This topic

How to get SH2 working with Firewalla Purple SE and Draytek Vigor 160

bbc_owl — Tue, 19 Dec 2023 15:39:13 GMT

I've been researching around for a while and it looks like this should, in theory, be possible, but I'm not sure how at the moment.

I have a BT SmartHub 2 which has been working fine for a couple of years. I have now purchased a Firewalla Purple SE which I want to install in router mode, and then realising that only has RJ45 ports I then purchased a Draytek Vigor 160 ADSL modem/router.

I thought all I would need to do was move the RJ11 from the SH2 to the Draytek, put the Draytek in modem mode only (i.e. just bridge the packets) and then connect the Draytek to the WAN port on the SH2 and make sure FTTP mode was enabled on it (which it was already, I noted). This would be my first test, if I could get that working, I'd be reasonably confident that I'd be able to insert the firewall inbetween the two.

Sadly it doesn't work and I'm not sure why. There doesn't seem to be many config options on the SH2 (or the Draytek for that matter) and the logs don't seem to really help.

There are some other things I could try: I could try configuring the Draytek in router mode but then I'd need to tell the SH2 to use a default gateway wouldn't I? And I don't see how you do that on the SH2. It looks like the only thing I can configure is the IP address and subnet mask of the SH2 and the DHCP address range. If I put the SH2 behind a router, how do I get it to find the internet?

If anyone has any suggestions of how to get the kit listed in the subject line to play nicely together, I would very much appreciate your guidance! I'm half worried somebody's going to say I have everything I need but ditch the SH2 and replace it with my own access points, but then, will that affect the Digital Voice? Yes, I've heard DV can be a problem, so please don't tell me what I'm trying to do is impossible ...... I really need this Firewalla installed and working!

Re: How to get SH2 working with Firewalla Purple SE and Draytek Vigor 160

licquorice — Tue, 19 Dec 2023 15:52:35 GMT

First things first, if you want Digital Voice you need to connect the SH2 directly to line.

Have you set the Vlan id on the Draytek to 101?

No idea why you need an expensive firewall

Re: How to get SH2 working with Firewalla Purple SE and Draytek Vigor 160

bbc_owl — Tue, 19 Dec 2023 16:02:23 GMT

Yes, as per the Vigor config guide, I enabled 'Service VLAN' in the VDSL2 Setting for the WAN port to tag 101.

Why does DV need SSH2 connection to line? It's not VoIP or not routable or something?

Re: How to get SH2 working with Firewalla Purple SE and Draytek Vigor 160

licquorice — Tue, 19 Dec 2023 16:08:58 GMT

Must admit I haven't tried using a modem with VDSL for DV. Thinking about it, it shouldn't be any different to an FTTP connection.

I assume you have a standard VDSL connection and not a G.Fast connection

Re: How to get SH2 working with Firewalla Purple SE and Draytek Vigor 160

bbc_owl — Tue, 19 Dec 2023 16:10:50 GMT

Just standard VDSL here, nothing fancy.

Re: How to get SH2 working with Firewalla Purple SE and Draytek Vigor 160

licquorice — Tue, 19 Dec 2023 16:16:43 GMT

To eliminate a problem with the hub, try making a direct PPPoE connection with a laptop/ PC connected to the modem. If that works, the problem lies with the hub, if it doesn't, the problem lies with the modem.

Re: How to get SH2 working with Firewalla Purple SE and Draytek Vigor 160

bbc_owl — Tue, 19 Dec 2023 16:18:40 GMT

Yeah, I was planning to try that test. I should really do that next. I guess I wasn't clear on where this was going, because I can't see the config options I think I would need to put a router before the SH2. When FTTP mode is enabled, how exactly is the WAN port used on the SH2, in terms of IP packets and routing?

Re: How to get SH2 working with Firewalla Purple SE and Draytek Vigor 160

licquorice — Tue, 19 Dec 2023 16:22:50 GMT

You definitely can't put another router in-between the modem and hub if you want DV. That definitely won't work.

Port 4 just becomes a normal WAN port instead of a LAN port when in FTTP mode.

Re: How to get SH2 working with Firewalla Purple SE and Draytek Vigor 160

bbc_owl — Tue, 19 Dec 2023 16:46:43 GMT

Hmm, so how does DV work then? So I guess this article, https://www.draytek.co.uk/support/guides/kb-btfttc-openreachmodem, that covers a different Draytek (I have the Vigor167 but I don't see why I wouldn't be able to do a similar trick), was written before the SH2 and before DV and wouldn't work anymore?

Re: How to get SH2 working with Firewalla Purple SE and Draytek Vigor 160

licquorice — Tue, 19 Dec 2023 16:52:29 GMT

DV is a proprietary VoIP system that requires the use of the home hub providing the PPPoE session hence the hub has to be the PPPoE device.

