Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Fiber optic to pfSense Box

    Scheduled Pinned Locked Moved General pfSense Questions
    82 Posts 8 Posters 9.3k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • stephenw10S
      stephenw10 Netgate Administrator
      last edited by

      You can just capture on the interface in pfSense in Diag > Packet Capture. Just set it to capture all tagged and non-tagged traffic and see what there is.

      You can download it and analyze it in Wireshark.

      1 Reply Last reply Reply Quote 0
      • D
        demonaii
        last edited by

        @stephenw10
        Hello again !

        The cat bit me, and I decided to risk it and factory reset the ISP router to finally see what is so hidden about it. It looks like, even after reset, the router works just fine. It looks unimpressive to be honest, but there probably should me something salvageable.

        The VLAN IDs can be confirmed to be true, and I've added them to the pfSense box VLAN ID section and I think assignments as OPT 1 and OPT 2.
        It's not entirely clear where exactly I should configure the DCHP server or client?

        Even tho I configured the SFP module and received Status 5, in the router there is a LOID + password. Could my O5 be a false positive ?

        Here in the pictures below you can see the settings that are by default, when the router is factory reset.

        Router Settings
        LINK : https://imgur.com/a/mxNrivV

        keyserK 1 Reply Last reply Reply Quote 0
        • stephenw10S
          stephenw10 Netgate Administrator
          last edited by

          So the main connection there should be on VLAN555. Set that interface as DHCP.

          It seems like you'd need that username/password in the GPON module though, I agree.

          1 Reply Last reply Reply Quote 0
          • keyserK
            keyser Rebel Alliance @demonaii
            last edited by

            @demonaii I don’t know of any methods of using a LOID/Password in the L2 GPON connection. Also - I’m quite sure the O5 is not a false positive. The GPON module is connected and linked to the GPON tree.

            With my Orange connection the login/password is sent encrypted as L3 DHCP parameters in order for the DHCP client to pass authentication. This is the “black box” I spoke of earlier. If your ISPs setup is similar you are in dire straits if you cannot find someone to clarify how those options should be configured and with what SALT/type of encryption the ID/password should be sent within the DHCP options.

            Alternatively a packet capture of the DHCP process in the ISP box (when connected), could reveal how the DHCP process is setup and how the options should be configured. But unless the ISP box has a builtin TCPDUMP you can use, it’s impossible as you cannot sit in the midle of the GPON connection.

            Love the no fuss of using the official appliances :-)

            1 Reply Last reply Reply Quote 1
            • stephenw10S
              stephenw10 Netgate Administrator
              last edited by

              Ah that's fun*. Hmm, I haven't had cause to dig very deep into GPON. Yet.

              1 Reply Last reply Reply Quote 0
              • D
                demonaii
                last edited by

                I asked fs.com customer support and they told me that and I quote
                "
                The corresponding port of your firewall (i.e. the port where the GPON-ONU-34-20BI module is plugged in) needs to be assigned to the ISP Internet access VLAN

                1. The GPON-ONU-34-20BI module is an SFU, which only has a bridging function. The end user needs to perform PPPoE dial-up on the downstream device. As for whether to perform PPPoE dial-up on the Netgate SG 2100 firewall or on a further downstream device, could please consult the downstream equipment supplier? "

                @keyser Maybe I should call the ISP again because I called them and they said " somebody messed with their settings . " .

                @stephenw10

                VLAN555 with parent interface WAN , Enable WAN DCHP on WAN interface ? Set a NAT and firewall rule from WAN to LAN ?

                keyserK 1 Reply Last reply Reply Quote 0
                • stephenw10S
                  stephenw10 Netgate Administrator
                  last edited by

                  You need to assign the WAN as the VLAN555 interface and set it to DHCP. It should then pull a lease from the ISP. Except that it may well require some custom dhcp client options as @keyser said.

                  D 1 Reply Last reply Reply Quote 1
                  • keyserK
                    keyser Rebel Alliance @demonaii
                    last edited by

                    @demonaii Exactly what @stephenw10 said🤘

                    Love the no fuss of using the official appliances :-)

                    1 Reply Last reply Reply Quote 0
                    • D
                      demonaii @stephenw10
                      last edited by demonaii

                      @stephenw10

                      Okay I switched to DHCP for the VLAN and I pull a IP but still no net. Probably I would have to contact the ISP ?

                      EDIT: The same thing I do with the IPTV or is IPTV on top of Net ?

                      1 Reply Last reply Reply Quote 0
                      • stephenw10S
                        stephenw10 Netgate Administrator
                        last edited by stephenw10

                        Getting IPTV to work would probably require some other stuff in place, it depends how it's presented to stuff internally.

                        However I wouldn't worry about that until you get regular internet working.

