4 ms·

Wait so you have your main cable plugged into their modem, their router plugged into their modem, and then your own router plugged into their router?

by dudul 6y ago

warent 6y ago
Yes exactly. Their router has a LAN with my router as the only other device, which it's bridged with, and then my router has the true home LAN. A weird side effect of this is that I'm not using the 192.168.x.x range like usual (because that's what theirs is using), but instead the 10.0.x.x range
- _rs 6y ago
  So are you bridged then or is it really a double nat?
  - warent 6y ago
    this is really where my limited knowledge of networking shows. I'm not entirely sure but I want to say both or double nat. There's two networks, but my router thinks theirs is a modem and is connected via the "Internet" port, not just a normal device port
    - _rs 6y ago
      Ah ok - sounds like a double NAT then, not a bridge. Edit: to go into more detail, their router is acting as a NAT for your public IP, giving you your first subnet, and then your router is getting a single IP on that subnet and creating a NAT where your devices all get IPs. In a bridge there would only be 1 IP space behind a single NAT. In your case with a double NAT a lot of consumer things might not work (like UPnP) and port forwarding would require you to add rules to both routers.
      - warent 6y ago
        Thanks, yes that's exactly what it is then. In order to give external access to my devices (e.g. my NAS) I have to forward ports from their router to my router, and from my router to the device. So, definitely double NAT. Amusingly the person who installed it incorrectly called it a bridge. Thank you for the insight and lesson!
Bluecobra 6y ago
Funnily enough this is how my AT&T fiber is set up as well. They force you to use their router, and you can’t directly connect your router to the ONT. The problem is that they use a device certificate + EAP. There’s work arounds but it’s a pain.
- spearo77 6y ago
  Oh, there's a workaround for that.. I've unplugged my Residential Gateway and now my UniFi dream machine pro is directly connected to the ONT. You install a CA from a jailbroken modem into a supplicant container that runs on the UDM pro. It confirms to the network that you are using "authorised" equipment for the connection and the packets flow!
  - cosmie 6y ago
    I'm curious to see what happens with the new installs, which terminate the fiber directly at the gateway using the SFP port on the new BGW320 gateways, rather than using a separate ONT like they have historically. The UDM Pro has an SFP WAN port that could ostensibly be used, but I haven't seen much yet about the feasibility of adapting the existing bypasses to ONT-less installs.
  - comboy 6y ago
    Which is then a problem when you try to explain them that yes, you are sure the issue is with their service and not your setup. But what's your reason to be going such lengths instead of just plugging UDM into their router? Unless it was done for the fun of it which is fine and understandable.
    - cosmie 6y ago
      > But what's your reason to be going such lengths instead of just plugging UDM into their router? While you can do this and things will generally work, AT&T restricts all of their residential gateways from operating in a true passthrough/bridge mode to another router. So you end with double NAT and all the joys that entails (such as [1]). There are also a number of other issues that have been associated with operating in their faux-passthrough mode, including - Issues with IPv6 prefix delegation - Sporadic latency spikes (an issue in general, that you inherit since the gateway is still "doing" everything it normally would, since it won't actually act as a ure passthrough/bridge) - A firmware update capped throughput at 50Mbps (later fixed in another firmware update)[2] - Firmware updates tend to silently re-enable the built-in wifi radios So while it'll generally work, it ends up problematic. You inherit all of the performance issues associated with just using the gateway as your all in one modem/router/firewall/AP/gateway, plus the addition of double NAT, plus the sharp edges of their poorly implemented faux-passthrough modes, plus the ever-present concern that you're one firmware update away from a non-working network despite having used their official passthrough configuration. Hence why gateway bypasses are so popular[3][4][5][6]. Even if they're a bit involved to set up, once you get it working things just... work. With little if any upkeep (potentially a few minutes after a power outage, depending on the bypass method you implement). [1] https://www.windowscentral.com/fix-xbox-one-double-nat https://www.windowscentral.com/fix-xbox-one-double-nat [2] https://www.dslreports.com/forum/r32172124-AT-T-Fiber-5268AC-DMZ-to-Router-Speeds-50-200 https://www.dslreports.com/forum/r32172124-AT-T-Fiber-5268AC... [3] https://github.com/MonkWho/pfatt https://github.com/MonkWho/pfatt [4] https://github.com/bypassrg/att https://github.com/bypassrg/att [5] https://github.com/mrozentsvayg/vyos.att https://github.com/mrozentsvayg/vyos.att [6] https://github.com/Hou-dev/simple-eap-proxy https://github.com/Hou-dev/simple-eap-proxy

