Multicast and IPTV

Multicast and IPTV

RouterOS supports three complementary multicast mechanisms that address different deployment scales:

Mechanism	Use case
IGMP Proxy	CPE/home router relaying ISP IPTV to a LAN. Simple, stateless, no routing protocol required.
Bridge IGMP Snooping	L2 switch optimization — constrains multicast flooding to only ports with active receivers.
PIM-SM	Enterprise or campus multicast routing across multiple L3 segments.

Most IPTV deployments on home and small-office routers use IGMP Proxy together with bridge IGMP snooping. PIM-SM is used when multicast traffic must be routed across multiple network segments managed by the same organization.

Overview

How Multicast Works

Multicast allows a single sender to reach many receivers without the sender needing separate unicast connections to each. Receivers join multicast groups using IGMP (IPv4) or MLD (IPv6). Routers and switches forward traffic only to segments that have active group members.

Multicast addresses are in the 224.0.0.0–239.255.255.255 range. IPTV streams commonly use the 239.0.0.0/8 range (administratively scoped).

Choosing a Multicast Approach

Use IGMP Proxy when:

• Your ISP delivers IPTV as multicast on the WAN/IPTV interface
• You have one upstream source and one or more downstream LAN segments
• No multicast routing protocol is running in your network

Use Bridge IGMP Snooping when:

• Multiple clients (STBs, PCs) share a bridge or VLAN
• You want to prevent multicast streams from flooding all bridge ports

Use PIM-SM when:

• Multicast sources and receivers are separated by multiple routed hops
• You need dynamic rendezvous point discovery (BSR) or source-specific multicast (SSM)
• Running enterprise video conferencing, financial data feeds, or multi-site IPTV headend distribution

Prerequisites

• RouterOS v7 (multicast package built into main package; for v6, install multicast package separately)
• PIM-SM is not available on SMIPS devices (hAP lite, hAP lite TC, hAP mini)
• For IPTV: know your ISP’s IPTV VLAN ID and whether IGMP queries originate from the ISP side
• Unicast routing must be functional before adding multicast configuration

Configuration

IGMP Proxy

IGMP Proxy relays IGMP membership reports between a downstream LAN and an upstream multicast source. The router tracks which groups downstream clients have joined and forwards those joins upstream, then replicates inbound multicast traffic to interested downstream interfaces.

Basic Setup

Define one upstream interface (toward the multicast source / ISP) and one or more downstream interfaces (toward clients):

/routing igmp-proxy
set quick-leave=yes

/routing igmp-proxy interface
add interface=ether1-wan upstream=yes
add interface=bridge-lan

Enable quick-leave to remove forwarding state as soon as a Leave is received, rather than waiting for a last-member query cycle. This is appropriate for most home IPTV setups where each port has a single STB.

IGMP Proxy with an IPTV VLAN

Many ISPs deliver IPTV on a dedicated VLAN carried on the same WAN trunk as Internet service. Create a VLAN subinterface and use it as the upstream:

/interface vlan
add name=vlan-iptv interface=ether1-wan vlan-id=850

/routing igmp-proxy
set quick-leave=yes

/routing igmp-proxy interface
add interface=vlan-iptv upstream=yes
add interface=bridge-lan

Multiple Downstream Segments

Add every interface or bridge that has IPTV clients as a downstream:

/routing igmp-proxy interface
add interface=vlan-iptv upstream=yes
add interface=bridge-lan
add interface=bridge-wifi

Firewall Considerations

FastTrack bypasses multicast routing state. Confirm FastTrack is not catching IPTV flows:

/ip firewall filter
add chain=forward action=accept src-address=224.0.0.0/4 comment="allow multicast forward" place-before=0
add chain=forward action=accept dst-address=224.0.0.0/4 comment="allow multicast forward" place-before=1

Allow IGMP (IP protocol 2) through the firewall input chain if IGMP processing is needed on the router itself:

/ip firewall filter
add chain=input action=accept protocol=igmp comment="allow IGMP"

Verify IGMP Proxy State

/routing igmp-proxy print
/routing igmp-proxy interface print
/routing igmp-proxy mfc print

The multicast forwarding cache (MFC) shows active (source, group) entries and packet/byte counters. An entry with incrementing counters confirms traffic is flowing.

---

Bridge IGMP Snooping

IGMP snooping causes the bridge to inspect IGMP messages and build a Multicast Database (MDB) mapping group addresses to ports. Only ports with active receivers receive a given stream, preventing multicast from flooding every bridge port.

