AT&T's fiber service comes with two pieces of hardware: the ONT and a "residential gateway" that, in addition to being a router, is a terminal for the VoIP serv

AT&T's fiber service comes with two pieces of hardware: the ONT and a "residential gateway" that, in addition to being a router, is a terminal for the VoIP service and also has some guts for facilitating their UVerse IPTV platform. Officially you can't opt out of using the RG. This differs from, say, Verizon's FiOS, which allows customers to just plug their own router straight into the ONT if they don't want the phone company's router. You can put the RG into a "passthrough" mode that gives a downstream client the public IP address, so a router thinks it's bridged, but under the hood the RG is still maintaining all the connections in its own NAT table. You can't simply plug a router into the ONT and have it work off the bat, as the RG has necessary 802.1x certs burned into the firmware. What you can do is use the eap_proxy tool mentioned in this same thread. I ran it on an EdgeRouter, and it essentially MITM'd the 802.1x handshaking and delegated that to the AT&T-provided RG, then once the 802.1x was dealt with, the EdgeRouter could get an address via DHCP. There's apparently nothing customer-specific about the 802.1x certs; there's a thread on DSLReports about people buying old AT&T RG's off eBay and rooting them to extract the certs to use on their own router. At the end of the day AT&T still owns and manages the hardware at the customer's end of the fiber (at the ONT level), they just also enforce usage of the router plugged into it too.