Orange ISP Bring Your Own Router
Version 20260606
This document describe how-to configure DHCP clients for ISP Orange in France. This could be used to remove the Livebox and prefer your own router…
Requirements
You must already have a working ONT/ONU registered on Orange fiber infrastructure. ONT/ONU are registering on Orange infrastructure with serial number. For informations, Orange use serial_number and vendor_id to allow a ONT/ONU to register. To configure properly your ONU/ONT, check dedicated topics and forums…
Basics
For memories, the good SFP power values should be in the following ranges :
- GPON : Tx 0.5 -> 5 dBm ; Rx -30 -> -8 dBm
- XGSPON : Tx 4 -> 9 dBm ; Rx -28 -> -9 dBm
2023 evolutions
[!IMPORTANT] Since December 2022, the following DHCP options are MANDATORY !
ipv4
- user-class [77] : “FSVDSL_livebox.Internet.softathome.Livebox6” or “2b46535644534c5f6c697665626f782e496e7465726e65742e736f66746174686f6d652e4c697665626f7836”
- vendor-class-identifier [60] : “sagem” or “0x736167656d”
- rfc3118-authentication [90] : “authentication string (00:00:00:00:00:00:00:00:00:00:00:1A:09:00:00:05:58:01:03:41:01:0Dxxx)”
- dhcp-client-identifier [61] : “01:<mac_addr>” or “01<mac_addr>” or “0x01<mac_addr>”
ipv6
- user-class [15] : “002b46535644534c5f6c697665626f782e496e7465726e65742e736f66746174686f6d652e4c697665626f7836”
- class-identifier [16] : “00:00:04:0e:00:05:73:61:67:65:6d” or “0x0000040e0005736167656d”
- authentication [11] : “authentication string (00:00:00:00:00:00:00:00:00:00:00:1A:09:00:00:05:58:01:03:41:01:0Dxxx)”
- client DUID [1] : “00:03:00:01:<mac_addr>” or “00030001<mac_addr>” or “0x00030001<mac_addr>”
notes
- All DHCP requests must be done with COS6 (DSCP6 recommended too).
- When you switch hardware (new router / ONU / ONT) you have to wait a few minutes with DISCONNECTED fiber link. DHCP IAID are dynamically generated by hardware equipments and Orange is waiting for a single IAID per client. To force expiration, the only way is to disconnect fiber 15-30 minutes and wait… The issue is that you will NOT get DHCPv6 prefix (NoPrefixAvail) from Orange.
- note authentication : ipv4 and ipv6 strings MUST be equals
- note user-class : user-class (ipv4:77 / ipv6:15) must match ipv4 and ipv6 (with different formats)
string2hex(FSVDSL_livebox.Internet.softathome.Livebox4) -> 46535644534c5f6c697665626f782e496e7465726e65742e736f66746174686f6d652e4c697665626f7834
user-class string = “2b” + string2hex() ; ipv6 string = “00” + “ipv4 string”
note: the last digit 4 is the Livebox version (Livebox 4 here), just replace with your version.
WARNING : take care of case (livebox7 6c697665626f7837 [BAD] vs Livebox7 4c697665626f7837 [GOOD])
[ipv4:77] : "FSVDSL_livebox.Internet.softathome.Livebox4" or "0x2b46535644534c5f6c697665626f782e496e7465726e65742e736f66746174686f6d652e4c697665626f7834"
[ipv6:15] : "002b46535644534c5f6c697665626f782e496e7465726e65742e736f66746174686f6d652e4c697665626f7834"
[ipv4:77] : "FSVDSL_livebox.Internet.softathome.Livebox5" or "0x2b46535644534c5f6c697665626f782e496e7465726e65742e736f66746174686f6d652e4c697665626f7835"
[ipv6:15] : "002b46535644534c5f6c697665626f782e496e7465726e65742e736f66746174686f6d652e4c697665626f7835"
[ipv4:77] : "FSVDSL_livebox.Internet.softathome.Livebox6" or "0x2b46535644534c5f6c697665626f782e496e7465726e65742e736f66746174686f6d652e4c697665626f7836"
[ipv6:15] : "002b46535644534c5f6c697665626f782e496e7465726e65742e736f66746174686f6d652e4c697665626f7836"
[ipv4:77] : "FSVDSL_livebox.Internet.softathome.Livebox7" or "0x2b46535644534c5f6c697665626f782e496e7465726e65742e736f66746174686f6d652e4c697665626f7837"
[ipv6:15] : "002b46535644534c5f6c697665626f782e496e7465726e65742e736f66746174686f6d652e4c697665626f7837"
WARNING : if dhcp client use raw or not, final (and true) string to have in tcpdump sniff should be (for LB7) :
[ipv4:77] : "4d2c2b46535644534c5f6c697665626f782e496e7465726e65742e736f66746174686f6d652e4c697665626f7837"
[ipv6:15] : "000f002d002b46535644534c5f6c697665626f782e496e7465726e65742e736f66746174686f6d652e4c697665626f7837"
- note vendor-opts : vendor-opts (or vendor_opts for vendor specific informations, IS NOT REQUIRED) [17] : “00:00:05:58:00:06:00:0e:49:50:56:36:5f:52:45:51:55:45:53:54:45:44” or “0x000005580006000e495056365f524551554553544544”, entreprise id “Orange” 4 octets 00000558 + 2 octets code 0006 + 14 octets data: 495056365f524551554553544544 (“IPV6_REQUESTED”)
- note systemd-networkd : each string must converted from “aa:bb:cc:dd:ee:…..” to xaaxbbxbbxccxddxeex….” (replace “:” with “x”)
echo "aa:bb:cc:dd:ee" | sed 's/^/\\\x/ ; s/:/\\\x/g'
systemd-network sample config (for LB6) :
[DHCPv4]
ClientIdentifier=mac
VendorClassIdentifier=sagem
UserClass=FSVDSL_livebox.Internet.softathome.Livebox6
SendOption=90:string:\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1A\x09\x00\x00\x05\x58\x01\x03\x41\x01\x0D\x66\x74\x69...
[DHCPv6]
DUIDType=link-layer
# Bring Your Own Router Orange ISP
UserClass=FSVDSL_livebox.Internet.softathome.Livebox6
#UserClass=\x00\x2b\x46\x53\x56\x44\x53\x4c\x5f\x6c\x69\x76\x65\x62\x6f\x78\x2e\x49\x6e\x74\x65\x72\x6e\x65\x74\x2e\x73\x6f\x66\x74\x61\x74\x68\x6f\x6d\x65\x2e\x4c\x69\x76\x65\x62\x6f\x78\x36
#SendOption=15:string:\x00\x2b\x46\x53\x56\x44\x53\x4c\x5f\x6c\x69\x76\x65\x62\x6f\x78\x2e\x49\x6e\x74\x65\x72\x6e\x65\x74\x2e\x73\x6f\x66\x74\x61\x74\x68\x6f\x6d\x65\x2e\x4c\x69\x76\x65\x62\x6f\x78\x36
SendOption=11:string:\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1A\x09\x00\x00\x05\x58\x01\x03\x41\x01\x0D\x66\x74\x69...
SendOption=16:string:\x00\x00\x04\x0e\x00\x05\x73\x61\x67\x65\x6d
ORO
The DHCPv6 ORO (Option Request Option, code 6), the following options are required : Option: Option Request (6) - Length: 8 - Value: 000b001100170018 Requested Option code: Authentication (11) Requested Option code: Vendor-specific Information (17) Requested Option code: DNS recursive name server (23) Requested Option code: Domain Search List (24)
But, for the RFC8415 (https://datatracker.ietf.org/doc/html/rfc8415#section-21.7), option 11 (Authentication) is forbidden. For Orange, it is NOT mandatory to include option 11 in SOLLICIT/REQUEST requests. You can only keep options 17,23,24.