Enable Snooping on a Bridge

/interface bridge
set [find name=bridge-lan] igmp-snooping=yes

Enable Multicast Querier

A querier sends periodic IGMP General Queries to keep group memberships fresh. Enable the bridge querier when no upstream multicast router is sending queries into the bridge domain:

/interface bridge
set [find name=bridge-lan] igmp-snooping=yes multicast-querier=yes

Do not enable the bridge querier if an upstream router (or the IGMP proxy upstream interface) is already sending queries — duplicate queriers cause election overhead.

Fast-Leave on STB Ports

Fast-leave removes a port from the MDB immediately on receiving a Leave, without waiting for a last-member query. Enable it on access ports with a single STB:

/interface bridge port
set [find interface=ether3-stb] fast-leave=yes

Do not enable fast-leave on trunk or shared ports where multiple devices share the same port.

Static Mrouter Ports

Mark an uplink port as an mrouter port to ensure unknown multicast and IGMP reports are forwarded toward the multicast router:

/interface bridge port
set [find interface=ether1-uplink] multicast-router=permanent

Values: permanent (always mrouter), temporary-query (learned from IGMP queries, default), disabled.

VLAN-Aware IGMP Snooping

In bridges with vlan-filtering=yes, IGMP snooping is scoped per VLAN. Each VLAN maintains its own MDB. Ensure bridge VLAN membership is correctly configured or snooping state will not match the traffic path:

/interface bridge
set [find name=bridge-lan] igmp-snooping=yes vlan-filtering=yes

/interface bridge vlan
add bridge=bridge-lan vlan-ids=850 tagged=ether1-uplink untagged=ether3-stb

Verify MDB State

/interface bridge mdb print

Each entry shows the multicast group, VLAN, and port. Confirm that STB ports appear for the groups they have joined.

---

PIM-SM

PIM-SM (Protocol Independent Multicast — Sparse Mode) builds multicast distribution trees across routed network segments. It is covered in detail in the PIM-SM reference. The key configuration steps are summarized here.

Enable PIM-SM on Interfaces

/routing pimsm interface
add interface=ether1-wan
add interface=bridge-lan

Enable PIM-SM on every interface that participates in multicast forwarding — both toward sources and toward receivers.

Configure a Static Rendezvous Point

All PIM-SM routers in the domain must agree on the RP address for each group range:

/routing pimsm rp
add address=10.0.0.1 group-prefix=239.0.0.0/8

Replace 10.0.0.1 with the RP router’s loopback or interface address.

Bootstrap Router (BSR) for Dynamic RP Discovery

In larger deployments, configure one or more candidate BSRs and candidate RPs rather than manually configuring static RP on every router. See the PIM-SM guide for BSR configuration.

Verify PIM-SM State

/routing pimsm interface print
/routing pimsm neighbor print
/routing pimsm mfc print

The MFC shows (*,G) (shared tree) and (S,G) (source tree) entries with interface lists and packet counts.

---

Real-World IPTV Examples

Example 1: ISP IPTV on a Dedicated VLAN (PPPoE Internet + IPTV VLAN)

Topology:

• ether1 — WAN uplink from ISP (trunk: Internet VLAN 100, IPTV VLAN 850)
• ether2–ether4 — LAN ports (bridge-lan)
• ether5 — STB port

# WAN VLANs
/interface vlan
add name=vlan-internet interface=ether1 vlan-id=100
add name=vlan-iptv interface=ether1 vlan-id=850

# Internet via PPPoE on VLAN 100
/interface pppoe-client
add name=pppoe-out1 interface=vlan-internet user=user@isp password=secret add-default-route=yes

# LAN bridge with IGMP snooping
/interface bridge
add name=bridge-lan igmp-snooping=yes

/interface bridge port
add bridge=bridge-lan interface=ether2
add bridge=bridge-lan interface=ether3
add bridge=bridge-lan interface=ether4
add bridge=bridge-lan interface=ether5 fast-leave=yes

# IGMP proxy: IPTV VLAN is upstream, LAN bridge is downstream
/routing igmp-proxy
set quick-leave=yes

/routing igmp-proxy interface
add interface=vlan-iptv upstream=yes
add interface=bridge-lan

# Firewall: allow IGMP and multicast
/ip firewall filter
add chain=input action=accept protocol=igmp
add chain=forward action=accept dst-address=224.0.0.0/4

Example 2: IPTV on Separate Physical Port (ONT/Modem with IPTV Port)

Topology:

• ether1 — Internet (PPPoE or DHCP)
• ether2 — ISP IPTV port (direct from ONT, untagged multicast)
• ether3–ether5 — LAN with STBs

/interface bridge
add name=bridge-lan igmp-snooping=yes multicast-querier=yes

/interface bridge port
add bridge=bridge-lan interface=ether3
add bridge=bridge-lan interface=ether4
add bridge=bridge-lan interface=ether5 fast-leave=yes

/routing igmp-proxy
set quick-leave=yes

/routing igmp-proxy interface
add interface=ether2 upstream=yes
add interface=bridge-lan

Enable multicast-querier on bridge-lan here because ether2 is the upstream physical port outside the bridge — the bridge has no natural querier on the LAN side.

