Apple TV across subnets

Question

Level 1

0 points

Apple TV across subnets

Hi,
Our marketing department would like to setup TVs at our branch offices and push information to some AppleTV boxes at each branch office. Each branch office is on a separate subnet (192.168.x.x)

The Mac which will control these devices is located at our main branch and can see an AppleTV setup we have here at the main branch (the Mac and the AppleTV are on the same subnet).

Our problem is that the Mac can not see the AppleTV device at the branch office. I will list what I've tried so far

- Pinged the AppleTV device successfully from the Mac
- Attempted to telnet to the AppleTV device from the Mac.
On this telnet attempt only port 3689 responded successfully. All other ports (listed in this article: http://support.apple.com/kb/HT2463) give a connection refused message

- Because of that I then went into the Cisco switches and routers between the Mac and the Apple TV and added an access-list which should allow TCP 123, 3689 and UDP 5353 from the Mac over to the AppleTV. Ports 80, 443, and 53 should never be blocked on our routers

- Again all attempts to telnet into those ports from the Mac computer failed

- I then tried to telnet to the AppleTV from the various switches and routers with the same result.

- I even went so far as to add a static route onto the Mac to go directly to the AppleTV as well.

All of this has resulted in no success.

I would greatly appreciate any help on this matter. Fortunately, our network is pretty simple so getting it to work on one subnet means we can easily get it working on all subnets.

Thanks!
-JLF

AppleTV, Mac OS X (10.6.3)

Posted on Apr 30, 2010 2:10 PM

Reply

Answer 1

capaho

Level 4

3,677 points

Apr 30, 2010 5:26 PM in response to jlf175

The ATV can only access iTunes libraries on the same local network, it can't share libraries over the Internet. It's possible you could get around this with a company VPN, but there is no VPN client for the ATV, so you would have to connect it to a router that is configured for the VPN.

Another option would be to create podcasts of your information and put them on a company server where they could be added to the iTunes library for each ATV via a URL.

Reply

Answer 2

jlf175 Author

Level 1

0 points

May 1, 2010 2:26 PM in response to jlf175

Hi, the network is all LAN/WAN and does not go out to the Internet or cloud networking. All connections between the branches are strictly point to point.

I remembered that I did forget to change the settings on one switch on the network and will try that Monday.

Reply

Answer 3

May 1, 2010 2:48 PM in response to jlf175

My understanding is that the devices must be on the same subnet (ie 192.168.1.x) and will not work over different subnets (ie 192.168.x.x)

That being said you should be able to complete the first part of your goal. If you are sure all the ports that should be open are, you might want to take a look at any security software you might be running.

Reply

Answer 4

jlf175 Author

Level 1

0 points

May 3, 2010 4:58 AM in response to Winston Churchill

Hi Winston,
As the network is a closed network the only security devices between branches are routers of which I've put in an access-list on on all points (i.e. switches and routers) between the Mac and AppleTV.

For example, here's the access-list additions I've made which I thought would be sufficient. I have, of course, omitted the IP address of the Mac ...

access-list 101 permit udp host <<Mac computer IP>> any eq 5353
access-list 101 permit tcp host <<Mac computer IP>> any eq 123
access-list 101 permit tcp host <<Mac computer IP>> any eq 3689

Normally, when you open up individual ports like this you should then be able to telnet into those individual ports and get some sort of response from the device, even if it's a blank screen or gibberish. The only port that I get any sort of response for is the tcp 3689 port. The 5353 and 123 give a "connection refused" message.

Reply

Answer 5

capaho

Level 4

3,677 points

May 3, 2010 7:04 AM in response to jlf175

The network is a closed network between our branches.

But closed how? The specific nature of the network infrastructure is important as to how to resolve your problem. If your network is using the Internet, then the individual branches are not on the same local network, which makes it impossible to do what you want to do.

If your network is hardwired or using satellite or microwave transceivers, you would probably need your IT department (or IT consultant) to configure the network to do what you want.

If you are using a VPN, you essentially have a virtual local network, but there is no way to install a VPN client on an ATV, so you would have to configure a router for it to see the VPN as a local network, if that's possible to do between a remotely hosted iTunes library and an ATV.

I believe the iTunes/ATV DRM scheme is designed to prevent the type of sharing you are trying to accomplish across remote locations. Your only viable option may be to distribute your content to the branches as podcasts.

Reply

Answer 6

jlf175 Author

Level 1

0 points

May 3, 2010 7:45 AM in response to capaho

It is closed in that there is a hardwire running from our main branch, through the telco trunk lines to our other branches. It's very rudimentary but it works. Our ISPs and phone companies bother us all the time to move away from this setup and go to cloud or VPN setup but for security concerns we won't do it.

Regardless, if the AppleTV system will not allow communication across subnets due to a hardware or software restriction in the product then the work I'm doing at the layer-3 level (routers and IPs) won't matter.

Sounds like our marketing team is out of luck for now.

Thanks to everyone who contributed to this thread.

Reply

Answer 7

capaho

Level 4

3,677 points

May 3, 2010 7:56 AM in response to jlf175

It is closed in that there is a hardwire running from our main branch, through the telco trunk lines to our other branches.

You're right, that method is old style. If you're using modems and telephone lines between branches, you are out of luck in relation to using ATVs as you described.

Reply

Answer 8

May 3, 2010 10:07 AM in response to jlf175

Forgive me if this is not helpful in any way, but would Wide Area Bonjour be something that would allow this?
http://www.dns-sd.org/ClientSetup.html

I haven't used it, but when I get a chance I am going to look into it for remote file sharing with another office.

Reply

Answer 9

jlf175 Author

Level 1

0 points

May 3, 2010 12:01 PM in response to jlf175

Unfortunately, the Bonjour program did not work either. I think the issue there is that our internal LAN network domain is not presentable to the outside world as it's not a valid domain name for public consumption.

However, as that link pointed out, once I did setup the test site listed I saw all sorts of new equipment from another network. So at least I know it was working with public facing domain names so that was pretty neat.

Reply

Answer 10

capaho

Level 4

3,677 points

May 3, 2010 6:21 PM in response to jlf175

...they do not go through the Internet or other ISP provider.

That in itself is not a problem. The primary problem is that each branch is on a different subnet. I believe the DRM scheme is such that iTunes will not acknowledge an ATV that is on a different subnet, nor will an ATV list an iTunes library that is on a different subnet.

Reply

Answer 11

capaho

Level 4

3,677 points

May 1, 2010 6:17 PM in response to jlf175

All connections between the branches are strictly point to point.

Does that mean that all of the branches are connected by a closed, hardwired network, or are you using a VPN?

Reply

Answer 12

jlf175 Author

Level 1

0 points

May 3, 2010 4:53 AM in response to capaho

The network is a closed network between our branches. We role "old school" around here. Clouds are something in the sky that make rain, not a network topology we want to use. 🙂

Reply

Answer 13

jlf175 Author

Level 1

0 points

May 3, 2010 10:34 AM in response to capaho

Possibly a bad choice of words. We have dedicated T1 lines between each branch that run from our main office to the branch office but they do not go through the Internet or other ISP provider.

Reply

Answer 14

jlf175 Author

Level 1

0 points

May 3, 2010 10:35 AM in response to Matt Larson2

Matt,
Thank you for that link, I will give it a try today.

Reply