Version 20250114
This document describe how-to configure DHCP clients for ISP Orange in France. This could be used to remove the Livebox and prefer your own router…
You must already have a working ONT/ONU registered on Orange fiber infrastructure. ONT/ONU are registering on Orange infrastructure with serial number.
For informations, Orange use serial_number and vendor_id to allow a ONT/ONU to register.
You could see this other article https://medium.com/@cyayon/configure-ont-leox-lxt-010h-d-for-orange-isp-4ef4b793ca7b.
To configure properly your ONU/ONT, check dedicated topics and forums…
[!INFO] Since December 2022, the following DHCP options are MANDATORY !
string2hex(FSVDSL_livebox.Internet.softathome.Livebox4) -> “46535644534c5f6c697665626f782e496e7465726e65742e736f66746174686f6d652e4c697665626f7834” user-class string = “2b” + string2hex() ; ipv6 string = “00” + “ipv4 string”
WARNING : take care of case (livebox vs Livebox)
[ipv4:77] : "FSVDSL_livebox.Internet.softathome.Livebox4" or "0x2b46535644534c5f6c697665626f782e496e7465726e65742e736f66746174686f6d652e4c697665626f7834"
[ipv6:15] : "002b46535644534c5f6c697665626f782e496e7465726e65742e736f66746174686f6d652e4c697665626f7834"
[ipv4:77] : "FSVDSL_livebox.Internet.softathome.Livebox5" or "0x2b46535644534c5f6c697665626f782e496e7465726e65742e736f66746174686f6d652e4c697665626f7835"
[ipv6:15] : "002b46535644534c5f6c697665626f782e496e7465726e65742e736f66746174686f6d652e4c697665626f7835"
[ipv4:77] : "FSVDSL_livebox.Internet.softathome.Livebox6" or "0x2b46535644534c5f6c697665626f782e496e7465726e65742e736f66746174686f6d652e4c697665626f7836"
[ipv6:15] : "002b46535644534c5f6c697665626f782e496e7465726e65742e736f66746174686f6d652e4c697665626f7836"
WARNING : if dhcp client use raw or not, final (and true) string to have in tcpdump sniff should be (for LB6) :
[ipv4:77] : "4d2c2b46535644534c5f6c697665626f782e496e7465726e65742e736f66746174686f6d652e4c697665626f7836"
[ipv6:15] : "000f002d002b46535644534c5f6c697665626f782e496e7465726e65742e736f66746174686f6d652e4c697665626f7836"
echo "aa:bb:cc:dd:ee" | sed 's/^/\\\x/ ; s/:/\\\x/g'systemd-network sample config :
[DHCPv4]
ClientIdentifier=mac
VendorClassIdentifier=sagem
UserClass=FSVDSL_livebox.Internet.softathome.Livebox6
SendOption=90:string:\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1A\x09\x00\x00\x05\x58\x01\x03\x41\x01\x0D\x66\x74\x69...
[DHCPv6]
DUIDType=link-layer
# Bring Your Own Router Orange ISP
UserClass=FSVDSL_livebox.Internet.softathome.Livebox6
#UserClass=\x00\x2b\x46\x53\x56\x44\x53\x4c\x5f\x6c\x69\x76\x65\x62\x6f\x78\x2e\x49\x6e\x74\x65\x72\x6e\x65\x74\x2e\x73\x6f\x66\x74\x61\x74\x68\x6f\x6d\x65\x2e\x4c\x69\x76\x65\x62\x6f\x78\x36
#SendOption=15:string:\x00\x2b\x46\x53\x56\x44\x53\x4c\x5f\x6c\x69\x76\x65\x62\x6f\x78\x2e\x49\x6e\x74\x65\x72\x6e\x65\x74\x2e\x73\x6f\x66\x74\x61\x74\x68\x6f\x6d\x65\x2e\x4c\x69\x76\x65\x62\x6f\x78\x36
SendOption=11:string:\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1A\x09\x00\x00\x05\x58\x01\x03\x41\x01\x0D\x66\x74\x69...
SendOption=16:string:\x00\x00\x04\x0e\x00\x05\x73\x61\x67\x65\x6d
The DHCPv6 ORO (Option Request Option, code 6), the following options are required : Option: Option Request (6) - Length: 8 - Value: 000b001100170018 Requested Option code: Authentication (11) Requested Option code: Vendor-specific Information (17) Requested Option code: DNS recursive name server (23) Requested Option code: Domain Search List (24)
But, for the RFC8415 (https://datatracker.ietf.org/doc/html/rfc8415#section-21.7), option 11 (Authentication) is forbidden. For Orange, it is NOT mandatory to include option 11 in SOLLICIT/REQUEST requests. You can only keep options 17,23,24.
note : You could also use https://jsfiddle.net/kgersen/3mnsc6wy/
shell script to generate authentication string :
#!/bin/bash
# You could also use https://jsfiddle.net/kgersen/3mnsc6wy/
# Version 20221214
[ -z "$2" ] && echo "usage : $0 '<fti/login>' '<passwd>'" && exit 1
login="$1" ; pass="$2"
tohex() {
for h in $(echo $1 | sed "s/\(.\)/\1 /g"); do printf %02x \'$h; done
}
addsep() {
echo $(echo $1 | sed "s/\(.\)\(.\)/:\1\2/g")
}
r=$(dd if=/dev/urandom bs=1k count=1 2>&1 | md5sum | cut -c1-16)
id=${r:0:1}
h=3C12$(tohex ${r})0313$(tohex ${id})$(echo -n ${id}${pass}${r} | md5sum | cut -c1-32)
str=$(addsep $(tohex ${login})${h})
echo "# dhclient"
echo "## ipv4"
echo "send rfc3118-authentication 00:00:00:00:00:00:00:00:00:00:00:1A:09:00:00:05:58:01:03:41:01:0D${str};"
echo "## ipv6"
echo "send dhcp6.auth 00:00:00:00:00:00:00:00:00:00:00:1A:09:00:00:05:58:01:03:41:01:0D${str};"
echo
echo "# systemd-networkd"
echo "## [DHCPv4]"
str2=`echo "00:00:00:00:00:00:00:00:00:00:00:1A:09:00:00:05:58:01:03:41:01:0D${str}" | sed 's/^/\\\x/ ; s/:/\\\x/g'`
echo "SendOption=90:string:${str2}"
echo "## [DHCPv6]"
echo "SendOption=11:string:${str2}"
echo
echo "# mikrotik routeros"
echo "## DHCPv4"
echo "/ip dhcp-client option"
str2=`echo "00:00:00:00:00:00:00:00:00:00:00:1A:09:00:00:05:58:01:03:41:01:0D${str}" | sed 's/://g'`
echo "add code=90 name=authsend value=0x${str2}"
echo "## DHCPv6"
echo "/ipv6 dhcp-client option"
echo "add code=11 name=authsend value=0x${str2}"
**DHCP packets MUST be flagged COS/PCP 6 and DSCP 6 (48 dec) class-of-service ** However, DSCP is not mandatory but recommended.
