Hacker News new | ask | show | jobs
by toast0 742 days ago
If you have the att fiber with the ONT separate from the modem, it's really easy to bypass 802.1X. Plug an unmanaged switch in between the modem and the ONT; let the modem auth; disconnect the modem. You'll likely need to do that again if the ONT reboots, but at least for me, ATT a UPS for the ONT, so reboot frequency should be low.

Personally, I built up a rube goldberg of software and hardware with bypass nics so if my firewall was off (or rebooting), traffic would flow through their modem, and when it was on, my firewall would take the traffic and selectively forward traffic through from the modem, but there's really no need for that when you just use an unmanaged switch. I can find the code if you're interested (requires FreeBSD), but you sound more sensible than that ;)
3 comments
Bluecobra 742 days ago
That's a good idea, I do have an extra UPS/switch I can use for this. In the past when I was a bachelor and had more free time, I used to run my own FreeBSD server with pf and other services running in jails. Now that I am settled down, I just want to make things as idiot proof as possible in case there is an Internet issue at home and another family member needs to fix it.

The XGS-PON workaround that DannyBee looks promising though:

https://pon.wiki/guides/masquerade-as-the-att-inc-bgw320-500...

I probably could pay to upgrade my speed to 2Gbps and then downgrade it back to 1Gbps and keep the XGS-PON.

link
gh02t 742 days ago
If you have a router running PfSense Plus* and at least 3 ports, Netgate actually has pretty detailed instructions for how to do the bypass with their layer 2 routing feature. It sounds a bit complicated, but I followed along exactly as it says and it just worked for me. Has been 100% reliable for almost 2 years, and I get significantly better speed (something like 10-20% vs the built in "passthrough" mode on the gateway, iirc). Plus I managed to cut the suspicious DNS server the gateway tries to interject out of my network.

> https://docs.netgate.com/pfsense/en/latest/recipes/authbridg...

There's another method that doesn't require Plus called pfatt, but I'm not sure what the state of it is.

* Plus is the paid version, yeah I know I agree I don't like what they did with the licensing changes but that's a different story

link
hsbauauvhabzb 742 days ago
How does that bypass 802.1x? Are the 802.1x packets are responded to by the official modem still? I was under the impression all packets were encrypted or signed with 802.1x, but Ive never had to implement or test it so I could be wrong.
link
toast0 742 days ago
802.1x is a secure login procedure, and then the port is open until link is dropped. There's no encryption or authentication per packet (it would be way too expensive), and if you put a switch between the ont and the modem, when you disconnect the modem, the ont doesn't see the link drop.

Managed switches or software ethernet bridges don't always propigate 802.1x packets, but unmanaged switches don't care.

link
throw0101c 742 days ago
> There's no encryption or authentication per packet (it would be way too expensive) […]

It is possible to tie together 802.1X and MACsec, and plenty of (Ethernet) chipsets can do MACsec at wire speed, even up to 400G and 800G:

* https://www.arista.com/assets/data/pdf/Datasheets/7800R3_MAC...

* https://www.juniper.net/us/en/solutions/400g-and-800g.html

I don't know the telco space well enough to know if there's a MACsec-equivalent for GPON, but given the 'only' 25G speeds involved I doubt it would be much of a challenge.

link