Authentication
note : You could also use https://jsfiddle.net/kgersen/3mnsc6wy/
shell script to generate authentication string :
#!/bin/bash
# You could also use https://jsfiddle.net/kgersen/3mnsc6wy/
# Version 20221214
[ -z "$2" ] && echo "usage : $0 '<fti/login>' '<passwd>'" && exit 1
login="$1" ; pass="$2"
tohex() {
for h in $(echo $1 | sed "s/\(.\)/\1 /g"); do printf %02x \'$h; done
}
addsep() {
echo $(echo $1 | sed "s/\(.\)\(.\)/:\1\2/g")
}
r=$(dd if=/dev/urandom bs=1k count=1 2>&1 | md5sum | cut -c1-16)
id=${r:0:1}
h=3C12$(tohex ${r})0313$(tohex ${id})$(echo -n ${id}${pass}${r} | md5sum | cut -c1-32)
str=$(addsep $(tohex ${login})${h})
echo "# dhclient"
echo "## ipv4"
echo "send rfc3118-authentication 00:00:00:00:00:00:00:00:00:00:00:1A:09:00:00:05:58:01:03:41:01:0D${str};"
echo "## ipv6"
echo "send dhcp6.auth 00:00:00:00:00:00:00:00:00:00:00:1A:09:00:00:05:58:01:03:41:01:0D${str};"
echo
echo "# systemd-networkd"
echo "## [DHCPv4]"
str2=`echo "00:00:00:00:00:00:00:00:00:00:00:1A:09:00:00:05:58:01:03:41:01:0D${str}" | sed 's/^/\\\x/ ; s/:/\\\x/g'`
echo "SendOption=90:string:${str2}"
echo "## [DHCPv6]"
echo "SendOption=11:string:${str2}"
echo
echo "# mikrotik routeros"
echo "## DHCPv4"
echo "/ip dhcp-client option"
str2=`echo "00:00:00:00:00:00:00:00:00:00:00:1A:09:00:00:05:58:01:03:41:01:0D${str}" | sed 's/://g'`
echo "add code=90 name=authsend value=0x${str2}"
echo "## DHCPv6"
echo "/ipv6 dhcp-client option"
echo "add code=11 name=authsend value=0x${str2}"
Class-Of-Service
**DHCP packets MUST be flagged COS/PCP 6 and DSCP 6 (48 dec) class-of-service ** However, DSCP is not mandatory but recommended.
DHCPv4 clients use RAW SOCKETS for DISCOVER/REQUEST (init) requests and BSD/UDP SOCKETS for RENEW requests. In consequence, you CANNOT use netfilter mangle rules to change COS/PCP and DSCP on DHCPv4. You MUST use L2 filtering. For IPv6, no problem for using netfilter mangle rules to change COS/DSCP. IMPORTANT NOTICE : Since kernel 5.7, the netfilter netdev egress filter could match DHCP packets. See below netfilter nftables egress filter, it could be fun to try without tc script…
ALL OUTPUT PACKETS (from router) MUST BE ZERO (0 !) COS/DSCP TAGGUED, except DHCP relative to authentication. If it is not the case, the flow speeds will be drastically limited !
For standalone ARP packets, it is currently not mandatory to set COS/DSCP, but it could be in a near future…
On Linux L2 filtering can be done with tc (traffic-control) tool. On Mikrotik router there switch rules or bridge filters.
linux tc
#!/bin/sh
iface="orange1"
tc_qos="0:6"
vlan="832"
physiface="wan1"
mac_addr="<livebox_mac>"
ip link add link $physiface name $iface type vlan id $vlan
ip link set dev $iface address $mac_addr
ip link set $iface up
tc qdisc del dev $iface root ; tc filter del dev $iface
tc qdisc replace dev $iface root handle 1: prio
tc filter add dev $iface parent 1: prio 1 u32 match ip protocol 17 ff match ip dport 67 ffff action skbedit priority $tc_qos # dhcpv4
tc filter add dev $iface parent 1: prio 2 protocol ipv6 u32 match ip6 protocol 17 ff match ip6 dport 547 ffff action skbedit priority $tc_qos # dhcpv6
# the following is not mandatory, but recommended
tc filter add dev $iface parent 1: prio 3 protocol 0x806 u32 match u32 0 0 action skbedit priority $tc_cos # arp
tc filter add dev $iface parent 1: prio 4 protocol ipv6 u32 match ip6 dst fe00::/7 match ip6 protocol 58 ff action skbedit priority $tc_cos # icmpv6_dst (fe00::/7 = fe80::/10 + ff02::/16)
# for information
#tc filter add dev $iface parent 1: prio 4 protocol ipv6 u32 match ip6 protocol 58 ff action skbedit priority $tc_cos # icmpv6
#tc filter add dev $iface parent 1: prio 5 protocol ip u32 match ip protocol 1 ff action skbedit priority $tc_cos # icmpv4 - SHOULD NOT BE USED !
DSCP
This step is optional.
https://lafibre.info/remplacer-livebox/durcissement-du-controle-de-loption-9011-et-de-la-conformite-protocolaire/324/ This version of tc script change COS and DSCP to 6, it should work but it has NOT been tested and work in progress. note: DSCP CS6 = 48 (dec) = 0xc0 (TOS-hex)
script based on tc :
#!/bin/sh
iface="orange1"
tc_cos="0:6"
tc_tos="0xc0"
tc_retain="0xfc"
vlan="832"
physiface="wan1"
mac_addr="<livebox_mac>"
ip link add link $physiface name $iface type vlan id $vlan
ip link set dev $iface address $mac_addr
ip link set $iface up
tc qdisc del dev $iface root ; tc filter del dev $iface
tc qdisc replace dev $iface root handle 1: prio
tc filter add dev $iface parent 1: prio 1 protocol ip u32 match ip ihl 5 0xf match u16 0x0000 0x1fff at 6 match ip protocol 17 0xff match ip sport 68 0xffff match ip dport 67 0xffff action skbedit priority $tc_cos pipe action pedit pedit munge ip tos set $tc_tos retain $tc_retain pipe action csum ip4h # dhcpv4_DSCP
tc filter add dev $iface parent 1: prio 2 protocol ipv6 u32 match ip6 protocol 17 0xff match ip6 sport 546 0xffff match ip6 dport 547 0xffff action skbedit priority $tc_cos pipe action pedit pedit munge ip6 tos set $tc_tos retain $tc_retain # dhcpv6_DSCP
# the following is not mandatory, but recommended
tc filter add dev $iface parent 1: prio 3 protocol arp u32 match u8 0 0 action skbedit priority $tc_cos # arp
tc filter add dev $iface parent 1: prio 4 protocol ipv6 u32 match ip6 dst fe00::/7 match ip6 protocol 58 0xff action skbedit priority 0:6 pipe action pedit ex munge ip6 traffic_class set $tc_tos retain $tc_retain # icmpv6_dst_DSCP (fe00::/7 = fe80::/10 + ff02::/16)
# for information - no dscp
#tc filter add dev $iface parent 1: prio 3 protocol ipv6 u32 match ip6 protocol 17 0xff match ip6 sport 546 0xffff match ip6 dport 547 0xffff action skbedit priority $tc_cos # dhcpv6
#tc filter add dev $iface parent 1: prio 4 protocol ipv6 u32 match ip6 dst fe00::/7 match ip6 protocol 58 0xff action skbedit priority $tc_cos # icmpv6 dst (fe00::/7 = fe80::/10 + ff02::/16)
nftables mangle
https://lafibre.info/remplacer-livebox/durcissement-du-controle-de-loption-9011-et-de-la-conformite-protocolaire/324/ The following change DSCP and COS for ipv6 NS/NA/RS packets. From systemd v253, new options exist to modify COS and DSCP to 6 on dhcpv4 (https://github.com/systemd/systemd/pull/25904). But, you always have to modify COS(PCP) and DSCP for dhcpv6 (and icmpv6). Todo this use the previous nftables rules.
