pfatt

Note that you can still downgrade an existing gateway, extract certs[0], then bypass the device [1]. I had to do this with OPNsense to avoid the latency buildup issue, which has been ongoing for months[2]. --- 0 -- https://www.dupuis.xyz/bgw210-700-root-and-certs/ 1 -- https://github.com/MonkWho/pfatt 2 -- https://www.reddit.com/r/ATTFiber/comments/1eqfouo/psa_att_n...

I'm 90% satisfied with mine: * 500/500 for $60, can go up 5gbps symmetrical if I wanted * While not advertised as static, I've had the same IPv4 IP since I checked a year ago * No significant downtime * The provided router has a single 2.5gbps port and has 802.11ax Disatisfied: * The ONT and gateway is a Nokia BGW320 provided by AT&T that I must have. I cannot provide my own. There are some work-arounds with pfsense [1] and bridging 802.1X traffic. * The Nokia ONT/Gateway kinda sucks and it's ARP tables fill up and the general networking of it are fairly basic and what you'd expect for some $30 TP-Link. * I'm fairly confidant that AT&T uses CGNAT. I haven't been able to get Plex remote access to work correctly. [1] https://github.com/MonkWho/pfatt

I read this and _instantly_ wonder if it's viable for certificate extraction to bypass the god-awful NAT system in AT&T's equipment, a-la pfatt: https://github.com/MonkWho/pfatt Edit: Ah yes, this is covered in the section "Obtaining the certificate via reboot & exploitation" Sadly my hardware appears to be patched.

Well from a consumer POV, Comcast forcing you to lease their hardware that phones home to the cloud at all times, remotely set wifi password and all on the xfi gateway for a discount on rent seeking behaviour is incredibly bullshit. That being said AT&T fiber at least doesn't allow you to use your own modem. You are required to use their equipment because they intentionally force no hardware to be "compatible" with their handoff. Last time I was using them you had to do some convoluted bullshit to even try (see https://github.com/MonkWho/pfatt)

I followed this guide: https://github.com/MonkWho/pfatt The gist is that you'll have two ethernet ports dedicated to AT&T, one for the ONT, and one for the gateway router (which needs to have the gateway's mac address). The pfSense interfaces have to be setup a specific way. There is also a script that has to run while pfSense boots. Once it boots, you can pretty much turn off the gateway and put it away. The only time you'd need to reconnect it is if your ONT loses power. I hope that helps.

you can still get around this with some effort [1] and a pfsense box, the pfsense box gets wan from the ont and the original att router is hung off a third nic where it's allowed to do 802.1x and nothing else. the setup was a little challenging at first but has been maintenance free since. maybe there is a technical reason they have their network set up this way but i was offended at the idea of being prevented from using my own router. [1] https://github.com/MonkWho/pfatt

> But what's your reason to be going such lengths instead of just plugging UDM into their router? While you can do this and things will generally work, AT&T restricts all of their residential gateways from operating in a true passthrough/bridge mode to another router. So you end with double NAT and all the joys that entails (such as [1]). There are also a number of other issues that have been associated with operating in their faux-passthrough mode, including - Issues with IPv6 prefix delegation - Sporadic latency spikes (an issue in general, that you inherit since the gateway is still "doing" everything it normally would, since it won't actually act as a ure passthrough/bridge) - A firmware update capped throughput at 50Mbps (later fixed in another firmware update)[2] - Firmware updates tend to silently re-enable the built-in wifi radios

There's also one for pfsense, which is what I used before I dumped my cert out of my router https://github.com/MonkWho/pfatt