ATT Uverse RG Bypass (0.2 BTC)

[AiC0315]

@andrew_241 when I initially set mine up my .pem files were not named correctly, so you may want to check that.
On mine, I have the mac address for the certs in the script and the mac address for my RG spoofed on my pfsense box. My certs did not come from my RG that's why I use 2 MACs

[ffuentes]

can somebody pm me on where I can get the pem's. Thanks.

[andrew_241]

So I tried to run the script manually when the firewall was already up and running, and it still hangs at 'waiting EAP for authorization...'. I can't see the ngeth0 interface as an option under 'Interface Assignments'.

If I change my igb0's MAC address to that of the gateway device, and run wpa_supplicant manually with the following configuration:

eapol_version=2
fast_reauth=1
ap_scan=0
network={
        ca_cert="/cf/conf/pfatt/wpa/ca.pem"
        client_cert="/cf/conf/pfatt/wpa/client.pem"
        eap=TLS
        eapol_flags=0
        identity="(Gateway MAC Address)"
        key_mgmt=IEEE8021X
        phase1="allow_canned_success=1"
        private_key="/cf/conf/pfatt/wpa/private.pem"
}

I get the log message:

igb0: CTRL-EVENT-EAP-SUCCESS EAP authentication completed successfully

So the certificates work. I can get my IP address, but the connection is slow (web browsers take a long time with DNS). I probably still need netgraph.

[andrew_241]

@AiC0315

I found the public certs for the CAs on the web. The client certificates I'm using, as well as the private key, were extracted from a different gateway device of the same model (BGW210-700) that I had sitting around.

[GPz1100]

@andrew_241

You should see no speed difference between a dumb switch bypass and certs. All wpa_supplicant does is allow for authentication of the device. It consumes practically no resources.

See if you have something hogging the cpu (top command in console). Netgraph method is obsolete these days. Certs method is completely self contained requiring no gateway box to be connected.

[andrew_241]

@GPz1100

I haven't read this entire thread, but I was under the impression that the netgraph method was required to get the WAN interface to recognize the traffic on VLAN0 from the ONT.

[pyrodex]

@andrew_241 said in ATT Uverse RG Bypass (0.2 BTC):

@GPz1100

I haven't read this entire thread, but I was under the impression that the netgraph method was required to get the WAN interface to recognize the traffic on VLAN0 from the ONT.

If you are physical... virtually you don't need netgraph :).

[GPz1100]

@andrew_241

You are correct. I forgot about that. I'm running a virtualized setup here (esxi). When testing pfsense/certs I had no vlan0 issues.. The other option is to use a dumb switch between the ONT and pfsense wan ports.

[andrew_241]

I tried to run the pfatt.sh script on my pfSense box manually, but I get the following:

