3 ms·

Some new data.... I ran the same script on two different machines connected via the same AT&T provided modem. Machine A is NATted, B uses a public address. A al

by bakul 6y ago

Some new data.... I ran the same script on two different machines connected via the same AT&T provided modem. Machine A is NATted, B uses a public address. A always gets the error within 50-60 fetches. B doesn't (I ran the test a number of times for a few seconds each). I even ran them both concurrently (repeated the test on A since it keeps failing) but it was always A that got the error. I am wondering if this is modem related -- may be they silently "upgraded" it or changed some default such as TCP checksum offload? Just guessing, I haven't checked. Experiment 2: I switched machine A to use a public address (from my static IP address block) and the problem disappeared! I then switched it back to the way it was and still there are no errors. Not sure what to make of this...

AaronFriel 6y ago
How are you bypassing the EAP authentication on your AT&T provided gateway? Are you using https://github.com/jaysoffian/eap_proxy https://github.com/jaysoffian/eap_proxy ? My router is also getting a public IP address, I've set my AT&T gateway to bridge mode, but the AT&T gateway is still a monster-in-the-middle, a tumor I can't excise because it has to be between your router and the ONT or else the fiber turns off.
- bakul 6y ago
  I recall hardly any of the details now but IIRC I talked to the AT&T support person and they changed some settings. Looking at the settings now, I see in "Home Networks->Subnets & DHCP" the [public subnet mode] is on. I haven't had to deal with any EAP authentication (but again I may be forgetting!). And IP Passthrough is off. Basically the modem is routing between the public and private subnets. BTW, I do have a static IP block from AT&T.
- toast0 6y ago
  When I was in the service area, I had written a EAP proxy and did it that way (I've still got the code around somewhere, ran on FreeBSD, email in my profile if you want it), but I've heard the easier way is to put an unmanaged switch between the ONT and the residential gateway, let the gateway do the 802.11x, then unplug it from the switch and use hardware of your choice. As long as your switch isn't too smart, it won't know to send an 802.11x signoff, and the ONT will leave the network port working. Yay, security theater. You may need to spoof mac for DHCP, but I don't know if that's strictly required.

by bakul 6y ago

AaronFriel 6y ago

How are you bypassing the EAP authentication on your AT&T provided gateway? Are you using https://github.com/jaysoffian/eap_proxy https://github.com/jaysoffian/eap_proxy ? My router is also getting a public IP address, I've set my AT&T gateway to bridge mode, but the AT&T gateway is still a monster-in-the-middle, a tumor I can't excise because it has to be between your router and the ONT or else the fiber turns off.

bakul 6y ago
I recall hardly any of the details now but IIRC I talked to the AT&T support person and they changed some settings. Looking at the settings now, I see in "Home Networks->Subnets & DHCP" the [public subnet mode] is on. I haven't had to deal with any EAP authentication (but again I may be forgetting!). And IP Passthrough is off. Basically the modem is routing between the public and private subnets. BTW, I do have a static IP block from AT&T.
toast0 6y ago
When I was in the service area, I had written a EAP proxy and did it that way (I've still got the code around somewhere, ran on FreeBSD, email in my profile if you want it), but I've heard the easier way is to put an unmanaged switch between the ONT and the residential gateway, let the gateway do the 802.11x, then unplug it from the switch and use hardware of your choice. As long as your switch isn't too smart, it won't know to send an 802.11x signoff, and the ONT will leave the network port working. Yay, security theater. You may need to spoof mac for DHCP, but I don't know if that's strictly required.