Wait so you have your main cable plugged into their modem, their router plugged into their modem, and then your own router plugged into their router?

by dudul 6y ago

Wait so you have your main cable plugged into their modem, their router plugged into their modem, and then your own router plugged into their router?

warent 6y ago

Yes exactly. Their router has a LAN with my router as the only other device, which it's bridged with, and then my router has the true home LAN. A weird side effect of this is that I'm not using the 192.168.x.x range like usual (because that's what theirs is using), but instead the 10.0.x.x range

_rs 6y ago
So are you bridged then or is it really a double nat?
- warent 6y ago
  this is really where my limited knowledge of networking shows. I'm not entirely sure but I want to say both or double nat. There's two networks, but my router thinks theirs is a modem and is connected via the "Internet" port, not just a normal device port
  - _rs 6y ago
    Ah ok - sounds like a double NAT then, not a bridge. Edit: to go into more detail, their router is acting as a NAT for your public IP, giving you your first subnet, and then your router is getting a single IP on that subnet and creating a NAT where your devices all get IPs. In a bridge there would only be 1 IP space behind a single NAT. In your case with a double NAT a lot of consumer things might not work (like UPnP) and port forwarding would require you to add rules to both routers.
    - warent 6y ago
      Thanks, yes that's exactly what it is then. In order to give external access to my devices (e.g. my NAS) I have to forward ports from their router to my router, and from my router to the device. So, definitely double NAT. Amusingly the person who installed it incorrectly called it a bridge. Thank you for the insight and lesson!

Bluecobra 6y ago

Funnily enough this is how my AT&T fiber is set up as well. They force you to use their router, and you can’t directly connect your router to the ONT. The problem is that they use a device certificate + EAP. There’s work arounds but it’s a pain.

spearo77 6y ago
Oh, there's a workaround for that.. I've unplugged my Residential Gateway and now my UniFi dream machine pro is directly connected to the ONT. You install a CA from a jailbroken modem into a supplicant container that runs on the UDM pro. It confirms to the network that you are using "authorised" equipment for the connection and the packets flow!
- cosmie 6y ago
  I'm curious to see what happens with the new installs, which terminate the fiber directly at the gateway using the SFP port on the new BGW320 gateways, rather than using a separate ONT like they have historically. The UDM Pro has an SFP WAN port that could ostensibly be used, but I haven't seen much yet about the feasibility of adapting the existing bypasses to ONT-less installs.
- comboy 6y ago
  Which is then a problem when you try to explain them that yes, you are sure the issue is with their service and not your setup. But what's your reason to be going such lengths instead of just plugging UDM into their router? Unless it was done for the fun of it which is fine and understandable.
  - cosmie 6y ago
    > But what's your reason to be going such lengths instead of just plugging UDM into their router? While you can do this and things will generally work, AT&T restricts all of their residential gateways from operating in a true passthrough/bridge mode to another router. So you end with double NAT and all the joys that entails (such as [1]). There are also a number of other issues that have been associated with operating in their faux-passthrough mode, including - Issues with IPv6 prefix delegation - Sporadic latency spikes (an issue in general, that you inherit since the gateway is still "doing" everything it normally would, since it won't actually act as a ure passthrough/bridge) - A firmware update capped throughput at 50Mbps (later fixed in another firmware update)[2] - Firmware updates tend to silently re-enable the built-in wifi radios So while it'll generally work, it ends up problematic. You inherit all of the performance issues associated with just using the gateway as your all in one modem/router/firewall/AP/gateway, plus the addition of double NAT, plus the sharp edges of their poorly implemented faux-passthrough modes, plus the ever-present concern that you're one firmware update away from a non-working network despite having used their official passthrough configuration. Hence why gateway bypasses are so popular[3][4][5][6]. Even if they're a bit involved to set up, once you get it working things just... work. With little if any upkeep (potentially a few minutes after a power outage, depending on the bypass method you implement). [1] https://www.windowscentral.com/fix-xbox-one-double-nat https://www.windowscentral.com/fix-xbox-one-double-nat [2] https://www.dslreports.com/forum/r32172124-AT-T-Fiber-5268AC-DMZ-to-Router-Speeds-50-200 https://www.dslreports.com/forum/r32172124-AT-T-Fiber-5268AC... [3] https://github.com/MonkWho/pfatt https://github.com/MonkWho/pfatt [4] https://github.com/bypassrg/att https://github.com/bypassrg/att [5] https://github.com/mrozentsvayg/vyos.att https://github.com/mrozentsvayg/vyos.att [6] https://github.com/Hou-dev/simple-eap-proxy https://github.com/Hou-dev/simple-eap-proxy