Recipe: television from your ISP (IPTV)

Goal: your ISP's television keeps working after you replace the ISP router with a MikroTik.

What you need

To know how your ISP delivers TV. There are three flavours: multicast over the ordinary internet connection, multicast over a VLAN of its own, or simply over the internet as an app. Only the first two need this recipe.
With a separate TV VLAN: the VLAN number. The provider presets in this tool fill in the internet connection only; the TV VLAN is deliberately not in them. For KPN, the note under the preset says TV runs over VLAN 4 and telephony over VLAN 7, while internet runs over VLAN 6.
A cable from the set-top box to the router or the switch. TV over Wi-Fi is a source of misery.

Step 1: the IPTV switch on the WAN

Go to WAN / internet and turn on Provider IPTV over multicast (IGMP proxy).
If your ISP delivers TV over the ordinary internet connection, you are done here.
If your ISP delivers TV on a VLAN of its own, add it as a second uplink: the same physical port, type DHCP, and the TV VLAN in the VLAN id on the WAN port field. Then pick that uplink under Uplink that carries IPTV; that field appears as soon as there is more than one uplink.

As soon as there are two uplinks, the tool assumes the second one is a backup line and offers a failover method. You do not want that here. Switch Add default route off on the TV uplink and leave the failover method on Distance + gateway check. Pick recursive or load balancing and the tool builds routes that try to send part of your internet through the TV connection.

Step 2: IGMP snooping on the bridge

Go to Bridge & ports and turn on IGMP snooping (multicast/IPTV). Without it the bridge sends the TV stream to every port, including ports where nobody is watching. With an HD channel that is enough to swamp a network. The tool warns about this when IPTV is on and snooping is off.

If there is a second MikroTik switch between the router and the set-top box, turn IGMP snooping on there as well; in the Switch role that toggle sits in the first step. If it is a SwOS switch, this tool gives you a setup sheet rather than a RouterOS script: switch snooping on there by hand.

Step 3: what the tool makes of it

An IGMP proxy with two interfaces: the chosen uplink as upstream with alternative-subnets=0.0.0.0/0, and the LAN as downstream. Those alternative subnets are needed because the stream comes from somewhere inside the provider's network rather than from the WAN subnet itself; without them the proxy ignores the sender.
Firewall rules: IGMP is accepted in the input chain, and multicast from WAN (224.0.0.0/4) in the forward chain.
In the bogon list, 224.0.0.0/4 is left out as a destination, because otherwise the television is thrown away in /ip firewall raw before anything else runs.

The IGMP proxy uses the LAN as its downstream, and that is the bridge. There is no field to choose another VLAN as the downstream. So your set-top box belongs in the ordinary LAN, not in a separate VLAN. The Firewall section has to be on, or the rules that let multicast in are missing; the tool says so.

Step 4: testing

/routing igmp-proxy interface print — are there two interfaces, and is the right one marked upstream?
/interface bridge print — does the bridge have igmp-snooping=yes?
/interface bridge mdb print — the multicast groups appear here as soon as the set-top box asks for a channel. If the list stays empty, the request from the box is not arriving.
/ip firewall filter print stats — are the two IPTV rules counting? If not, no multicast is coming in.
The real test: zap through the channels, and leave one channel running for ten minutes. A picture that stutters after a few minutes is a different problem from a channel that never starts.

When the picture stutters or the network floods

Snooping is off. The classic case: the picture works, but the whole network turns slow the moment the TV goes on. The stream is going to every port.
The set-top box is on Wi-Fi. Multicast over Wi-Fi is sent at the lowest rate and is not acknowledged. Run a cable. This tool has no setting that converts multicast to unicast.
The wrong VLAN. When nothing comes in at all, it is almost always the TV VLAN. Check the number with your ISP; the preset does not fill it in.
Firewall off or replaced. If you choose MikroTik's own default firewall copied exactly, the other firewall options are skipped, and so are the IPTV rules.
Zapping is slow. That is the IGMP proxy having to join a new group per channel. A few seconds is normal; tens of seconds points at loss between the set-top box and the router.
The switch cannot keep up. Snooping and VLAN filtering together can move traffic off the switch chip and into the CPU on smaller models. If the throughput lags, read the warnings when you generate; for the Atheros8327 and QCA8337 family the tool says so explicitly.
Internet through the TV uplink. If internet suddenly stops after you added the second uplink, check that Add default route is off on that uplink.