- original version (prefer next/simpler/better version) :
iface = orange1.832
table inet firewall {
chain prio_orange {
meta nfproto ipv4
meta priority set 0:0
ip dscp set cs0
meta nfproto ipv6
meta priority set 0:0
ip6 dscp set cs0
ip6 daddr { fe80::/10, ff02::/16 }
icmpv6 type {
nd-router-solicit,
nd-neighbor-solicit,
nd-neighbor-advert
}
meta priority set 0:6
ip6 dscp set cs6
ip6 daddr { fe80::/10, ff02::/16 }
udp sport 546
udp dport 547
meta priority set 0:6
ip6 dscp set cs6
}
chain mangle_postrouting {
type filter hook postrouting priority mangle
policy accept
oifname $iface rt ipsec missing jump prio_orange
}
}
- a simpler (better?) version (note the new netdev/egress filter at the end) : note: it should be better to untrack mangled packets https://wiki.nftables.org/wiki-nftables/index.php/Mangling_packet_headers (not tested)
# ipv4 (for renew)
table ip mangle {
chain prio_orange {
udp sport 68 udp dport 67 meta priority set 0:6 ip dscp set cs6 untrack counter comment "mangle-prio_orange_DHCP"
#udp sport 68 udp dport 67 meta priority set 0:6 ip dscp set cs6 counter comment "mangle-prio_orange_DHCP"
}
chain POSTROUTING {
type filter hook postrouting priority mangle; policy accept;
oifname $iface counter jump prio_orange comment "mangle-postrouting_orange"
}
}
# ipv6
table ip6 mangle {
chain prio_orange {
icmpv6 type { nd-router-solicit, nd-neighbor-solicit, nd-neighbor-advert } meta priority set 0:6 ip6 dscp set cs6 untrack counter comment "mangle6-prio_orange_ICMP"
#icmpv6 type { nd-router-solicit, nd-neighbor-solicit, nd-neighbor-advert } meta priority set 0:6 ip6 dscp set cs6 counter comment "mangle6-prio_orange_ICMP"
udp sport 546 udp dport 547 meta priority set 0:6 ip6 dscp set cs6 untrack counter comment "mangle6-prio_orange_DHCP"
#udp sport 546 udp dport 547 meta priority set 0:6 ip6 dscp set cs6 counter comment "mangle6-prio_orange_DHCP"
}
chain POSTROUTING {
type filter hook postrouting priority mangle; policy accept;
oifname $iface ip6 daddr { fe80::/10, ff02::/16 } counter jump prio_orange comment "mangle6-postrouting_orange"
}
}
nftables netdev
Before kernel 6.x, nftables was NOT able to modify ipv4 DHCP packets, because they are using RAW sockets.
Since recent kernels, a new method exist with netdev egress filter : Filtrer les raw socket avec nftables ? with netdev egress rules, netfilter mangle rules or traffic-control (tc script) are NO MORE NECESSARY https://nftables.org/projects/nftables/files/changes-nftables-1.1.3.txt
There are 2 methods to change dscp/cos/pcp on nftables netdev egress. The first method (recommended) is to apply egress on physical interface (parent of vlan interface 832). The second is to apply on vlan 832 interface. Note: we are using netdev table, in this case we are applying settings on low level network device stack. You can specify « ^vlan id 832 » or not, it will work in both case. For this documentation, we will keep it for clarification.
Note: we will using vlan pcp set 6 instead of meta priority set 0:6 + egress-qos-map just because it is easier. DO NOT FORGET that in all case egress-qos-map is required, but it can be set natively with systemd-netword via EgressQOSMaps=6-6 (since systemd v253).
- method1: use physical interface
note: ‘meta priority set 0:6’ should NOT be required if phy version (‘vlan pcp set 6’ already done the right thing)
chain prio_orange_phy { icmpv6 type { nd-router-solicit, nd-neighbor-solicit, nd-neighbor-advert } vlan pcp set 6 meta priority set 0:6 ip6 dscp set cs6 counter comment "prio_orange_ICMP6" udp dport 547 vlan pcp set 6 meta priority set 0:6 ip6 dscp set cs6 counter comment "prio_orange_DHCP6" udp dport 67 vlan pcp set 6 meta priority set 0:6 ip dscp set cs6 counter comment "prio_orange_DHCP4" vlan type arp vlan pcp set 6 counter comment "prio_orange_ARP" }note: you could also use
vlan pcp set 6 ip6 dscp set cs6instead ofvlan pcp set 6 meta priority set 0:6 ip6 dscp set cs6. $iface_wan1 = physical interface (parent of vlan 832 interface). Remember that you are using netdev and in this case, you can remove (or not) « ^vlan id 832 ».chain egress { type filter hook egress devices = $iface_wan1 priority filter; policy accept; vlan id 832 jump prio_orange_phy comment "egress-prio_orange_phy" } - method2: use vlan interface (832)
note: no ‘vlan pcp set 6’ in this version, ‘meta priority set 0:6’ is required
chain prio_orange_vlan { icmpv6 type { nd-router-solicit, nd-neighbor-solicit, nd-neighbor-advert } meta priority set 0:6 ip6 dscp set cs6 counter comment "prio_orange_ICMP6" udp dport 547 meta priority set 0:6 ip6 dscp set cs6 counter comment "prio_orange_DHCP6" udp dport 67 meta priority set 0:6 ip dscp set cs6 counter comment "prio_orange_DHCP4" ether type arp meta priority set 0:6 counter comment "prio_orange_ARP" }$iface_wan1 = virtual vlan interface (832)
chain egress { type filter hook egress devices = $iface_wan1 priority filter; policy accept; jump prio_orange_vlan comment "egress-prio_orange_vlan" }
You MUST modify COS/DSCP before the very FIRST DHCP request. To do this, it is necessary to execute a script just AFTER the creation of the VLAN (832) interface (in our case, orange1). To inject nftables netdev/egress nftables rules on interface creation process, we could use the following systemd service unit.
/etc/systemd/system/netdev-egress@.service (not FULLY tested, prefer other alternative below) :
[Unit]
Description=netdev-egress pre-requisite for %i
After=network.target network-online.target
Wants=network-online.target
[Service]
Type=oneshot
ExecStartPre=/usr/lib/systemd/systemd-networkd-wait-online --interface=%i --operational-state=off --timeout=8
ExecStart=/etc/systemd/scripts/netdev-egress %i
RemainAfterExit=yes
TimeoutSec=10
A BETTER tested version (should be running just after interface link UP and before dhcp client requests):
[Unit]
Description=netdev-egress pre-requisite for %i
BindTo=sys-subsystem-net-devices-%i.device
After=sys-subsystem-net-devices-%i.device
[Service]
Type=oneshot
ExecStart=/etc/systemd/scripts/netdev-egress %i
RemainAfterExit=true
TimeoutSec=10
[Install]
WantedBy=sys-subsystem-net-devices-%i.device
/etc/systemd/scripts/netdev-egress (change iface=orange1 as required) :
note: this script apply on vlan interface (not physical) and is binded to its creation via systemd-networkd
#!/bin/sh
# apply netdev/egress priority for orange dhcp client requests
# Version 20240717
SleepRetry=3
# set orange interface
if [ -z "$1" ] ; then
iface="orange1"
else
iface="$1"
fi
echo "executing nft chain netdev filter egress device $iface"
ip link show dev $iface
if [ $? -ne 0 ] ; then
echo "ERROR : interface $iface not exist, retrying in ${SleepRetry}s..."
