast-relay id 20 address 10.0.0.1

# TFTP for PXE Boot
set service broadcast-relay id 21 description 'PXE Boot TFTP'
set service broadcast-relay id 21 interface eth0.500
set service broadcast-relay id 21 interface eth0.501
set service broadcast-relay id 21 interface eth0.502
set service broadcast-relay id 21 port 69
set service broadcast-relay id 21 address 10.0.0.1

commit

Scenario 4: Multiple offices over VPN

Goal: Relay broadcast between VPN interfaces to discover network resources.

Topology:

  • Local LAN - eth1 (192.168.1.0/24)
  • VPN Office 1 - wg0 (10.10.1.0/24)
  • VPN Office 2 - wg1 (10.10.2.0/24)

Configuration:

# NETBIOS between offices
set service broadcast-relay id 30 description 'Inter-Office NETBIOS'
set service broadcast-relay id 30 interface eth1
set service broadcast-relay id 30 interface wg0
set service broadcast-relay id 30 interface wg1
set service broadcast-relay id 30 port 137

# Wake-on-LAN between offices
set service broadcast-relay id 31 description 'Inter-Office WoL'
set service broadcast-relay id 31 interface eth1
set service broadcast-relay id 31 interface wg0
set service broadcast-relay id 31 interface wg1
set service broadcast-relay id 31 port 9

commit

Common UDP ports for Relay

PortProtocol/ServiceDescription
7Echo / WoLWake-on-LAN (alternative)
9Discard / WoLWake-on-LAN (primary)
67DHCP ServerDHCP requests from clients
68DHCP ClientDHCP responses from the server
69TFTPTrivial File Transfer Protocol
137NETBIOS-NSNetBIOS Name Service
138NETBIOS-DGMNetBIOS Datagram Service
161SNMPSimple Network Management Protocol
427SLPService Location Protocol
1900SSDPSimple Service Discovery Protocol (UPnP)
5353mDNSMulticast DNS (Bonjour/Avahi)
6969BitTorrentBitTorrent tracker discovery
10001UbiquitiUbiquiti device discovery

Operational commands

Viewing the configuration

All relays:

show service broadcast-relay

A specific relay:

show service broadcast-relay id 1

Current configuration in CLI format:

show configuration commands | grep broadcast-relay

Traffic monitoring

Viewing UDP broadcast on an interface:

monitor traffic interface eth0 filter "udp and broadcast"

Monitoring a specific port:

monitor traffic interface eth0 filter "udp port 67"

Verbose output with packet contents:

monitor traffic interface eth0.10 filter "udp port 9" verbose

Logs

System relay logs:

show log | grep broadcast

Real-time monitoring:

monitor log | grep broadcast

Interface statistics

Checking broadcast packets on an interface:

show interfaces ethernet eth0 statistics

Testing

Sending Wake-on-LAN from the router:

generate wol interface eth0 mac 00:11:22:33:44:55

Troubleshooting

Broadcast packets are not forwarded

Check 1: Make sure the relay is active:

show service broadcast-relay id 1

If it shows disabled, enable it:

configure
delete service broadcast-relay id 1 disable
commit

Check 2: Verify that the interfaces are up:

show interfaces

Check 3: Make sure the broadcast reaches the interface:

monitor traffic interface eth0 filter "udp port 67"

Check 4: Verify the firewall rules:

show firewall

Make sure UDP broadcast is not blocked:

set firewall ipv4 forward filter rule 100 action accept
set firewall ipv4 forward filter rule 100 protocol udp
set firewall ipv4 forward filter rule 100 destination port 67
commit

DHCP relay does not work

Problem: Clients do not receive addresses through the relay.

Solution: Use the dedicated DHCP relay instead of the broadcast relay:

delete service broadcast-relay id 1
set service dhcp-relay interface eth0.10
set service dhcp-relay interface eth0.20
set service dhcp-relay server 192.168.1.1
commit

DHCP relay supports DHCP-specific features (giaddr, relay agent information).

Wake-on-LAN does not wake devices

Check 1: Make sure the device supports WoL:

  • BIOS/UEFI setting is enabled
  • The network card supports WoL
  • The OS is configured for WoL

Check 2: Verify the port: Some implementations use port 7, others use port 9:

set service broadcast-relay id 3 port 7
commit

Check 3: Test from the same subnet first:

generate wol interface eth0.10 mac 00:11:22:33:44:55

Check 4: Make sure the broadcast address is correct:

  • 255.255.255.255 (limited broadcast)
  • 192.168.1.255 (subnet broadcast for 192.168.1.0/24)

SONOS/Chromecast are not discovered

Problem: Devices on different VLANs cannot see each other.

Solution 1: Add an mDNS relay (port 5353):

set service broadcast-relay id 10 description 'mDNS Relay'
set service broadcast-relay id 10 interface eth0.100
set service broadcast-relay id 10 interface eth0.200
set service broadcast-relay id 10 port 5353
commit

Solution 2: Use the dedicated mDNS repeater:

set service mdns repeater interface eth0.100
set service mdns repeater interface eth0.200
commit

The mDNS repeater is more efficient for multicast DNS.

Broadcast storm

Problem: Retransmission loops cause network overload.

