* SOLVED* CBRAS setup question

  • @KOM
    I'm thinking I will have problems becasue I'm trying to build a VPN between the sites. Won't doubling NATing confuse it?

    Also, I was talking with a fifth tech at CL. He believes they have to update/submit an AGW form. From what he said, it sounds like they need to add my gateway IP to their 'gateway db system'.

  • Yes, that would cause you some issues. Is this ISP the only one in your area? Perhaps they have a higher tier or business plan where you don't have to fight this double-NAT CBRAS nonsense.

  • @vegastech
    More FYI...
    The CL tech double checked my settings in their DSL modem. He also said I should use the starting IP on my router. The first static IP goes into the C3000Z. It should be noted that the static IP (not starting IP) is actually the network subnet ID. It sounds to me like their DSL modem becomes a mini router and defines a public network which my router is part of.

    I'm headed back to the office in a bit to see if things are working properly - i.e. I can put the starting IP on pfSense and move the the cable to the ethernet port.

  • @KOM
    Unfortunately, they are the only feed to the building. Cox cablemodem service says they'll build into the building over the next year.

  • OK, so next I would confirm with them that this CBRAS dealie is all they support. Ask if there is any way at all to get a bridged connection.

  • @KOM
    Nope, no more bridge mode for CenturyLink. All of their future rollouts with static IP will be CBRAS.

  • Highly unfortunate. I don't know if there is anything else you can do.

  • @vegastech

    This a.m. I called in to check the state of the AGW job. Finally, I wound up with a knowledgeable tech! He looked at the setup and said, no, AGW is more oriented for towns and COs not users and that Vegas has had their AGW updated for some time. As he looked at the setup he noticed that the office profile was sharing the same resources assigned to another location/office/business. I asked if he meant our IP address(s) and he said not that specifically but other CL resources. He adjusted things and said to reboot the DSL modem. An hour later I was onsite, move the pfSense WAN to the ethernet1 (away from the LAN/WAN) port, rebooted the DSL modem, assigned the starting IP, gw, subnet to pfSense WAN port and voila everything is working. I updated the IP in the far side of the VPN and that link came up. We're now getting .6ms RTT and .2 RTTsd on our gateway. Those are incredible numbers for any site in Vegas. It appears the office's temperamental Aprima EMR cross network scanning app is working properly (the dang thing that started all of this).

    More CBRAS things to note

    • don't config your network as, you shouldn't anyway/ever; the DSL modem still has a network in its brain and the modem exists at; the modems never go into bridge mode; I can access the modem from inside my network which I though I wouldn't be able to do even though 'don't pass private IP' options are enabled in pfSense

    Hopefully these notes will help other people with their CBRAS setup. The real issue is training of the CenturyLink staff to properly configure, deploy, and troubleshoot their new CBRAS service. The pfSense side pretty straight forward.

  • Yeah, I called them 10 minutes before you did and straightened them out for you.

    😆 😆

  • I am in a similar situation. I do not have the CL modem, only a pfsense box and CL fiber that uses CBRAS and I have a static IP. Help? Can’t get this thing to use it.

  • @techsalot
    Here's what I found in my notes...


    • C3000Z becomes a mini router that defines a public IP range, the pfSense router is in that new range
    • remember that defining + wiring the 'ethernet ports' is important, especially if you only assign a single port
    • DSL1 is a single pair going to the DSL modem, usually tops out about 20Mb/s
    • DSL2 is an additional single pair going to the DSL modem, they bond the lines together and can get about 40Mb/s total
    • remember to turn off the wifi at the C3000Z
    • default IP is
    • in bridge mode the world icon no longer lights up
    • crazy, but even after you properly configure the LAN and WAN in pfSense, you can still get to from your LAN, regardless of the segment (i.e. can still get to
    • never use for the LAN, you shouldn't be doing that anyway

  • @vegastech thanks, but I think you misunderstood what I have.

    I have NO CL modem.

    I have ONT > pfsense

    That’s it. It gets the DHCP from CL, not sure how to configure the static on the pfsense.

  • Netgate Administrator

    Set the WAN to your assigned static IP/subnet and add a gateway to it using the IP they have have given you for that. It should not be more difficult than that if they are routing that IP to you.
    Otherwise they should tell you how it needs to be configured.


  • Netgate Administrator

    Ah, OK, that's fun!

    Well you should be able to leave the WAN set to DHCP and apply the statuc IP they gave you as an IPAlias on it. Then you can use it however you wish, 1:1 NAT out of it or use it as the default IP.


  • @stephenw10 that sounds more like it, I’m just not really sure how to do that exactly.

    Check my profile, I left a longer post in a different section with details if you could describe what to do based on that, it would be helpful.

  • Netgate Administrator

    Go to Firewall > VirtualIPs. Add a new VIP with type IPAlias on the WAN. Set the static IP and give it a description.

    Now go to Diag > Ping and try to ping something external using the new VIP as the source IP. If it succeeds you're good.


  • @stephenw10 I made an edit above, but I’ll give what you said a try. Thanks.

  • @stephenw10 I re-read this part too...I still want to NAT addresses behind the pfsense. I just want to use the static address to get to my network remotely to use features like VPN.

  • @stephenw10 said in * SOLVED* CBRAS setup question:

    Go to Firewall > VirtualIPs. Add a new VIP with type IPAlias on the WAN. Set the static IP and give it a description.

    Now go to Diag > Ping and try to ping something external using the new VIP as the source IP. If it succeeds you're good.


    No dice

    PING google.com ( from 71.33.XXX.73: 56 data bytes
    --- google.com ping statistics ---
    3 packets transmitted, 0 packets received, 100.0% packet loss

Log in to reply