Example 3: IPTV Delivered Over DHCP (No PPPoE)

Some ISPs deliver IPTV on the same IP subnet as the Internet connection. In this case, IGMP proxy still works — the upstream interface receives multicast from the ISP network:

# DHCP client on WAN
/ip dhcp-client
add interface=ether1 add-default-route=yes

/interface bridge
add name=bridge-lan igmp-snooping=yes

/interface bridge port
add bridge=bridge-lan interface=ether2
add bridge=bridge-lan interface=ether3 fast-leave=yes

/routing igmp-proxy
set quick-leave=yes

/routing igmp-proxy interface
add interface=ether1 upstream=yes
add interface=bridge-lan

Example 4: PIM-SM for Enterprise Multicast (Multi-Router)

Two-router setup with a dedicated RP:

RP Router (10.0.0.1):

/routing pimsm
set enabled=yes

/routing pimsm interface
add interface=ether1
add interface=ether2

/routing pimsm rp
add address=10.0.0.1 group-prefix=239.0.0.0/8

Leaf Router (10.0.0.2):

/routing pimsm
set enabled=yes

/routing pimsm interface
add interface=ether1          # uplink toward RP
add interface=bridge-lan      # LAN with receivers

/routing pimsm rp
add address=10.0.0.1 group-prefix=239.0.0.0/8

---

Verification

IGMP Proxy

# Show configured interfaces and upstream/downstream roles
/routing igmp-proxy interface print

# Show active multicast forwarding entries
/routing igmp-proxy mfc print

# Check packet counts on upstream interface
/interface print stats where name=vlan-iptv

Bridge IGMP Snooping

# Show multicast database — groups, VLANs, ports
/interface bridge mdb print

# Show bridge ports and their mrouter/fast-leave settings
/interface bridge port print detail

# Capture IGMP traffic to confirm join/leave flow
/tool sniffer quick ip-protocol=igmp interface=bridge-lan

PIM-SM

# Show PIM-enabled interfaces and their state
/routing pimsm interface print

# Show discovered PIM neighbors
/routing pimsm neighbor print

# Show multicast forwarding cache ((*,G) and (S,G) entries)
/routing pimsm mfc print

---

Troubleshooting

IGMP Joins Visible but No Stream

1. Check multicast firewall rules — ensure dst-address=224.0.0.0/4 traffic is accepted in the forward chain.
2. Verify FastTrack is not catching IPTV flows. Add an explicit accept rule before the FastTrack rule for multicast destinations.
3. Check for conflicting IPsec policies — an IPsec policy matching the multicast destination can silently drop traffic.
4. On the upstream VLAN, verify that IGMP membership reports are being forwarded correctly: tool sniffer quick ip-protocol=igmp interface=vlan-iptv.

STB Receives Only Some Channels

1. Check the MDB: /interface bridge mdb print. Confirm the STB port appears for each joined group.
2. Verify unknown-multicast-flood is enabled on ports where the STB might need streams before a join is processed.
3. Check fast-leave is not enabled on shared ports — it will remove state for all receivers when any one sends a Leave.

IGMP Proxy MFC Has No Entries

1. Confirm the upstream interface sees IGMP traffic: tool sniffer quick ip-protocol=igmp interface=<upstream>.
2. Confirm a downstream client is actually sending IGMP joins. Use sniffer on the downstream bridge or interface.
3. Verify no firewall rule is dropping IGMP (protocol 2) on the input chain.
4. Restart the IGMP proxy process: /routing igmp-proxy set quick-leave=yes (read-write triggers reload).

PIM-SM Neighbors Not Forming

1. Verify PIM is enabled on the correct interfaces: /routing pimsm interface print.
2. Confirm unicast reachability between neighbors — PIM Hello messages use the link-local source.
3. Check firewall for PIM (IP protocol 103) being dropped on the input chain.

Multicast Not Forwarded Across VLANs

When using VLAN-aware bridges, each VLAN’s IGMP state is independent. Confirm:

• The IPTV VLAN is configured in /interface bridge vlan
• The uplink port is tagged for the IPTV VLAN
• The STB port is untagged (or tagged) correctly in that VLAN

---

See Also

• PIM-SM — full PIM-SM reference including BSR, candidate RP, SPT switchover
• Bridge IGMP Snooping — detailed bridge snooping reference
• Bridge VLAN Filtering — VLAN configuration on RouterOS bridges
• Firewall Filters — managing firewall rules that affect multicast