ATT Uverse RG Bypass (0.2 BTC)

michaellacroix

Hi All,

I'm using frontier 1gb fiber service for my internet and I have a strange issue when using the netgraph script.
Currently my setup is using a pfsense instance on a Hyper-V server which is great because the virtual switch strips the vlan tags so my pfsense works great natively. My speed test show about 940mbp up and down on my hyper v instance.
If I use a use pfsense on comparable hardware directly on a metal box using the netgraph script I get speed tests of about 750mbs down and 840 up consistently. CPU and memory aren't even breaking a sweat. I would have expected speeds of around the same as my Hyper-V since that PC is actually using more resources. Not to mention other than adding the netgraph script I'm using pfsense straight from installation without making any other changes.
I'm happy to post any benchmarks and would love to hear this groups thoughts on this.
Thanks

slushieken

@michaellacroix recommend you look through and tune/test interface settings eg:

NIC Flow Control
NIC Offload
NIC Rx Buffer
NIC Tx Buffer

These being out of tune for best performance on your particular platform likely would explain that amount of speed discrepancy.

michaellacroix

Great idea! I will try that as soon as I get home. These are intel em cards.

untamedgorilla

@stephenw10 I upgraded from 2.4.4 with no issues. I'm using supplicant mode.

mikela

I'm using the latest 2.5.2 release.

mikela

So I tried making changes to tune my interface settings which made no difference in speed.
I did however remove netgraph from the equation and set a static IP from the dhcp pool and it also made very little difference in regard to speed. I think the hyper-v vmswitch is just stripping out all the crap from my ISP's connection allowing for the best connection and performance.
If that's the case I guess I'm stuck using pfsense as a vm. I would have much rather preferred using dedicated equipment instead.

stephenw10

Mmm, yeah if you're going through a v-switch and trying to use vlan0 I could certainly see that causing problems!

bk150

I got the "joy" of receiving the BGW320-500 device in my new house. Let me know if anyone wants me to test anything regarding a potential bypass. I'm reasonably strong with Linux/UNIX and have a fair bit of hardware laying around that can run pfsense and others.

bigjohns97

I have been running supplicant mode with ngeth for a while now successfully but would love to be able to just use a switch to handle the VLAN 0 piece and take ngeth out of the chain and then just use my certs and wpa_supplicant to authenticate to the At&t network.

Would it be possible to get a smart switch and then have the port going to my pfsense WAN port as untagged VLAN 0 and then the port going to the ONT as a tagged VLAN 0 port and not have to use ngeth anymore and just use the wpa_supplicant and extracted certs to authenticate?

I really don't want to go the virtualization route and always hear about people using a dumb switch but don't want to have to plugin the RG whenever there is an issue.

Will this untagged / tagged combo work with a switch like the Netgear GS108Ev3?

netnerdy

@bigjohns97 You can use a managed netgear switch and use its mac based vlan feature to do what you want. I use ms510tx to do exactly what you are asking for. I see some other switches which has this capability on this page. link

Check the user manual of your switch to see if you have it.

bigjohns97

@netnerdy said in ATT Uverse RG Bypass (0.2 BTC):

@bigjohns97 You can use a managed netgear switch and use its mac based vlan feature to do what you want. I use ms510tx to do exactly what you are asking for. I see some other switches which has this capability on this page. link

Check the user manual of your switch to see if you have it.

@netnerdy that is a pretty expensive option, I am guessing you used MAC based VLAN to have flexibility to plug into any port?

I was looking to use the GS108Ev3 model which has port based VLAN but when I go into the user manual online it says VLAN ID 1-4096. This is a little concerning.

I am guessing you are using that switch for more than just bypassing the Att RG?

I might just order the GS108Ev3 from somewhere with a good return policy and give this a shot.

Thanks for confirming the tagged / untagged combo would work for me.

stephenw10

@netnerdy said in ATT Uverse RG Bypass (0.2 BTC):

ms510tx

That switch will tag traffic in VLAN0? That surprises me if true.

bigjohns97

@stephenw10 said in ATT Uverse RG Bypass (0.2 BTC):

@netnerdy said in ATT Uverse RG Bypass (0.2 BTC):

ms510tx

That switch will tag traffic in VLAN0? That surprises me if true.

The docs suggest valid values 1-4093.