                        It pulls an address/gateway via DHCP? Is the gateway pingable? Is it a real public IP?

                        D 1 Reply Last reply Reply Quote 0
                        • D
                          demonaii @stephenw10
                          last edited by demonaii

                          @stephenw10

                          I can ping my public IP. I don't know about the gateway, however I do have internet. It's not the full 1 Gbps by contract, it's about 96 Mbps, but it works. I don't know what I did, I maybe It's because I turned pfSense of and unplugged the fibre.

                          What might be the reason for the low speed ?

                          keyserK 1 Reply Last reply Reply Quote 0
                          • keyserK
                            keyser Rebel Alliance @demonaii
                            last edited by

                            @demonaii said in Fiber optic to pfSense Box:

                            @stephenw10

                            I can ping my public IP. I don't know about the gateway, however I do have internet. It's not the full 1 Gbps by contract, it's about 96 Mbps, but it works. I don't know what I did, I maybe It's because I turned pfSense and unplugged the fibre.

                            What might be the reason for the low speed ?

                            Cool!! - then you really were lucky and have a ISP that does not jump through hoops to make it difficult for customers to use their own equipment. I have experienced several times that pfSense requires a reboot when you assign new VLANs to active interfaces before it starts working. I actually just discussed this with @stephenw10 in another thread last week :-) I’m sure you just experienced the same thing.

                            About the speed. 96Mbps sound very much like something on your side is only linked at 100Mbps. Check both the physical link speed of WAN and LAN on pfSense and especially your Client PC/switch ports.

                            Love the no fuss of using the official appliances :-)

                            D 1 Reply Last reply Reply Quote 0
                            • stephenw10S
                              stephenw10 Netgate Administrator
                              last edited by

                              Yup suspiciously close to 100Mbps. How are you testing?

                              1 Reply Last reply Reply Quote 0
                              • D
                                demonaii @keyser
                                last edited by

                                Strange, kind, lost the connection again. Probably because I halted the device and unplugged it from the outlet. I still have the public IP, tho. :/

                                @keyser

                                I am directly or should I say was connected to the router . The standalone switch was planning to install it tomorrow but it looks like it has to wait . :(

                                @stephenw10

                                I plugged my laptop directly to LAN1. The cable, probably, can't be the problem . WAN,LAN and OPT all says 1000base . The LAN port is on default. The laptop can achieve the speeds of the ISP router.

                                1 Reply Last reply Reply Quote 0
                                • stephenw10S
                                  stephenw10 Netgate Administrator
                                  last edited by

                                  So you are testing against speedtest.net or some similar public site?

                                  It's possible the ISP limits you depending on the login.

                                  D 1 Reply Last reply Reply Quote 0
                                  • D
                                    demonaii @stephenw10
                                    last edited by

                                    @stephenw10 Well, I use whatever is out there speedtest, fast.com .

                                    What do you mean exactly ? Using mine or their router ?

                                    1 Reply Last reply Reply Quote 0
                                    • stephenw10S
                                      stephenw10 Netgate Administrator
                                      last edited by

                                      I mean some ISPs will provide some limited connection speed, often for testing, until you authenticate correctly. It's possible you're seeing that if everything internally is linked at 1G or higher.

                                      1 Reply Last reply Reply Quote 0
                                      • D
                                        demonaii
                                        last edited by

                                        @stephenw10

                                        I called the ISP and the technicians came today. They weren't happy what I was planning, they told is it is not possible, and I was cut from the network.

                                        The younger technician told me that I wasn't getting internet and the problem lied at the box for the flat. He plugged it in to the ISP and called it a day but gave me a wink or so I thought of what I wanted to do. I checked the ISP router settings and there is a new WAN connection known as CGNAT for internet. The VLANIDs looked changed, so probably I would have to change them.

                                        1 Reply Last reply Reply Quote 0
                                        • stephenw10S
                                          stephenw10 Netgate Administrator
                                          last edited by

                                          Can only try it and see.

                                          D 1 Reply Last reply Reply Quote 0
                                          • D
                                            demonaii @stephenw10
                                            last edited by

                                            @stephenw10

                                            In a different forum with the same ISP a customer suggested to OP that one bridge would be called WAN with Internet VLAN ID , one bridge would be for IPTV with IPTV VLAN ID . He put DCHP client on bridge WAN where in the NAT rule for source will mask the with him the OUT interface . He created a bridge for the LAN and the rest of the Ethernet ports.

                                            I did that . The VLAN DCHP and the bridge receive different IPs.
                                            I am not sure if he uses optic or Ethernet cable .

                                            When it comes to the LOID and password . I tried to unmask the censored password, but the text becomes invisible. Either I have to guess it or I dont have any idea .

                                            1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.