ATT Uverse RG Bypass (0.2 BTC)

GPz1100

@bk150 It looks like that method is funneling all wan traffic through ngeth0 for the vlan0 tagging. First off are you able to attain full line speed (during speed tests)? Is the pfsense cpu usage very high during this event?

bk150

@GPz1100 Here is a result from just a few moments ago:

alt text

Here's a screenshot of CPU usage and load average on the system during the test:

alt text

GPz1100

I wonder if the usage would be that high if a dumb switch was placed inline in between ont and pfsense wan?

Selcouth

@GPz1100 I'm not authenticating with a dumb switch in line either. I must have some other problem. Maybe I'll start fresh to double check everything.

bk150

@GPz1100 I'll find a day/evening when my girlfriend doesn't need internet and try the dumbswitch method. I can post my results back here

bkatt

Hello All.
I am able to get this script working via bridge mode, but having issues getting it to work via supplicant mode. It is running on bare metal.

The script seems to hang at "Waiting EAP for authorization"

I have root and wheel group full permission to the 3 certs. I got them from ebay and converted them into the correct format using some tools suggested online. Is there anything easy I could be missing? Been through the guide multiple times but cannot seem to figure it out thus far.

I have checked the configuration inside pfatt.sh multiple times and appears to be correct.

i following this thread with lot of interest

netman89

I had the same issue as above with the 'no such file or directory' errors and resolved it by adding the following lines in the pfatt.sh script around line 144:

/usr/bin/logger -st "pfatt" "attaching interfaces to ng_ether..."
/usr/local/bin/php -r "pfSense_ngctl_attach('.', '$ONT_IF');"

The lines were added right after:
/usr/bin/logger -st "pfatt" " ONT---[] [$ONT_IF]$HOST"

I had to set the WAN interface back to ngeth0, but after a reboot, I was getting an IP address and was able to browse the net. Hope this helps.

Ican'treadorwrite

@Dade I realize you posted this a long time ago, so sorry for bringing this up again. I also have ATT with 5 extra static IPs (/29). I made another lan interface and assigned the "Gateway IP" from ATT to this interface. I don't have any problem using 1:1 NAT to assign public IPs to specific devices on my LAN.

I am also using the static "Gateway IP" from ATT as the IP address for a VPN server--which works except for one thing. My ATT static Gateway IP is 75.xxx.xxx.78. My dynamic ATT IP is 68.xxx.xxx.29. I can connect to the VPN using the address 75.xxx.xxx.78, but while connected to this VPN, if I google "what is my IP address" the response is 68.xxx.xxx.29, when it should be 75.xxx.xxx.78.

Using your method, were you able to resolve this? Either way, could you describe the firewall/NAT rules that you used?

Thanks!

foxide

@Ican-treadorwrite The IP you're going to see on a "what's my IP" query is going to be the NAT IP that applies to that traffic. You'll have to create a new NAT rule ONLY for the internal IP addresses of your VPN clients specifying that that specific IP (your static IP) is the "NAT address" for that traffic.

shad0wca7

@bkatt said in ATT Uverse RG Bypass (0.2 BTC):

Hello All.
I am able to get this script working via bridge mode, but having issues getting it to work via supplicant mode. It is running on bare metal.

The script seems to hang at "Waiting EAP for authorization"

I have root and wheel group full permission to the 3 certs. I got them from ebay and converted them into the correct format using some tools suggested online. Is there anything easy I could be missing? Been through the guide multiple times but cannot seem to figure it out thus far.

I have checked the configuration inside pfatt.sh multiple times and appears to be correct.

I am having this exact same situation. Permissions, names, etc all look fine - it just hangs at 'waiting EAP for authorisation'....

AiC0315

@shad0wca7
What are your file names and file type?
I have my permissions set to 755

bk150

I really hope the underlying issue people are having isn't related to this: https://www.dslreports.com/forum/r32839785-AT-T-Fiber-Gateway-bypass-with-WPA-supplicant-stopped-working-2-days-ago

AiC0315

@bk150
I'm running 2.4.5 and rebooted just the other day with no problems.

shad0wca7

@AiC0315

-rw-------  1 root  wheel  6431 Aug 22 16:46 ca.pem
-rw-------  1 root  wheel  1131 Aug 22 16:46 client.pem
-rw-------  1 root  wheel   887 Aug 22 16:46 private.pem

bkatt

@AiC0315 I set my permissions to 775 and tested. It was previously set to 774. Unfortunately same message, "Waiting EAP for Autorization". Three files, ca.pem, client.pem, and private.pem. running 2.4.5 r1 also.

AiC0315

@bkatt
Well unfortunately mine is now broken!
I imagine it has something to do with the link @bk150 posted earlier.

Darth Android

I recently set up new service with AT&T and was not able to get wpa_supplicant/dhcp working without making a few tweaks to the pfatt.sh script:

wpa_supplicant had to run on the bare port, not ngeth0

-WPA_DAEMON_CMD="/usr/sbin/wpa_supplicant -Dwired -ingeth0 -B -C /var/run/wpa_supplicant"
+WPA_DAEMON_CMD="/usr/sbin/wpa_supplicant -Dwired -i$ONT_IF -B -C /var/run/wpa_supplicant"

Both the bare port and ngeth0 had to have a MAC that matched the certificates I was using (not my assigned router gateway, as I had purchased certificates online instead of messing with the firmware of my assigned gateway):

-/usr/sbin/ngctl msg ngeth0: set $RG_ETHER_ADDR
+/usr/sbin/ngctl msg ngeth0: set $EAP_SUPPLICANT_IDENTITY

 /usr/bin/logger -st "pfatt" "enabling promisc for $ONT_IF..."
+/sbin/ifconfig $ONT_IF ether $EAP_SUPPLICANT_IDENTITY
 /sbin/ifconfig $ONT_IF up
 /sbin/ifconfig $ONT_IF promisc

This got me line speeds with minimal CPU usage on a bare metal installation of pfsense (CPU is a Xeon D-1518 @ 2.2Ghz, for reference, which is overkill for this but not the 10Gbps ports)

That said, I still do not have IPV6 working fully, and am at a loss there-- I can get a WAN IP via DHCPv6, and I can get prefix delegations for all of my LANs, but IPv6 packets just get dropped several hops outside of my network without the slightest hint as to why.

pyrodex

@Darth-Android said in ATT Uverse RG Bypass (0.2 BTC):

That said, I still do not have IPV6 working fully, and am at a loss there-- I can get a WAN IP via DHCPv6, and I can get prefix delegations for all of my LANs, but IPv6 packets just get dropped several hops outside of my network without the slightest hint as to why.

Did you set your IPv6 to DHCPv6 on your WAN and then in the IPv6 settings set a prefix? I have my prefix set to /60 and the following settings:

Use IPv4 Connectivity as Parent Interface - Checked
Request only an IPv6 Prefix - Checked
Send IPv6 Prefix Hint - Checked

Once this is done save and then go to each non-WAN interface and set IPv6 to TRACK and then set the track interface to WAN and start with 0 incrementing by one for each interface.

Darth Android

@pyrodex Hmmmm, those checkboxes are different from what's recommended in the pfatt repo, but even with your settings I can't get more than 2 hops into AT&T's network before the packets disappear. (traceroute6 google.com always shows pfsense + 2 more hops, and then nothing; pfsense is connected directly to the ONT in my setup)