4 ms·
Sigh, those AT&T gateways are such a dumpster fire. What's sad is that it's not likely that there will be an easy way to fix this as those gateways do not have
by MertsA 9y ago
Sigh, those AT&T gateways are such a dumpster fire. What's sad is that it's not likely that there will be an easy way to fix this as those gateways do not have any kind of bridge mode which is a crime in and of itself. The best they've got is DMZ+ mode which fakes giving the LAN device the public IP address but it's still doing NAT behind the scenes and routing everything as normal so it doesn't work for any IP protocol other than TCP, UDP, and ICMP so no IPSEC tunnels or GRE with those modems.
- toast0 9y agoThe biggest crime is that AT&T uses these on their FTTH to turn ethernet from the GPON transceiver into ethernet for the home. Thankfully, in that application, you can bypass it, but it's still a tragedy. My equipment is perfectly capable of handling Ethernet, thanks (it's also perfectly capable of bridging 802.1x packets to the gateway, and keeping all the rest of the packets :)
- benjaminl 9y agoDo you have a write-up of this anywhere? When I installed AT&T fiber I looked into this briefly, but I didn't find any success stories other than manual VLAN reassignment.
- boshaus 9y agohttps://bzsparks.com/2016/10/05/using-an-ubiquiti-edgerouter-with-att-gigapower-fiber/ https://bzsparks.com/2016/10/05/using-an-ubiquiti-edgerouter... here's an example for a ubiquiti edgerouter to not have to do the vlan garbage. I'm going to try getting it to work on pfsense later this week.
- toast0 9y agoI was planning on cleaning up some hardcoded values so I could push it to some git service, but haven't gotten around to it. However, I'm not above a code dump. My IP is hard coded, but then again, I'm going to link you to my website hosted on that IP, so it is what it is. :) http://ruka.org/~toast/steal/ http://ruka.org/~toast/steal/ (note the README which is going to tell you much of the same thing below in different words) Here's the scoop. This is a FreeBSD program which opens up netgraph sockets against two physical ethernet interfaces and one virtual one. The physical interfaces are a) one connected to the ONT, b) one connected to the WAN port on the Residential GateWay. The virtual interface (ngeth0) is the one that you configure as your internet connection for FreeBSD (These interfaces are hardcoded in init_netgraph in steal_util.c; sorry!) Everytime a packet comes in from the ONT, RGW, or FreeBSD, there's a decision for what to do with the packet. Mostly the RGW and FreeBSD packets go to the ONT, but through the libalias NAT engine for connection tracking. Packets inbound from the ONT are checked in the NAT tables to see where they should go... if there's no clear place to send it, then it goes to the FreeBSD. That's mostly in steal_util:loop. I haven't figured out how to setup the virtual interface in the program, so see the bottom of README for how i do that. steal2.c is a little bit insane, it's basically setting up hot code loading. It's annoying to restart the daemon because the NAT tables are dropped, and I do a lot of Erlang work in my day job, so I really wanted to be able to hotload some things with this. So it uses dlopen and dlfunc to load steal_util.so and calls the init and loop functions. If init fails on a reload, it continues to use the old loop. There's some provision for updating the state data structure in a safe way. Theoretically, this might work in Linux too, I think netgraph got ported there a couple of times, but I don't know if libalias did. Anyway, the main ideas could certainly be ported into whatever tool is available; namely: proxy 802.1x to the RGW, drop EAPOL logoff packets; oversend ARP packets, spoof mac address of the RGW, make pcaps of packets you don't know how to handle, etc. :) Also of note: the ONT/RGW send packets with VLAN 0, FreeBSD strips this when reading packets via netgraph, and I haven't found a way to send packets with VLAN 0, which hasn't been a problem (yet?). If it becomes a problem, I suspect I'd need to switch to the packet apis that tcpdump uses (BPF), I think there may be a sending interface there too. And I'm also sadly moving out of AT&T fiber's reach this summer, so at that point, I won't be able to test anything else.
- cat199 9y agoDevils advocate (not for AT&T routers, which are crap, but for this conversion) wouldn't this provide some benefit w/r/t electrical isolation of surges, etc. between the two networks?
- pjc50 9y agoEthernet is electrical isolation, at both ends, supposedly good up to 1500V.
- astrodust 9y agoEthernet would be really good at causing fires if this wasn't the case. Floating neutrals are no joke!
- benjaminl 9y agoIn this case for AT&T FTTH there are two seperate devices a ONT and AT&T's router. The ONT is a media converter that converts the GPON (fiber) to Ethernet. AT&T's router is superfluous in the scenario where the customer wants to user their own router. The only reason AT&T's router is necessary is to perform the 802.1x authentication. Living in Central Florida, the lightning capital of the United States, I take electrical isolation very seriously. This is what is so great about fiber. Instead of having a another separate conductor running into your house (twisted pair or coax) there is just a glass insulator (fiber). So no extra isolation needed.
- cat199 9y agoah yes! fiber! thanks good point.
- tinus_hn 9y agoIt’s all software, it’s quite unlikely they don’t have a firmware upgrade procedure. The hard part is getting AT&T to move.