sleep $SleepRetry
ip link show dev $iface ; [ $? -ne 0 ] && echo "ERROR : interface $iface definitely not exist !" && exit 9
fi
echo "executing nft chain netdev filter egress device $iface"
echo ; echo "existing table netdev filter"
nft list table netdev filter
echo ; echo "applying nft chain netdev filter egress $iface"
nft add "table netdev filter"
nft add "chain netdev filter egress { type filter hook egress devices = { ${iface} } priority 0; }"
nft insert "rule netdev filter egress udp dport 67 meta priority set 0:6 ip dscp set cs6 counter comment \"egress_prio_${iface}_DHCP4\""
nft insert "rule netdev filter egress ether type arp meta priority set 0:6 counter comment \"egress_prio_${iface}_ARP\""
nft insert "rule netdev filter egress udp dport 547 meta priority set 0:6 ip6 dscp set cs6 counter comment \"egress_prio_${iface}_DHCP6\""
nft insert "rule netdev filter egress icmpv6 type { nd-router-solicit, nd-neighbor-solicit, nd-neighbor-advert } meta priority set 0:6 ip6 dscp set cs6 counter comment \"egress_prio_${iface}_ICMP6\""
#nft insert "rule netdev filter egress icmpv6 daddr { fe00::/7 } meta priority set 0:6 ip6 dscp set cs6 counter comment \"egress_prio_${iface}_ICMP6\""
echo ; echo "final nft table netdev filter"
nft list table netdev filter
echo ; echo "networkctl renew $iface"
networkctl renew $iface
echo ; echo "networkctl status $iface"
networkctl -s status $iface
Finally, enable service unit : systemctl enable netdev-egress@<vlan832-interface> and show logs journalctl -xeu netdev-egress@vlan832 :
[...]
systemd-networkd[1071]: orange1: Gained IPv6LL
[...]
systemd-networkd[1071]: orange1: DHCP: received delegated prefix xxxx::/56
[...]
systemd-networkd[1071]: orange1: DHCPv4 address xxxx/24, gateway xxxx.1 acquired from yy.yy.yy.yy.yy
Mikrotik
DHCPv4 clients use RAW SOCKETS for DISCOVER/REQUEST (init) requests and BSD/UDP SOCKETS for RENEW requests. In consequence, you CANNOT use netfilter mangle rules to change PCP and DSCP. You MUST use L2 rules (switch rules or bridge filters).
Moreover, Mikrotik limit its switch rules to INGRESS, switch rules cannot be used for EGRESS. In other terms, to change COS/PCP and DSCP on DHCPv4 requests you must use a different device (switch/router) in front of your main router.
To bypass this limitation, you can use bridge filters (instead of switch rules), BUT it is not recommended in performance point view because the CPU will be in charge of these filters.
If you want to use switch rules : ISP Fiber — Switch (switch rules) — Router (DHCP clients) If you want to use bridge filters : ISP Fiber — Router (DHCP clients + bridge filters)
note : fe00::/7 (fe80::/10 + ff02::/16)
- on switch (CRS/CCR211x) with switch rules (before ROS 7.15) :
/interface ethernet switch rule
add comment="orange1 dhcp4 COS6" dst-port=67 mac-protocol=ip new-vlan-priority=6 ports=sfp1.router protocol=udp switch=switch1 vlan-id=832
add comment="orange1 dhcp6 COS6" dst-port=547 mac-protocol=ipv6 new-vlan-priority=6 ports=sfp1.router protocol=udp switch=switch1 vlan-id=832
add comment="orange1 icmp6 COS6" dst-address6=fe00::/7 mac-protocol=ipv6 new-vlan-priority=6 ports=sfp1.router protocol=icmp switch=switch1 vlan-id=832
add comment="orange1 arp COS6" mac-protocol=arp new-vlan-priority=6 ports=sfp1.router switch=switch1 vlan-id=832
- on switch (CRS/CCR211x) with switch rules (after ROS 7.15 - modify PCP and DSCP) : note : the following is for a CRS310, you must disable tx-manager only on disabled ports (not used), and enable on router port (ingress traffic)
/interface ethernet switch set 0 qos-hw-offloading=yes
/interface ethernet switch qos profile add comment="orange PCP6 DSCP48_CS6" dscp=48 name=orange-prio-bng pcp=6 traffic-class=6
/interface ethernet switch qos port
set sfp-sfpplus4 tx-manager=offline
set sfp1 tx-manager=offline
set sfp2 tx-manager=offline
set sfp3 tx-manager=offline
set sfp4 tx-manager=offline
set sfp5 tx-manager=offline
/interface ethernet switch l3hw-settings set icmp-reply-on-error=no
/interface ethernet switch rule
add comment="orange1 arp QOS" mac-protocol=arp new-qos-profile=orange-prio-bng ports=sfpplus1.router switch=switch1 vlan-id=832
add comment="orange1 dhcp4 QOS" dst-port=67 src-port=68 mac-protocol=ip new-qos-profile=orange-prio-bng ports=sfpplus1.router protocol=udp switch=switch1 vlan-id=832
add comment="orange1 dhcp6 QOS" dst-port=547 src-port=546 mac-protocol=ipv6 new-qos-profile=orange-prio-bng ports=sfpplus1.router protocol=udp switch=switch1 vlan-id=832
add comment="orange1 icmp6 QOS" dst-address6=fe00::/7 mac-protocol=ipv6 new-qos-profile=orange-prio-bng ports=sfpplus1.router protocol=icmpv6 switch=switch1 vlan-id=832
- since ROS 7.16 it is necessary to define a param to keep PCP and DSCP (and NOT ignore) that could be defined before reaching the switch (CRS/CCR211x). For example, if you ALREADY change PCP and DSCP on a previous equipment (firewall mangle or dhcp clients for example) and if
trust-l2andtrust-l3are not defined (ignore by default), the switch will reset packets to prio 0 (and dhcp clients will not be able to authenticate to Orange). https://lafibre.info/remplacer-livebox/news-mikrotik-7-16-breaking-changes-qos-trust-l2l3
/interface ethernet switch qos port print
/interface ethernet switch qos port
set sfp1.router trust-l2=keep trust-l3=keep
set sfp2.orange1-ont trust-l2=keep trust-l3=keep
set sfp3.orange1-onu trust-l2=keep trust-l3=keep
If you have TV, add also these rules :
/interface ethernet switch qos profile add name=orange-prio-tv pcp=5 traffic-class=5
/interface ethernet switch rule add comment="orange TV PCP5" mac-protocol=ip new-qos-profile=orange-prio-tv ports=sfp1.router switch=switch1 vlan-id=840
- on router (CCR2004 - WITHOUT switch chipset ) with bridge filters :
/interface bridge filter
add action=set-priority chain=output comment="orange1 dhcp4 COS6" disabled=yes dst-port=67 ip-protocol=udp log=yes log-prefix="orange1 COS6_DHCP4" mac-protocol=ip new-priority=6 out-interface=bridge-wan1 passthrough=yes
add action=set-priority chain=output comment="orange1 dhcp6 COS6" disabled=yes dst-port=547 ip-protocol=udp log=yes log-prefix="orange1 COS6_DHCP6" mac-protocol=ipv6 new-priority=6 out-interface=bridge-wan1 passthrough=yes
add action=set-priority chain=output comment="orange1 icmp6 COS6" disabled=yes ip-protocol=icmpv6 log-prefix="orange1 COS6_ICMP6" mac-protocol=ipv6 new-priority=6 out-interface=bridge-wan1 passthrough=yes
add action=set-priority chain=output comment="orange1 arp COS6" disabled=yes log=yes log-prefix="orange1 COS6_ARP" mac-protocol=arp new-priority=6 out-interface=bridge-wan1 passthrough=yes
- firewall mangle rules are ONLY for DHCPv6 client requests (IPv6 do not use RAW SOCKETS for DHCP) :
/ipv6 firewall mangle
add action=set-priority chain=output comment="orange1 icmp6 133RS COS6" dst-address=ff00::/8 icmp-options=133:0-255 new-priority=6 out-interface=bridge-wan1 passthrough=yes protocol=icmpv6
add action=set-priority chain=output comment="orange1 icmp6 136NA COS6" dst-address=fe80::ba0:bab/128 icmp-options=136:0-255 new-priority=6 out-interface=bridge-wan1 passthrough=yes protocol=icmpv6
add action=set-priority chain=output comment="orange1 icmp6 135NS COS6" dst-address=fe80::ba0:bab/128 icmp-options=135:0-255 new-priority=6 out-interface=bridge-wan1 passthrough=yes protocol=icmpv6
add action=set-priority chain=output comment="orange1 dhcp6 COS6" dst-port=547 new-priority=6 out-interface=bridge-wan1 passthrough=yes protocol=udp src-port=546
DSCP
This step is optional and obsoleted with last ROS (7.15-16) capabilities - see previous chapter.