[2.4.5-RELEASE][root@pfSense]/root: /cf/conf/pfatt/bin/pfatt.sh
pfatt: starting pfatt...
pfatt: configuration:
pfatt:   ONT_IF = igb0
pfatt:   RG_ETHER_ADDR = (MAC address is here)
pfatt:   EAP_MODE = supplicant
pfatt:   EAP_SUPPLICANT_IDENTITY = (MAC address is here)
pfatt:   EAP_BRIDGE_IF = igb1
pfatt:   EAP_BRIDGE_5268AC = 0
pfatt: resetting netgraph...
pfatt: configuring EAP environment for supplicant mode...
pfatt: cabling should look like this:
pfatt:   ONT---[] [igb0]pfSense
pfatt: creating vlan node and ngeth0 interface...
ngctl: send msg: No such file or directory
ngctl: send msg: No such file or directory
ngctl: send msg: No such file or directory
ngctl: send msg: No such file or directory
ngctl: send msg: No such file or directory
pfatt: enabling promisc for igb0...
pfatt: starting wpa_supplicant...
pfatt: wpa_supplicant running on PID ...
pfatt: setting wpa_supplicant network configuration...
Failed to connect to non-global ctrl_ifname: (nil)  error: No such file or directory
Failed to connect to non-global ctrl_ifname: (nil)  error: No such file or directory
Failed to connect to non-global ctrl_ifname: (nil)  error: No such file or directory
Failed to connect to non-global ctrl_ifname: (nil)  error: No such file or directory
Failed to connect to non-global ctrl_ifname: (nil)  error: No such file or directory
Failed to connect to non-global ctrl_ifname: (nil)  error: No such file or directory
Failed to connect to non-global ctrl_ifname: (nil)  error: No such file or directory
Failed to connect to non-global ctrl_ifname: (nil)  error: No such file or directory
Failed to connect to non-global ctrl_ifname: (nil)  error: No such file or directory
Failed to connect to non-global ctrl_ifname: (nil)  error: No such file or directory
Failed to connect to non-global ctrl_ifname: (nil)  error: No such file or directory
Failed to connect to non-global ctrl_ifname: (nil)  error: No such file or directory
Failed to connect to non-global ctrl_ifname: (nil)  error: No such file or directory
pfatt: waiting EAP for authorization...
Failed to connect to non-global ctrl_ifname: (nil)  error: No such file or directory
Failed to connect to non-global ctrl_ifname: (nil)  error: No such file or directory
Failed to connect to non-global ctrl_ifname: (nil)  error: No such file or directory
Failed to connect to non-global ctrl_ifname: (nil)  error: No such file or directory
Failed to connect to non-global ctrl_ifname: (nil)  error: No such file or directory
Failed to connect to non-global ctrl_ifname: (nil)  error: No such file or directory
Failed to connect to non-global ctrl_ifname: (nil)  error: No such file or directory
Failed to connect to non-global ctrl_ifname: (nil)  error: No such file or directory
Failed to connect to non-global ctrl_ifname: (nil)  error: No such file or directory
Failed to connect to non-global ctrl_ifname: (nil)  error: No such file or directory
Failed to connect to non-global ctrl_ifname: (nil)  error: No such file or directory
Failed to connect to non-global ctrl_ifname: (nil)  error: No such file or directory
Failed to connect to non-global ctrl_ifname: (nil)  error: No such file or directory
Failed to connect to non-global ctrl_ifname: (nil)  error: No such file or directory
Failed to connect to non-global ctrl_ifname: (nil)  error: No such file or directory
Failed to connect to non-global ctrl_ifname: (nil)  error: No such file or directory
Failed to connect to non-global ctrl_ifname: (nil)  error: No such file or directory
Failed to connect to non-global ctrl_ifname: (nil)  error: No such file or directory
Failed to connect to non-global ctrl_ifname: (nil)  error: No such file or directory
Failed to connect to non-global ctrl_ifname: (nil)  error: No such file or directory
Failed to connect to non-global ctrl_ifname: (nil)  error: No such file or directory
Failed to connect to non-global ctrl_ifname: (nil)  error: No such file or directory
Failed to connect to non-global ctrl_ifname: (nil)  error: No such file or directory
Failed to connect to non-global ctrl_ifname: (nil)  error: No such file or directory
Failed to connect to non-global ctrl_ifname: (nil)  error: No such file or directory
Failed to connect to non-global ctrl_ifname: (nil)  error: No such file or directory
Failed to connect to non-global ctrl_ifname: (nil)  error: No such file or directory

I also got the same error when trying to type in the commands manually.

[andrew_241]

I've since connected a dumb switch (Netgear GS105) between the ONT and my pfSense box in order to deal with the VLAN 0 issue, and retried the gateway bypass method using only the wpa_supplicant, and a spoofed MAC address. My wpa_supplicant configuration is as it was in my comment above, and I've configured Shellcmd to execute the following toward the end of the boot up process:

wpa_supplicant -s -B -Dwired -iigb0 -c/cf/conf/wpa_supplicant.conf

So far, so good. There are some instances where DNS resolving takes a couple seconds though, but it seems the bypass was successful.

[andrew_241]

Looks like this method isn't working. I keep losing IPv4 connectivity after about one hour (gateway goes down), among other problems, including long wait times (2 minutes or so) to renew the WAN connection after a release.

