ATT Uverse RG Bypass (0.2 BTC)
-
It is fine if you are manually changing the configuration instead of using the GUI for something that has a GUI field. The system does not know the difference when you restore the configuration.
But you should use the GUI to initially establish the necessary XML. In the instant case, that involves installing the shellcmd package.
For instance, if you are migrating a configuration from a system with em NICs to one with igb NICs it is perfectly acceptable to download the configuration, edit it to change the physical NIC names, and restore it to the new unit.
But don't expect just any manual edit to survive.
In other words, changing values in existing XML tags works (as long as your changes are sane) but you have to know exactly what you are doing if you choose to add your own tags from nothing.
-
Thanks for elaborating @Derelict, makes sense. Just speculating along those lines, as it sounded like he was using both the gui (via shellcmd pkg) and manually editing the <earlyshellcmd> section -- that may be why manual edits were lost at boot (gui superseded them).
-
Thanks for clearing it up.
-
Has anyone attempted (or ideally achieved) a bypass of the AT&T ONT? I am successfully bypassing the Residential Gateway, but I was curious about taking the fiber directly in to an SFP or SFP+ NIC. Latency should be superior by avoiding the media conversion to copper. The same NIC could then connect to a switch via fiber on a different port.
-
@jasonsansone you should look at pfatt method to bypass. I use to to plug my ONT directly into my pfsense router. https://github.com/aus/pfatt
-
@Makaveli6103 thank you, but you misunderstand my inquiry. I am using pfatt. The ONT connects via Cat6 into the NIC in my pfSense installation. I want to bypass the ONT so that the fiber line goes directly in to pfSense without the media conversion from fiber to copper.
-
@jasonsansone
not possible. It's the ONT that sets your line rate so you better believe there is security in it else anyone could just bypass it and get full gig. -
Ya, after more thought and research I realized that being the DMARC, I shouldn’t screw with it. Thank you.
-
I'm able to get this working in bridge mode but when I try it in supplicant mode, the boot up looks like this.
code_text Loading configuration......done. pfatt: starting pfatt... pfatt: configuration: pfatt: ONT_IF = em0 pfatt: RG_ETHER_ADDR = xx:xx:xx:xx:xx:xx pfatt: EAP_MODE = supplicant pfatt: EAP_SUPPLICANT_IDENTITY = xx:xx:xx:xx:xx:xx pfatt: EAP_BRIDGE_IF = em1 pfatt: EAP_BRIDGE_5268AC = 0 pfatt: resetting netgraph... pfatt: configuring EAP environment for supplicant mode... pfatt: cabling should look like this: pfatt: ONT---[] [em0] pfatt: creating vlan node and ngeth0 interface... ngeth0: link state changed to UP pfatt: enabling promisc for em0... em0: permanently promiscuous mode enabled pfatt: starting wpa_supplicant... pfatt: wpa_supplicant running on PID 453... pfatt: setting wpa_supplicant network configuration... pfatt: waitng EAP for authorization... em0: link state changed to UPcode_text
Then it just sits there. I have the certs in /conf/pfatt/wpa and the MAC address is correct.
Any ideas of what might be wrong?Thanks!
-
Figured out the problem. The code is looking for:
ca.pem
client.pem
private.pemMy .pem files where named differently. Once I changed them I got supplicant mode working. One odd thing I noticed, download speeds are 500-600 while upload speeds are 920-940..
-
So I am not having luck. I have tried in both the dumb switch, bridge mode way and using the pfatt.sh add-on. On first bootup I never got prompted to adjust interfaces, but in the web GUI I was able to select the ngeth0 interface for my WAN.
DHCP never pulls down an IP and just displays 0.0.0.0. This is the same thing that happened when I tried it in dumb switch bridge mode.
Right now the connection from AT&T is directly plugged into igb4 and igb3 is plugged directly into my BGW210.
When I had tested dumb switch bridge mode I had tested with AT&T line going through my switch then to modem, all worked, but then unplugging mode and spoofing mac never seemed to work. Any ideas? We are a small office, but no way the 8k session limitation is doable for us so I must have a work around or we will end up paying the ETF and cancelling services.
Some info from my config.
There are 11 total nodes:
Name: igb0_366 Type: ether ID: 00000024 Num hooks: 0
Name: igb3 Type: ether ID: 00000004 Num hooks: 2
Name: snmpd Type: socket ID: 00000025 Num hooks: 0
Name: igb4 Type: ether ID: 00000005 Num hooks: 1
Name: <unnamed> Type: socket ID: 00000009 Num hooks: 0
Name: o2m Type: one2many ID: 0000000e Num hooks: 3
Name: vlan0 Type: vlan ID: 00000011 Num hooks: 2
Name: ngeth0 Type: eiface ID: 00000014 Num hooks: 1
Name: waneapfilter Type: etf ID: 00000018 Num hooks: 2
Name: ngctl25340 Type: socket ID: 0000003a Num hooks: 0
Name: eapfiltlaner Type: etf ID: 0000001c Num hooks: 3Log file
2019-10-16 13:19:45 :: [pfatt.sh] :: pfSense + AT&T U-verse Residential Gateway for true bridge mode
2019-10-16 13:19:45 :: [pfatt.sh] :: Configuration:
2019-10-16 13:19:45 :: [pfatt.sh] :: ONT_IF: igb4
2019-10-16 13:19:45 :: [pfatt.sh] :: RG_IF: igb3
2019-10-16 13:19:45 :: [pfatt.sh] :: RG_ETHER_ADDR: xxxxx
2019-10-16 13:19:45 :: [pfatt.sh] :: OPNSENSE: no
2019-10-16 13:19:45 :: [pfatt.sh] :: loading netgraph kernel modules... OK!