I am beginning to think this only way to do what I am looking for is to use a hypervisor.

stephenw10

Right, because VLAN 0 is invalid, out if spec. It seems likely AT&T and others use it precisely because it's difficult to use with other equipment. Though that could just be my inner cynic.

fresnoboy

@bigjohns97

What's that line "How I stopped worrying and learned to love the hypervisor"? :)

Seriously though, the ability to do snapshots and easily restore to a prior state is really helpful. PFSense is usually very stable, but there have been times with the original 2.5.0 upgrade and plugins where being able to recover from a snapshot helped save me (and the family) from extended downtime.

bigjohns97

@fresnoboy said in ATT Uverse RG Bypass (0.2 BTC):

@bigjohns97

What's that line "How I stopped worrying and learned to love the hypervisor"? :)

Seriously though, the ability to do snapshots and easily restore to a prior state is really helpful. PFSense is usually very stable, but there have been times with the original 2.5.0 upgrade and plugins where being able to recover from a snapshot helped save me (and the family) from extended downtime.

I would love to have snapshots available to me for restores but I just couldn't get over how much the PfSense GUI showed cpu usage when doing speed tests while using ESXi. Without suricata running I only get around 3% CPU during a speed test but with ESXi it was around 30%.

This was passing through the NIC which obviously I would need to give up if I were to trade ngeth for virtualization.

I do run suricata now but honestly don't feel like I really get much from it outside of a bunch of false positives, I do get a great feeling from pfblockerng from a security perspective.

At the end of the day I just felt like running this on ESXi just added complexity and hurt performance enough to a point I wasn't comfortable with.

I may revisit this with something like proxmox where I can dedicate cores but I seem to remember a similar experience when using unraid which I believe is the same hypervisor as proxmox under the covers.

netnerdy

@bigjohns97

Reason my switch is expensive is because it can do multi-
gig. I’m sure you can find cheap gigabit managed switches
that can do mac based vlan from netgear.

I also run my pfsense on ESXI for easy backup/restore, but can also do NIC passthrough and so don’t incur the ngeth or ESXI networking cost, which both cost extra cpu.

@stephenw10
Vlan 0 is not out of spec. It’s called “priority tagging”. This mechanism is used to prioritize stuff like VOIP phone packets in switches which support it. The problem arises because there are devices which would like to specify a priority in their ip packets without specifying a vlan id. Check out the link I sent previously, you’ll see mentions of “priority tagging” there.

fortillian

@bigjohns97

I use a Netgear GSS108E "smart" switch between the ONT, ATT RG and PFSENSE.

I have only had to plug in the ATT RG 2 times to re-authenticate so far this year. I have the ONT on Port 1, ATT RG on Port 2 and PFSense on Port 3.

alt text

When I need to re-auth, I plug in the ATT RG and login to the switch and change Port 2 VLAN ID to 1, and Port 3 VLAN ID to 2. I wait about 2 mins for the ATT RG to show a service light, then I switch the VLAN Port IDs for Ports 2/3 back to how its shown in the picture and I am back online.

DanielJay23

I have been using the pfatt script to with no issue. My connection I have 5 static IPs associated with my account. However I have been unable to get the gateway to show online. My Internet appears to work no issue but the gateways section on the dashboard shows Offline 100% loss for my static IP gateway. The DHCP acquired gateway shows online with RTT of 0.6ms and RTTsd of 0.06ms and no packet loss.
My /var/log/pfatt.log file shows:

[pfatt.sh] :: pfSense + AT&T U-verse Residential Gateway for true bridge mode
[pfatt.sh] :: Configuration:
[pfatt.sh] ::        ONT_IF: igb2
[pfatt.sh] ::         RG_IF: igb3
[pfatt.sh] :: RG_ETHER_ADDR: <removed>
[pfatt.sh] :: loading netgraph kernel modules... OK!
[pfatt.sh] :: attaching interfaces to ng_ether... OK!
[pfatt.sh] :: building netgraph nodes...
[pfatt.sh] ::   creating ng_one2many... OK!
[pfatt.sh] ::   creating vlan node and interface... OK!
[pfatt.sh] ::   defining etf for igb2 (ONT)... OK!
[pfatt.sh] ::   defining etf for igb3 (RG)... OK!
[pfatt.sh] ::   bridging etf for igb2 <-> igb3... OK!
[pfatt.sh] ::   defining filters for EAP traffic... OK!
[pfatt.sh] ::   enabling one2many links... OK!
[pfatt.sh] ::   removing waneapfilter:nomatch hook... OK!
[pfatt.sh] :: enabling igb3 interface... OK!
[pfatt.sh] :: enabling igb2 interface... OK!
[pfatt.sh] :: enabling promiscuous mode on igb3... OK!
[pfatt.sh] :: enabling promiscuous mode on igb2... OK!
[pfatt.sh] :: ngeth0 should now be available to configure as your pfSense WAN
[pfatt.sh] :: done!

My biggest issue is I am trying to troubleshoot slow connectivity. Part of my issue is DNS which I am digging into but also wondering if since this gateway is down if that is part of my issue?
Current pfsense firmware is on 2.4.4

stephenw10

2.4.4 is ancient.

You wouldn't normally have two WAN gateways like that. One may be a remnant from some older config.

Steve