# UDP Broadcast Relay

> UDP Broadcast Relay on VyOS - forward UDP broadcast packets between networks for DHCP relay, SONOS discovery, and Wake-on-LAN

Source: https://opennix.org/en/docs/vyos/services/vyos-udp-broadcast-relay/


UDP Broadcast Relay is a service for forwarding UDP broadcast packets between different network segments and VLANs.

## Overview

UDP Broadcast Relay solves the problem of broadcast domain isolation, allowing services that rely on UDP broadcast for discovery to work across network boundaries.

### Key features

- Forwarding UDP broadcast between interfaces and VLANs
- Support for up to 99 independent relay configurations
- Filtering by UDP port
- Protection against broadcast storms
- Ability to specify a source IP for outgoing packets
- Independent enabling/disabling of a relay without deleting its configuration

### Typical use cases

1. **DHCP Relay** - forwarding DHCP requests between subnets
2. **NETBIOS/WINS** - discovering Windows network resources
3. **Wake-on-LAN (WoL)** - remotely powering on computers across VLANs
4. **SONOS/UPnP/SSDP** - discovering media devices on multicast networks
5. **Network equipment** - discovering printers, IP cameras, and access points
6. **Game consoles** - discovering games and devices on the local network

### How it works

1. VyOS listens for UDP broadcast on the specified interfaces
2. When a broadcast packet is received on the specified port, it is retransmitted to all other interfaces in the group
3. The packet is sent as a broadcast on each interface
4. A protection mechanism prevents retransmission loops

## Basic configuration

### Command structure

```
set service broadcast-relay id <relay-id>
  ├── description <text>
  ├── interface <interface>
  ├── port <udp-port>
  └── address <source-ip>
```

### Minimal configuration

The simplest relay between two interfaces:

```
set service broadcast-relay id 1 interface eth0
set service broadcast-relay id 1 interface eth1
set service broadcast-relay id 1 port 9
commit
```

### Configuration parameters

#### Relay ID

A unique identifier for the relay group (1-99):

```
set service broadcast-relay id 1
```

You can create up to 99 independent relay configurations.

#### Interfaces

Interfaces used for retransmitting broadcast packets:

```
set service broadcast-relay id 1 interface eth0
set service broadcast-relay id 1 interface eth1
set service broadcast-relay id 1 interface eth0.10
set service broadcast-relay id 1 interface eth0.20
```

Supported types:
- Physical interfaces (eth0, eth1)
- VLAN interfaces (eth0.10, eth0.100)
- Bridge interfaces (br0)
- Bonding interfaces (bond0)

#### UDP port

Specifying a UDP port for filtering:

```
set service broadcast-relay id 1 port 67
```

The relay will process only broadcast traffic on the specified UDP port.

#### Description

A text description for the relay group:

```
set service broadcast-relay id 1 description 'DHCP Relay between VLANs'
```

#### Source Address (optional)

Specifying a source IP for outgoing packets:

```
set service broadcast-relay id 1 address 192.168.1.1
```

Useful for controlling the packet source in routed networks.

#### Disabling without deleting

Temporarily disabling a relay:

```
set service broadcast-relay id 1 disable
```

The configuration is preserved, but the relay is inactive.

## Common configurations

### DHCP Relay

Forwarding DHCP requests (ports 67/68) between VLANs:

```
# DHCP Server Request (port 67)
set service broadcast-relay id 1 description 'DHCP Relay'
set service broadcast-relay id 1 interface eth0.10
set service broadcast-relay id 1 interface eth0.20
set service broadcast-relay id 1 interface eth0.30
set service broadcast-relay id 1 port 67
commit
```

**Important**: For a full-featured DHCP relay, it is recommended to use the built-in `service dhcp-relay`:
```
set service dhcp-relay interface eth0.10
set service dhcp-relay interface eth0.20
set service dhcp-relay server 192.168.1.1
```

### NETBIOS Name Service

Discovering Windows resources (port 137):

```
set service broadcast-relay id 2 description 'NETBIOS Name Service'
set service broadcast-relay id 2 interface eth0
set service broadcast-relay id 2 interface eth1
set service broadcast-relay id 2 interface eth2
set service broadcast-relay id 2 port 137
commit
```