Therefore it should work in conjunction with a third party modem but not a third party router providing the PPPoE session.

Your link gives me a 404 btw.

Re: How to get SH2 working with Firewalla Purple SE and Draytek Vigor 160

bbc_owl — Tue, 19 Dec 2023 16:59:46 GMT

Sorry, the link seemed to have a comma at the end, try this:

https://www.draytek.co.uk/support/guides/kb-btfttc-openreachmodem

Proprietary VoIP that can't be routed over a standard network router? Why would anybody do that?

Re: How to get SH2 working with Firewalla Purple SE and Draytek Vigor 160

licquorice — Tue, 19 Dec 2023 17:04:32 GMT

SIP can be easily spoofed, DV is secure as the source is authenticated by the SH2.

The article isn't relevant as it is about configuring a router rather than modem.

Re: How to get SH2 working with Firewalla Purple SE and Draytek Vigor 160

Keith_Beddoe — Tue, 19 Dec 2023 17:07:44 GMT

In fact its more secure than the analogue PSTN network, as nobody can intercept your line by plugging a phone across your line.

Re: How to get SH2 working with Firewalla Purple SE and Draytek Vigor 160

bbc_owl — Tue, 19 Dec 2023 17:25:44 GMT

So it sounds like there is simply no way to have use a firewall router at home if I'm using BT Digital Voice?

Re: How to get SH2 working with Firewalla Purple SE and Draytek Vigor 160

Keith_Beddoe — Tue, 19 Dec 2023 17:30:25 GMT

There is already an effective firewall in the SH2, look at the firewall logs.

What exactly do you hope to block, as incoming traffic to your LAN is blocked, unless you have opened up ports?

Re: How to get SH2 working with Firewalla Purple SE and Draytek Vigor 160

licquorice — Tue, 19 Dec 2023 17:45:56 GMT

You should still be able to use the firewall as long as it is transparent to DV. It is the PPPoE device that needs to be first in line.

As said previously, not sure why you need to spend a lot of money on a firewall, but it's your money to throw away.

Re: How to get SH2 working with Firewalla Purple SE and Draytek Vigor 160

bbc_owl — Tue, 19 Dec 2023 17:51:29 GMT

The Firewalla https://firewalla.com/products/firewalla-purple-se can run in bridging mode.

So do you think of I can get the Draytek to work as a modem in bridging mode, I could connect that to the Firewalla in bridging mode and then connect that to the SH2 WAN port with FTTP enabled?

But then I'm back to where I started this thread from, because I have tried connecting the RJ11 to the Draytek, configure in bridging mode and connected it to the SH2 WAN port and I get no Internet.

I guess next test is to connect my Windows PC to the Draytek and configure PPPoE in Windows to see if I get Internet access that way. Then at least I can prove it is an SH2 problem?

Re: How to get SH2 working with Firewalla Purple SE and Draytek Vigor 160

Keith_Beddoe — Tue, 19 Dec 2023 17:56:19 GMT

I am sure that authentication is more complex that that, otherwise someone would have already cracked it.

I would expect the BT network only authenticates against the SH2 if it sees a direct path (possibly a specific VLAN) back to the server. Similar to the way the public BT Wifi is established.

Anything in between, is going to break both of these.

Re: How to get SH2 working with Firewalla Purple SE and Draytek Vigor 160

licquorice — Tue, 19 Dec 2023 17:58:30 GMT

@bbc_owl Exactly, one step at a time

Re: How to get SH2 working with Firewalla Purple SE and Draytek Vigor 160

licquorice — Tue, 19 Dec 2023 18:15:40 GMT

@Keith_Beddoe this post on Kitz explains.

