Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    ATT Uverse RG Bypass (0.2 BTC)

    Bounties
    80
    555
    997.6k
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • H
      hfrazier @ikkuranus
      last edited by hfrazier

      @ikkuranus
      I came here wondering the same thing. Was just about to try it.. It looks like there's a clone here, but is outdated according to the internet archive..

      Edit: Maybe just use this repo
      https://github.com/0xC0ncord/pfatt

      A 1 Reply Last reply Reply Quote 1
      • F
        ffuentes
        last edited by

        It turns out that I have a clone from 04/19/2020 so looks like I am good to go. I would like to know what happen though...

        1 Reply Last reply Reply Quote 0
        • A
          AiC0315 @GPz1100
          last edited by

          @GPz1100 Do you need the scripts?

          H 1 Reply Last reply Reply Quote 0
          • H
            hfrazier @AiC0315
            last edited by

            @AiC0315 I need them too please

            1 Reply Last reply Reply Quote 0
            • A
              andrewpdupuis @hfrazier
              last edited by andrewpdupuis

              @hfrazier since this was a public repo, do we know which is the new parent where future work should go? If he deleted/made private, there should have been a split and all the forks should have gotten reparented.

              edit: looks like MonkWho is the new parent repo, based on the graph. Here's all the most recent updates for anyone who needs them https://github.com/MonkWho/pfatt/network

              H 1 Reply Last reply Reply Quote 1
              • H
                hfrazier @andrewpdupuis
                last edited by

                @andrewpdupuis Ah, thanks! I had found that repo just wasn't sure if it was the latest.

                F 1 Reply Last reply Reply Quote 0
                • F
                  foxide
                  last edited by

                  This post is deleted!
                  1 Reply Last reply Reply Quote 0
                  • F
                    foxide @hfrazier
                    last edited by

                    @hfrazier Looks like the latest fork from that is found at https://github.com/neclimdul/pfatt

                    1 Reply Last reply Reply Quote 0
                    • G
                      GPz1100
                      last edited by

                      Does anyone have the zip of https://github.com/aus/pfatt/tree/supplicant ?

                      1 Reply Last reply Reply Quote 0
                      • MonkWhoM
                        MonkWho
                        last edited by MonkWho

                        I decided to check if there were any changes to pfatt last week and found out that original is now gone and my fork became a new parent. No idea how or why.

                        I will maintain it to the best of my abilities. I pulled some requests and done some commits to clean things up. Screwed up a little when I was uploading the supplicant branch but got it all fixed up now. I also separated OPNsense specific script into it's own file for clarity. So currently https://github.com/MonkWho/pfatt contains the latest files.

                        @GPz1100 said in ATT Uverse RG Bypass (0.2 BTC):

                        Does anyone have the zip of https://github.com/aus/pfatt/tree/supplicant ?

                        A copy of it is here - https://github.com/MonkWho/pfatt/tree/supplicant. It contains most recent files. Unfortunatly this branch was not there when I originally created my fork so I had to semi-manually recreate it from a backup I had locally.

                        G 1 Reply Last reply Reply Quote 6
                        • G
                          glio @MonkWho
                          last edited by

                          @MonkWho I just want to say thank you for carrying the torch. I just recently discovered this whole workaround thing - was getting discouraged trying to find a way to build the netgraph for my SG3100 - then found out it is included with pfsense now. Except on 2.4.5, the ng_etf package is missing! lol

                          https://redmine.pfsense.org/issues/10463

                          So now I must wait until 2.4.5-p1 release to be able to set this all up. Anyways, thank you for carrying on the work @aus started.

                          A 1 Reply Last reply Reply Quote 0
                          • A
                            AiC0315 @glio
                            last edited by

                            @glio Maybe I am missing something, I am running 2.4.5 with the supplicant bypass. I did install it on an earlier version.

                            G 1 Reply Last reply Reply Quote 0
                            • G
                              glio @AiC0315
                              last edited by

                              @AiC0315 The EAP proxy is not available without ng_etf being present. I've not previously set up this stuff on earlier versions so maybe that's the difference.