[GPz1100]

Connectivity seems to stop if dhcp is unsuccessful. Need to find out why it's taking so long/failing.

[andrew_241]

Looks like something's going on with DHCP. The lease time from the ISP is one hour, according to a packet capture. I tried the bypass method again and this time I couldn't even get a stable connection after authenticating. I get a lease offer from the ISP after about two minutes in, but for some reason, pfSense wasn't accepting it.

[fresnoboy]

@andrew_241

I had a number of issues with getting this to work. I had the same behavior (worked for an hour then quit) when I ran the script manually using the bypass method in esxi.. However, after having pfatt.sh start up as an early shell command in pfsense, and doing a reboot, things appear to be stable.

I did take out all references to ngeth in the script since vmware is doing the VLAN0 stripping and replaced them with em0. And I prefixed the cert files with a /cf so the files had the right absolute file name.

[fresnoboy]

Folks, now that I have the supplicant method working well and virtualized pfsense talking to the ONT directly, I would like to enable it to failover to a different ESX host so that when I do ESXi host upgrades I don't have to take Internet downtime. This was impossible before with ethernet devices in passthrough mode.

Now, I have unifi switches, but I don't think I can use them to create a separate VLAN that connects the ONT to the two different hosts because they process 802.1x messages in the switch. Is that right?

So should I use one of the cheap netgear switches mentioned earlier in the thread and will vmotion etc... work if I share the ONT port that way?

Thanks!

[MonkWho]

@andrew_241 said in ATT Uverse RG Bypass (0.2 BTC):

I tried to run the pfatt.sh script on my pfSense box manually, but I get the following:

[2.4.5-RELEASE][root@pfSense]/root: /cf/conf/pfatt/bin/pfatt.sh
pfatt: starting pfatt...
pfatt: configuration:
pfatt:   ONT_IF = igb0
pfatt:   RG_ETHER_ADDR = (MAC address is here)
pfatt:   EAP_MODE = supplicant
pfatt:   EAP_SUPPLICANT_IDENTITY = (MAC address is here)
pfatt:   EAP_BRIDGE_IF = igb1
pfatt:   EAP_BRIDGE_5268AC = 0
pfatt: resetting netgraph...
pfatt: configuring EAP environment for supplicant mode...
pfatt: cabling should look like this:
pfatt:   ONT---[] [igb0]pfSense
pfatt: creating vlan node and ngeth0 interface...
ngctl: send msg: No such file or directory
ngctl: send msg: No such file or directory
ngctl: send msg: No such file or directory
ngctl: send msg: No such file or directory
ngctl: send msg: No such file or directory
pfatt: enabling promisc for igb0...
pfatt: starting wpa_supplicant...
pfatt: wpa_supplicant running on PID ...
pfatt: setting wpa_supplicant network configuration...
Failed to connect to non-global ctrl_ifname: (nil)  error: No such file or directory
Failed to connect to non-global ctrl_ifname: (nil)  error: No such file or directory
Failed to connect to non-global ctrl_ifname: (nil)  error: No such file or directory
Failed to connect to non-global ctrl_ifname: (nil)  error: No such file or directory
Failed to connect to non-global ctrl_ifname: (nil)  error: No such file or directory
Failed to connect to non-global ctrl_ifname: (nil)  error: No such file or directory
Failed to connect to non-global ctrl_ifname: (nil)  error: No such file or directory
Failed to connect to non-global ctrl_ifname: (nil)  error: No such file or directory
Failed to connect to non-global ctrl_ifname: (nil)  error: No such file or directory
Failed to connect to non-global ctrl_ifname: (nil)  error: No such file or directory
Failed to connect to non-global ctrl_ifname: (nil)  error: No such file or directory
Failed to connect to non-global ctrl_ifname: (nil)  error: No such file or directory
Failed to connect to non-global ctrl_ifname: (nil)  error: No such file or directory
pfatt: waiting EAP for authorization...
Failed to connect to non-global ctrl_ifname: (nil)  error: No such file or directory
Failed to connect to non-global ctrl_ifname: (nil)  error: No such file or directory
Failed to connect to non-global ctrl_ifname: (nil)  error: No such file or directory
Failed to connect to non-global ctrl_ifname: (nil)  error: No such file or directory
Failed to connect to non-global ctrl_ifname: (nil)  error: No such file or directory
Failed to connect to non-global ctrl_ifname: (nil)  error: No such file or directory
Failed to connect to non-global ctrl_ifname: (nil)  error: No such file or directory
Failed to connect to non-global ctrl_ifname: (nil)  error: No such file or directory
Failed to connect to non-global ctrl_ifname: (nil)  error: No such file or directory
Failed to connect to non-global ctrl_ifname: (nil)  error: No such file or directory
Failed to connect to non-global ctrl_ifname: (nil)  error: No such file or directory
Failed to connect to non-global ctrl_ifname: (nil)  error: No such file or directory
Failed to connect to non-global ctrl_ifname: (nil)  error: No such file or directory
Failed to connect to non-global ctrl_ifname: (nil)  error: No such file or directory
Failed to connect to non-global ctrl_ifname: (nil)  error: No such file or directory
Failed to connect to non-global ctrl_ifname: (nil)  error: No such file or directory
Failed to connect to non-global ctrl_ifname: (nil)  error: No such file or directory
Failed to connect to non-global ctrl_ifname: (nil)  error: No such file or directory
Failed to connect to non-global ctrl_ifname: (nil)  error: No such file or directory
Failed to connect to non-global ctrl_ifname: (nil)  error: No such file or directory
Failed to connect to non-global ctrl_ifname: (nil)  error: No such file or directory
Failed to connect to non-global ctrl_ifname: (nil)  error: No such file or directory
Failed to connect to non-global ctrl_ifname: (nil)  error: No such file or directory
Failed to connect to non-global ctrl_ifname: (nil)  error: No such file or directory
Failed to connect to non-global ctrl_ifname: (nil)  error: No such file or directory
Failed to connect to non-global ctrl_ifname: (nil)  error: No such file or directory
Failed to connect to non-global ctrl_ifname: (nil)  error: No such file or directory

