The amount of configuration information on T-Mobile Thuis fiber connections with EdgeRouter equiptment is a bit scarce. The configuration looks a lot like the KPN Fiber and Vodafone configuration, but is slightly different.
I have chosen to use a fiber to ethernet converter, the TP-Link MC220L. But I think that I will buy the new EdgeRouter 4 when it comes to the Netherlands. Which is roughly the EdgeRouter X with fiber port and the EdgeRouter Lite combined. But for now, this configuration is based on the EdgeRouter Lite 3.
T-Mobile and their VLAN’s
At first, we need to know that T-Mobile seperates the internet and IPTV connection using VLAN’s. VLAN300 is used for the internet traffic and VLAN640 is used for the IPTV traffic. T-Mobile seperates this traffic in their own router. We will have to do the same in our configuration. Later on, we will devide our connection using a bridge in to two seperate VLAN’s. These VLAN’s will be made available in the switches.
My set-up
My set-up is fairly basic. In the diagram below, I have drawn out my setup. Let me talk you through it; The fiber connection comes in at the fiber converter and is attached to the ETH0 interface of the EdgeRouter-Lite (ER-L). The LAN connection is on ETH1 and is connected to an managed ethernet switch. The ETH2 is (in my case) directly attached to the IPTV box.
The switch has (multiple) Ubiquiti UniFi access points attached, a few wired devices (laptop, Ikea Tradfri gateway, a computer) and a (trunk) connection to another managed switch in the living room for my Playstation, TV and HTPC.
The configuration of the EdgeRouter Lite
Below here is a copy of my configuration, with a few details cleared. These are port mappings, static IP assignments and passwords. What this configuration does is the following:
- Create ETH0 for the WAN connection, with DHCP enabled so it receives it’s (external) IP from T-Mobile
- Split ETH0 in to ETH0.300 for the VLAN300 and ETH0.640 for the VLAN640 traffic (internet and iptv)
- Creathe ETH1 with local IP adresses in the 192.168.0.0/24 range. ETH1 has VLAN300 attached for the internet traffic.
- Creathe ETH2 without an IP adres (T-Mobile will handle that itself) with VLAN640 attached for IPTV.
- Create a few default firewall rules to block harmful traffic.
- Allow NAT for VLAN300 for the internet traffic
- Enable an IGMP proxy for IPTV
These configurations can be done using the Config Tree in the console, from top to bottom.
Robin@vanbruggen:~$ show configuration | no-more
firewall {
all-ping enable
broadcast-ping disable
ipv6-receive-redirects disable
ipv6-src-route disable
ip-src-route disable
log-martians enable
name WAN_IN {
default-action drop
description "WAN to internal"
enable-default-log
rule 40 {
action accept
description "Allow established/related"
log enable
protocol all
state {
established enable
invalid disable
new disable
related enable
}
}
rule 50 {
action drop
description "Drop invalid state"
log enable
protocol all
state {
established disable
invalid enable
new disable
related disable
}
}
}
name WAN_LOCAL {
default-action drop
description "WAN to router"
enable-default-log
rule 30 {
action accept
description "Allow established/related"
log disable
protocol all
state {
established enable
invalid disable
new disable
related enable
}
}
rule 40 {
action drop
description "Drop invalid state"
log disable
protocol all
state {
established disable
invalid enable
new disable
related disable
}
}
}
receive-redirects disable
send-redirects enable
source-validation disable
syn-cookies enable
}
interfaces {
bridge br0 {
aging 300
bridged-conntrack disable
hello-time 2
max-age 20
multicast enable
priority 32768
promiscuous disable
stp false
}
ethernet eth0 {
address dhcp
bridge-group {
}
duplex auto
speed auto
vif 100 {
description MGT
mtu 1500
}
vif 300 {
address dhcp
description Internet
firewall {
in {
name WAN_IN
}
local {
name WAN_LOCAL
}
}
}
vif 640 {
bridge-group {
bridge br0
}
description IPTV
}
}
ethernet eth1 {
address 192.168.1.1/24
description Local
duplex auto
speed auto
}
ethernet eth2 {
bridge-group {
bridge br0
}
description IPTV
duplex auto
speed auto
vif 640 {
bridge-group {
bridge br0
}
description IPTV
}
}
loopback lo {
}
}
protocols {
igmp-proxy {
interface eth0 {
role disabled
threshold 1
}
interface eth0.300 {
role disabled
threshold 1
}
interface eth0.640 {
alt-subnet 0.0.0.0/0
role upstream
threshold 1
}
interface eth1 {
role disabled
threshold 1
}
interface eth2 {
alt-subnet 0.0.0.0/0
role downstream
threshold 1
}
}
}
service {
dhcp-server {
disabled false
hostfile-update disable
shared-network-name LAN1 {
authoritative enable
subnet 192.168.1.0/24 {
default-router 192.168.1.1
dns-server 8.8.8.8
dns-server 8.8.4.4
domain-name vanbruggen
lease 86400
start 192.168.1.100 {
stop 192.168.1.250
}
}
}
use-dnsmasq disable
}
dns {
forwarding {
cache-size 150
listen-on eth1
listen-on eth2
}
}
gui {
http-port 80
https-port 443
older-ciphers enable
}
inbound-interface eth0.300
inside-address {
address 192.168.1.200
port 32400
}
log disable
protocol tcp
type destination
}
rule 5010 {
description "masquerade for WAN"
log disable
outbound-interface eth0.300
protocol all
type masquerade
}
}
ssh {
port 22
protocol-version v2
}
unms {
disable
}
}
system {
host-name vanbruggen
login {
user Robin {
authentication {
encrypted-password ****************
}
level admin
}
}
ntp {
server 0.ubnt.pool.ntp.org {
}
server 1.ubnt.pool.ntp.org {
}
server 2.ubnt.pool.ntp.org {
}
server 3.ubnt.pool.ntp.org {
}
}
offload {
hwnat disable
ipv4 {
forwarding enable
pppoe enable
vlan enable
}
}
syslog {
file dhcpd {
archive {
files 5
size 5000
}
facility local2 {
level debug
}
}
global {
facility all {
level notice
}
facility protocols {
level debug
}
}
}
time-zone Europe/Amsterdam
}
A screenshot from the EdgeRouter Dashboard after the configuration:
Switch configuration
In order to correctly browse the internet using the wireless access point (which has a very basic default configuration, nothing special) and/or use the internet on any other wired device, you will have to assign each port to the correct VLAN. If you have extra switches behind the first switch, you will need to configure a trunked VLAN port and transmit both VLAN’s (300 and 640) on that port.
I have done the following in my switch, a TP-Link TL-SG1016DE. Which is a managed switch. Create VLAN300 and attach it to the correct ports where your (internet) devices are on. Do this in the ‘802.1Q VLAN’ configuration and the ‘802.1Q PVID setting’.
My ToDo list/problems left to fix
The only problem left to fix for me, is the ability to attach ETH2 for IPTV into the switch and watch TV. When I do this, the EPG/Guide is visible and working, audio is (sometimes) OK, but the screen freezes or stays black. Which looks like a problem related to the switch or maybe a multicast/igmp problem in combination with the switch i’m using.
I will get back on that! For now, everything is working fine. I have a 100/100mbit fiber connection and I receive around 120/120mbit, so I’m happy with that 😉