DHCPv4 clients use RAW SOCKETS for DISCOVER/REQUEST (init) requests and BSD/UDP SOCKETS for RENEW requests. In consequence, you CANNOT use netfilter mangle rules to change COS/PCP and DSCP. You MUST use L2 filtering. IMPORTANT NOTICE : Since kernel 5.7, the netfilter netdev egress filter could match DHCP packets. See below netfilter nftables egress filter, it could be fun to try without tc script…
On Linux L2 filtering can be done with tc (traffic-control) tool. On Mikrotik router there switch rules or bridge filters.
#!/bin/sh
iface="orange1"
tc_qos="0:6"
vlan="832"
physiface="wan1"
mac_addr="<livebox_mac>"
ip link add link $physiface name $iface type vlan id $vlan
ip link set dev $iface address $mac_addr
ip link set $iface up
tc qdisc del dev $iface root ; tc filter del dev $iface
tc qdisc replace dev $iface root handle 1: prio
tc filter add dev $iface parent 1: prio 1 u32 match ip protocol 17 ff match ip dport 67 ffff action skbedit priority $tc_qos # dhcpv4
tc filter add dev $iface parent 1: prio 2 protocol ipv6 u32 match ip6 protocol 17 ff match ip6 dport 547 ffff action skbedit priority $tc_qos # dhcpv6
# the following is not mandatory, but recommended
tc filter add dev $iface parent 1: prio 3 protocol 0x806 u32 match u32 0 0 action skbedit priority $tc_cos # arp
tc filter add dev $iface parent 1: prio 4 protocol ipv6 u32 match ip6 dst fe00::/7 match ip6 protocol 58 ff action skbedit priority $tc_cos # icmpv6_dst (fe00::/7 = fe80::/10 + ff02::/16)
# for information
#tc filter add dev $iface parent 1: prio 4 protocol ipv6 u32 match ip6 protocol 58 ff action skbedit priority $tc_cos # icmpv6
#tc filter add dev $iface parent 1: prio 5 protocol ip u32 match ip protocol 1 ff action skbedit priority $tc_cos # icmpv4 - SHOULD NOT BE USED !
This step is optional.
https://lafibre.info/remplacer-livebox/durcissement-du-controle-de-loption-9011-et-de-la-conformite-protocolaire/324/ This version of tc script change COS and DSCP to 6, it should work but it has NOT been tested and work in progress. note: DSCP CS6 = 48 (dec) = 0xc0 (TOS-hex)
script based on tc :
#!/bin/sh
iface="orange1"
tc_cos="0:6"
tc_tos="0xc0"
tc_retain="0xfc"
vlan="832"
physiface="wan1"
mac_addr="<livebox_mac>"
ip link add link $physiface name $iface type vlan id $vlan
ip link set dev $iface address $mac_addr
ip link set $iface up
tc qdisc del dev $iface root ; tc filter del dev $iface
tc qdisc replace dev $iface root handle 1: prio
tc filter add dev $iface parent 1: prio 1 protocol ip u32 match ip ihl 5 0xf match u16 0x0000 0x1fff at 6 match ip protocol 17 0xff match ip sport 68 0xffff match ip dport 67 0xffff action skbedit priority $tc_cos pipe action pedit pedit munge ip tos set $tc_tos retain $tc_retain pipe action csum ip4h # dhcpv4_DSCP
tc filter add dev $iface parent 1: prio 2 protocol ipv6 u32 match ip6 protocol 17 0xff match ip6 sport 546 0xffff match ip6 dport 547 0xffff action skbedit priority $tc_cos pipe action pedit pedit munge ip6 tos set $tc_tos retain $tc_retain # dhcpv6_DSCP
# the following is not mandatory, but recommended
tc filter add dev $iface parent 1: prio 3 protocol arp u32 match u8 0 0 action skbedit priority $tc_cos # arp
tc filter add dev $iface parent 1: prio 4 protocol ipv6 u32 match ip6 dst fe00::/7 match ip6 protocol 58 0xff action skbedit priority 0:6 pipe action pedit ex munge ip6 traffic_class set $tc_tos retain $tc_retain # icmpv6_dst_DSCP (fe00::/7 = fe80::/10 + ff02::/16)
# for information - no dscp
#tc filter add dev $iface parent 1: prio 3 protocol ipv6 u32 match ip6 protocol 17 0xff match ip6 sport 546 0xffff match ip6 dport 547 0xffff action skbedit priority $tc_cos # dhcpv6
#tc filter add dev $iface parent 1: prio 4 protocol ipv6 u32 match ip6 dst fe00::/7 match ip6 protocol 58 0xff action skbedit priority $tc_cos # icmpv6 dst (fe00::/7 = fe80::/10 + ff02::/16)
https://lafibre.info/remplacer-livebox/durcissement-du-controle-de-loption-9011-et-de-la-conformite-protocolaire/324/ The following change DSCP and COS for ipv6 NS/NA/RS packets. From systemd v253, new options exist to modify COS and DSCP to 6 on dhcpv4 (https://github.com/systemd/systemd/pull/25904). But, you always have to modify COS(PCP) and DSCP for dhcpv6 (and icmpv6). Todo this use the previous nftables rules.
iface = orange1.832
table inet firewall {
chain prio_orange {
meta nfproto ipv4
meta priority set 0:0
ip dscp set cs0
meta nfproto ipv6
meta priority set 0:0
ip6 dscp set cs0
ip6 daddr { fe80::/10, ff02::/16 }
icmpv6 type {
nd-router-solicit,
nd-neighbor-solicit,
nd-neighbor-advert
}
meta priority set 0:6
ip6 dscp set cs6
ip6 daddr { fe80::/10, ff02::/16 }
udp sport 546
udp dport 547
meta priority set 0:6
ip6 dscp set cs6
}
chain mangle_postrouting {
type filter hook postrouting priority mangle
policy accept
oifname $iface rt ipsec missing jump prio_orange
}
}
# ipv4 (for renew)
table ip mangle {
chain prio_orange {
udp sport 68 udp dport 67 meta priority set 0:6 ip dscp set cs6 untrack counter comment "mangle-prio_orange_DHCP"
#udp sport 68 udp dport 67 meta priority set 0:6 ip dscp set cs6 counter comment "mangle-prio_orange_DHCP"
}
chain POSTROUTING {
type filter hook postrouting priority mangle; policy accept;
oifname $iface counter jump prio_orange comment "mangle-postrouting_orange"
}
}
# ipv6
table ip6 mangle {
chain prio_orange {
icmpv6 type { nd-router-solicit, nd-neighbor-solicit, nd-neighbor-advert } meta priority set 0:6 ip6 dscp set cs6 untrack counter comment "mangle6-prio_orange_ICMP"
#icmpv6 type { nd-router-solicit, nd-neighbor-solicit, nd-neighbor-advert } meta priority set 0:6 ip6 dscp set cs6 counter comment "mangle6-prio_orange_ICMP"
udp sport 546 udp dport 547 meta priority set 0:6 ip6 dscp set cs6 untrack counter comment "mangle6-prio_orange_DHCP"
#udp sport 546 udp dport 547 meta priority set 0:6 ip6 dscp set cs6 counter comment "mangle6-prio_orange_DHCP"
}
chain POSTROUTING {
type filter hook postrouting priority mangle; policy accept;
oifname $iface ip6 daddr { fe80::/10, ff02::/16 } counter jump prio_orange comment "mangle6-postrouting_orange"
}
}
Before kernel 6.x, nftables was NOT able to modify ipv4 DHCP packets, because they are using RAW sockets.
