Great job, and you also learned port forwarding, ACL ordering, alias creation and much more. I love this forum you can learn so
much. Now you just need a OpenVPN configured with a NAS server for private cloud use

@johnpoz said in How to keep networks separated:

Seems odd to me that your saying pfsense is getting a public IP - but other devices are getting 192 - this isn't normally how a gateway in bridge mode works.

That's how the att garbage works. Their gateways have what's called passthrough mode. Via dhcp it assigned the public ip to a single device on the lan side.

However, the public ip still remains assigned to the gateway's wan as well. It's a pseudo passthrough mode of sorts, fake bridge.

The end result, customer's device (router, pfsense, etc) has what appears to be a public ip as well as the gateway. As such, the gateway can assign various private ip's to other devices (wired and wireless) connected its ethernet ports and/or wifi ssid. A traceroute behind the customer's router (pfsense or other), will show the gateway ip as the first hop (192.168.1.254) rather than the real wan gateway.

For those of us on fiber in areas not get upgraded to xg-pon, several bypass methods exist which eliminate the isp gateway box entirely. The best is extracting (or buying) the 802.1x certs then implementing them in software using wpa_supplicant. This gives customer full access and control of the network, no double nat, etc. Also a /60 PD for ipv6 vs /64 from the gateway box.

The other methods still rely on the gateway box in one manner or another.

@ddbnj

Then I can only assume you didn't reboot pfsense. That's pretty much necessary to get the full sequence. Otherwise, you only get renewals.

You're workaround also fixed the issue for me!

The issue on my machine was not because of manual disconnects; it was when probably renewing DHCP every 24h. Sometimes it would not come back online and it would give:

« CHAT: The modem is not responding to "AT" at ModemCmd: label. »

Error in log.

power_off and power_on solved it without having to reboot the whole machine. Seems like for some reason /dev/cuaU0.2 was locked also but it doesn't appear in the logs.

na so wie ich das verstehe, muss das, was auch immer dann da hängt, irgendwie mit der Telekom reden können ... also es ist ja nicht nur eine reine DECT Station sondern eben auch mit Einwahl und so verbunden ... und da hab ich halt gar keine Ahnung, was man da alternativ zu einer Fritzbox nehmen kann. ¯_(ツ)_/¯