WebRTC and OPNsense

[sammyke007]

Hi

I'm running Frigate for some months and I absolutely love it.
I had WebRTC working perfectly fine external with my old Asus router, but after switching to OPNsense it won't work anymore...

I see in my OPNsense firewall log that the initial connection to my Frigate IP is allowed on port 8555, but then it tries to connect 5 times over a random port after that (which gets blocked every time again).

Any ideas? I've tried something with "static" in outbound NAT rules, but no succes.

Port forward 8555 TCP/UDP from any source to my Frigate IP is enabled.

So currently it does this:
213.119.173.6:29134 > 192.168.1.21:8555 (= ALLOWED)
213.119.173.6:25307 > ISP_IP:8161 (= DISALLOWED)
213.119.173.6:25307 > ISP_IP:8161 (= DISALLOWED)
213.119.173.6:25307 > ISP_IP:8161 (= DISALLOWED)
213.119.173.6:25307 > ISP_IP:8161 (= DISALLOWED)
213.119.173.6:25307 > ISP_IP:8161 (= DISALLOWED)

213.119.173.6 is my phone's mobile IP (connected thru 5G).

Tnx!

[NickM-27]

You need to enable uPnP

[kirsch33]

can you elaborate more on your setup (if you have pfsense/opnsense)?

as described in my other reply, my setup works, but isnt always reliable (sometimes only loads jsmpeg, recordings slow to slow, etc). do you have upnp enabled and no other firewall or NAT rules?

[NickM-27]

I have 8555 mapped on my router, but I am running 1.5.0. I believe in 1.2.0 it uses a random UDP port but in 1.5.0 go2rtc only uses 8555 tcp and udp.

[kirsch33]

i run 1.5.0 as well, and by mapped you mean what exactly? forwarded to frigate?

do you have static IP or do you use stun?

[NickM-27]

I mean port forwarding, along with running frigate in host mode. I use stun

[kirsch33]

I have WebRTC working well by doing this. Note that I view my cameras thru Home Assistant, and that I have Frigate and HA on the same VLAN:

• Open port 8555 inbound WAN (TCP/UDP protocols) and forward to host running Frigate (with Frigate running in host network mode)
• Within firewall rules for Frigate/HA VLAN, I created a "Allow Local WebRTC" rule that allows all traffic FROM the Frigate host, destination IP any, destination port range 20000-65535, protocol UDP
• Floating firewall rule to allow 8555, TCP/UDP, across all VLANs (this may not actually be needed but I created it in a fit of frustration when trying to get this all working)

This may not be 100% correct but is reasonably secure and has been working for me.

[sammyke007]

I'll try your suggestions later today.
As far as I can see UPnP is an additional plugin for OPNsense correct?

I'm running Frigate 0.12.1 with go2rtc 1.5.0
As written above, I get an initial connection on port 8555, but then I get 5 new connections on a complete random port (that get disallowed in the firewall).

This is my port forward in OPNsense:

This is the rule:

Frigate is internally running on 192.168.1.21

I must say that I'm connecting to Frigate with a Cloudflare Tunnel.
I tried adding all the Cloudflare ipv4's as candidates but no succes:

  webrtc:
    listen: ":8555" # address of your local server and port (TCP/UDP)
    candidates:
      - 78.***.***.***:8555 # My external IP
      - 173.245.48.0/20:8555
      - 103.21.244.0/22:8555
      - 103.22.200.0/22:8555
      - 103.31.4.0/22:8555
      - 141.101.64.0/18:8555
      - 108.162.192.0/18:8555
      - 190.93.240.0/20:8555
      - 188.114.96.0/20:8555
      - 197.234.240.0/22:8555
      - 198.41.128.0/17:8555
      - 162.158.0.0/15:8555
      - 104.16.0.0/13:8555
      - 104.24.0.0/14:8555
      - 172.64.0.0/13:8555
      - 131.0.72.0/22:8555

This is exactly what happens when I try to load an RTC stream in my firewall:

78...*** is my ISP external IP
188.189.171.18 is my client IP (mobile on 4G to test external access)
192.168.1.21 is my Frigate running in hostmode on a Proxmox LXC

[ors86]

@sammyke007 Might you found a walkaround? Same issue with mikrotik.