Cross VLAN Multicast / PIM Config

I have done a ton of searching and am still at a loss. I have a CCR2004 (ROS v7.10.2) router and am trying to get multicast to route between subnets. I have my main LAN subnet, (192.168.1.0/24) and an IoT network (192.168.20.0/24 - VLAN). If my phone is on the same VLAN as my smart home devices, everything works perfect. If I’m on my LAN, I can’t get things to work right (ie: Google home app tells me to join the same wifi as my devices).

I have firewall rules setup to allow my LAN and IoT network to access any subnet, but multicast doesn’t appear to be routing like everything else does.

I’m very new to Mikrotik configs and setup. Coming from pfSense environment. I know i’m going to be missing important information, so ask if you need it, but trying to get this fixed is a new journey lol

Looking for specific instructions on configuring PIM. Did a lot of Googling over the past couple weeks off and on and still stuck.

1 Like

PIM is non-functional on RouterOS v7.

You should contact MikroTik support.

While this can be achieved with PIM, it is quite a big gun to get AirPlay/Chrome/IoT working among routed VLANs.
All those systems rely on mDNS (a simple multicast based DNS system, aka as Bonjour in the Apple world) for devices to find each other. mDNS is designed to work inside an IP subnet resp. L2 broadcast domain and excluded from L3 routing per relevant RFCs.

What is required to have mDNS working among subnets is mDNS forwarder and/or IGMP proxy as for ex. provided by OPN/pfsense.
This can be done running a container (docker) image in ROS, see http://forum.mikrotik.com/t/mdns-repeater-feature/148334/307
and also
https://help.mikrotik.com/docs/display/ROS/Container

So I got the container installed, I guess the issue i’m having now is, would I need to assign a VLAN ID to my primary bridge? If I use VLAN 1 in the container, it won’t grab an IP.

Dont use vlan1 for data, use any other number

For each VLAN requiring mDNS “routing” by the container, add a veth and addd it to the bridge with matching PID.
If your main bridge uses default VLAN1 for untagged traffic, add a veth with PID1 to the bridge.

VLAN1 does not matter in non-Cisco gear. On Linux aka RouterOS, you just need to ensure bridge ingress filtering to drop untagged “native” VLAN. You can use VLAN 1 just like any other VLAN. I use VLAN1 for MGMT traffic, but you can use it for whatever you want.

But man, too many people lack clear networking fundamentals to even know this.

To use VLAN 1 in MT world, one has to speak ROSish quite fluently … it’s not a problem of VID itself, the problem is that it’s used in ROS as implicit default all over place and one has to know how to look to see it. And then change it according to needs. Which might be too much of a hassle, thus recommendation to avoid VID=1 if possible. Effectively it’s the same as Cisco (with it’s native VLAN concept) and many other vendors, who all treat VLAN with ID=1 in some special way (ROS is quite modest at it, it allows one to reconfigure things which is more than some others allow).

You misunderstood me. VLAN 1 has special value or meaning only in Cisco in the world of network engineering as a whole:
https://lostintransit.se/2022/09/05/is-vlan-1-special-in-cisco-networks/

On Juniper, Arista, MikroTik, Cumulus - All these stated vendors, allow you to prune VLAN 1. On MikroTik this means:

/interface bridge
add frame-types=admit-only-vlan-tagged name=bridge vlan-filtering=yes

First step is to understand nature of your multicast. If it’s routable, then your need IGMP Proxy or PIM (as well as a careful look into IGMP Snooping, Multicast helpers etc). If it’s non-routable than you need a repeater of some sort.

E.g. mDNS’s multicast is non-routable and you would need a repeater such as Avahi. Or you could add specifically crafted static DNS records to your DNS server (mDNS/DNS-SD). The latter is the preferred solution for wide area mDNS.

I understood you well. On the other hand you’re underestimating the number of necessary changes to get rid of VLAN 1 use in ROS:


The above only takes care of bridge port. One has to deal with the issue on the rest of bridge ports as well (the way of dealing it depends on whether port is untagged access port, hybrid port or trunk port).

Again, I’m not saying it can’t be done, in contrary, it can be done. But, again, for inexperienced user it’s only too easy to miss all the points where it has to be done so it’s way easier to use other VIDs if there isn’t a very good reason to use VID 1 in tagged traffic.

We all started from somewhere. I started with computer science and CCNA syllabi. If a user is unwilling to learn computer science and network engineering fundamentals to do network engineering, they should quit while they are ahead.

I’m speaking as someone who was once a noob.

Good for you. I sometimes wonder if you actually understand posts by other (inexperienced) users …

Only a few users on this forum have desire to get beyond basic networking knowledge (enough to make their home network somehow working) and for the rest advice to stay away from VLAN 1 is pretty good advice IMO. If one goes beyond basic knowledge, then he will know all the bells and whistles. Unlike many others on this forum I try to help solve fellow members’ problems (and try to explain a thing or two on the way). I’m not upset if someone’s knowledge level is below my own (which, I’m honest with myself, is not very high) … unlike some other forum members who get nervous when dealing with users with inadequate knowledge.

Is this sill the case? I did a lot PIM-routing stuff around 2018/2019 with ROSv6 and it worked really good.
Cant believe they still werent able to fix an alredy good working (in v6) feature…

It’s not working on latest ROS v7.11 stable at least. And MikroTik did not provide PIM config documentation for ROSv7 either.

I suggest you raise a support ticket to push them to fix it.

PIM is an ancient protocol that’s like 20 years old. I don’t know how MikroTik doesn’t support 20-year-old protocols natively and smoothly.

It is true that PIM was undocumented on the new v7-centric help site for a long time, but that changed in October of last year. I haven’t had a good excuse to add VLANs to my MT LAN and then configure PIM-SM to route multicast between them, but why write all those new docs in a spurt of 12 new versions if nothing about it works?

I took the appearance of that new material as an indication that they’d gotten something working on v7.


like 20 years old

Twenty-six. :slight_smile:

I did a netinstall of v7.11.2. PIM seems to be working with early testing. Config example for people:

/routing pimsm instance
add afi=ipv4 disabled=no name=pimsm-IPv4 vrf=main
add afi=ipv6 disabled=no name=pimsm-IPv6 vrf=main

/routing pimsm interface-template
add disabled=no instance=pimsm-IPv4 interfaces="VLAN200" source-addresses=x.x.x.x
add disabled=no instance=pimsm-IPv6 interfaces="VLAN200" source-addresses=x.x.x.x
add disabled=no instance=pimsm-IPv4 interfaces="VLAN300" source-addresses=x.x.x.x
add disabled=no instance=pimsm-IPv6 interfaces="VLAN300" source-addresses=x.x.x.x

/interface bridge
add igmp-snooping=yes igmp-version=3 mld-version=2 name=bridge

Keep in mind, I’m using the official recommended bridge VLAN filtering to ensure IGMP/MLD Snooping works correctly:
https://help.mikrotik.com/docs/display/ROS/Basic+VLAN+switching

I set 3 interfaces in bridge (my main LAN), set also services on it. On another interface I set a different subnet for GUEST.
Would your setup work for DLNA discovery too? A device on the GUEST subnet needs to contact a service running on the LAN side.
Unfortunately I can’t set up VLANs at the moment. Thanks

If you don’t have VLANs, you don’t need PIM nor IGMP Proxy. The basic IGMP/MLD snooping configuration should be sufficient.

PIM/IGMP Proxy is for inter-VLAN routing.

So the conclusion is that with the latest firmware one can multicast between vlans successfully?