### Wake-on-LAN (WoL)

Forwarding magic packets for remote power-on (port 9):

```
set service broadcast-relay id 3 description 'Wake-on-LAN'
set service broadcast-relay id 3 interface eth0.10
set service broadcast-relay id 3 interface eth0.20
set service broadcast-relay id 3 interface eth0.30
set service broadcast-relay id 3 port 9
commit
```

Port 7 is also supported (used by some WoL implementations):
```
set service broadcast-relay id 4 description 'Wake-on-LAN (port 7)'
set service broadcast-relay id 4 interface eth0.10
set service broadcast-relay id 4 interface eth0.20
set service broadcast-relay id 4 port 7
commit
```

### SONOS Discovery

Discovering SONOS audio systems (port 1900 - SSDP):

```
set service broadcast-relay id 5 description 'SONOS Discovery'
set service broadcast-relay id 5 interface eth3
set service broadcast-relay id 5 interface eth4
set service broadcast-relay id 5 interface eth5
set service broadcast-relay id 5 port 1900
commit
```

### UPnP/SSDP

Universal Plug and Play discovery (port 1900):

```
set service broadcast-relay id 6 description 'UPnP/SSDP Discovery'
set service broadcast-relay id 6 interface eth0.100
set service broadcast-relay id 6 interface eth0.200
set service broadcast-relay id 6 port 1900
commit
```

### Chromecast Discovery

Google Chromecast uses mDNS (port 5353):

```
set service broadcast-relay id 7 description 'Chromecast mDNS'
set service broadcast-relay id 7 interface eth0.10
set service broadcast-relay id 7 interface eth0.20
set service broadcast-relay id 7 port 5353
commit
```

### Printers and scanners

Discovering network printers (SNMP trap - port 161):

```
set service broadcast-relay id 8 description 'Network Printers'
set service broadcast-relay id 8 interface eth0.50
set service broadcast-relay id 8 interface eth0.60
set service broadcast-relay id 8 port 161
commit
```

## Practical scenarios

### Scenario 1: Corporate network with VLANs

**Goal**: Enable DHCP and Wake-on-LAN across departmental VLANs.

**Topology**:
- VLAN 10 - Management (192.168.10.0/24)
- VLAN 20 - Development (192.168.20.0/24)
- VLAN 30 - Production (192.168.30.0/24)
- DHCP server: 192.168.10.5

**Configuration**:

```
# DHCP Relay between all VLANs
set service broadcast-relay id 1 description 'Corporate DHCP Relay'
set service broadcast-relay id 1 interface eth0.10
set service broadcast-relay id 1 interface eth0.20
set service broadcast-relay id 1 interface eth0.30
set service broadcast-relay id 1 port 67

# Wake-on-LAN between VLANs
set service broadcast-relay id 2 description 'Corporate WoL'
set service broadcast-relay id 2 interface eth0.10
set service broadcast-relay id 2 interface eth0.20
set service broadcast-relay id 2 interface eth0.30
set service broadcast-relay id 2 port 9

commit
```

### Scenario 2: Home multimedia network

**Goal**: SONOS, Chromecast, and Smart TVs must be discoverable between the guest and home networks.

**Topology**:
- VLAN 100 - Home (192.168.100.0/24)
- VLAN 200 - Guest (192.168.200.0/24)
- VLAN 300 - IoT (192.168.300.0/24)

**Configuration**:

```
# SONOS Discovery
set service broadcast-relay id 10 description 'SONOS Audio'
set service broadcast-relay id 10 interface eth0.100
set service broadcast-relay id 10 interface eth0.300
set service broadcast-relay id 10 port 1900

# Chromecast mDNS
set service broadcast-relay id 11 description 'Chromecast'
set service broadcast-relay id 11 interface eth0.100
set service broadcast-relay id 11 interface eth0.200
set service broadcast-relay id 11 interface eth0.300
set service broadcast-relay id 11 port 5353

# UPnP for Smart TVs
set service broadcast-relay id 12 description 'Smart TV UPnP'
set service broadcast-relay id 12 interface eth0.100
set service broadcast-relay id 12 interface eth0.300
set service broadcast-relay id 12 port 1900

commit
```

### Scenario 3: Data center with isolated zones

**Goal**: Enable centralized management through Wake-on-LAN and PXE boot.

**Topology**:
- VLAN 500 - Management (10.0.0.0/24)
- VLAN 501 - DMZ Servers (10.0.1.0/24)
- VLAN 502 - Internal Servers (10.0.2.0/24)
- VLAN 503 - Database Zone (10.0.3.0/24)

**Configuration**:

```
# Wake-on-LAN for all server zones
set service broadcast-relay id 20 description 'Datacenter WoL'
set service broadcast-relay id 20 interface eth0.500
set service broadcast-relay id 20 interface eth0.501
set service broadcast-relay id 20 interface eth0.502
set service broadcast-relay id 20 interface eth0.503
set service broadcast-relay id 20 port 9
set service broadcast-relay id 20 address 10.0.0.1

# TFTP for PXE Boot
set service broadcast-relay id 21 description 'PXE Boot TFTP'
set service broadcast-relay id 21 interface eth0.500
set service broadcast-relay id 21 interface eth0.501
set service broadcast-relay id 21 interface eth0.502
set service broadcast-relay id 21 port 69
set service broadcast-relay id 21 address 10.0.0.1

commit
```

### Scenario 4: Multiple offices over VPN

**Goal**: Relay broadcast between VPN interfaces to discover network resources.

**Topology**:
- Local LAN - eth1 (192.168.1.0/24)
- VPN Office 1 - wg0 (10.10.1.0/24)
- VPN Office 2 - wg1 (10.10.2.0/24)

**Configuration**:

```
# NETBIOS between offices
set service broadcast-relay id 30 description 'Inter-Office NETBIOS'
set service broadcast-relay id 30 interface eth1
set service broadcast-relay id 30 interface wg0
set service broadcast-relay id 30 interface wg1
set service broadcast-relay id 30 port 137

# Wake-on-LAN between offices
set service broadcast-relay id 31 description 'Inter-Office WoL'
set service broadcast-relay id 31 interface eth1
set service broadcast-relay id 31 interface wg0
set service broadcast-relay id 31 interface wg1
set service broadcast-relay id 31 port 9

commit
```

## Common UDP ports for Relay

| Port | Protocol/Service | Description |
|------|----------------|----------|
| 7 | Echo / WoL | Wake-on-LAN (alternative) |
| 9 | Discard / WoL | Wake-on-LAN (primary) |
| 67 | DHCP Server | DHCP requests from clients |
| 68 | DHCP Client | DHCP responses from the server |
| 69 | TFTP | Trivial File Transfer Protocol |
| 137 | NETBIOS-NS | NetBIOS Name Service |
| 138 | NETBIOS-DGM | NetBIOS Datagram Service |
| 161 | SNMP | Simple Network Management Protocol |
| 427 | SLP | Service Location Protocol |
| 1900 | SSDP | Simple Service Discovery Protocol (UPnP) |
| 5353 | mDNS | Multicast DNS (Bonjour/Avahi) |
| 6969 | BitTorrent | BitTorrent tracker discovery |
| 10001 | Ubiquiti | Ubiquiti device discovery |

## Operational commands

### Viewing the configuration

All relays:
```
show service broadcast-relay
```

A specific relay:
```
show service broadcast-relay id 1
```

Current configuration in CLI format:
```
show configuration commands | grep broadcast-relay
```

### Traffic monitoring

Viewing UDP broadcast on an interface:
```
monitor traffic interface eth0 filter "udp and broadcast"
```

Monitoring a specific port:
```
monitor traffic interface eth0 filter "udp port 67"
```

Verbose output with packet contents:
```
monitor traffic interface eth0.10 filter "udp port 9" verbose
```

### Logs

System relay logs:
```
show log | grep broadcast
```

Real-time monitoring:
```
monitor log | grep broadcast
```

### Interface statistics

Checking broadcast packets on an interface:
```
show interfaces ethernet eth0 statistics
```

### Testing

Sending Wake-on-LAN from the router:
```
generate wol interface eth0 mac 00:11:22:33:44:55
```

## Troubleshooting

### Broadcast packets are not forwarded

**Check 1**: Make sure the relay is active:
```
show service broadcast-relay id 1
```

If it shows `disabled`, enable it:
```
configure
delete service broadcast-relay id 1 disable
commit
```

