A slightly better way to filter wireless multicast on DD-WRT

Wi-Fi is a shared, half-duplex medium. Furthermore, every unicast frame must be acknowledged by the receiver. Combine these facts with a crowded spectrum in most areas, and we have every reason we need to keep unnecessary traffic off the airwaves.

Multicast traffic is uncommon on many smaller networks, but occasionally it pops up. Without a managed switching backbone that implements something like IGMP snooping, multicast frames are just converted into broadcast frames and ultimately hit every port—including access points. It’s up to the WAP to filter multicast, and most enterprise-grade systems have options to do so. However, consumer-grade equipment is usually out of luck, unless you’re running aftermarket firmware like DD-WRT.

A few of the guides online involve loading secondary ebtables kernel modules to match multicast frames based on frame type. This is entirely unnecessary, as layer 2 multicast addresses are readily identified, and ebtables can filter based on the destination type.

Filtering layer 2 traffic requires ebtables, which comes in most DD-WRT builds, except micro.

Browse to Administration > Commands and add either one of these as your Firewall, depending on your router’s chipset.

Broadcom:

ebtables -A FORWARD -o eth1 -d Multicast -j DROP
ebtables -A OUTPUT -o eth1 -d Multicast -j DROP

Atheros:

ebtables -A FORWARD -o ath+ -d Multicast -j DROP
ebtables -A OUTPUT -o ath+ -d Multicast -j DROP

Leave a Reply

Your email address will not be published. Required fields are marked *