This is optional in 2023, and not really required (DSCP 48 match with 6 on layer 2). Since ROS 7.15, it is possible to modify DSCP directly with Switch rules (see above). note : if it do not work with new-dscp=48, try new-dscp=6
- original version :
/ipv6 firewall mangle
add action=change-dscp chain=output comment="orange1 icmp6 133RS DSCP6" dst-address=ff00::/8 icmp-options=133:0-255 new-dscp=48 out-interface=bridge-wan1 passthrough=yes protocol=icmpv6
add action=change-dscp chain=output comment="orange1 icmp6 136NA DSCP6" dst-address=fe80::ba0:bab/128 icmp-options=136:0-255 new-dscp=48 out-interface=bridge-wan1 passthrough=yes protocol=icmpv6
add action=change-dscp chain=output comment="orange1 icmp6 135NS DSCP6" dst-address=fe80::ba0:bab/128 icmp-options=135:0-255 new-dscp=48 out-interface=bridge-wan1 passthrough=yes protocol=icmpv6
add action=change-dscp chain=output comment="orange1 dhcp6 DSCP6" dst-port=547 new-dscp=48 out-interface=bridge-wan1 passthrough=yes protocol=udp src-port=546
- better version with POSTROUTING (you could also use OUTPUT chain) :
/ipv6 firewall mangle
add action=set-priority chain=prio_orange_dhcp6 comment="dhcp6 COS6" new-priority=6 passthrough=yes
add action=change-dscp chain=prio_orange_dhcp6 comment="dhcp6 DSCP6" new-dscp=48 passthrough=yes
add action=accept chain=prio_orange_dhcp6 comment="ACCEPT"
/ip firewall mangle
add action=change-dscp chain=postrouting comment="dhcp4 DSCP6" dst-port=67 new-dscp=48 out-interface=bridge-wan1 passthrough=yes protocol=udp src-port=68
/ipv6 firewall mangle
add action=jump chain=postrouting comment="jump prio_orange_icmp6" dst-address=fe00::/7 jump-target=prio_orange_icmp6 out-interface=bridge-wan1 protocol=icmp6
add action=jump chain=postrouting comment="jump prio_orange_dhcp6" dst-address=fe00::/7 dst-port=547 jump-target=prio_orange_dhcp6 out-interface=bridge-wan1 protocol=udp src-port=546
# you could also change DSCP6(48) for all COS6 packets (and remove all change-dscp rules in prio_orange_* chains)
#add action=change-dscp chain=postrouting comment="DSCP6 for all COS6" new-dscp=48 out-interface=bridge-wan1 passthrough=no priority=6
/ipv6 firewall mangle
add action=set-priority chain=prio_orange_icmp6 comment="icmp6 136NA COS6" dst-address=fe80::ba0:bab/128 icmp-options=136:0-255 new-priority=6 passthrough=yes protocol=icmp6
add action=change-dscp chain=prio_orange_icmp6 comment="icmp6 136NA DSCP6" dst-address=fe80::ba0:bab/128 icmp-options=136:0-255 new-dscp=48 passthrough=yes protocol=icmp6
add action=set-priority chain=prio_orange_icmp6 comment="icmp6 135NS COS6" dst-address=fe80::ba0:bab/128 icmp-options=135:0-255 new-priority=6 passthrough=yes protocol=icmp6
add action=change-dscp chain=prio_orange_icmp6 comment="icmp6 135NS DSCP6" dst-address=fe80::ba0:bab/128 icmp-options=135:0-255 new-dscp=48 passthrough=yes protocol=icmp6
add action=set-priority chain=prio_orange_icmp6 comment="icmp6 133RS COS6" dst-address=fe00::/7 icmp-options=133:0-255 new-priority=6 passthrough=yes protocol=icmp6
add action=change-dscp chain=prio_orange_icmp6 comment="icmp6 133RS DSCP6" dst-address=fe00::/7 icmp-options=133:0-255 new-dscp=48 passthrough=yes protocol=icmp6
add action=accept chain=prio_orange_icmp6 comment="ACCEPT"
RouterOS 7.20+
Since RouterOS version 7.20+, there is an option in dhcp client (ipv4) to set COS (vlan-priority). This option set the COS for RAW ipv4 sockets. Then, you could finaly use firewall mangle rules to set COS (and DSCP) for ipv6 (which are NOT RAW). No more switch rules or bridge filters are required. In the following code block, OUTPUT is used, but you could also use POSTROUTING chain…
# DO NOT FORGET TO SET VLAN-PRIORITY AND DSCP IN DHCP4 CLIENT
/ip dhcp-client add dscp=48 interface=orange1 vlan-priority=6
/ip firewall mangle
add action=set-priority chain=prio_orange comment="dhcp COS6" new-priority=6 passthrough=yes
add action=change-dscp chain=prio_orange comment="dhcp DSCP48" new-dscp=48 passthrough=yes
add action=accept chain=prio_orange comment="ACCEPT"
/ipv6 firewall mangle
add action=set-priority chain=prio_orange comment="dhcp COS6" new-priority=6 passthrough=yes
add action=change-dscp chain=prio_orange comment="dhcp DSCP48" new-dscp=48 passthrough=yes
add action=accept chain=prio_orange comment="ACCEPT"
/ip firewall mangle
add action=jump chain=output comment="orange dhcp4" dst-port=67 jump-target=prio_orange out-interface=orange1 protocol=udp src-port=68
/ipv6 firewall mangle
add action=jump chain=output comment="orange icmp6" dst-address=fe00::/7 jump-target=prio_orange out-interface=orange1 protocol=icmpv6
add action=jump chain=output comment="orange dhcp6" dst-address=fe00::/7 dst-port=547 jump-target=prio_orange out-interface=orange1 protocol=udp src-port=546
Note: ARP packets should also be modified (new-priority=6 and new-dscp=48), but it is not currently mandatory. There is also no specific setting to do this. Let’s see if DHCP(v4/v6) settings are sufficients…
DHCP clients
systemd-networkd
note : to check interface status, use networkctl -s status <iface>
- /etc/systemd/network/wan1.network :
[Match]
Name=wan1
[Network]
ConfigureWithoutCarrier=true
Address=192.168.2.254/24
Description=WAN1 Orange1
VLAN=orange1
IPv6AcceptRA=no
[DHCP]
UseDNS=false
- /etc/systemd/network/orange1.netdev :
[NetDev]
Name=orange1
Kind=vlan
MACAddress=<livebox_macaddr>
[VLAN]
Id=832