                              1 Reply Last reply Reply Quote 0
                              • P
                                pyrodex
                                last edited by

                                I've heard people being able to use the supplicant mode without netgraph if they used a switch or bypass switch between pfSense and the ONT. Can anyone confirm and what model switch did you use?

                                I tried this on my new physical firewall with a DGS-1005G and had no luck. Any one?

                                1 Reply Last reply Reply Quote 0
                                • Z
                                  Zaf9670
                                  last edited by

                                  So based on what I'm reading over the past 2+ years pfsense still requires netgraph in order to work with the 802.1x certificates?

                                  Also of note, someone on Reddit found a downgrade loophole for the BGW210-700 which allows root access. So you can extract the 802.1x certificates and disable the auto-updates to the gateway.

                                  Reddit post:
                                  https://www.reddit.com/r/ATT/comments/g59rwm/bgw210700_root_exploitbypass/

                                  Pastebin with steps to perform:
                                  https://pastebin.com/SUGLTfv4

                                  1 Reply Last reply Reply Quote 0
                                  • timtraceT
                                    timtrace
                                    last edited by timtrace

                                    This post is deleted!
                                    1 Reply Last reply Reply Quote 0
                                    • timtraceT
                                      timtrace
                                      last edited by

                                      Is this expected behavior?

                                      Running the netgraph bypass as documented at https://github.com/MonkWho/pfatt . No LANs have been routed to ngeth0 just yet.

                                      I get about about one packet every two-three minutes from the RG: tcpdump -ei em4

                                      10:06:30.887851 f8:2d:c0:yy:yy:yy (oui Unknown) > Broadcast, ethertype 802.1Q (0x8100), length 424: vlan 0, p 3, ethertype IPv4, 0.0.0.0.bootpc > 255.255.255.255.bootps: BOOTP/DHCP, Request from f8:2d:c0:yy:yy:yy (oui Unknown), length 378

                                      And I get about 100 per minute from the ONT: tcpdump -ei em5

                                      09:59:03.144906 a0:f3:e4:59:27:94 (oui Unknown) > f8:2d:c0:yy:yy:yy (oui Unknown), ethertype 802.1Q (0x8100), length 60: vlan 0, p 0, ethertype IPv4, 162-224-176-1.lightspeed.stlsmo.sbcglobal.net > zzz-zzz-179-129.lightspeed.stlsmo.sbcglobal.net: ICMP echo reply, id 30739, seq 4885, length 8
                                      • $RG_IF = em4
                                      • $ONT_IF = em5
                                      • f8:2d:c0:yy:yy:yy / zzz-zzz-179-129.lightspeed.stlsmo.sbcglobal.net = my RG
                                      • a0:f3:e4:59:27:94 / 162-224-176-1.lightspeed.stlsmo.sbcglobal.net = ATT
                                      1 Reply Last reply Reply Quote 0
                                      • G
                                        GPz1100
                                        last edited by

                                        ^^For the first one, I think that might be a byproduct of the rg not getting an ip when using the eap proxy method. That is, it keeps requesting, but because the proxy only passes 802.1x traffic, it never actually receives it.

                                        The 2nd looks like the gateway is responding to a ping request? You have something pinging the gateway ip (162.224.176.1) often?

                                        1 Reply Last reply Reply Quote 1
                                        • timtraceT
                                          timtrace
                                          last edited by timtrace

                                          Sounds like the first one is benign, unless, it is an indicator that something else is wrong.

                                          The second - I’m not pinging in on that IP.

                                          Edit: The second thing, with the 100+ pings per minute, was the pfSense gateway monitor. It's now disabled.

                                          1 Reply Last reply Reply Quote 0
                                          • G
                                            GPz1100
                                            last edited by

                                            What gateway box are you using? Maybe time to dump it entirely and go wpa_supplicant method?

                                            timtraceT 1 Reply Last reply Reply Quote 1
                                            • First post
                                              Last post