Hacker News Reader

Comment by Merad | Hacker News Reader

I wonder how much longer we'll even have the option to use our own equipment. Late last year I briefly tried AT&T fiber, and it was required to use their hybrid modem/router monstrosity. It didn't even have options to disable the router functionality, the best you could do was turn off its WiFi networks and disable its firewall. Even after setting all of my own passwords on it it was still possible to access settings through my AT&T account online, telling me that the thing is backdoored all to hell. TBH that thing was a big factor in me canceling the service after 5 days (also the service was mediocre and they tried to screw me on pricing).

View on HN

I had a ginormous AT&T router/modem (pace 5268ac) with a set of static ip addresses and a few times, AT&T just stopped routing traffic to it.

It had happened before and then magically fixed itself a few days later.

One time I had a week of outage with AT&T basically said the problem was on my side. They could ping the modem, and then punted. I had several truck rolls. The techs were really nice guys, but were basically cabling guys, better for finding a bad cable than debugging a packet loss. The problem for me was that my ipv4 static ip addresses would not receive traffic.

I was at wit's end after a week and I debugged the thing myself. By looking at EVERY bit of data on the router, I found mention of the blocked packets in the firewall log. I would clear all the logs, and found even with the firewall DISABLED, the firewall log would see and block incoming packets I was sending using my neighbor's comcast connection.

I called AT&T, but this time mentioning "firewall is completely off, but packets are blocked by the router and showing up in the log" was concrete enough for them to look up a (known) solution.

The fix was to disable the firewall, but to enable stealth mode. wtf?

To be clear, this was a firmware bug, and caused dozens of calls to AT&T, lots of heartache and finger pointing always in my direction.

I should also mention at the start of this fiasco, I checked the system log and noticed they pushed a firmware update to the modem at the time the problem started. Strangely after one call to the agent, that specific line disappeared out of the log file, but other log entries remained. hmmm.

What is old is new...

You used to not be able to own your phone - it was leased from AT&T. That was the only option until Ma Bell was broken up in the early 80s.

Fiber doesn’t use a “modem” so I’m a little curious what you’re talking about. As to “backdoors”—all fiber CPE has to have the capability to be managed from the provider side. A lit fiber is like an Ethernet cable plugged into the provider’s switch. Nobody would be crazy enough to not control both ends of that connnection. Even if you spend thousands of dollars a month for a business grade Metro Ethernet connection, the provider will install CPE that it can manage remotely, usually an L2 switch.

I think the issue is with the fact that it also forced you to use their router as it was built in, as I'm pretty sure all fiber providers require you use their hardware.

Good to have a service from a proper and somewhat local ISP. They set us up initially with a DASAN fiber->WiFi router completely administered on their end, but at some point I called them with the request to replace it with just a fiber->Ethernet bridge. They complied without a problem, replaced the box, and gave me the PPPoE credentials with a warning that past the bridge's Ethernet end, I'm on my own.

AT&T's fiber service comes with two pieces of hardware: the ONT and a "residential gateway" that, in addition to being a router, is a terminal for the VoIP service and also has some guts for facilitating their UVerse IPTV platform.

Officially you can't opt out of using the RG. This differs from, say, Verizon's FiOS, which allows customers to just plug their own router straight into the ONT if they don't want the phone company's router.

You can put the RG into a "passthrough" mode that gives a downstream client the public IP address, so a router thinks it's bridged, but under the hood the RG is still maintaining all the connections in its own NAT table.

You can't simply plug a router into the ONT and have it work off the bat, as the RG has necessary 802.1x certs burned into the firmware. What you can do is use the eap_proxy tool mentioned in this same thread. I ran it on an EdgeRouter, and it essentially MITM'd the 802.1x handshaking and delegated that to the AT&T-provided RG, then once the 802.1x was dealt with, the EdgeRouter could get an address via DHCP.

There's apparently nothing customer-specific about the 802.1x certs; there's a thread on DSLReports about people buying old AT&T RG's off eBay and rooting them to extract the certs to use on their own router.

At the end of the day AT&T still owns and manages the hardware at the customer's end of the fiber (at the ONT level), they just also enforce usage of the router plugged into it too.

Frontier FIOS keeps trying very hard to charge me a rental fee for a router. That I specifically declined at the initial installation, and do not have, and do not want. And periodically, that fee comes back, and I get to spend a while on the phone with Frontier until it goes away again. (They always give some kind of "hard-wired into our system" excuse.)

Anyone have similar experiences with Frontier to report? I'd be interested in collaborating on potential actions.

Same here. I've researched the issue far enough to know that others have contacted state authorities (I'm in California) and been told that since the up-front advertising for Frontier's service lists the rental fee and states it is mandatory even if you don't use their hardware, there's nothing illegal happening and nothing that can be done.

I think it's disgusting and if anyone does hear of something that can be done, I'm in.

You can bypass the AT&T RG:

https://github.com/jaysoffian/eap_proxy/

That said, I haven’t had any trouble with it as a router.

When I had at&t fiber, the residential gateway couldn't be convinced to let my he.net IPv6 tunnel through. I also shaved off a few tenths of milliseconds off my pings! (Not particularly useful, but it was consistent and measurable). I think it did one or two other things I didn't care for, but I can't remember what.

AT&T has roled out dual-stack in most places by now. But... I ended up disabling it on my home network because whenever I’d have a network issue it was just another thing I had to worry about debugging. I feel bad about it but I’m not switching to dual stack till there are sites I care about that are only IPv6 reachable. I feel shame admitting this publicly.

Oh, that was the other thing, the residential gateway wouldn't allow me to host anything on IPv6; so the natural solution is to use my he.net tunnel (it's nice that that also has a static IP), which wasn't possible either (until I started bypassing the gateway)

> I wonder how much longer we'll even have the option to use our own equipment.

Comcast already made it very nearly impossible to buy your own ATA for phone. I figured out how to do it. You had to go IN PERSON to a Best Buy with an Xfinity center (there was one about an hour away in my state). There you would pay and place your order. You would have to return in person to pick it up, then setup a provisioning appointment. As far as I could tell, aside from having an insider this was the only way they would allow you to provision your own device.

Oh yeah, and if it breaks you're out the cost.

They list a number of them on their website that you can buy.

https://mydeviceinfo.xfinity.com/

If you want 1Gbps and phone service, they support one device: Netgear CM1150V

If you're ~400Mbps, they support four more devices:

   ARRIS SBV3202
   Netgear C7100V
   Motorola MT7711
   ARRIS SVG248AC

Maybe they backed off the policy, it's been around 4-5 years since I last used them for business phone. Thanks for the info.

Apparently its due to ATT using custom authentication:

https://forums.att.com/t5/AT-T-Fiber-Equipment/List-of-Compa...

It’s not custom. It’s a standard 802.1x certificate.

Reply on news.ycombinator.com