Since recent kernels, a new method exist with netdev egress filter : Filtrer les raw socket avec nftables ? with netdev egress rules, netfilter mangle rules or traffic-control (tc script) are NO MORE NECESSARY
note: check the alternative for ICMPv6 (type or daddr)
# orange dhcp client requests (ipv4/ipv6)
# since recent kernel (6.x) with netdev egress filter (mangle rules or tc are NO MORE NECESSARY)
# note : not really tested, need to tryout (tc script could NOT be required anymore)...
# WARNING : these rules need to be loaded BEFORE dhcp client requests !
table netdev filter {
chain egress {
type filter hook egress devices = $iface_wan priority filter; policy accept;
icmpv6 type { nd-router-solicit, nd-neighbor-solicit, nd-neighbor-advert } meta priority set 0:6 ip6 dscp set cs6 counter comment "egress_prio_orange_ICMP6"
#icmpv6 daddr { fe00::/7 } meta priority set 0:6 ip6 dscp set cs6 counter comment "egress_prio_orange_ICMP6"
udp dport 547 meta priority set 0:6 ip6 dscp set cs6 counter comment "egress_prio_orange_DHCP6"
udp dport 67 meta priority set 0:6 ip dscp set cs6 counter comment "egress_prio_orange_DHCP4"
ether type arp meta priority set 0:6 counter comment "egress_prio_orange_ARP"
}
}
You MUST modify COS/DSCP before the very FIRST DHCP request. To do this, it is necessary to execute a script just AFTER the creation of the VLAN (832) interface (in our case, orange1). To inject nftables netdev/egress nftables rules on interface creation process, we could use the following systemd service unit.
/etc/systemd/system/netdev-egress@.service (not FULLY tested, prefer other alternative below) :
[Unit]
Description=netdev-egress pre-requisite for %i
After=network.target network-online.target
Wants=network-online.target
[Service]
Type=oneshot
ExecStartPre=/usr/lib/systemd/systemd-networkd-wait-online --interface=%i --operational-state=off --timeout=8
ExecStart=/etc/systemd/scripts/netdev-egress %i
RemainAfterExit=yes
TimeoutSec=10
A BETTER tested version (should be running just after interface link UP and before dhcp client requests):
[Unit]
Description=netdev-egress pre-requisite for %i
BindTo=sys-subsystem-net-devices-%i.device
After=sys-subsystem-net-devices-%i.device
[Service]
Type=oneshot
ExecStart=/etc/systemd/scripts/netdev-egress %i
RemainAfterExit=true
TimeoutSec=10
[Install]
WantedBy=sys-subsystem-net-devices-%i.device
/etc/systemd/scripts/netdev-egress (change iface=orange1 as required) :
#!/bin/sh
# apply netdev/egress priority for orange dhcp client requests
# Version 20240717
SleepRetry=3
# set orange interface
if [ -z "$1" ] ; then
iface="orange1"
else
iface="$1"
fi
echo "executing nft chain netdev filter egress device $iface"
ip link show dev $iface
if [ $? -ne 0 ] ; then
echo "ERROR : interface $iface not exist, retrying in ${SleepRetry}s..."
sleep $SleepRetry
ip link show dev $iface ; [ $? -ne 0 ] && echo "ERROR : interface $iface definitely not exist !" && exit 9
fi
echo "executing nft chain netdev filter egress device $iface"
echo ; echo "existing table netdev filter"
nft list table netdev filter
echo ; echo "applying nft chain netdev filter egress $iface"
nft add "table netdev filter"
nft add "chain netdev filter egress { type filter hook egress devices = { ${iface} } priority 0; }"
nft insert "rule netdev filter egress udp dport 67 meta priority set 0:6 ip dscp set cs6 counter comment \"egress_prio_${iface}_DHCP4\""
nft insert "rule netdev filter egress ether type arp meta priority set 0:6 counter comment \"egress_prio_${iface}_ARP\""
nft insert "rule netdev filter egress udp dport 547 meta priority set 0:6 ip6 dscp set cs6 counter comment \"egress_prio_${iface}_DHCP6\""
nft insert "rule netdev filter egress icmpv6 type { nd-router-solicit, nd-neighbor-solicit, nd-neighbor-advert } meta priority set 0:6 ip6 dscp set cs6 counter comment \"egress_prio_${iface}_ICMP6\""
#nft insert "rule netdev filter egress icmpv6 daddr { fe00::/7 } meta priority set 0:6 ip6 dscp set cs6 counter comment \"egress_prio_${iface}_ICMP6\""
echo ; echo "final nft table netdev filter"
nft list table netdev filter
echo ; echo "networkctl renew $iface"
networkctl renew $iface
echo ; echo "networkctl status $iface"
networkctl -s status $iface
Finally, enable service unit : systemctl enable netdev-egress@<vlan832-interface> and show logs journalctl -xeu netdev-egress@vlan832 :
[...]
systemd-networkd[1071]: orange1: Gained IPv6LL
[...]
systemd-networkd[1071]: orange1: DHCP: received delegated prefix xxxx::/56
[...]
systemd-networkd[1071]: orange1: DHCPv4 address xxxx/24, gateway xxxx.1 acquired from yy.yy.yy.yy.yy
DHCPv4 clients use RAW SOCKETS for DISCOVER/REQUEST (init) requests and BSD/UDP SOCKETS for RENEW requests. In consequence, you CANNOT use netfilter mangle rules to change PCP and DSCP. You MUST use L2 rules (switch rules or bridge filters).
Moreover, Mikrotik limit its switch rules to INGRESS, switch rules cannot be used for EGRESS. In other terms, to change COS/PCP and DSCP on DHCPv4 requests you must use a different device (switch/router) in front of your main router.
To bypass this limitation, you can use bridge filters (instead of switch rules), BUT it is not recommended in performance point view because the CPU will be in charge of these filters.