EgressQOSMaps=6-6 # systemd v253 only
- /etc/systemd/network/orange1.network :
[Match]
Name=orange1
[Network]
Description=Orange1
LinkLocalAddressing=ipv6
DHCP=yes
#IPForward=yes
IPv4Forwarding=yes
IPv6Forwarding=yes
IPv6AcceptRA=yes
DHCPPrefixDelegation=yes
# define Orange IPs (prefer pure dhcp for IPv4/DHCPv4 and manually for IPv6)
#Address=80.xx.xx.xx/24
#Address=2a01:xx:xx:xx::254/64
[DHCPv4]
# use only ClientIdentifier=mac ; equivalent to DUIDType=link-layer (not required) ; try DUIDRawData=01:<livebox_macaddr> ; reset ONT could be required
ClientIdentifier=mac
# it could be a good idea to define a static IAID (just an integer, same for dhcpv6, not mandatory)
#IAID=123456
VendorClassIdentifier=sagem
# SendOption=77:string:... == UserClass - https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1138756
# UserClass=FSVDSL_livebox.Internet.softathome.Livebox7
# SendOption=77:string:\x2b\x46\x53\x56\x44\x53\x4c\x5f\x6c\x69\x76\x65\x62\x6f\x78\x2e\x49\x6e\x74\x65\x72\x6e\x65\x74\x2e\x73\x6f\x66\x74\x61\x74\x68\x6f\x6d\x65\x2e\x4c\x69\x76\x65\x62\x6f\x78\x37
SendOption=77:string:\x2b\x46\x53\x56\x44\x53\x4c\x5f\x6c\x69\x76\x65\x62\x6f\x78\x2e\x49\x6e\x74\x65\x72\x6e\x65\x74\x2e\x73\x6f\x66\x74\x61\x74\x68\x6f\x6d\x65\x2e\x4c\x69\x76\x65\x62\x6f\x78\x37
SendOption=90:string:<authentication_string>
\x68\x89\xa2\x63
UseHostname=no
UseDNS=no
UseDomains=no
UseNTP=no
#UseAddress=no
SendHostname=no
RouteMetric=0
# systemd v253 only
IPServiceType=CS6
SocketPriority=6
[DHCPv6]
# prefer DUIDType=link-layer (mac_addr of interface MUST be equal to livebox_macaddr>) ; try DUIDRawData=00:03:00:01:<livebox_macaddr> (should work) or DUIDRawData=00:03:00::<livebox_macaddr> (should not work) ; reset ONT could be required
#DUIDRawData=00:03:00:01:58:1D:D8:xx:xx:xx
DUIDType=link-layer
# it could be a good idea to define a static IAID (just an integer, same for dhcpv4, not mandatory)
#IAID=123456
# SendOption=16:string: == VendorClassIdentifier (use ONLY SendOption=16:string: in DHCPv6)
SendOption=16:string:\x00\x00\x04\x0e\x00\x05\x73\x61\x67\x65\x6d
# SendOption=15:string:\x00... == UserClass (add the prefix \x00)
# UserClass=FSVDSL_livebox.Internet.softathome.Livebox7
# SendOption=15:string:\x00\x2b\x46\x53\x56\x44\x53\x4c\x5f\x6c\x69\x76\x65\x62\x6f\x78\x2e\x49\x6e\x74\x65\x72\x6e\x65\x74\x2e\x73\x6f\x66\x74\x61\x74\x68\x6f\x6d\x65\x2e\x4c\x69\x76\x65\x62\x6f\x78\x37
SendOption=15:string:\x00\x2b\x46\x53\x56\x44\x53\x4c\x5f\x6c\x69\x76\x65\x62\x6f\x78\x2e\x49\x6e\x74\x65\x72\x6e\x65\x74\x2e\x73\x6f\x66\x74\x61\x74\x68\x6f\x6d\x65\x2e\x4c\x69\x76\x65\x62\x6f\x78\x37
SendOption=11:string:<authentication_string>
\x68\x89\xa2\x63
UseHostname=no
UseDNS=no
UseDomains=no
UseNTP=no
UseAddress=no
SendHostname=no
RouteMetric=1024
WithoutRA=solicit
# disable rapid commit (simple standard)
RapidCommit=no
#PrefixDelegationHint=::/56
[IPv6AcceptRA]
DHCPv6Client=always
UseDNS=no
UseDomains=no
[DHCPPrefixDelegation]
# SubnetId in Hexa (<0xY>=...:xxxY::/64)
# Token to use xxxY<token>/64 (<::Z>=xxxY::Z/64)
# Assign=no to disable addr definition
SubnetId=0x2
Token=::254
Assign=yes
UplinkInterface=:self
Announce=no
- OPTIONNAL FOR PREFIX DELEGATION ONLY on “lan” interface /etc/systemd/network/lan.network :
#[Link]
#RequiredForOnline=no
[Network]
DHCPServer=yes
DHCPPrefixDelegation=yes
IPv6SendRA=yes
IPv6AcceptRA=no
[Address]
Address=<lan_ip4_subnet>
[DHCPServer]
PoolSize=30
EmitRouter=yes
EmitTimezone=yes
Timezone=Europe/Paris
[DHCPPrefixDelegation]
# SubnetId in Hexa (<0xY>=...:xxxY::/64)
# Token to use xxxY<token>/64 (<::Z>=xxxY::Z/64)
# Assign=no to disable addr definition
SubnetId=0x20
Token=::254
Announce=yes
- for debugging /etc/system/systemd-networkd.service.d/10-debug.conf :
[Service]
Environment=SYSTEMD_LOG_LEVEL=debug
note : since systemd v253, new options [EgressQOSMaps, IPServiceType, SocketPriority] exists to modify COS and DSCP to 6 on DHCPv4 (https://github.com/systemd/systemd/pull/25904).
WARNING : You always have to modify COS and DSCP for DHCPv6 (and ICMPv6). Todo this use the previous nftables rules (see paragraph).
Authentication Strings
Remplacer la livebox par systemd-networkd / nftables
To strictly follow Orange recommendation, you have to renew authentications strings each time. Here is the requirements to do this with native systemd-netword environment file feature. Currently, it is NOT mandatory, but it could be one day…
- /etc/networkd-orange/networkd-orange-env.sh
#!/bin/bash
set -eu
log() {
local level="$1"
shift
printf '%-5s %s\n' "$level" "$*"
}
# Destination
IN_OUT_PATH="${IN_OUT_PATH:-/etc/networkd-orange}"
FILE_NAME="${FILE_NAME:-orange.env}"
# Orange vars
LOGIN="${LOGIN:-<default>}"
PASSWORD="${PASSWORD:-<default>}"
LIVEBOX_VERSION="${LIVEBOX_VERSION:-<default>}"
LIVEBOX_HARDWARE="${LIVEBOX_HARDWARE:-<default>}"
log INFO "Orange parameters"
log INFO " Login: ********"
log INFO " Password: ********"
log INFO " Livebox Version: ${LIVEBOX_VERSION}"
log INFO " Livebox Hardware: ${LIVEBOX_HARDWARE}"
# Check for default values
if [ $LOGIN == "<default>" ]; then
log WARN " * LOGIN is default value !"
fi
if [ $PASSWORD == "<default>" ]; then
log WARN " * PASSWORD is default value !"
fi
if [ $LIVEBOX_VERSION == "<default>" ]; then
log WARN " * LIVEBOX_VERSION is default value !"
fi
if [ $LIVEBOX_HARDWARE == "<default>" ]; then
log WARN " * LIVEBOX_HARDWARE is default value !"
