Router coercion with a complex network (private) - ideas (IP passthrough)

  • Hello everyone

    I’m just a little at a loss again (somehow Swisscom always manages it šŸ˜‰:

    I will be moving at the beginning of October and while reporting the move I came across that I would be forced to share my Centro Grando with the I.B. 2 or the I. B. standard. I deliberately kept the Centro Grande until now because of the IP passthrough option.

    I assume that I’m not the only person in this forum who has a relatively complex home network and uses certain services etc., which can simply be managed better with a ā€œproperlyā€ configurable, ā€œdecentā€ router behind the Swisscom router . Since I now discovered with horror that the I.B. 2 part IP passthrough (of course…), I’m now wondering how you solved this problem?

    Many greetings and thanks to all inputs šŸ™‚

    Cheers

    dbd

    Show original language (German)
    • Tux0ne likes that.
    • The other variant is with your own router behind the Internet box in a router cascade.

      If you want to adhere to a sensible security concept for access from the Internet directly to your home network, the effort involved in managing the double NAT limit is actually very reasonable.

      Even for access from outside, I only work with Open VPN on a VPN server in my own network. In addition to the security aspect, I also have to forward port 1194 UDP on the Internet box to my own network and the public IP is not forwarded by the Internet box Internetbox’s own DynDNS service can compensate.

      Since I had to give up my Netopia modem, which had been in use in bridge mode for 10 years, about 2 years ago, I have been forced to live with the inflexibility of the various Swisscom routers and the double NAT challenge.

      In the meantime, I can say: No matter how stubborn Swisscom is with its routers, there is always a solution in a router cascade, and personally I would never want to take over the modem function.

      In my opinion, one of the core competencies of an ISP is clearly the provision of an Internet connection on an Ethernet basis. Why do I want to bother with vectoring, G.Fast and various low-level technical details without comprehensive support - Swisscom can certainly do that better and I have already paid them to give me access to the Internet and its technical aspects further development is available.

      My personal interface is always about Ethernet accessibility, but then there are still enough challenges in the internal network, which is independent of Swisscom!

    The other variant is with your own router behind the Internet box in a router cascade.

    If you want to adhere to a sensible security concept for access from the Internet directly to your home network, the effort involved in managing the double NAT limit is actually very reasonable.

    Even for access from outside, I only work with Open VPN on a VPN server in my own network. In addition to the security aspect, I also have to forward port 1194 UDP on the Internet box to my own network and the public IP is not forwarded by the Internet box Internetbox’s own DynDNS service can compensate.

    Since I had to give up my Netopia modem, which had been in use in bridge mode for 10 years, about 2 years ago, I have been forced to live with the inflexibility of the various Swisscom routers and the double NAT challenge.

    In the meantime, I can say: No matter how stubborn Swisscom is with its routers, there is always a solution in a router cascade, and personally I would never want to take over the modem function.

    In my opinion, one of the core competencies of an ISP is clearly the provision of an Internet connection on an Ethernet basis. Why do I want to bother with vectoring, G.Fast and various low-level technical details without comprehensive support - Swisscom can certainly do that better and I have already paid them to give me access to the Internet and its technical aspects further development is available.

    My personal interface is always about Ethernet accessibility, but then there are still enough challenges in the internal network, which is independent of Swisscom!

    Show original language (German)

    Hobby-Nerd ohne wirtschaftliche AbhƤngigkeiten zur Swisscom

    Thank you very much for your detailed answer! Shoot me dead, but I haven’t even thought about a cascade yet
    The only consideration I have made is the free i.b. to choose standard and then test whether I can simply continue to operate the whole thing with the centro grande and the i.b. standard leave to sour directly in your box haha

    Show original language (German)

    I have another question: I have just read the specifications of the two available Internet boxes. Based on the differences (VPN, central storage function), I don’t know why I want the Internet Box 2 from the I.B. Standard should be preferred (since I use storage etc. via NAS, VPN and WLAN via my own router etc.). Experience has shown that there are disadvantages with the standard or reasons why one would still rather use the.i.b. should take 2?

    thanks in advance šŸ™‚

    Show original language (German)

    The only argument against cascading is the fact that you don’t have the public IP directly on the interface of your own hardware.

    Either way, IPv4 is no longer really interesting, which is why Wayne is interested.

    With IPv6, the Swisscom CPE cannot do DHCP6-PD. At least not yet. As far as I know, with a prefix of /60 only the 15 remaining /64s could be passed on anyway. At least I wouldn’t know what to do with a /64 prefix directly on the interface of my hardware…

    The CPE can also be viewed as an untrusted gateway between the LAN and the Internet.

    So that would speak against cascading. But that also makes it clear to me why this has the lowest priority. (Lack of understanding of the subject matter by those responsible…)

    Show original language (German)

    @deadbydawn

    When it comes to the question of IBS or IB2 as a pure access router, I think there are only minor differences.

    I’ve already done it myself with both models, and the only difference that was relevant for me personally was the VPN server of the IB2 in connection with landline telephony from outside with the cell phone via VPN using the flat rate of the landline connection.

    If you want to use the IB app on a cell phone to make calls from outside via VPN, you need the IB2, as you then need IB2’s own VPN server for telephony.