If you want to use switch rules : ISP Fiber — Switch (switch rules) — Router (DHCP clients) If you want to use bridge filters : ISP Fiber — Router (DHCP clients + bridge filters)
note : fe00::/7 == fe80::/10 + ff02::/16
/interface ethernet switch rule
add comment="orange1 dhcp4 COS6" dst-port=67 mac-protocol=ip new-vlan-priority=6 ports=sfp1.router protocol=udp switch=switch1 vlan-id=832
add comment="orange1 dhcp6 COS6" dst-port=547 mac-protocol=ipv6 new-vlan-priority=6 ports=sfp1.router protocol=udp switch=switch1 vlan-id=832
add comment="orange1 icmp6 COS6" dst-address6=fe00::/7 mac-protocol=ipv6 new-vlan-priority=6 ports=sfp1.router protocol=icmp switch=switch1 vlan-id=832
add comment="orange1 arp COS6" mac-protocol=arp new-vlan-priority=6 ports=sfp1.router switch=switch1 vlan-id=832
/interface ethernet switch set 0 qos-hw-offloading=yes
/interface ethernet switch qos profile add comment="orange PCP6 DSCP48_CS6" dscp=48 name=orange-prio-bng pcp=6 traffic-class=6
/interface ethernet switch qos port
set sfp-sfpplus4 tx-manager=offline
set sfp1 tx-manager=offline
set sfp2 tx-manager=offline
set sfp3 tx-manager=offline
set sfp4 tx-manager=offline
set sfp5 tx-manager=offline
/interface ethernet switch l3hw-settings set icmp-reply-on-error=no
/interface ethernet switch rule
add comment="orange1 arp QOS" mac-protocol=arp new-qos-profile=orange-prio-bng ports=sfpplus1.router switch=switch1 vlan-id=832
add comment="orange1 dhcp4 QOS" dst-port=67 src-port=68 mac-protocol=ip new-qos-profile=orange-prio-bng ports=sfpplus1.router protocol=udp switch=switch1 vlan-id=832
add comment="orange1 dhcp6 QOS" dst-port=547 src-port=546 mac-protocol=ipv6 new-qos-profile=orange-prio-bng ports=sfpplus1.router protocol=udp switch=switch1 vlan-id=832
add comment="orange1 icmp6 QOS" dst-address6=fe00::/7 mac-protocol=ipv6 new-qos-profile=orange-prio-bng ports=sfpplus1.router protocol=icmpv6 switch=switch1 vlan-id=832
trust-l2and trust-l3are not defined (ignore by default), the switch will reset packets to prio 0 (and dhcp clients will not be able to authenticate to Orange).
https://lafibre.info/remplacer-livebox/news-mikrotik-7-16-breaking-changes-qos-trust-l2l3/interface ethernet switch qos port print
/interface ethernet switch qos port
set sfp1.router trust-l2=keep trust-l3=keep
set sfp2.orange1-ont trust-l2=keep trust-l3=keep
set sfp3.orange1-onu trust-l2=keep trust-l3=keep
If you have TV, add also these rules :
/interface ethernet switch qos profile add name=orange-prio-tv pcp=5 traffic-class=5
/interface ethernet switch rule add comment="orange TV PCP5" mac-protocol=ip new-qos-profile=orange-prio-tv ports=sfp1.router switch=switch1 vlan-id=840
/interface bridge filter
add action=set-priority chain=output comment="orange1 dhcp4 COS6" disabled=yes dst-port=67 ip-protocol=udp log=yes log-prefix="orange1 COS6_DHCP4" mac-protocol=ip new-priority=6 out-interface=bridge-wan1 passthrough=yes
add action=set-priority chain=output comment="orange1 dhcp6 COS6" disabled=yes dst-port=547 ip-protocol=udp log=yes log-prefix="orange1 COS6_DHCP6" mac-protocol=ipv6 new-priority=6 out-interface=bridge-wan1 passthrough=yes
add action=set-priority chain=output comment="orange1 icmp6 COS6" disabled=yes ip-protocol=icmpv6 log-prefix="orange1 COS6_ICMP6" mac-protocol=ipv6 new-priority=6 out-interface=bridge-wan1 passthrough=yes
add action=set-priority chain=output comment="orange1 arp COS6" disabled=yes log=yes log-prefix="orange1 COS6_ARP" mac-protocol=arp new-priority=6 out-interface=bridge-wan1 passthrough=yes
/ipv6 firewall mangle
add action=set-priority chain=output comment="orange1 icmp6 133RS COS6" dst-address=ff00::/8 icmp-options=133:0-255 new-priority=6 out-interface=bridge-wan1 passthrough=yes protocol=icmpv6
add action=set-priority chain=output comment="orange1 icmp6 136NA COS6" dst-address=fe80::ba0:bab/128 icmp-options=136:0-255 new-priority=6 out-interface=bridge-wan1 passthrough=yes protocol=icmpv6
add action=set-priority chain=output comment="orange1 icmp6 135NS COS6" dst-address=fe80::ba0:bab/128 icmp-options=135:0-255 new-priority=6 out-interface=bridge-wan1 passthrough=yes protocol=icmpv6
add action=set-priority chain=output comment="orange1 dhcp6 COS6" dst-port=547 new-priority=6 out-interface=bridge-wan1 passthrough=yes protocol=udp src-port=546
This step is optional and obsoleted with last ROS (7.15-16) capabilities - see previous chapter.
This is optional in 2023, and not really required (DSCP 48 match with 6 on layer 2). Since ROS 7.15, it is possible to modify DSCP directly with Switch rules (see above). note : if it do not work with new-dscp=48, try new-dscp=6
/ipv6 firewall mangle
add action=change-dscp chain=output comment="orange1 icmp6 133RS DSCP6" dst-address=ff00::/8 icmp-options=133:0-255 new-dscp=48 out-interface=bridge-wan1 passthrough=yes protocol=icmpv6
add action=change-dscp chain=output comment="orange1 icmp6 136NA DSCP6" dst-address=fe80::ba0:bab/128 icmp-options=136:0-255 new-dscp=48 out-interface=bridge-wan1 passthrough=yes protocol=icmpv6
add action=change-dscp chain=output comment="orange1 icmp6 135NS DSCP6" dst-address=fe80::ba0:bab/128 icmp-options=135:0-255 new-dscp=48 out-interface=bridge-wan1 passthrough=yes protocol=icmpv6
add action=change-dscp chain=output comment="orange1 dhcp6 DSCP6" dst-port=547 new-dscp=48 out-interface=bridge-wan1 passthrough=yes protocol=udp src-port=546
/ip firewall mangle
add action=change-dscp chain=postrouting comment="dhcp4 DSCP6" dst-port=67 new-dscp=48 out-interface=bridge-wan1 passthrough=yes protocol=udp src-port=68
/ipv6 firewall mangle
add action=jump chain=postrouting comment="jump prio_orange_icmp6" dst-address=fe00::/7 jump-target=prio_orange_icmp6 out-interface=bridge-wan1 protocol=icmp6
add action=jump chain=postrouting comment="jump prio_orange_dhcp6" dst-address=ff00::/8 dst-port=547 jump-target=prio_orange_dhcp6 out-interface=bridge-wan1 protocol=udp src-port=546