fi
# Forge DHCP option 90
tohex() {
for h in $(echo $1 | sed "s/\(.\)/\1 /g"); do printf %02x \'$h; done
}
addsep() {
echo $(echo $1 | sed "s/\(.\)\(.\)/:\1\2/g")
}
r=$(dd if=/dev/urandom bs=1k count=1 2>&1 | md5sum | cut -c1-16)
id=${r:0:1}
h=3c12$(tohex ${r})0313$(tohex ${id})$(echo -n ${id}${PASSWORD}${r} | md5sum | cut -c1-32)
log INFO "Generating Orange DHCP values"
# vendor class
export VENDOR_CLASS_IDENTIFIER_4=${LIVEBOX_HARDWARE}
export VENDOR_CLASS_IDENTIFIER_6=00:00:04:0e:00:05$(addsep $(tohex ${LIVEBOX_HARDWARE}))
log INFO " Vendor class has been generated"
# user class
export USER_CLASS_4=+FSVDSL_livebox.Internet.softathome.Livebox${LIVEBOX_VERSION}
export USER_CLASS_6=00$(addsep $(tohex "+FSVDSL_livebox.Internet.softathome.Livebox${LIVEBOX_VERSION}"))
log INFO " User class has been generated"
# option 90
export AUTHENTICATION_STR=00:00:00:00:00:00:00:00:00:00:00:1a:09:00:00:05:58:01:03:41:01:0d$(addsep $(tohex ${LOGIN})${h})
log INFO " Option 90 has been generated"
# Generate DHCP option for networkd
envsubst < ${IN_OUT_PATH}/${FILE_NAME}.template > ${IN_OUT_PATH}/${FILE_NAME}
log INFO "Generating env vars files"
log INFO " Source = ${IN_OUT_PATH}/${FILE_NAME}.template"
log INFO " Destination = ${IN_OUT_PATH}/${FILE_NAME}"
- /etc/systemd/system/networkd-orange-env.service
[Unit]
Description=Generate networkd-orange.env before systemd-networkd
Before=systemd-networkd.service
Requires=network-pre.target
DefaultDependencies=no
[Service]
EnvironmentFile=/etc/networkd-orange/networkd-orange-env.env
Type=oneshot
ExecStart=/etc/networkd-orange/networkd-orange-env.sh
UMask=0077
[Install]
WantedBy=systemd-networkd.service
- /etc/networkd-orange/networkd-orange-env.env (change values as required)
# Orange variables
LOGIN=fti/XXXXX
PASSWORD=XXXXXXX
LIVEBOX_VERSION=6
LIVEBOX_HARDWARE=sagem
# Destination and filename (template + gen file)
IN_OUT_PATH="/etc/networkd-orange"
FILE_NAME="orange.env"
- /etc/networkd-orange/networkd-orange-env.template
# IPV4
VendorClassIdentifier4=${VENDOR_CLASS_IDENTIFIER_4}
UserClass4=${USER_CLASS_4}
# IPV6
VendorClassIdentifier6=${VENDOR_CLASS_IDENTIFIER_6}
UserClass6=${USER_CLASS_6}
# Global
Authentication=${AUTHENTICATION_STR}
- modify (or copy) systemd-networkd.service and add
[Service]
EnvironmentFile=/etc/networkd-orange/orange.env
- update you systemd-networkd orange config file (/etc/systemd/network/orange.network for example)
[DHCPv4]
VendorClassIdentifier=$VendorClassIdentifier4
UserClass=$UserClass4
SendOption=90:string:$Authentication
[DHCPv6]
VendorClassIdentifier=$VendorClassIdentifier6
UserClass=$UserClass6
SendOption=SendOption=11:string:$Authentication
- install service
chmod 750 /etc/networkd-orange/networkd-orange-env.sh
chmod 640 /etc/networkd-orange/networkd-orange-env.env
chown root:root /etc/networkd-orange/networkd-orange-env.env
chmod 644 /etc/systemd/system/networkd-orange-env.service
systemctl enable /etc/systemd/system/networkd-orange-env.service
systemctl restart systemd-networkd
The result should be:
systemd[1]: Starting networkd-orange-env.service - Generate /etc/networkd-orange/network.env before systemd-networkd...
[6368]: INFO Orange parameters
[6368]: INFO Login: ********
[6368]: INFO Password: ********
[6368]: INFO Livebox version: 6
[6368]: INFO Livebox hardware: sagem
[6368]: INFO Generating Orange DHCP values
[6368]: INFO Vendor class has been generated
[6368]: INFO User class has been generated
[6368]: INFO Option 90 has been generated
[6368]: INFO Generating env vars files
[6368]: INFO Source = /etc/networkd-orange/networkd-orange.template
[6368]: INFO Destination = /etc/networkd-orange/orange.env
systemd[1]: networkd-orange-env.service: Deactivated successfully.
systemd[1]: Finished networkd-orange-env.service - Generate /etc/networkd-orange/orange.env before systemd-networkd.
Mikrotik
- ipv4
/ip/dhcp-client/print detail
interface=vlan832-orange1.wan1 add-default-route=no use-peer-dns=no use-peer-ntp=no dhcp-options=hostname,clientid,authsend,userclass,vendor-class-identifier
script=
:if ($bound=1) do={
/log info "dhcp4-client script begin"
# multiwan
/routing rule set [find where action=lookup table=route-wan1 ] src-address=$"lease-address"
ip route set [find where dst-address="0.0.0.0/0" routing-table=route-wan1 distance=1 ] gateway=$"gateway-address" comment="wan1 - FIB - dhclient"
# recursive
#/ip route set [find where dst-address="1.0.0.1/32" scope=10 routing-table=main] gateway=$"gateway-address"
#/ip route set [find where dst-address="8.8.4.4/32" scope=10 routing-table=main] gateway=$"gateway-address"
#/ip route set [find where dst-address="9.9.9.10/32" scope=10 routing-table=main] gateway=$"gateway-address"
# not recursive
/ip route set [find where dst-address="0.0.0.0/0" routing-table=main distance=1 ] gateway=$"gateway-address" comment="wan1 - def - dhclient"
/ip route set [find where dst-address="0.0.0.0/0" routing-table=main distance=101 ] gateway=$"gateway-address" comment="wan1 - persist - dhclient"
# update routes oneshot (not tested)
#/ip route set [ find where immediate-gw~$"interface" dst-address=0.0.0.0/0 ] gateway=$"gateway-address"
# netwatch
/tool netwatch set [find where comment="wan1 - ipv4 - dhclient" ] src-address=$"lease-address"
/log info "dhcp4-client script finished"
}
status=bound address=xx.xx.xx.xx/24 gateway=xx.xx.xx.1 dhcp-server=80.xx.xx.xx primary-dns=xx.xx.xx.xx secondary-dns=xx.xx.xx.xx expires-after=5d5h16s
/ip/dhcp-client/option/print detail
0 name="vendor-class-identifier" code=60 value="0x736167656d" raw-value="736167656d"
1 name="userclass" code=77 value="0x2b46535644534c5f6c697665626f782e496e7465726e65742e736f66746174686f6d652e4c697665626f7836" raw-value="2b46535644534c5f6c697665626f782e496e7465726e65742e736f66746174686f6d652e4c697665626f7836"
2 name="authsend" code=90 value="0x00000000000000000000001A090000055801034101xxxxxxxxxxx"
raw-value="00000000000000000000001a090000055801034101xxxxxxxxxx"
3 name="clientid_duid" code=61 value="0xff$(CLIENT_DUID)" raw-value="ff"
4 name="clientid" code=61 value="0x01$(CLIENT_MAC)" raw-value="01"
5 name="hostname" code=12 value="$(HOSTNAME)" raw-value="xxxxxx"
- ipv6
/ipv6/dhcp-client/print detail
interface=vlan832-orange1.wan1 status=bound duid="0x000300xxxxxxxxx" dhcp-server-v6=fe80::ba0:bab request=prefix add-default-route=yes default-route-distance=1 use-peer-dns=no use-interface-duid=yes rapid-commit=no dhcp-options=authsend,userclass,class-identifier pool-name="pool6-wan1" pool-prefix-length=64 prefix-hint=::/0