I also got the same error when trying to type in the commands manually.

@andrew_241 I don't know if you resolved it but from this log it seems you might be having some issue with ngctl. Try running some of the commands from "resetting netgraph" section but without ">/dev/null 2>&1" and see if those commands also give you errors. Also see if you can run "ngctl list" command and let us know what it outputs.

[csburroughs]

@MonkWho I'm having the same issue as andrew_241. I've attached a screenshot of a ngctl list command and the "restting netgraph" commands. The other screenshot displays the console errors when -s is added to WPA_DAEMON_CMD. I had to CTRL-C to get to a command prompt to run the commands. Any guidance would be appreciated. Thanks!

login-to-view login-to-view

[fresnoboy]

Folks, if you are trying to get the pfatt.sh supplicant model configuration to run under vmware which is taking care of the VLAN0 issue, here is the configuration I am using with em0 as the WAN interface (I hardcoded em0 there, so look for all instances of em0 if you need to use a different interface). I have removed all the ngeth references as that is not needed anymore.

Works great, super reliable and no gateway needed anymore in supplicant mode.

Attached.

pfatt.sh (esxi).txt

[MonkWho]

@csburroughs said in ATT Uverse RG Bypass (0.2 BTC):

@MonkWho I'm having the same issue as andrew_241. I've attached a screenshot of a ngctl list command and the "restting netgraph" commands. The other screenshot displays the console errors when -s is added to WPA_DAEMON_CMD. I had to CTRL-C to get to a command prompt to run the commands. Any guidance would be appreciated. Thanks!

It sounds like there is something strange going on with netgraph on your server. I'm not really an expert in it.

Try running "kldstat -v" and see is these are on the list:
netgraph
ng_ether
ng_eiface
ng_one2many
ng_vlan
ng_etf

Also try running "ngctl list" and see if there are any issues with the nodes on the list.

[Selcouth]

This post is deleted!