Home→Posts→Getting Proximus IPTV to Behave on a Multi-Vendor Network (OPNsense + Cisco + UniFi)

Getting Proximus IPTV to Behave on a Multi-Vendor Network (OPNsense + Cisco + UniFi)

By tuabuh••5 min read•17 views
networkinghardware
Share:
Getting Proximus IPTV to Behave on a Multi-Vendor Network (OPNsense + Cisco + UniFi)
Swapping your ISP's router for your own hardware is one of those homelab milestones everyone eventually hits. For most setups, the pain ends once the WAN link comes up and you can ping the outside world. If you're on Proximus here in Belgium, that's roughly where it starts.

Plain internet on OPNsense is straightforward. Proximus TV is the part that cost me a weekend, mostly because the IPTV stream has to cross a switch network made up of three different vendors and stay alive the whole way.

The symptom is easy to spot. The stream plays fine, sometimes for hours and sometimes for only a few minutes, then freezes on a single frame for no obvious reason. That kind of intermittent failure usually comes down to multicast routing and IGMP timeouts, which is what this post covers.

My setup is an OPNsense firewall, a Cisco-like core switch, and a UniFi switch in the TV room. Below is the architecture, the VLAN layout, and the switch configuration that made it stable.

1. The Layout

With the ISP box you never deal with any of this, because it handles everything internally. Once you segment the network yourself, the TV traffic has to pass through every layer you've built. Here is how mine is wired:

  • OPNsense (the edge). Terminates the raw Proximus line and runs igmpproxy to move the multicast streams between the provider and the local network.
  • Cisco-like core switch. Connected directly to the firewall, and distributes connections to the other rooms.
  • UniFi switch (TV room). The last hop before the IPTV set-top box (STB).
[Proximus ISP] 
       │
       ▼ (VLAN 20)
 [OPNsense Firewall (192.168.2.1)]
       │
       ▼ (VLAN 1)
 [Cisco-like Core Switch] 
       │
       ▼ (Trunk)
 [UniFi TV Room Switch] ───► [IPTV Set-Top Box]

2. The VLAN Layout

I use three VLANs, each with a specific role:

  • VLAN 1 (LAN). The main home network. Regular devices live here, and so does the IPTV STB. That detail matters more than it looks.
  • VLAN 20 (WAN / provider upstream). The link between OPNsense and the Proximus infrastructure, carrying both internet and the raw TV streams.
  • VLAN 99 (IoT). An isolated network for smart-home devices. I keep IGMP Snooping off here so the device discovery chatter doesn't interfere with the video traffic.

3. The Core Switch

The core switch does most of the work. For IPTV, its job is to figure out where the multicast routers are, using IGMP Snooping.

If you look at its multicast tables, you can see it learn the active queriers:

Switch#show ip igmp snooping mrouter           Bridge 1: 
 VLAN: 1  Igmp Snooping Enabled 
    Mrouter -> ge1/1 (Learn't) 192.168.2.1
 VLAN: 20  Igmp Snooping Enabled 
    Mrouter -> ge1/2 (Learn't) 195.13.31.34
 VLAN: 99  Igmp Snooping Disabled

I never enabled the core's own IGMP Querier manually. It detects them on its own:

  • On VLAN 20 it picks up 195.13.31.34, the upstream multicast router inside Proximus's network.
  • On VLAN 1 it picks up 192.168.2.1, the OPNsense box running igmpproxy.

The rule worth remembering: if something upstream is already querying a VLAN, don't also enable the switch's built-in querier on that same VLAN. Two queriers on one segment trigger a querier election, and those elections drop the stream while they happen. Keep one querier per VLAN.

4. The UniFi Switch

This is where most Proximus TV setups break, and it took me a while to accept that the problem was here and not in OPNsense.

UniFi gear likes to manage itself. Put a UniFi switch into a network that already has a Cisco core and an OPNsense firewall, and it will try to take over the IGMP plane from both of them. That is what causes the random freezing.

The fix is to make the UniFi switch defer to the layers above it. In the IGMP Snooping profile for the LAN network:

  • Querier Selection: Off (3rd Party Switches). This stops UniFi from acting as a querier and makes it listen to the queries coming down from the OPNsense and Cisco layer instead.
  • Fast Leave: Enabled. When you change a channel, this drops the old stream from the STB's port straight away instead of leaving it open. Without it, the link can get overloaded with several HD streams that should already be gone.

5. Why It Freezes (Sometimes)

This was the part that took the longest to pin down. The stream would come up clean and run fine for a long stretch, then drop after only a few minutes the next time, with no clear pattern. The inconsistency is the real problem, because there's no fixed timing to point at. What's behind it is usually an IGMP membership timeout, and once you understand the mechanism the fix is clear.

When the STB tunes a channel, it sends an IGMP Join packet. The switches see it, open the port, and the picture starts. To keep that port open, the network has to send a periodic IGMP General Query to confirm someone is still watching.

If those queries stop arriving, it breaks down. With UniFi left in "Advanced Querier" mode, or with OPNsense's software igmpproxy occasionally missing a query, the switches assume the STB is no longer watching. The snooping entry times out, the port is pruned, and the picture freezes. Because the queries only get missed now and then, the freezes happen at random rather than on a schedule, which is what makes them hard to reproduce.

A more reliable fallback

If igmpproxy keeps dropping queries even after you've adjusted the UniFi settings, the more reliable option is to move query duty to hardware:

  1. Keep igmpproxy running on OPNsense, since you still need it to route the data between interfaces.
  2. Enable the IGMP Querier on VLAN 1 on the Cisco core, and give it a dedicated IP on that subnet.

A switch ASIC holds a steady 60-second query interval, which keeps the UniFi switch and the STB in sync. That is what finally stopped the freezing on my setup.