I've had a lot of spare time to continue this, and I have eventually made it work. My Asus router is now connected to the ONT and is acting as the router and the SH2 is connected to one of the LAN ports on the Asus router and is only used for Digital Voice phone and I am able to make phone calls. I worked out that the SH2 makes a call to https://linediscovery.hub.bt.com/ and passes the PPPoE Host-Uniq tag value and the PPPoE Session ID and it is returned the SIP details which it then uses to initiate the SIP connection for phone calls. The local and remote IP addresses and MAC addresses, and the AC Name are not important. The SH2 changes the Host-Uniq value every time it makes a new connection which makes it more difficult to get this to work. The Asus router is running a version of linux, the source code is freely available on the Asus web site, and it is possible to configure SSH access in order to run commands on the Asus router in order to reconfigure things. I downloaded a copy of the open source PPPoE server https://dianne.skoll.ca/projects/rp-pppoe/ I changed it so that on receipt of the PADI message, it extracts the Host-Uniq tag, and reconfigures the Asus router to use this value on it's external PPPoE connection, and then makes the Asus router re-establish the PPPoE session. Once it is re-established, it gets the PPPoE Session ID and uses that later in the PADS message sent back to the SH2 so that the SH2 will use that, along with the host-Uniq value, when making a call to https://linediscovery.hub.bt.com/ In order to change the Host-Uniq tag on the Asus router and cause it to reconnect the following commands can be run on the Asus router: nvram set wan0_pppoe_hostuniq=20EF000 nvram set rc_service="restart_wan_if 0" kill -SIGUSR1 1 In order to get the PPPoE session ID on the Asus router, the following command can be run: cat /proc/net/pppoe|cut -d" " -f1 A linux server (Raspberry Pi or other), needs to be running on the same LAN as the SH2. On this server, the changed RP-PPPOE needs to be installed and the file /etc/ppp/pppoe-server-options needs to contain the following (192.168.0.1 is the Asus LAN IP Address): noauth noproxyarp ms-dns 192.168.0.1 lcp-echo-interval 10 lcp-echo-failure 2 IP forwarding needs to be enabled on the linux server : echo 1 > /proc/sys/net/ipv4/ip_forward A NAT rule needs to be added on the linux server to NAT the data coming from the SH2 to the internet. I use a bridge interface br0, but for most servers it will be eth0 or similar: iptables -t nat -A POSTROUTING -s 192.168.1.0/24 -o br0 -j MASQUERADE The Asus router needs to be configured to forward UDP traffic on port 5050 to an additional IP address which will be assigned to the linux server. The linux server will have 2 IP addresses - it's main one and the one used for PPP. I assigned 192.168.0.11 for this purpose. A NAT rule needs to be added to the linux server to forward the voice data from the internet through the PPP connection to the SH2: iptables -t nat -A PREROUTING -d 192.168.0.11 -p udp --dport 5050 -j DNAT --to-destination 192.168.1.1:5050 The hacked PPPoE server needs to be run (the -o 1 is ignored in my hacked server and be replaced with the Session ID): pppoe-server -C acc-aln2.l-zzz -I br0 -L 192.168.0.11 -R 192.168.1.1 -o 1 -N 1 -k The SH2 will then think it's connected to the ONT and connect the Digital Voice even though it's running on the LAN. Report to moderator Logged j0hn Kitizen **** Posts: 4056 View Profile Personal Message (Offline) Re: A possible solution to BT Digital Voice « Reply #1 on: November 09, 2022, 02:41:23 PM » ReplyQuote That was posted about a year ago on Thinkbroadband You can do the same with Sky's digital voice. Unfortunately that also requires the Sky Hub just as the solution above requires the Smart Hub to still be connected. « Last Edit: November 09, 2022, 02:45:27 PM by j0hn » Report to moderator Logged Alex Atkin UK Addicted Kitizen ***** Posts: 5151 View Profile Thinkbroadband Quality Monitors Personal Message (Offline) Re: A possible solution to BT Digital Voice « Reply #2 on: November 10, 2022, 12:50:45 AM » ReplyQuote What a huge PITA. Report to moderator Logged tubaman Senior Kitizen ****** Posts: 12059 View Profile Personal Message (Offline) Re: A possible solution to BT Digital Voice « Reply #3 on: November 10, 2022, 07:43:04 AM » ReplyQuote I understand why BT want to have a simple plug and play solution for Digital Voice but why on earth have they done it in such a way that you can't use your own equipment if you so wish? I'd be happy to accept them asking me to plug in the Smart Hub if I wanted support in the same way I do with their Broadband service (admittedly somewhat grudgingly ::)). Edited to add - a quick Google found this - https://community.bt.com/t5/Home-phone-including-Digital/Digital-Voice-with-different-Router/td-p/2095493 - where this setup is given: "Smart Hub 2 > Netduma R1 > Asus AC68u as AP On the Smart hub disable, DHCP, Firewall, UPNP, Wifi and smart setup (everything disabled) - only connect the digital voice phone first. Connect the Netduma to the Ethernet Port1 of the Smart Hub, then to the WAN of the Netduma. Create a static IP on the WAN setup in the Netduma, i.e 192.168.1.1, Gateway 192.168.1.254 and both DNS as 192.168.1.254 and then add that static IP to the Smart Hub 2 (192.168.1.1) place this in DMZ and also add a port fowarding Rule 1:65535 (BOTH) TCP and UDP to the static IP of the Netduma (192.168.1.1). My Netduma then manages DHCP under 192.168.88.1 Save Turn everything off Turn on the Smart Hub 2 let it connect, check the phone is connected, the boot up the Netduma, this should then connect and allow internet access, you can then add a AP direct to the Netduma. Any 3rd Party router should work so long as you can create a static WAN ip on that router, and then add this to the smart hub 2. My setup has been like this for months and is working faultlessly." Without fully understanding what has been done here I'm not in a position to know whether it gets around the double NAT issue or not - perhaps more network savvy members could comment.