Ethernet network and firewall

[sekriT]

I have two phantoms and a dialog connected via ethernet.  Wifi on these receive IP addresses on 192.168.1.x network. I had to connect them via ethernet since Wifi was annoyingly unreliable using crowded 2.4 Ghz even though 5 Ghz bandwidth was free (see my old posts about this).  Anyways, phantoms have been working fine since I connected them via ethernet and never wondered about the ethernet addresses since it just worked.  But I installed a pfSense firewall recently as a better replacement for a residential wireless router/firewall. I was digging the firewall logs and noticed that 3 local devices were being blocked. These were on 10.201.42.1 (dialog), 10.201.42.35 and 10.201.42.44 (phantoms) using port 24242 sending packets each other every 3-5 seconds. I unblocked them so that they can freely talk to each other.  Surprising to me that they worked even though firewall was blocking this traffic. But music now plays immediately instead of 1-2 seconds of delay after pressing the play button. It is absurd that while Wifi network uses the same subnet as the other devices on the home network, ethernet was fixed at 10.201.42.x subnet. Maybe dialog acts as a router for phantoms using ethernet hence different network addresses are used. On the other hand receives IP address from home router when using Wifi? Strange.

So, if you have a setup similar to mine, it pays to check the firewall logs.

[iliapas]

The 10.42.42.0 network is used by Phantoms when creating the setup wifi network, and it does make sense for dialog+phantoms to automatically set up shop on some unused internal ip range, such that even if one of them has issues with normal dhcp server, it will still be available through the secondary ip.

Would you be able to make a capture of communication between dialog and phantom when initiating playback from some streaming service, or using dialog's optical input?

[angenet]

I have two phantoms and a dialog connected via ethernet.  Wifi on these receive IP addresses on 192.168.1.x network. I had to connect them via ethernet since Wifi was annoyingly unreliable using crowded 2.4 Ghz even though 5 Ghz bandwidth was free (see my old posts about this).  Anyways, phantoms have been working fine since I connected them via ethernet and never wondered about the ethernet addresses since it just worked.  But I installed a pfSense firewall recently as a better replacement for a residential wireless router/firewall. I was digging the firewall logs and noticed that 3 local devices were being blocked. These were on 10.201.42.1 (dialog), 10.201.42.35 and 10.201.42.44 (phantoms) using port 24242 sending packets each other every 3-5 seconds. I unblocked them so that they can freely talk to each other.  Surprising to me that they worked even though firewall was blocking this traffic. But music now plays immediately instead of 1-2 seconds of delay after pressing the play button. It is absurd that while Wifi network uses the same subnet as the other devices on the home network, ethernet was fixed at 10.201.42.x subnet. Maybe dialog acts as a router for phantoms using ethernet hence different network addresses are used. On the other hand receives IP address from home router when using Wifi? Strange.

So, if you have a setup similar to mine, it pays to check the firewall logs.

Hi

Very interesting topic.. some few weeks back.. on a weekend I managed to wire all my four phantoms (located in 3 rooms) of my house..
but since I have experienced a lot of issues.. the phamtom will stop playing and as if they are disconnected from the network...Spark will become non active leaving me with the only option to reboot dialog and the phantoms...

So I was wondering if something is blocking the connection ...

The firewall in my router is set to low...

Any suggestion will be highly appreciated.

[sekriT]

Normally, spark, dialog and phantoms should not loose connection with each other. I was also wondering why it is difficult to connect dialog with phantoms even though they were connected via wired ethernet. You should login to your router and read the firewall logs. Dialog functions as a network router itself and talk to spark and phantoms every few seconds using UDP port 24242. If your home router is blocking this traffic, you should tweak the firewall setting. I know most household routers neither has logging function nor any setting to modify the firewall. If that's the case, you can unplug your internet connection from router and temporarily turn off the firewall. If the phantoms are recognized during the setup immediately and don't get lost by dialog, then you may suspect the firewall. If it is not making any difference, then you can ignore this post. I was not aware of this issue until I installed a "real" firewall like pfSense which logs every action it takes.  Attached image shows settings on my firewall to allow their communication.

[iliapas]

Easiest solution is to disable the firewall.

Unless you need it enabled (and you would know if you do), it doesn't actually protect you from anything, and just adds an extra layer of faulty software that adds latency and provides another attack surface, especially if you're using NAT (which most modern home internet connections do).

So, disable firewall and see if that helps.

If there's any setting to do with "broadcast domain" in "LAN setting", disable any "broadcast protection". Phantoms as well as many UPNP/DLNA appliances use local-network broadcast addresses to broadcast their messages (basically sending UDP packets to x.x.x.255 address, which is supposed to be seen by all hosts on same local network. In corporate networks with hundreds of hosts you break up broadcast domains to limit amount of (idle) traffic, but at home the main reason is to save power on wireless devices (which have to receive an process these broadcast messages). So many home routers do not forward broadcast packets to wifi endpoints. There is normally a setting to control that, though. This issue affects Phantoms, UPNP/DLNA, Apple AirPlay/Bonjour, SMB and other services, so enabling broadcast on wifi might solve some older problems you did not think had a solution
(not having to do with any phantom issues: if you're having any issues with p2p voice apps - whatsapp,skype,viber,googlevoice,facetime,hangouts etc - in router NAT settings, see if you can choose between "full-cone" and "symmetric/open" NAT, then choose "symmetric/open")

[sekriT]

I would not recommend anybody to disable their firewall permanently if the router is connected to the internet.  Once you read firewall logs, you realize how much malicious scanning exists from well known sources.

[angenet]

I would not recommend anybody to disable their firewall permanently if the router is connected to the internet.  Once you read firewall logs, you realize how much malicious scanning exists from well knows sources.

Hi

Thanks a lot, I have now disabled the firewall and will update you if there is any change/improvement.

cheers