howto/multicast.md
... ...
@@ -62,6 +62,36 @@ The number of maximum groups is optional and can be set freely. For security rea
62 62
IGMP and MLD messages must follow a specific format. `require-router-alert` filters out invalid messages.
63 63
Even if an interface is only intended to handle IGMP/MLD, PIM must be enabled on it. If you still do not want to use PIM, a firewall rule is recommended.
64 64
65
+### nftables configuration
66
+
67
+Allow PIM:
68
+```
69
+iifname "[INTERFACE NAME]" ip6 saddr [SOURCE ADDRESS] ip6 daddr ff02::d meta protocol ip6 meta l4proto pim counter accept;
70
+```
71
+```
72
+iifname "[INTERFACE NAME]" ip saddr [SOURCE ADDRESS] ip daddr 224.0.0.13 meta protocol ip meta l4proto pim counter accept;
73
+```
74
+
75
+Allow MLDv2:
76
+```
77
+set icmp6_mld {
78
+ type icmpv6_type . icmpv6_code;
79
+ flags interval;
80
+ elements = {
81
+ mld-listener-query . 0,
82
+ mld2-listener-report . 0
83
+ };
84
+}
85
+```
86
+```
87
+iifname [CLIENT INTERFACE NAME] icmpv6 type . icmpv6 code @icmp6_mld ip6 hoplimit 1 exthdr hbh exists ip6 saddr fe80::/10 counter accept;
88
+```
89
+
90
+Allow IGMPv3:
91
+```
92
+iifname [CLIENT INTERFACE NAME] ip protocol igmp igmp type { membership-query, membership-report-v3 } ip ttl 1 counter accept;
93
+```
94
+
65 95
### Participants
66 96
67 97
Current participants: