Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    ATT Uverse RG Bypass (0.2 BTC)

    Scheduled Pinned Locked Moved Bounties
    555 Posts 80 Posters 1.2m Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • A
      andrew_241
      last edited by

      Looks like this method isn't working. I keep losing IPv4 connectivity after about one hour (gateway goes down), among other problems, including long wait times (2 minutes or so) to renew the WAN connection after a release.

      1 Reply Last reply Reply Quote 0
      • GPz1100G
        GPz1100
        last edited by

        Connectivity seems to stop if dhcp is unsuccessful. Need to find out why it's taking so long/failing.

        1 Reply Last reply Reply Quote 0
        • A
          andrew_241
          last edited by andrew_241

          Looks like something's going on with DHCP. The lease time from the ISP is one hour, according to a packet capture. I tried the bypass method again and this time I couldn't even get a stable connection after authenticating. I get a lease offer from the ISP after about two minutes in, but for some reason, pfSense wasn't accepting it.

          F 1 Reply Last reply Reply Quote 0
          • F
            fresnoboy @andrew_241
            last edited by

            @andrew_241

            I had a number of issues with getting this to work. I had the same behavior (worked for an hour then quit) when I ran the script manually using the bypass method in esxi.. However, after having pfatt.sh start up as an early shell command in pfsense, and doing a reboot, things appear to be stable.

            I did take out all references to ngeth in the script since vmware is doing the VLAN0 stripping and replaced them with em0. And I prefixed the cert files with a /cf so the files had the right absolute file name.

            1 Reply Last reply Reply Quote 0
            • F
              fresnoboy
              last edited by

              Folks, now that I have the supplicant method working well and virtualized pfsense talking to the ONT directly, I would like to enable it to failover to a different ESX host so that when I do ESXi host upgrades I don't have to take Internet downtime. This was impossible before with ethernet devices in passthrough mode.

              Now, I have unifi switches, but I don't think I can use them to create a separate VLAN that connects the ONT to the two different hosts because they process 802.1x messages in the switch. Is that right?

              So should I use one of the cheap netgear switches mentioned earlier in the thread and will vmotion etc... work if I share the ONT port that way?

              Thanks!

              1 Reply Last reply Reply Quote 0
              • MonkWhoM
                MonkWho @andrew_241
                last edited by

                @andrew_241 said in ATT Uverse RG Bypass (0.2 BTC):

                I tried to run the pfatt.sh script on my pfSense box manually, but I get the following:

                [2.4.5-RELEASE][root@pfSense]/root: /cf/conf/pfatt/bin/pfatt.sh
pfatt: starting pfatt...
pfatt: configuration:
pfatt:   ONT_IF = igb0
pfatt:   RG_ETHER_ADDR = (MAC address is here)
pfatt:   EAP_MODE = supplicant
pfatt:   EAP_SUPPLICANT_IDENTITY = (MAC address is here)
pfatt:   EAP_BRIDGE_IF = igb1
pfatt:   EAP_BRIDGE_5268AC = 0
pfatt: resetting netgraph...
pfatt: configuring EAP environment for supplicant mode...
pfatt: cabling should look like this:
pfatt:   ONT---[] [igb0]pfSense
pfatt: creating vlan node and ngeth0 interface...
ngctl: send msg: No such file or directory
ngctl: send msg: No such file or directory
ngctl: send msg: No such file or directory
ngctl: send msg: No such file or directory
ngctl: send msg: No such file or directory
pfatt: enabling promisc for igb0...
pfatt: starting wpa_supplicant...
pfatt: wpa_supplicant running on PID ...
pfatt: setting wpa_supplicant network configuration...
Failed to connect to non-global ctrl_ifname: (nil)  error: No such file or directory
Failed to connect to non-global ctrl_ifname: (nil)  error: No such file or directory
Failed to connect to non-global ctrl_ifname: (nil)  error: No such file or directory
Failed to connect to non-global ctrl_ifname: (nil)  error: No such file or directory
Failed to connect to non-global ctrl_ifname: (nil)  error: No such file or directory
Failed to connect to non-global ctrl_ifname: (nil)  error: No such file or directory
Failed to connect to non-global ctrl_ifname: (nil)  error: No such file or directory
Failed to connect to non-global ctrl_ifname: (nil)  error: No such file or directory
Failed to connect to non-global ctrl_ifname: (nil)  error: No such file or directory
Failed to connect to non-global ctrl_ifname: (nil)  error: No such file or directory
Failed to connect to non-global ctrl_ifname: (nil)  error: No such file or directory
Failed to connect to non-global ctrl_ifname: (nil)  error: No such file or directory
Failed to connect to non-global ctrl_ifname: (nil)  error: No such file or directory
pfatt: waiting EAP for authorization...
Failed to connect to non-global ctrl_ifname: (nil)  error: No such file or directory
Failed to connect to non-global ctrl_ifname: (nil)  error: No such file or directory
Failed to connect to non-global ctrl_ifname: (nil)  error: No such file or directory
Failed to connect to non-global ctrl_ifname: (nil)  error: No such file or directory
Failed to connect to non-global ctrl_ifname: (nil)  error: No such file or directory
Failed to connect to non-global ctrl_ifname: (nil)  error: No such file or directory
Failed to connect to non-global ctrl_ifname: (nil)  error: No such file or directory
Failed to connect to non-global ctrl_ifname: (nil)  error: No such file or directory
Failed to connect to non-global ctrl_ifname: (nil)  error: No such file or directory
Failed to connect to non-global ctrl_ifname: (nil)  error: No such file or directory
Failed to connect to non-global ctrl_ifname: (nil)  error: No such file or directory
Failed to connect to non-global ctrl_ifname: (nil)  error: No such file or directory
Failed to connect to non-global ctrl_ifname: (nil)  error: No such file or directory
Failed to connect to non-global ctrl_ifname: (nil)  error: No such file or directory
Failed to connect to non-global ctrl_ifname: (nil)  error: No such file or directory
Failed to connect to non-global ctrl_ifname: (nil)  error: No such file or directory
Failed to connect to non-global ctrl_ifname: (nil)  error: No such file or directory
Failed to connect to non-global ctrl_ifname: (nil)  error: No such file or directory
Failed to connect to non-global ctrl_ifname: (nil)  error: No such file or directory
Failed to connect to non-global ctrl_ifname: (nil)  error: No such file or directory
Failed to connect to non-global ctrl_ifname: (nil)  error: No such file or directory
Failed to connect to non-global ctrl_ifname: (nil)  error: No such file or directory
Failed to connect to non-global ctrl_ifname: (nil)  error: No such file or directory
Failed to connect to non-global ctrl_ifname: (nil)  error: No such file or directory
Failed to connect to non-global ctrl_ifname: (nil)  error: No such file or directory
Failed to connect to non-global ctrl_ifname: (nil)  error: No such file or directory
Failed to connect to non-global ctrl_ifname: (nil)  error: No such file or directory

                I also got the same error when trying to type in the commands manually.

                @andrew_241 I don't know if you resolved it but from this log it seems you might be having some issue with ngctl. Try running some of the commands from "resetting netgraph" section but without ">/dev/null 2>&1" and see if those commands also give you errors. Also see if you can run "ngctl list" command and let us know what it outputs.

                C 1 Reply Last reply Reply Quote 0
                • C
                  csburroughs @MonkWho
                  last edited by csburroughs

                  @MonkWho I'm having the same issue as andrew_241. I've attached a screenshot of a ngctl list command and the "restting netgraph" commands. The other screenshot displays the console errors when -s is added to WPA_DAEMON_CMD. I had to CTRL-C to get to a command prompt to run the commands. Any guidance would be appreciated. Thanks!

                  20200803_075859_resized.jpg 20200803_080222_resized.jpg

                  MonkWhoM 1 Reply Last reply Reply Quote 0
                  • F
                    fresnoboy
                    last edited by fresnoboy

                    Folks, if you are trying to get the pfatt.sh supplicant model configuration to run under vmware which is taking care of the VLAN0 issue, here is the configuration I am using with em0 as the WAN interface (I hardcoded em0 there, so look for all instances of em0 if you need to use a different interface). I have removed all the ngeth references as that is not needed anymore.

                    Works great, super reliable and no gateway needed anymore in supplicant mode.

                    Attached.

                    pfatt.sh (esxi).txt

                    1 Reply Last reply Reply Quote 0
                    • MonkWhoM
                      MonkWho @csburroughs
                      last edited by

                      @csburroughs said in ATT Uverse RG Bypass (0.2 BTC):

                      @MonkWho I'm having the same issue as andrew_241. I've attached a screenshot of a ngctl list command and the "restting netgraph" commands. The other screenshot displays the console errors when -s is added to WPA_DAEMON_CMD. I had to CTRL-C to get to a command prompt to run the commands. Any guidance would be appreciated. Thanks!

                      It sounds like there is something strange going on with netgraph on your server. I'm not really an expert in it.

                      Try running "kldstat -v" and see is these are on the list:
                      netgraph
                      ng_ether
                      ng_eiface
                      ng_one2many
                      ng_vlan
                      ng_etf

                      Also try running "ngctl list" and see if there are any issues with the nodes on the list.

                      S 1 Reply Last reply Reply Quote 0
                      • S
                        Selcouth @MonkWho
                        last edited by

                        This post is deleted!
                        1 Reply Last reply Reply Quote 0
                        • S
                          Selcouth
                          last edited by

                          Count me as yet another user with bridge working and supplicant not. I'm running 2.4.5-p1 on bare metal. I've verified my certificates, verified my paths, and stepped through the supplicant code in pfatt.sh manually. wpa_cli shows CONNECTING and then FAILED.

                          To confirm, has anyone reported a working supplicant configuration without virtualization? I've tried on my Intel 82576 and I217-LM cards. I may take some time to spin up ESXi and virtualize pfSense to get around keeping the RG plugged in.

                          GPz1100G B 2 Replies Last reply Reply Quote 0
                          • GPz1100G
                            GPz1100 @Selcouth
                            last edited by

                            @Selcouth You should be able to confirm a working config by connecting the ONT to pfsense by way of a dumb switch (t o filter out the vlan 0 tags). ONT goes to one port, pfsense's wan goes to another.

                            S 1 Reply Last reply Reply Quote 0
                            • B
                              bk150 @Selcouth
                              last edited by

                              @Selcouth I'm running supplicant mode on an SG-5100 on 2.4.5-RELEASE-p1 (amd64). I purchased the certificates from maczrcool on eBay and followed the guide in the README in the supplicant branch of MonkWho's pfatt fork: https://github.com/MonkWho/pfatt/tree/supplicant

                              GPz1100G 1 Reply Last reply Reply Quote 0
                              • GPz1100G
                                GPz1100 @bk150
                                last edited by

                                @bk150 It looks like that method is funneling all wan traffic through ngeth0 for the vlan0 tagging. First off are you able to attain full line speed (during speed tests)? Is the pfsense cpu usage very high during this event?

                                B 1 Reply Last reply Reply Quote 0
                                • B
                                  bk150 @GPz1100
                                  last edited by bk150

                                  @GPz1100 Here is a result from just a few moments ago:

                                  alt text

                                  Here's a screenshot of CPU usage and load average on the system during the test:

                                  alt text

                                  1 Reply Last reply Reply Quote 0
                                  • GPz1100G
                                    GPz1100
                                    last edited by

                                    I wonder if the usage would be that high if a dumb switch was placed inline in between ont and pfsense wan?

                                    B 1 Reply Last reply Reply Quote 0
                                    • S
                                      Selcouth @GPz1100
                                      last edited by

                                      @GPz1100 I'm not authenticating with a dumb switch in line either. I must have some other problem. Maybe I'll start fresh to double check everything.

                                      1 Reply Last reply Reply Quote 0
                                      • B
                                        bk150 @GPz1100
                                        last edited by

                                        @GPz1100 I'll find a day/evening when my girlfriend doesn't need internet and try the dumbswitch method. I can post my results back here

                                        1 Reply Last reply Reply Quote 0
                                        • B
                                          bkatt
                                          last edited by bkatt

                                          Hello All.
                                          I am able to get this script working via bridge mode, but having issues getting it to work via supplicant mode. It is running on bare metal.

                                          The script seems to hang at "Waiting EAP for authorization"

                                          I have root and wheel group full permission to the 3 certs. I got them from ebay and converted them into the correct format using some tools suggested online. Is there anything easy I could be missing? Been through the guide multiple times but cannot seem to figure it out thus far.

                                          I have checked the configuration inside pfatt.sh multiple times and appears to be correct.

                                          S 1 Reply Last reply Reply Quote 0
                                          • ?
                                            A Former User
                                            last edited by

                                            i following this thread with lot of interest

                                            1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.