Explanation: The built-in VyOS protection prevents this, but check the topology:

Check: Make sure there are no L2 loops:

show spanning-tree

Solution: Enable STP on bridge interfaces:

set interfaces bridge br0 stp
commit

High CPU usage

Problem: High CPU load caused by the relay.

Cause: Too much broadcast traffic.

Solution 1: Filter the relay to only the required ports.

Solution 2: Limit the number of interfaces in the relay group.

Solution 3: Use dedicated protocols instead of broadcast relay:

  • DHCP relay instead of broadcast relay
  • mDNS repeater instead of broadcast relay for mDNS

Security and best practices

1. Minimize broadcast domains

Use relay only when necessary. Do not create large broadcast domains without a reason.

2. Filter by ports

Always specify the exact UDP ports:

set service broadcast-relay id 1 port 67

Do not use relay for all ports.

3. Limit the interfaces

Add only the required interfaces to a relay:

set service broadcast-relay id 1 interface eth0.10
set service broadcast-relay id 1 interface eth0.20

Do not add WAN interfaces to a relay!

4. Use descriptions

Document the purpose of each relay:

set service broadcast-relay id 1 description 'DHCP for Office VLANs 10-30'

5. Control the source address

For routed networks, specify the source:

set service broadcast-relay id 1 address 192.168.1.1

6. Firewall protection

Restrict broadcast relay with firewall rules:

set firewall ipv4 forward filter rule 100 action accept
set firewall ipv4 forward filter rule 100 protocol udp
set firewall ipv4 forward filter rule 100 source address 192.168.0.0/16
set firewall ipv4 forward filter rule 100 destination port 67

7. Monitoring

Regularly check broadcast traffic:

show interfaces statistics

8. Alternatives to broadcast relay

Use dedicated protocols where possible:

  • DHCP relay for DHCP
  • mDNS repeater for mDNS/Bonjour
  • IGMP proxy for multicast

9. Separate relay groups

Do not combine different services in a single relay:

# Good - separate relays
set service broadcast-relay id 1 port 67  # DHCP
set service broadcast-relay id 2 port 9   # WoL

# Bad - one relay for everything
set service broadcast-relay id 1 port 67
set service broadcast-relay id 1 port 9   # Not possible!

10. Test before production

Always test a relay in a lab environment before deploying it.

Integration with other services

DHCP Server + Broadcast Relay

A combination for centralized DHCP:

# DHCP Server on the router
set service dhcp-server shared-network-name LAN subnet 192.168.10.0/24 subnet-id 10
set service dhcp-server shared-network-name LAN subnet 192.168.10.0/24 option default-router '192.168.10.1'
set service dhcp-server shared-network-name LAN subnet 192.168.10.0/24 range 0 start '192.168.10.100'
set service dhcp-server shared-network-name LAN subnet 192.168.10.0/24 range 0 stop '192.168.10.200'

# Relay from other VLANs to the DHCP server
set service dhcp-relay interface eth0.20
set service dhcp-relay interface eth0.30
set service dhcp-relay server 192.168.10.1

mDNS Repeater + Broadcast Relay

For full compatibility with Apple/Android devices:

# mDNS repeater for Bonjour/Avahi
set service mdns repeater interface eth0.100
set service mdns repeater interface eth0.200

# Broadcast relay for other discovery protocols
set service broadcast-relay id 10 description 'SSDP/UPnP'
set service broadcast-relay id 10 interface eth0.100
set service broadcast-relay id 10 interface eth0.200
set service broadcast-relay id 10 port 1900

DNS Forwarding

Integration with local DNS:

# DNS forwarding to resolve local names
set service dns forwarding listen-address 192.168.1.1
set service dns forwarding listen-address 192.168.2.1

# Broadcast relay for NETBIOS
set service broadcast-relay id 5 description 'NETBIOS'
set service broadcast-relay id 5 interface eth0
set service broadcast-relay id 5 interface eth1
set service broadcast-relay id 5 port 137

Comparison with alternatives

Broadcast Relay vs DHCP Relay

Broadcast Relay (Generic):

  • Advantages: universal, simple
  • Disadvantages: no DHCP-specific features

DHCP Relay (Specialized):

  • Advantages: giaddr support, relay agent info, more efficient
  • Disadvantages: DHCP only

Recommendation: Use DHCP relay for DHCP.

Broadcast Relay vs mDNS Repeater

Broadcast Relay (UDP port 5353):

  • Advantages: simple configuration
  • Disadvantages: does not understand the mDNS-specific protocol

mDNS Repeater:

  • Advantages: optimized for mDNS, understands the protocol
  • Disadvantages: mDNS only

Recommendation: Use the mDNS repeater for Bonjour/Avahi.

Broadcast Relay vs IGMP Proxy

Broadcast Relay:

  • UDP broadcast only
  • Not suitable for multicast

IGMP Proxy:

  • For multicast groups
  • Requires IGMP membership

Recommendation: Use IGMP proxy for IPTV and multicast streaming.

Limitations

  1. UDP only: The relay works only with the UDP protocol
  2. Broadcast only: Does not work with unicast or multicast (use IGMP proxy)
  3. Performance: A large volume of broadcast can affect the CPU
  4. TTL: Broadcast does not cross routers (TTL=1); the relay lets you work around this
  5. Not for WAN: Never use a relay on WAN interfaces

Next steps

Reviewed by OpenNix LLC · Last updated on
TFTP Server in VyOSWeb Proxy (Squid) in VyOS