Runbook 08 — mDNS reflector + cast/print rules (WORKSTATIONS ⇄ IOT)¶

Goal: let phones/laptops/desktops on WORKSTATIONS (the trusted client zone — wired + stationary wifi, incl. the Kodi box) discover and use the Roku and the wifi printer on IOT, without flattening the network. mDNS/Bonjour is link-local multicast (224.0.0.251:5353) and does not cross VLANs, so you need a reflector plus unicast allow rules for the actual streams.

Prereqs: runbook 06 validated (WORKSTATIONS↔IOT unicast allow rules stubbed).

1. Reflect mDNS across VLANs — native OPNsense plugin (source-checked)¶

OPNsense ships a native mDNS repeater. System → Firmware → Plugins → install os-mdns-repeater; after a reload it appears at Services → mDNS Repeater (displayed text is "mDNS Repeater"): - Enable: on (the checkbox is labeled just "Enable") - Listen Interfaces: select WORKSTATIONS and IOT. At least 2 must be selected; the daemon supports up to 5. (The form also has "Enable CARP Failover" and a "Blocklist" — neither is needed for this single-node lab.)

That's the reflector — it re-broadcasts mDNS announcements between the selected VLANs. You still need the unicast allow rules below for the actual media/print streams (the reflector only carries discovery, port 5353).

Alternatives (only if you'd rather not run the plugin): - At the APs: UniFi/Omada/Aruba have a built-in "Multicast DNS"/Bonjour reflector — enable it and scope it to WORKSTATIONS ⇄ IOT. - Avahi on a tiny helper LXC with a leg in WORKSTATIONS + IOT (dnf install avahi, enable-reflector=yes). Don't multi-home a sensitive box (fileserver/ Proxmox) into IOT just for this.

2. Unicast allow rules (the actual media/print traffic)¶

Discovery ≠ data. Add/confirm these (these refine the stubs from runbook 06):

Firewall → Rules → WORKSTATIONS: - Pass: src WS net → dst IOT net: - Roku/Jellyfin cast: TCP 8060 (Roku ECP), 8009 (Chromecast), AirPlay TCP 7000,7100, plus the app's media ports as needed. - Printing: TCP 631 (IPP), 9100 (raw/JetDirect), UDP 5353 (mDNS). - Pass: src WS net → dst IOT net UDP 5353 (mDNS) — so reflected queries/ responses reach devices.

Firewall → Rules → IOT (return/originated discovery): - Pass: src IOT net → dst WS net UDP 5353 (mDNS responses) — keep this narrow (port 5353 only); IOT remains otherwise blocked from RFC1918.

If you used Option A (AP reflector), the reflection happens at L2 on the AP; you still need the unicast allow rules above for the streams that traverse the firewall between VLANs.

Validation¶

[ ] A phone on WORKSTATIONS sees the Roku in its cast list and can start playback from Jellyfin.
[ ] A laptop on WORKSTATIONS discovers the printer (Bonjour/IPP) and prints.
[ ] IOT remains blocked from everything else in RFC1918 (only 5353 back to WORKSTATIONS + Jellyfin to SERVERS) — verify in the firewall live log.

Then → runbook 09 (public services).