Firewall – What are good host firewall rules to allow UDP multicast

firewallmulticastsolarisudp

I have a system with a restrictive firewall that will be participating in UDP multicasting (sending and receiving). What's a good set of rules to make the host's firewall allow this?

This is my current setup, using ipf on Solaris:

# Enable UDP multicasting
pass out log quick on INTERFACE proto udp from HOSTIP/32 to 224.0.0.0/4
pass in log quick on INTERFACE proto udp from 224.0.0.0/4 to HOSTIP/32

# Enable multicast ping discovery
pass in log quick on INTERFACE proto icmp from any to 224.0.0.1/32

# Allow pings out.
pass out quick on INTERFACE proto icmp all keep state

The host is expected to participate in exactly one multicast group. Can I replace "224.0.0.0/4" with this specific group (e.g., GROUP/32) without causing problems?

Are there any other openings that should be created?

Best Answer

Yes, you should be able to use the specific multicast address in place of 224.0.0.0 without a problem if you've got a hard-coded multicast address to use. We do it for our multicast setups without a hassle. As far as "what else should I open?", that depends on what you're using -- if you've got some unicast traffic that manages the multicast streams, for example, then you need to allow that traffic to get to where it's going, too. Obviously without knowing what it is that you're doing, I can't give you any advice on that.