    If you use your own VPN server downstream of the IBS, you cannot do this with the IB app because it only works with the Swisscom VPN, but then you have to configure your own SIP client with the IBS’s internal SIP credentials It also works without Swisscom’s own VPN server.

    Otherwise, I would rather choose the IB2 because of its future security (G.Fast, bonding, etc.), but if you have little space (or if the device needs to be in a control cabinet or rack), the IBS is also a good choice.

    Show original language (German)

    Hobby-Nerd ohne wirtschaftliche AbhƤngigkeiten zur Swisscom


    @deadbydawn wrote:
    ….. based on experience, are there any disadvantages with the standard or reasons why you would still rather use the.i.b. Should take 2?….


    The IB2 can support g.fast out of the box, the IBstandard would have to be retrofitted with an SPF module.

    If that is relevant, in this case (as just a gateway) that would be the second reason (besides the above-mentioned bonding ability) to prefer the IB2 to the IBS…

    Show original language (German)

    ….keep on rockin' šŸ¤˜šŸ¼šŸ¤˜šŸ¼šŸ¤˜šŸ¼

    7 days later

    I got IB light last week. Unusable, no port forwarding possible.

    In my current Centro, I routed a lot of things directly to the Fritzbox behind it, which then distributes it to the respective devices and apps.

    Is this possible with IBS? Can you set forwarding there as you wish?

    Show original language (German)

    Yes that works. You can do NA(P)T as well as a NAT default mode which at ib is simply called DMZ ( 🤣 ). Without IP passthrough of a publicly available IPv4, of course.

    Show original language (German)

    Swisscom has lost its technical mind with the Internet boxes. The IB2 can’t even use one of the Ethernet ports as a WAN port. Every $100 VDSL router can do this. No, you need an SFP module to extend the fiber optic, which you of course have to pay for yourself. And a media converter for fiber optic connections. You also have to pay for it yourself. And needs space and electricity. According to Swisscom, this feature was ā€œforgottenā€. Although the SC knew full well that the IB2 no longer fit in the box and the fiber therefore had to be routed somewhere else. And the turret pseudo AirPort design is also ugly.

    SC tries every couple of weeks, but I won’t give up my Centro Grande as long as no G.fast or glass comes. It hangs in the basement, can IP passthrough, makes the telephone reliable, the TV box hangs directly on the CG, the rest behind a real router (or PFsense in my case) with forwarded public IP and several decent WLAN access points. The IB2’s WLAN is less bad than that of the earlier boxes, but still very modest compared to a Ubiquiti or similar. And the price of 200 is beyond belief.

    So be careful with a new box: they take away your public IP and switch you to CGNAT. But you have to find out for yourself. You lose IP passthrough. And with your own device, such as the Zyxel, you are left out in the cold for a few days in the event of connection problems, even if the problem is clearly on the SC side.

    And important: If your LAN is connected directly to SC Bƶxli, the SC will snoop around in your LAN. The box regularly scans all your devices on the LAN and transmits the data to Swisscom. Swisscom even reserves the right to sell this data. And thanks to TR-069, they can do whatever they want on your LAN anyway. You are in full control.

    Show original language (German)

    Yes, good, but how are things going with the center and telephone today?

    I tried to operate the phone on the Centro, but it no longer works.

    The Gui shows that my phone is connected to the Centro and also in the customer center, but when I pick up the receiver there is no sound and I can’t dial. When I call the number, the phone rings, but no connection is established.

    Show original language (German)

    This indicates that the PIN assignment on the phone does not match. A central tap from PIN 4.5 would be correct. Or that there is actually something not so clean about the in-house installation. E.g. Alarm clock bridge, you can either fix this or try the second telephone port on the router.

    Show original language (German)

    Telephone always worked before switching to AllIP.

    After I plugged in the IB light, the telephone on the Centro no longer worked.

    However, it works on the Fritz, there is an external SIP provider configured and you can use it from the Fritz as normal. Even if I connect the telephone socket on the Cebtro to the telephone input on the Fritz, nothing works.

    From the beginning on the telephone there are simply 4 wires normally connected to RJ11. This is the included cable.

    If it were somehow possible to operate the telephone on the Centro (I have the picollo) even after the AllIP conversion, I would of course be very happy, everything works fine as far as the Internet is concerned.

    So if there are any tricks to it, I’m open.

    Show original language (German)

    A little addendum from me: I’ve finally thought about the fact that I’ll have enough to do with moving/setting up since I’m moving from an apartment to a house. I have now told swisscom to keep the i.b.2. and I keep my centro grande with ip passthrough. šŸ˜‰ I’ll deal with such trivialities when I’m finished furnishing it šŸ˜‰ Luckily, the architect at least thought along back then and network-wired the entire house ^^

    Show original language (German)

    Good morning

    Since the firmware version 8.8.26 was only rolled out on the IB Plus and IB 2 models, but not on the IB Standard, with the justification that there were problems with the LAN ports, then I have to assume that the mainboards or . the chipsets differ?

    Does anyone know more?

    Greetings

    RAL9004

    PS:

    And yes: Swisscom gilds the BD with Admeira and, on the other hand, with its (third-party programmed) routers with an integrated support backdoor and a customer service whose employees are primarily hired under the cost factor, is critical.

    Show original language (German)