5 ms·

Just as a FYI/aside, it is fairly trivial to root AT&T home gateways, pull the certs and use your own hardware to authenticate to the network, removing their ha

by l2p 6y ago

Just as a FYI/aside, it is fairly trivial to root AT&T home gateways, pull the certs and use your own hardware to authenticate to the network, removing their hardware off your stack entirely except for the ONT. (goodbye internet downtime due to random uncontrolled gateway "upgrades"). You just need a router capable of 802.1x client auth. Throughput both ways actually gets really close to what I am paying for with this configuration, where as before with the default gateway (regardless of configuration), I was lucky to see 1/2 of the gigabit speeds I have been paying for.

conk 6y ago
This is true for existing installs. But recently ATT moved to XGPON gateways with integrated ONT. You can no longer bypass these gateways. Also to my knowledge you can’t extract the certs from Pace gateways.
- inetknght 6y ago
  And, these gateways use NAT even when in "bridged mode"
- BrianGraggg 6y ago
  You can request to go into bridge mode which will bypass the internal residential gateway (NAT).
  - userbinator 6y ago
    If an ISP is NAT'ing everyone (which I've heard of referred to as an "InterNAT Service Provider"), does "bridge mode" mean you get a real public IP? How does that work with everyone else still behind the NAT? (I have an actual end-to-end-connectable public IP from my ISP, which from the general discussion seems like an increasingly rare thing --- they keep pestering me to "upgrade" to outrageously faster yet slightly cheaper plans with a "free router included", so I suspect they are trying to get me to give up that IP...)
    - conk 6y ago
      There are 2 different topics here. One is carrier grade NAT (CGNAT), which is used by ISPs that have run out of IPv4 addresses so you don’t get a real public IPv4 address, although you should have a public IPv6. If you’re unlucky enough to be on one of thee ISPs there’s likely not much you can do. The other issue is ISP provided gateways that handle authentication onto the ISP network, like ATT fiber. These devices contain the certificate/keys to gain access to the network. Unfortunately theses devices also try to be more than just an auth device/gateway. In ATT’s case the gateway also handles some Uverse/IP TV services so they don’t have a true bridge mode where they send all traffic to another device. This approach then causes issues like update downtime or NAT table issues. Either of these issues shouldn’t be caused simply by an ISP provided router. If an ISP wants to implement either approach they will do so without your approval.
      - oarsinsync 6y ago
        > One is carrier grade NAT (CGNAT), which is used by ISPs that have run out of IPv4 addresses so you don’t get a real public IPv4 address, although you should have a public IPv6. If you’re unlucky enough to be on one of thee ISPs there’s likely not much you can do. This is true. Your options look like: 1. Get a new ISP 2. Get a VPN that supplies you with a public IP (these exist) 3. Hope you can do whatever you need on IPv6 instead
        tomatocracy 6y ago
        Some CGNAT ISPs will also sell service with a public IPv4 for a premium. That's probably the most "user-friendly" option but it's also probably something they don't advertise and you need to ask for explicitly, if offered.
      - pixelface 6y ago
        you can still get around this with some effort [1] and a pfsense box, the pfsense box gets wan from the ont and the original att router is hung off a third nic where it's allowed to do 802.1x and nothing else. the setup was a little challenging at first but has been maintenance free since. maybe there is a technical reason they have their network set up this way but i was offended at the idea of being prevented from using my own router. [1] https://github.com/MonkWho/pfatt https://github.com/MonkWho/pfatt
  - greg5green 6y ago
    The AT&T gateways do not have a true bridge mode. They still use NAT even if they look like they are just passing the connection on.
JoshGlazebrook 6y ago
It's even more trivial with CenturyLinks Fiber. You don't even need any certs.
recursive 6y ago
I have such AT&T hardware also, but you and I have very different ideas about what's trivial. I didn't know their box even had certs, or what "ONT" is. Is there like... a written series of steps I could follow?
- diegs 6y ago
  If you are willing to move to Ubiquiti hardware (recommended, security breach from today notwithstanding) there's a relatively straightforward bypass method where the authentication packets are forwarded from the ONT to the AT&T box but it's otherwise out of the loop, and you have fully native routing with the Ubiquiti USG (a really nice router and ecosystem). Instructions: https://medium.com/@mrtcve/at-t-gigabit-fiber-modem-bypass-using-unifi-usg-updated-c628f7f458cf https://medium.com/@mrtcve/at-t-gigabit-fiber-modem-bypass-u... Github project that makes it possible: https://github.com/jaysoffian/eap_proxy https://github.com/jaysoffian/eap_proxy It's definitely not plug and play but I've been using this setup for a year and a half and I get my full 1gb bandwidth throughout my network with lots of hosts.
  - lights0123 6y ago
    AT&T has started using a much newer gateway for new installations.
    - diegs 6y ago
      Damn, that's a serious bummer. I hope mine doesn't break anytime soon.
- l2p 6y ago
  If you have the BGW210 gateway there is a written series of steps for root here: https://github.com/Archerious/bgw210-root https://github.com/Archerious/bgw210-root As well as step by step configuration for complete gateway bypass on Mikrotik router hardware here: https://forum.mikrotik.com/viewtopic.php?t=154954 https://forum.mikrotik.com/viewtopic.php?t=154954 If you are stuck with the newer XG-PON hardware, it looks like you might be out of luck for now.