# you could also change DSCP6(48) for all COS6 packets (and remove all change-dscp rules in prio_orange_* chains)
#add action=change-dscp chain=postrouting comment="DSCP6 for all COS6" new-dscp=48 out-interface=bridge-wan1 passthrough=no priority=6
/ipv6 firewall mangle
add action=set-priority chain=prio_orange_icmp6 comment="icmp6 136NA COS6" dst-address=fe80::ba0:bab/128 icmp-options=136:0-255 new-priority=6 passthrough=yes protocol=icmp6
add action=change-dscp chain=prio_orange_icmp6 comment="icmp6 136NA DSCP6" dst-address=fe80::ba0:bab/128 icmp-options=136:0-255 new-dscp=48 passthrough=yes protocol=icmp6
add action=set-priority chain=prio_orange_icmp6 comment="icmp6 135NS COS6" dst-address=fe80::ba0:bab/128 icmp-options=135:0-255 new-priority=6 passthrough=yes protocol=icmp6
add action=change-dscp chain=prio_orange_icmp6 comment="icmp6 135NS DSCP6" dst-address=fe80::ba0:bab/128 icmp-options=135:0-255 new-dscp=48 passthrough=yes protocol=icmp6
add action=set-priority chain=prio_orange_icmp6 comment="icmp6 133RS COS6" dst-address=ff00::/8 icmp-options=133:0-255 new-priority=6 passthrough=yes protocol=icmp6
add action=change-dscp chain=prio_orange_icmp6 comment="icmp6 133RS DSCP6" dst-address=ff00::/8 icmp-options=133:0-255 new-dscp=48 passthrough=yes protocol=icmp6
add action=accept chain=prio_orange_icmp6 comment="ACCEPT"
/ipv6 firewall mangle
add action=set-priority chain=prio_orange_dhcp6 comment="dhcp6 COS6" new-priority=6 passthrough=yes
add action=change-dscp chain=prio_orange_dhcp6 comment="dhcp6 DSCP6" new-dscp=48 passthrough=yes
add action=accept chain=prio_orange_dhcp6 comment="ACCEPT"
note : to check interface status, use networkctl -s status <iface>
[Match]
Name=wan1
[Network]
ConfigureWithoutCarrier=true
Address=192.168.2.254/24
Description=WAN1 Orange1
VLAN=orange1
IPv6AcceptRA=no
[DHCP]
UseDNS=false
[NetDev]
Name=orange1
Kind=vlan
MACAddress=<livebox_macaddr>
[VLAN]
Id=832
EgressQOSMaps=6-6 # systemd v253 only
[Match]
Name=orange1
[Network]
Description=Orange1
LinkLocalAddressing=ipv6
DHCP=yes
IPForward=yes
IPv6AcceptRA=yes
DHCPPrefixDelegation=yes
#Address=<orange1_ipext>
Address=<orange1_ip6prefix_2>::254/64
[DHCPv4]
ClientIdentifier=mac
VendorClassIdentifier=sagem
UserClass=FSVDSL_livebox.Internet.softathome.Livebox6
SendOption=90:string:<authentication_string>
UseHostname=no
UseDNS=no
UseDomains=no
UseNTP=no
#UseAddress=no
SendHostname=no
RouteMetric=0
IPServiceType=CS6 # already default
SocketPriority=6 # systemd v253 only
[DHCPv6]
# prefer DUIDType=link-layer (mac_addr of interface MUST be equal to livebox_macaddr>) ; try DUIDRawData=00:03:00:01:<livebox_macaddr> (should work) or DUIDRawData=00:03:00::<livebox_macaddr> (should not work) ; reset ONT could be required
#DUIDRawData=00:03:00:01:<livebox_macaddr>
DUIDType=link-layer
# UserClass and SendOption=15:string: are equivalent
UserClass=FSVDSL_livebox.Internet.softathome.Livebox6
#UserClass=\x00\x2b\x46\x53\x56\x44\x53\x4c\x5f\x6c\x69\x76\x65\x62\x6f\x78\x2e\x49\x6e\x74\x65\x72\x6e\x65\x74\x2e\x73\x6f\x66\x74\x61\x74\x68\x6f\x6d\x65\x2e\x4c\x69\x76\x65\x62\x6f\x78\x36
#SendOption=15:string:\x00\x2b\x46\x53\x56\x44\x53\x4c\x5f\x6c\x69\x76\x65\x62\x6f\x78\x2e\x49\x6e\x74\x65\x72\x6e\x65\x74\x2e\x73\x6f\x66\x74\x61\x74\x68\x6f\x6d\x65\x2e\x4c\x69\x76\x65\x62\x6f\x78\x36
SendOption=11:string:<authentication_string>
SendOption=16:string:\x00\x00\x04\x0e\x00\x05\x73\x61\x67\x65\x6d
UseHostname=no
UseDNS=no
UseDomains=no
UseNTP=no
UseAddress=no
SendHostname=no
RouteMetric=1024
WithoutRA=solicit
RapidCommit=no
#PrefixDelegationHint=::/56
[IPv6AcceptRA]
DHCPv6Client=always
UseDNS=no
UseDomains=no
[DHCPPrefixDelegation]
SubnetId=0x2
UplinkInterface=:self
Announce=no
#Assign=no
[Service]
Environment=SYSTEMD_LOG_LEVEL=debug
note : since systemd v253, new options [EgressQOSMaps, IPServiceType, SocketPriority] exists to modify COS and DSCP to 6 on DHCPv4 (https://github.com/systemd/systemd/pull/25904).
WARNING : You always have to modify COS and DSCP for DHCPv6 (and ICMPv6). Todo this use the previous nftables rules (see paragraph).
/ip/dhcp-client/print detail
interface=vlan832-orange1.wan1 add-default-route=no use-peer-dns=no use-peer-ntp=no dhcp-options=hostname,clientid,authsend,userclass,vendor-class-identifier
script=
:if ($bound=1) do={
/log info "dhcp4-client script begin"
# multiwan
/routing rule set [find where action=lookup table=route-wan1 ] src-address=$"lease-address"
ip route set [find where dst-address="0.0.0.0/0" routing-table=route-wan1 distance=1 ] gateway=$"gateway-address" comment="wan1 - FIB - dhclient"
# recursive
#/ip route set [find where dst-address="1.0.0.1/32" scope=10 routing-table=main] gateway=$"gateway-address"
#/ip route set [find where dst-address="8.8.4.4/32" scope=10 routing-table=main] gateway=$"gateway-address"
#/ip route set [find where dst-address="9.9.9.10/32" scope=10 routing-table=main] gateway=$"gateway-address"
# not recursive
/ip route set [find where dst-address="0.0.0.0/0" routing-table=main distance=1 ] gateway=$"gateway-address" comment="wan1 - def - dhclient"
/ip route set [find where dst-address="0.0.0.0/0" routing-table=main distance=101 ] gateway=$"gateway-address" comment="wan1 - persist - dhclient"
# update routes oneshot (not tested)
#/ip route set [ find where immediate-gw~$"interface" dst-address=0.0.0.0/0 ] gateway=$"gateway-address"
# netwatch
/tool netwatch set [find where comment="wan1 - ipv4 - dhclient" ] src-address=$"lease-address"
/log info "dhcp4-client script finished"
}
status=bound address=xx.xx.xx.xx/24 gateway=xx.xx.xx.1 dhcp-server=80.xx.xx.xx primary-dns=xx.xx.xx.xx secondary-dns=xx.xx.xx.xx expires-after=5d5h16s
/ip/dhcp-client/option/print detail
0 name="vendor-class-identifier" code=60 value="0x736167656d" raw-value="736167656d"