2019-10-16 13:19:45 :: [pfatt.sh] :: attaching interfaces to ng_ether... OK!
2019-10-16 13:19:45 :: [pfatt.sh] :: building netgraph nodes...
2019-10-16 13:19:45 :: [pfatt.sh] :: creating ng_one2many... OK!
2019-10-16 13:19:45 :: [pfatt.sh] :: creating vlan node and interface... OK!
2019-10-16 13:19:45 :: [pfatt.sh] :: defining etf for igb4 (ONT)... OK!
2019-10-16 13:19:45 :: [pfatt.sh] :: defining etf for igb3 (RG)... OK!
2019-10-16 13:19:45 :: [pfatt.sh] :: bridging etf for igb4 <-> igb3... OK!
2019-10-16 13:19:45 :: [pfatt.sh] :: defining filters for EAP traffic... OK!
2019-10-16 13:19:45 :: [pfatt.sh] :: enabling one2many links... OK!
2019-10-16 13:19:45 :: [pfatt.sh] :: removing waneapfilter:nomatch hook... OK!
2019-10-16 13:19:45 :: [pfatt.sh] :: enabling igb3 interface... OK!
2019-10-16 13:19:46 :: [pfatt.sh] :: enabling igb4 interface... OK!
2019-10-16 13:19:46 :: [pfatt.sh] :: enabling promiscuous mode on igb3... OK!
2019-10-16 13:19:46 :: [pfatt.sh] :: enabling promiscuous mode on igb4... OK!
2019-10-16 13:19:46 :: [pfatt.sh] :: ngeth0 should now be available to configure as your pfSense WAN
2019-10-16 13:19:46 :: [pfatt.sh] :: done!
2019-10-16 13:39:46 :: [pfatt.sh] :: pfSense + AT&T U-verse Residential Gateway for true bridge mode -
@phatty which method are you using to get the above log file?
-
Log is from pfatt.log, only thing I tweaked in the config for that was adding igb interface info and Mac. Then on first bootup I changed my wan interface to use the ngeth
-
@phatty The instructions are very good, I'd check the instructions again step-by-step.
FWIW, I set pfatt.sh aside several months ago after not finding significant performance enhancement and planned to return to it later for another try. During that time I have decided it may not be useful to me. As a home user and not running web services but with roughly 20 connections I do not readily fill up my BGW's nat table. In fact, since early August I have hardly made an impact on that table. Unless I'm missing some other useful functionality it appears that I can get along fine without pfatt.Also I had hoped it would improve my throughput since the default install is double NAT but after a number of speed tests with and w/o pfatt active I see an insignificant difference. That said, if I updated my hardware I might find different results and I am considering getting a newer Netgate appliance and a managed switch. Currently I am running pfSense on a netgate sg-2440 and have a dumb switch behind it.
-
@AiC0315 I suppose you were just looking for bridge mode vs supplicant, and right now its bridge mode as I followed the default readme instructions on github.
I am wondering if something else is at play, considering dumb switch and mac address modifications doesn't work, and neither is this. The modem authenticates directly through the dumb switch without any problems, its when I unplug the modem and then plugin pfsense with the forged MAC that things fail. For grins I just built another pfsense box from scratch, as previously I had been playing with my live environment. Still not getting anywhere on fresh build attempting the bridge method. DHCP never pulls anything down.
@JonH appreciate the input, but with a fresh pfsense build completed this morning not sure what I could have missed. It seems simple enough, copy around a file, make a file executable, config to run on startup, and modify wan to use the ngeth interface seems to about sum up the instructions.
Unfortunately I am trying to get running in an office with about 25 users, no way I can survive on 8k. It seems if the Cascade router feature would actually work on my BGW210, then I may be able to avoid all this, but support keeps pushing me to use IP Passthrough, and won't acknowledge that Cascaded Router is even a configuration on the modem.
-
@phatty in your reply it sounds like you are mixing methods. How many interfaces do you have on your pfsense box?
Nothing gets unplugged using the pfatt method. And if using the bridge mode, you need 3 interfaces on your pfsense box.
1 for the Ont, 1 for the ATT Gateway and 1 for your LAN -
@AiC0315 I am using bridge mode, 3 interfaces for the default pfatt method, my device is a SG-8860 so I have 6 ports, all in use. But I have my primary LAN, the Uverse WAN, and the Uverse 210 gateway device. On top of that are my other networks including my still functional AT&T Enterprise WAN, VOIP Lan, some VLANS, and a port dedicated for my CARP HA failover configurations. The unplugged method was my reference to attempting some dumb switch methods I have seen documented where you simply only plug the RG in when loosing connection and needing re-authentication. I am wondering if something has changed with the latest firmware, that is denying my Cascade Router feature, or if something could be different for being in a multi-tenant office building.
-
@phatty It wouldn't surprise me at all if something on ATT's end has changed. I was using the DMZ+ mode on my pace gateway and one day I had no internet, due to a firmware update.
I would go back and carefully look at the pfatt instructions. Bridge mode is very easy to get working.
FYI I never got the dumb switch method to work either.
-
@phatty Using the dumb switch method have you tried configuring the wan interface on your pfsense box statically with the ip assigned to your att modem during authentication?
-
@gfeiner said in ATT Uverse RG Bypass (0.2 BTC):
FYI. I'm doing this bypass on my netgate SG5100 and I can get in the 900-940Mb range with ATT UVERSE gigabit plan. So maybe it is your CPU.
Well, it appears you were right and thanks for the suggestion. Last week I retired my SG2440 for a SG5100. I still have not installed all the pkg's I was using in 2440 but I didn't run IDS stuff so I don't think what I haven't installed impacts my speed.
Using CLI speedtest I am getting 950-990 which is about 2x what I was getting before. I am not currently using the aus rg-bypass, just the BGW ip-passthrough.