by l2p 6y ago

conk 6y ago

This is true for existing installs. But recently ATT moved to XGPON gateways with integrated ONT. You can no longer bypass these gateways. Also to my knowledge you can’t extract the certs from Pace gateways.

inetknght 6y ago
And, these gateways use NAT even when in "bridged mode"
BrianGraggg 6y ago
You can request to go into bridge mode which will bypass the internal residential gateway (NAT).
- userbinator 6y ago
  If an ISP is NAT'ing everyone (which I've heard of referred to as an "InterNAT Service Provider"), does "bridge mode" mean you get a real public IP? How does that work with everyone else still behind the NAT? (I have an actual end-to-end-connectable public IP from my ISP, which from the general discussion seems like an increasingly rare thing --- they keep pestering me to "upgrade" to outrageously faster yet slightly cheaper plans with a "free router included", so I suspect they are trying to get me to give up that IP...)
  - conk 6y ago
    There are 2 different topics here. One is carrier grade NAT (CGNAT), which is used by ISPs that have run out of IPv4 addresses so you don’t get a real public IPv4 address, although you should have a public IPv6. If you’re unlucky enough to be on one of thee ISPs there’s likely not much you can do. The other issue is ISP provided gateways that handle authentication onto the ISP network, like ATT fiber. These devices contain the certificate/keys to gain access to the network. Unfortunately theses devices also try to be more than just an auth device/gateway. In ATT’s case the gateway also handles some Uverse/IP TV services so they don’t have a true bridge mode where they send all traffic to another device. This approach then causes issues like update downtime or NAT table issues. Either of these issues shouldn’t be caused simply by an ISP provided router. If an ISP wants to implement either approach they will do so without your approval.
    - oarsinsync 6y ago
      > One is carrier grade NAT (CGNAT), which is used by ISPs that have run out of IPv4 addresses so you don’t get a real public IPv4 address, although you should have a public IPv6. If you’re unlucky enough to be on one of thee ISPs there’s likely not much you can do. This is true. Your options look like: 1. Get a new ISP 2. Get a VPN that supplies you with a public IP (these exist) 3. Hope you can do whatever you need on IPv6 instead
      - tomatocracy 6y ago
        Some CGNAT ISPs will also sell service with a public IPv4 for a premium. That's probably the most "user-friendly" option but it's also probably something they don't advertise and you need to ask for explicitly, if offered.
    - pixelface 6y ago
      you can still get around this with some effort [1] and a pfsense box, the pfsense box gets wan from the ont and the original att router is hung off a third nic where it's allowed to do 802.1x and nothing else. the setup was a little challenging at first but has been maintenance free since. maybe there is a technical reason they have their network set up this way but i was offended at the idea of being prevented from using my own router. [1] https://github.com/MonkWho/pfatt https://github.com/MonkWho/pfatt
- greg5green 6y ago
  The AT&T gateways do not have a true bridge mode. They still use NAT even if they look like they are just passing the connection on.

JoshGlazebrook 6y ago

It's even more trivial with CenturyLinks Fiber. You don't even need any certs.

recursive 6y ago

I have such AT&T hardware also, but you and I have very different ideas about what's trivial. I didn't know their box even had certs, or what "ONT" is. Is there like... a written series of steps I could follow?

diegs 6y ago
If you are willing to move to Ubiquiti hardware (recommended, security breach from today notwithstanding) there's a relatively straightforward bypass method where the authentication packets are forwarded from the ONT to the AT&T box but it's otherwise out of the loop, and you have fully native routing with the Ubiquiti USG (a really nice router and ecosystem). Instructions: https://medium.com/@mrtcve/at-t-gigabit-fiber-modem-bypass-using-unifi-usg-updated-c628f7f458cf https://medium.com/@mrtcve/at-t-gigabit-fiber-modem-bypass-u... Github project that makes it possible: https://github.com/jaysoffian/eap_proxy https://github.com/jaysoffian/eap_proxy It's definitely not plug and play but I've been using this setup for a year and a half and I get my full 1gb bandwidth throughout my network with lots of hosts.
- lights0123 6y ago
  AT&T has started using a much newer gateway for new installations.
  - diegs 6y ago
    Damn, that's a serious bummer. I hope mine doesn't break anytime soon.
l2p 6y ago
If you have the BGW210 gateway there is a written series of steps for root here: https://github.com/Archerious/bgw210-root https://github.com/Archerious/bgw210-root As well as step by step configuration for complete gateway bypass on Mikrotik router hardware here: https://forum.mikrotik.com/viewtopic.php?t=154954 https://forum.mikrotik.com/viewtopic.php?t=154954 If you are stuck with the newer XG-PON hardware, it looks like you might be out of luck for now.