1 name="userclass" code=77 value="0x2b46535644534c5f6c697665626f782e496e7465726e65742e736f66746174686f6d652e4c697665626f7836" raw-value="2b46535644534c5f6c697665626f782e496e7465726e65742e736f66746174686f6d652e4c697665626f7836"
2 name="authsend" code=90 value="0x00000000000000000000001A090000055801034101xxxxxxxxxxx"
raw-value="00000000000000000000001a090000055801034101xxxxxxxxxx"
3 name="clientid_duid" code=61 value="0xff$(CLIENT_DUID)" raw-value="ff"
4 name="clientid" code=61 value="0x01$(CLIENT_MAC)" raw-value="01"
5 name="hostname" code=12 value="$(HOSTNAME)" raw-value="xxxxxx"
/ipv6/dhcp-client/print detail
interface=vlan832-orange1.wan1 status=bound duid="0x000300xxxxxxxxx" dhcp-server-v6=fe80::ba0:bab request=prefix add-default-route=yes default-route-distance=1 use-peer-dns=no use-interface-duid=yes rapid-commit=no dhcp-options=authsend,userclass,class-identifier pool-name="pool6-wan1" pool-prefix-length=64 prefix-hint=::/0
script=
:if ($"pd-valid" = 1) do={
/log info "dhcp6-client script begin"
:local iface "vlan832-orange1.wan1"
# infos
:local pdprefix $"pd-prefix"
:local naaddress $"na-address"
/log info "dhcp6-client infos interface:$iface pd-prefix:$pdprefix na-address:$naadress"
# netmap
##:set pdprefix ([:pick $"pd-prefix" 0 [:find $"pd-prefix" "/"]]."/56");
##/log info "dhcp6-client cleaned pd-prefix is $pdprefix"
/ipv6/firewall/nat set [find where out-interface=$iface ] to-address=$"pd-prefix"
## netwatch
##/tool netwatch set [find where comment="wan1 - ipv6 - dhclient" ] src-address=$"na-address"
/log info "dhcp6-client script finished"
}
dhcp-options=authsend,userclass,class-identifier prefix=xx:xx:xx:xx::/56, 6d23h46m11s
/ipv6/dhcp-client/option/print detail
0 name="class-identifier" code=16 value="0x0000040e0005736167656d" raw-value="0000040e0005736167656d"
1 name="userclass" code=15 value="0x002b46535644534c5xxxxxxx" raw-value="002b46535644534c5f6c697665626f782e4xxxxx"
2 name="authsend" code=11 value="0x00000000000000000000001A0900xxxxxx" raw-value="00000000000000000000001a0900xxx"
dhcpcd is using NetworkConfiguration
https://roy.marples.name/projects/dhcpcd https://github.com/NetworkConfiguration/dhcpcd
noipv4ll
nohook hostname resolv.conf timesyncd.conf
allowinterfaces orange1
debug
logfile /var/log/dhcpcd.log
noauthrequired
noarp
noipv6rs
interface orange1
iaid xxxxxxxx
ia_pd xxxxxxxx br0//64
ipv6rs
clientid
userclass FSVDSL_livebox.Internet.softathome.Livebox6
vendclass 1038 sagem
vendorclassid sagem
broadcast
option subnet_mask routers domain_name_servers domain_name broadcast_address dhcp_lease_time dhcp_renewal_time dhcp_rebinding_time domain_search sip_server 125 auth
option dhcp6_vivso dhcp6_name_servers dhcp6_domain_search dhcp6_auth
nooption 33 57
authprotocol token 0x123/0x456
authtoken 0x456 "" forever 64:68:63:70:6c:69:76:65:62:6f:78:66:72:32:35:30
authtoken 0x123 "" forever 1a:09:00:00:05:58:01:03:41:01:0d:66:74:69:2f:...
WARNING : ISC dhclient is deprecated since 2023, prefer systemd-networkd
Do not forget to :
if necessary and to avoid /etc/resolv.conf overwrite, use chattr +i /etc/resolv.conf
iface="orange1"
cfgdir=...
leasedir=...
piddir=...
dhclient -4 -cf ${cfgdir}/${iface}_4.conf -pf ${piddir}/${iface}_4.pid -lf ${leasedir}/${iface}_4.leases $iface
dhclient -6 -cf ${cfgdir}/${iface}_6.conf -pf ${piddir}/${iface}_6.pid -lf ${leasedir}/${iface}_6.leases -P -nw $iface
option rfc3118-authentication code 90 = string;
interface "orange1" {
timeout 60;
retry 1;
select-timeout 0;
#supersede dhcp-renewal-time 30;
#supersede dhcp-rebinding-time 60;
#supersede dhcp-lease-time 90;
send vendor-class-identifier "sagem";
send user-class "+FSVDSL_livebox.Internet.softathome.Livebox4";
send rfc3118-authentication 00:00:00:00:00:00:<authentication_string>;
send dhcp-client-identifier 01:<livebox_mac>;
request subnet-mask, routers, broadcast-address;
#request subnet-mask, routers, domain-name-servers, domain-name, broadcast-address, dhcp-lease-time, dhcp-renewal-time, dhcp-rebinding-time, rfc3118-authentication;
#request subnet-mask, broadcast-address, dhcp-lease-time, dhcp-renewal-time, dhcp-rebinding-time, rfc3118-authentication;
}
option dhcp6.auth code 11 = string;
option dhcp6.userclass code 15 = string;
option dhcp6.vendorclass code 16 = string;
interface "orange1" {
timeout 60;
retry 1;
select-timeout 0;
send dhcp6.vendorclass 00:00:04:0e:00:05:73:61:67:65:6d;
send dhcp6.userclass 00:2b:46:53:56:44:53:4c:5f:6c:69:76:65:62:6f:78:2e:49:6e:74:65:72:6e:65:74:2e:73:6f:66:74:61:74:68:6f:6d:65:2e:4c:69:76:65:62:6f:78:34;
send dhcp6.auth 00:00:00:00:00:00:00:00:<authentication_string>;
send dhcp6.client-id 00:03:00:01:<livebox_mac>;
also request dhcp6.auth, dhcp6.vendorclass, dhcp6.userclass, dhcp6.vendor-opts;
}
This utility must be used with dhcp client utility (like dhclient or dhpcd, NOT systemd). It provide the ability to run the dhcp client with a modified Socket Priority. It is using LD_PRELOAD feature. WARNING : It is NOT compatible with systemd-networkd (which have built-in params to do COS6) !
https://git.kindwolf.org/so_priority.so/ https://lafibre.info/remplacer-livebox/petit-ld_preload-pour-amateurs-de-setsockopt/
compilation :
gcc -shared -ldl -fPIC so_priority.c -o so_priority.so
usage :
SO_PRIORITY_DEBUG=1 SO_PRIORITY_VALUE=6 LD_PRELOAD=/path/to/so_priority.so program arg1 arg2
source code :
/*
Set SO_PRIORITY right after each socket() call.
Compile with: gcc -shared -ldl -fPIC so_priority.c -o so_priority.so
Usage: SO_PRIORITY_DEBUG=1 SO_PRIORITY_VALUE=6 LD_PRELOAD=/path/to/so_priority.so program arg1 arg2
(c) 2020 - Xavier Guerrin
This program is free software. It comes without any warranty, to
the extent permitted by applicable law. You can redistribute it
and/or modify it under the terms of the Do What The Fuck You Want
To Public License, Version 2, as published by Sam Hocevar. See
http://www.wtfpl.net/ for more details.