**Check 2**: Verify that the interfaces are up:
```
show interfaces
```

**Check 3**: Make sure the broadcast reaches the interface:
```
monitor traffic interface eth0 filter "udp port 67"
```

**Check 4**: Verify the firewall rules:
```
show firewall
```

Make sure UDP broadcast is not blocked:
```
set firewall ipv4 forward filter rule 100 action accept
set firewall ipv4 forward filter rule 100 protocol udp
set firewall ipv4 forward filter rule 100 destination port 67
commit
```

### DHCP relay does not work

**Problem**: Clients do not receive addresses through the relay.

**Solution**: Use the dedicated DHCP relay instead of the broadcast relay:

```
delete service broadcast-relay id 1
set service dhcp-relay interface eth0.10
set service dhcp-relay interface eth0.20
set service dhcp-relay server 192.168.1.1
commit
```

DHCP relay supports DHCP-specific features (giaddr, relay agent information).

### Wake-on-LAN does not wake devices

**Check 1**: Make sure the device supports WoL:
- BIOS/UEFI setting is enabled
- The network card supports WoL
- The OS is configured for WoL

**Check 2**: Verify the port:
Some implementations use port 7, others use port 9:
```
set service broadcast-relay id 3 port 7
commit
```

**Check 3**: Test from the same subnet first:
```
generate wol interface eth0.10 mac 00:11:22:33:44:55
```

**Check 4**: Make sure the broadcast address is correct:
- 255.255.255.255 (limited broadcast)
- 192.168.1.255 (subnet broadcast for 192.168.1.0/24)

### SONOS/Chromecast are not discovered

**Problem**: Devices on different VLANs cannot see each other.

**Solution 1**: Add an mDNS relay (port 5353):
```
set service broadcast-relay id 10 description 'mDNS Relay'
set service broadcast-relay id 10 interface eth0.100
set service broadcast-relay id 10 interface eth0.200
set service broadcast-relay id 10 port 5353
commit
```

**Solution 2**: Use the dedicated mDNS repeater:
```
set service mdns repeater interface eth0.100
set service mdns repeater interface eth0.200
commit
```

The mDNS repeater is more efficient for multicast DNS.

### Broadcast storm

**Problem**: Retransmission loops cause network overload.

**Explanation**: The built-in VyOS protection prevents this, but check the topology:

**Check**: Make sure there are no L2 loops:
```
show spanning-tree
```

**Solution**: Enable STP on bridge interfaces:
```
set interfaces bridge br0 stp
commit
```

### High CPU usage

**Problem**: High CPU load caused by the relay.

**Cause**: Too much broadcast traffic.

**Solution 1**: Filter the relay to only the required ports.

**Solution 2**: Limit the number of interfaces in the relay group.

**Solution 3**: Use dedicated protocols instead of broadcast relay:
- DHCP relay instead of broadcast relay
- mDNS repeater instead of broadcast relay for mDNS

## Security and best practices

### 1. Minimize broadcast domains

Use relay only when necessary. Do not create large broadcast domains without a reason.

### 2. Filter by ports

Always specify the exact UDP ports:
```
set service broadcast-relay id 1 port 67
```

Do not use relay for all ports.

### 3. Limit the interfaces

Add only the required interfaces to a relay:
```
set service broadcast-relay id 1 interface eth0.10
set service broadcast-relay id 1 interface eth0.20
```

Do not add WAN interfaces to a relay!

### 4. Use descriptions

Document the purpose of each relay:
```
set service broadcast-relay id 1 description 'DHCP for Office VLANs 10-30'
```

### 5. Control the source address

For routed networks, specify the source:
```
set service broadcast-relay id 1 address 192.168.1.1
```

### 6. Firewall protection

Restrict broadcast relay with firewall rules:
```
set firewall ipv4 forward filter rule 100 action accept
set firewall ipv4 forward filter rule 100 protocol udp
set firewall ipv4 forward filter rule 100 source address 192.168.0.0/16
set firewall ipv4 forward filter rule 100 destination port 67
```

### 7. Monitoring

Regularly check broadcast traffic:
```
show interfaces statistics
```

### 8. Alternatives to broadcast relay

Use dedicated protocols where possible:
- DHCP relay for DHCP
- mDNS repeater for mDNS/Bonjour
- IGMP proxy for multicast

### 9. Separate relay groups

Do not combine different services in a single relay:
```
# Good - separate relays
set service broadcast-relay id 1 port 67  # DHCP
set service broadcast-relay id 2 port 9   # WoL

# Bad - one relay for everything
set service broadcast-relay id 1 port 67
set service broadcast-relay id 1 port 9   # Not possible!
```

### 10. Test before production

Always test a relay in a lab environment before deploying it.