*/
#define _GNU_SOURCE /* RTLD_NEXT */
#include <dlfcn.h> /* dlsym, dlerror */
#include <errno.h> /* errno */
#include <stdio.h> /* dprintf */
#include <stdlib.h> /* atoi, getenv */
#include <string.h> /* strerror */
#include <sys/types.h> /* setsockopt */
#include <sys/socket.h> /* setsockopt */
#ifndef SOPRIORITY_SO_NAME
#define SOPRIORITY_SO_NAME "so_priority.so"
#endif
#ifndef SOPRIORITY_VALUE_EV
#define SOPRIORITY_VALUE_EV "SO_PRIORITY_VALUE"
#endif
#ifndef SOPRIORITY_DEBUG_EV
#define SOPRIORITY_DEBUG_EV "SO_PRIORITY_DEBUG"
#endif
typedef int (*socket_function_type)(int, int, int);
/* Pointer to the actual socket symbol. */
socket_function_type so_priority_socket = NULL;
/* SO_PRIORITY value to set; can be configured using the SO_PRIORITY_VALUE environment variable. */
int so_priority_value = 0;
/* Debug level; can be configured using the SO_PRIORITY_DEBUG environment variable. */
int so_priority_debug = 0;
int so_priority_known = 0;
/* Ask the linker to provide the actual "socket" symbol: */
static int so_priority_get_socket() {
char *error_string;
so_priority_socket = (socket_function_type)dlsym(RTLD_NEXT, "socket");
if (!so_priority_socket) {
error_string = dlerror();
if (error_string) {
dprintf(2, "%s: unable to find the actual socket symbol: %s\n", SOPRIORITY_SO_NAME, error_string);
}
else {
dprintf(2, "%s: unable to find the actual socket symbol\n", SOPRIORITY_SO_NAME);
}
return 0;
}
return 1;
}
/* Read the priority value from the environment. */
static void so_priority_set_options() {
char *str;
str = getenv(SOPRIORITY_VALUE_EV);
if (str) so_priority_value = atoi(str);
str = getenv(SOPRIORITY_DEBUG_EV);
if (str) so_priority_debug = atoi(str);
so_priority_known = 1;
}
/* Wrapper around the actual socket() function that sets SO_PRIORITY by calling setsockopt(). */
int socket(int domain, int type, int protocol) {
int ret, setsockopt_errno, socket_errno, sockfd;
if (!so_priority_socket && !so_priority_get_socket()) {
errno = ENOENT;
return -1;
}
/* Actually call socket(): */
sockfd = so_priority_socket(domain, type, protocol);
/* Do not call setsockopt() if socket() failed: */
if (sockfd < 0) return sockfd;
/* Time for the actual work: */
socket_errno = errno;
if (!so_priority_known) so_priority_set_options();
ret = setsockopt(sockfd, SOL_SOCKET, SO_PRIORITY, &so_priority_value, sizeof(so_priority_value));
/* Ignore setsockopt() errors, except for debugging purposes. */
if (so_priority_debug) {
setsockopt_errno = errno;
dprintf(2, "%s: setsockopt(%d, SOL_SOCKET, SO_PRIORITY, %d, %zu) returned %d",
SOPRIORITY_SO_NAME, sockfd, so_priority_value, sizeof(so_priority_value), ret);
if (ret < 0) dprintf(2, "; errno is %d: %s", setsockopt_errno, strerror(setsockopt_errno));
dprintf(2, "\n");
}
errno = socket_errno;
return sockfd;
}
Archlinux PKGBUILD :
# https://git.kindwolf.org/so_priority.so/
# https://lafibre.info/remplacer-livebox/petit-ld_preload-pour-amateurs-de-setsockopt/
# USAGE : SO_PRIORITY_DEBUG=1 SO_PRIORITY_VALUE=6 LD_PRELOAD=/path/to/so_priority.so program arg1 arg2
pkgname=so_priority
pkgver=1.0
pkgrel=0
pkgdesc='Set SO_PRIORITY (aka skb->priority) right after each socket() call.'
arch=('i686' 'x86_64')
url="https://git.kindwolf.org/so_priority.so"
license=('GPL3')
source=(https://git.kindwolf.org/so_priority.so/raw/master/so_priority.c)
validpgpkeys=(
'SKIP'
)
sha256sums=(
'SKIP')
build() {
cd "$srcdir"/
gcc -shared -ldl -fPIC so_priority.c -o so_priority.so
}
package() {
cd "$srcdir"/
for s in *.so; do
install -Dm755 $s "$pkgdir/usr/lib/so_priority/$s"
done
}
Finally try to regenerate authentication options (90 for DHCPv4 and 11 for DHCPv6). Sometimes, it could be necessary to regenerate authentication options, after a few months for example…
'[vlan ${vlan}, p X]' : ..., ethertype 802.1Q (0x8100), length XXX: vlan ${vlan}, p X, ethertype IPv4 (0x0800), ...
tcpdump command lines :
# prefer :
tcpdump -vnei wan1 '(udp port 546 or port 547) or icmp6'
# alternatives :
tcpdump -i wan1 -ne -vv "(udp port 546 and port 547)"
tcpdump -i wan1 -vvv -n ip6 “(udp port 546 and port 547)”
tcpdump -vnes0 -i wan1 udp port 67 or port 68 or port 546 or port 547
tcpdump -vvvvv -ttt -i wan1 'icmp6 and (ip6[40] = 134 or ip6[40] = 133 or ip6[40] = 135 or ip6[40] = 136 or ip6[40] = 129 or ip6[40] = 128 or ip6[40] = 3 or ip6[40] = 2 or ip6[40] = 1)' -w /tmp/capture.pcap # use wireshark to analyse /tmp/capture.pcap
04xx : billing issue
DHCP6 Client IAID: 0x8864a065 DHCP6 Client DUID: DUID-LL:000144d4540axxxx0000
tcpdump sample trace :
dhcp6 solicit (xid=6461b1 (rapid-commit) (IA_PD IAID:22882960xx T1:0 T2:0) (Client-FQDN) (user-class) (option-request opt_82) (client-ID hwaddr type 1 44d4540axxxx)
dhcp6 advertise (xid=6461b1 (IA_PD IAID:22882960xx T1:83812 T2:207360 (IA_PD-prefix 2a01:xxxx::/56 pltime:259200 vltime:259200)) (server-ID vid 0000055844455348) (client-ID hwaddr type 1 44d4540axxxx)
dhcp6 request (xid=76595c (server-ID vid 0000055844455348) (IA_PD IAID:22882960xx T1:0 T2:0 (IA_PD-prefix 2a01:xxxx::/56 pltime:0 vltime:0)) (Client-FQDN) (user-class) (client-ID hwaddr type 1 44d4540axxxx)
dhcp6 reply (xid=76595c (IA_PD IAID:22882960xx T1:86413 T2:207360 (IA_PD-prefix 2a01:xxxx::/56 pltime:259200 vltime:259200)) (server-ID vid 0000055844455348) (client-ID hwaddr type 1 44d4540axxxx)
Sometimes, when switching hardware or interface on the same fiber link, you will encounter IAID issue. In this case ipv6 DHCP client will give you NO PREFIX answer from DHCP server.
To determine what IAID will be used, convert internal ID of an interface on which DHCP client is running from hex to decimal. For example, DHCP client is running on interface pppoe-out1. To get internal ID use following command :
/interface> :put \[find name="vlan832-orange1"]
For example, you will get : *15
Now convert hex value 15 to decimal and you get IAID=21
routerOS command line to snif interface and send to a remote host :
xxxxxx] > /tool/sniffer/export
# apr/20/2023 19:01:18 by RouterOS 7.6
# software id = xxxxxx
#
# model = CCR2004-1G-12S+2XS
# serial number = xxxxxxx
/tool sniffer
set file-limit=100000KiB filter-interface=br-wan filter-ip-protocol=udp filter-port=bootps,bootpc,546,547 filter-stream=yes memory-limit=5000KiB memory-scroll=no streaming-enabled=yes streaming-server=192.168.xxx.xxx
In some cases, the ONU/ONT is mapping the VLAN 832 on VLAN 2800. See the post https://github.com/Anime4000/RTL960x/issues/282#issuecomment-2089248396.
You have to connect on the ONU/ONT and use command omcicli:
# omcicli mib get 84
XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
VlanTagFilterData
XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
=================================
EntityID: 0x1102
FilterTbl[0]: PRI 0,CFI 0, VID 2800
FwdOp: 0x10
NumOfEntries: 1
=================================
=================================
EntityID: 0x1103
FilterTbl[0]: PRI 0,CFI 0, VID 835
FwdOp: 0x10
NumOfEntries: 1
=================================
=================================
EntityID: 0x1104
FilterTbl[0]: PRI 0,CFI 0, VID 852
FwdOp: 0x10
NumOfEntries: 1
=================================
=================================
EntityID: 0x110b
FilterTbl[0]: PRI 0,CFI 0, VID 835
FilterTbl[2]: PRI 0,CFI 0, VID 852
FilterTbl[4]: PRI 0,CFI 0, VID 2800
FwdOp: 0x10
NumOfEntries: 3
=================================
# omcicli mib get 171
XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
ExtVlanTagOperCfgData
XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
=================================
EntityId: 0x101
AssociationType: 2
ReceivedFrameVlanTagOperTableMaxSize: 0
InputTPID: 0x8100
OutputTPID: 0x8100
DsMode: 0
ReceivedFrameVlanTaggingOperTable
INDEX 0
Filter Outer : PRI 15,VID 4096, TPID 0
Filter Inner : PRI 7,VID 851, TPID 5, EthType 0x00
Treatment Outer : PRI 15,VID 0, TPID 0, RemoveTags 1
Treatment Inner : PRI 7,VID 852, TPID 2
INDEX 1
Filter Outer : PRI 15,VID 4096, TPID 0
Filter Inner : PRI 6,VID 851, TPID 5, EthType 0x00
Treatment Outer : PRI 15,VID 0, TPID 0, RemoveTags 1
Treatment Inner : PRI 5,VID 852, TPID 2
INDEX 2
Filter Outer : PRI 15,VID 4096, TPID 0
Filter Inner : PRI 5,VID 851, TPID 5, EthType 0x00
Treatment Outer : PRI 15,VID 0, TPID 0, RemoveTags 1
Treatment Inner : PRI 4,VID 852, TPID 2
INDEX 3
Filter Outer : PRI 15,VID 4096, TPID 0
Filter Inner : PRI 4,VID 851, TPID 5, EthType 0x00
Treatment Outer : PRI 15,VID 0, TPID 0, RemoveTags 1
Treatment Inner : PRI 4,VID 852, TPID 2
INDEX 4
Filter Outer : PRI 15,VID 4096, TPID 0
Filter Inner : PRI 3,VID 851, TPID 5, EthType 0x00
Treatment Outer : PRI 15,VID 0, TPID 0, RemoveTags 1
Treatment Inner : PRI 3,VID 852, TPID 2
INDEX 5
Filter Outer : PRI 15,VID 4096, TPID 0
Filter Inner : PRI 2,VID 851, TPID 5, EthType 0x00
Treatment Outer : PRI 15,VID 0, TPID 0, RemoveTags 1
Treatment Inner : PRI 2,VID 852, TPID 2
INDEX 6
Filter Outer : PRI 15,VID 4096, TPID 0
Filter Inner : PRI 1,VID 851, TPID 5, EthType 0x00
Treatment Outer : PRI 15,VID 0, TPID 0, RemoveTags 1
Treatment Inner : PRI 1,VID 852, TPID 2
INDEX 7
Filter Outer : PRI 15,VID 4096, TPID 0
Filter Inner : PRI 0,VID 851, TPID 5, EthType 0x00
Treatment Outer : PRI 15,VID 0, TPID 0, RemoveTags 1
Treatment Inner : PRI 0,VID 852, TPID 2
INDEX 8
Filter Outer : PRI 15,VID 4096, TPID 0
Filter Inner : PRI 8,VID 835, TPID 5, EthType 0x00
Treatment Outer : PRI 15,VID 0, TPID 0, RemoveTags 1
Treatment Inner : PRI 8,VID 835, TPID 2
INDEX 9
Filter Outer : PRI 15,VID 4096, TPID 0
Filter Inner : PRI 8,VID 832, TPID 5, EthType 0x00
Treatment Outer : PRI 15,VID 0, TPID 0, RemoveTags 1
Treatment Inner : PRI 8,VID 2800, TPID 2
INDEX 10
Filter Outer : PRI 15,VID 4096, TPID 0
Filter Inner : PRI 15,VID 0, TPID 5, EthType 0x00
Treatment Outer : PRI 15,VID 0, TPID 0, RemoveTags 3
Treatment Inner : PRI 15,VID 0, TPID 2
INDEX 11
Filter Outer : PRI 14,VID 4096, TPID 5
Filter Inner : PRI 14,VID 4096, TPID 0, EthType 0x00
Treatment Outer : PRI 15,VID 0, TPID 0, RemoveTags 3
Treatment Inner : PRI 15,VID 4096, TPID 3
INDEX 12
Filter Outer : PRI 15,VID 4096, TPID 0
Filter Inner : PRI 14,VID 4096, TPID 5, EthType 0x00
Treatment Outer : PRI 15,VID 0, TPID 0, RemoveTags 3
Treatment Inner : PRI 15,VID 4096, TPID 2
AssociatedMePoint: 0x101
If you are in this case, you just have to change the VLAN 832 with 2800 in your router configuration.
There are lot of sources which helped me to write this article. Here are the most importants.
https://lafibre.info/remplacer-livebox/durcissement-du-controle-de-loption-9011-et-de-la-conformite-protocolaire/ https://lafibre.info/remplacer-livebox/guide-de-connexion-fibre-directement-sur-un-routeur-voire-meme-en-2gbps/ https://lafibre.info/remplacer-livebox/index-des-solutions-de-remplacement-de-la-livebox/ https://lafibre.info/remplacer-livebox/filtrer-les-raw-socket-avec-nftables/ https://lafibre.info/remplacer-livebox/remplacer-la-livebox-par-systemd-networkd-nftables/24/
Special thanks to lafibre.info forum and its members !