## Integration with other services

### DHCP Server + Broadcast Relay

A combination for centralized DHCP:

```
# DHCP Server on the router
set service dhcp-server shared-network-name LAN subnet 192.168.10.0/24 subnet-id 10
set service dhcp-server shared-network-name LAN subnet 192.168.10.0/24 option default-router '192.168.10.1'
set service dhcp-server shared-network-name LAN subnet 192.168.10.0/24 range 0 start '192.168.10.100'
set service dhcp-server shared-network-name LAN subnet 192.168.10.0/24 range 0 stop '192.168.10.200'

# Relay from other VLANs to the DHCP server
set service dhcp-relay interface eth0.20
set service dhcp-relay interface eth0.30
set service dhcp-relay server 192.168.10.1
```

### mDNS Repeater + Broadcast Relay

For full compatibility with Apple/Android devices:

```
# mDNS repeater for Bonjour/Avahi
set service mdns repeater interface eth0.100
set service mdns repeater interface eth0.200

# Broadcast relay for other discovery protocols
set service broadcast-relay id 10 description 'SSDP/UPnP'
set service broadcast-relay id 10 interface eth0.100
set service broadcast-relay id 10 interface eth0.200
set service broadcast-relay id 10 port 1900
```

### DNS Forwarding

Integration with local DNS:

```
# DNS forwarding to resolve local names
set service dns forwarding listen-address 192.168.1.1
set service dns forwarding listen-address 192.168.2.1

# Broadcast relay for NETBIOS
set service broadcast-relay id 5 description 'NETBIOS'
set service broadcast-relay id 5 interface eth0
set service broadcast-relay id 5 interface eth1
set service broadcast-relay id 5 port 137
```

## Comparison with alternatives

### Broadcast Relay vs DHCP Relay

**Broadcast Relay (Generic)**:
- Advantages: universal, simple
- Disadvantages: no DHCP-specific features

**DHCP Relay (Specialized)**:
- Advantages: giaddr support, relay agent info, more efficient
- Disadvantages: DHCP only

**Recommendation**: Use DHCP relay for DHCP.

### Broadcast Relay vs mDNS Repeater

**Broadcast Relay (UDP port 5353)**:
- Advantages: simple configuration
- Disadvantages: does not understand the mDNS-specific protocol

**mDNS Repeater**:
- Advantages: optimized for mDNS, understands the protocol
- Disadvantages: mDNS only

**Recommendation**: Use the mDNS repeater for Bonjour/Avahi.

### Broadcast Relay vs IGMP Proxy

**Broadcast Relay**:
- UDP broadcast only
- Not suitable for multicast

**IGMP Proxy**:
- For multicast groups
- Requires IGMP membership

**Recommendation**: Use IGMP proxy for IPTV and multicast streaming.

## Limitations

1. **UDP only**: The relay works only with the UDP protocol
2. **Broadcast only**: Does not work with unicast or multicast (use IGMP proxy)
3. **Performance**: A large volume of broadcast can affect the CPU
4. **TTL**: Broadcast does not cross routers (TTL=1); the relay lets you work around this
5. **Not for WAN**: Never use a relay on WAN interfaces

## Next steps

- [DHCP Server](/docs/vyos/services/vyos-dhcp) - configuring the DHCP server
- [DHCP Relay](/docs/vyos/services/vyos-dhcp-relay) - dedicated DHCP relay
- [DNS Forwarding](/docs/vyos/services/vyos-dns/) - local DNS
- [mDNS Repeater](/docs/vyos/services/vyos-mdns-repeater/) - multicast DNS
- [Firewall](/docs/vyos/firewall/) - controlling broadcast traffic
- [VLAN](/docs/vyos/interfaces/vyos-vlan) - configuring VLAN interfaces