script=
:if ($"pd-valid" = 1) do={
/log info "dhcp6-client script begin"
:local iface "vlan832-orange1.wan1"
# infos
:local pdprefix $"pd-prefix"
:local naaddress $"na-address"
/log info "dhcp6-client infos interface:$iface pd-prefix:$pdprefix na-address:$naadress"
# netmap
##:set pdprefix ([:pick $"pd-prefix" 0 [:find $"pd-prefix" "/"]]."/56");
##/log info "dhcp6-client cleaned pd-prefix is $pdprefix"
/ipv6/firewall/nat set [find where out-interface=$iface ] to-address=$"pd-prefix"
## netwatch
##/tool netwatch set [find where comment="wan1 - ipv6 - dhclient" ] src-address=$"na-address"
/log info "dhcp6-client script finished"
}
dhcp-options=authsend,userclass,class-identifier prefix=xx:xx:xx:xx::/56, 6d23h46m11s
/ipv6/dhcp-client/option/print detail
0 name="class-identifier" code=16 value="0x0000040e0005736167656d" raw-value="0000040e0005736167656d"
1 name="userclass" code=15 value="0x002b46535644534c5xxxxxxx" raw-value="002b46535644534c5f6c697665626f782e4xxxxx"
2 name="authsend" code=11 value="0x00000000000000000000001A0900xxxxxx" raw-value="00000000000000000000001a0900xxx"
dhcpcd
dhcpcd is using NetworkConfiguration
https://roy.marples.name/projects/dhcpcd https://github.com/NetworkConfiguration/dhcpcd
noipv4ll
nohook hostname resolv.conf timesyncd.conf
allowinterfaces orange1
debug
logfile /var/log/dhcpcd.log
noauthrequired
noarp
noipv6rs
interface orange1
iaid xxxxxxxx
ia_pd xxxxxxxx br0//64
ipv6rs
clientid
userclass FSVDSL_livebox.Internet.softathome.Livebox6
vendclass 1038 sagem
vendorclassid sagem
broadcast
option subnet_mask routers domain_name_servers domain_name broadcast_address dhcp_lease_time dhcp_renewal_time dhcp_rebinding_time domain_search sip_server 125 auth
option dhcp6_vivso dhcp6_name_servers dhcp6_domain_search dhcp6_auth
nooption 33 57
authprotocol token 0x123/0x456
authtoken 0x456 "" forever 64:68:63:70:6c:69:76:65:62:6f:78:66:72:32:35:30
authtoken 0x123 "" forever 1a:09:00:00:05:58:01:03:41:01:0d:66:74:69:2f:...
ISC dhclient
WARNING : ISC dhclient is deprecated since 2023, prefer systemd-networkd
Do not forget to :
- define Enter and Exit hooks
- use so_priority or LD_PRELOAD to force packets COS6
-
if necessary and to avoid /etc/resolv.conf overwrite, use
chattr +i /etc/resolv.conf - launch command lines :
iface="orange1"
cfgdir=...
leasedir=...
piddir=...
dhclient -4 -cf ${cfgdir}/${iface}_4.conf -pf ${piddir}/${iface}_4.pid -lf ${leasedir}/${iface}_4.leases $iface
dhclient -6 -cf ${cfgdir}/${iface}_6.conf -pf ${piddir}/${iface}_6.pid -lf ${leasedir}/${iface}_6.leases -P -nw $iface
- /etc/dhclient/orange1_4.conf :
option rfc3118-authentication code 90 = string;
interface "orange1" {
timeout 60;
retry 1;
select-timeout 0;
#supersede dhcp-renewal-time 30;
#supersede dhcp-rebinding-time 60;
#supersede dhcp-lease-time 90;
send vendor-class-identifier "sagem";
send user-class "+FSVDSL_livebox.Internet.softathome.Livebox4";
send rfc3118-authentication 00:00:00:00:00:00:<authentication_string>;
send dhcp-client-identifier 01:<livebox_mac>;
request subnet-mask, routers, broadcast-address;
#request subnet-mask, routers, domain-name-servers, domain-name, broadcast-address, dhcp-lease-time, dhcp-renewal-time, dhcp-rebinding-time, rfc3118-authentication;
#request subnet-mask, broadcast-address, dhcp-lease-time, dhcp-renewal-time, dhcp-rebinding-time, rfc3118-authentication;
}
- /etc/dhclient/orange1_6.conf :
option dhcp6.auth code 11 = string;
option dhcp6.userclass code 15 = string;
option dhcp6.vendorclass code 16 = string;
interface "orange1" {
timeout 60;
retry 1;
select-timeout 0;
send dhcp6.vendorclass 00:00:04:0e:00:05:73:61:67:65:6d;
send dhcp6.userclass 00:2b:46:53:56:44:53:4c:5f:6c:69:76:65:62:6f:78:2e:49:6e:74:65:72:6e:65:74:2e:73:6f:66:74:61:74:68:6f:6d:65:2e:4c:69:76:65:62:6f:78:34;
send dhcp6.auth 00:00:00:00:00:00:00:00:<authentication_string>;
send dhcp6.client-id 00:03:00:01:<livebox_mac>;
also request dhcp6.auth, dhcp6.vendorclass, dhcp6.userclass, dhcp6.vendor-opts;
}
so_priority
This utility must be used with dhcp client utility (like dhclient or dhpcd, NOT systemd). It provide the ability to run the dhcp client with a modified Socket Priority. It is using LD_PRELOAD feature. WARNING : It is NOT compatible with systemd-networkd (which have built-in params to do COS6) !
https://git.kindwolf.org/so_priority.so/ https://lafibre.info/remplacer-livebox/petit-ld_preload-pour-amateurs-de-setsockopt/
- compilation
gcc -shared -ldl -fPIC so_priority.c -o so_priority.so
- usage
SO_PRIORITY_DEBUG=1 SO_PRIORITY_VALUE=6 LD_PRELOAD=/path/to/so_priority.so program arg1 arg2
- source code
/*
Set SO_PRIORITY right after each socket() call.
Compile with: gcc -shared -ldl -fPIC so_priority.c -o so_priority.so
Usage: SO_PRIORITY_DEBUG=1 SO_PRIORITY_VALUE=6 LD_PRELOAD=/path/to/so_priority.so program arg1 arg2
(c) 2020 - Xavier Guerrin
This program is free software. It comes without any warranty, to
the extent permitted by applicable law. You can redistribute it
and/or modify it under the terms of the Do What The Fuck You Want
To Public License, Version 2, as published by Sam Hocevar. See
http://www.wtfpl.net/ for more details.
*/
#define _GNU_SOURCE /* RTLD_NEXT */
#include <dlfcn.h> /* dlsym, dlerror */
#include <errno.h> /* errno */
#include <stdio.h> /* dprintf */
#include <stdlib.h> /* atoi, getenv */
#include <string.h> /* strerror */
#include <sys/types.h> /* setsockopt */
#include <sys/socket.h> /* setsockopt */
#ifndef SOPRIORITY_SO_NAME
#define SOPRIORITY_SO_NAME "so_priority.so"
#endif
#ifndef SOPRIORITY_VALUE_EV
#define SOPRIORITY_VALUE_EV "SO_PRIORITY_VALUE"
#endif
#ifndef SOPRIORITY_DEBUG_EV
#define SOPRIORITY_DEBUG_EV "SO_PRIORITY_DEBUG"
#endif
typedef int (*socket_function_type)(int, int, int);
/* Pointer to the actual socket symbol. */
socket_function_type so_priority_socket = NULL;
/* SO_PRIORITY value to set; can be configured using the SO_PRIORITY_VALUE environment variable. */
int so_priority_value = 0;
/* Debug level; can be configured using the SO_PRIORITY_DEBUG environment variable. */
int so_priority_debug = 0;
int so_priority_known = 0;
/* Ask the linker to provide the actual "socket" symbol: */
static int so_priority_get_socket() {
char *error_string;
so_priority_socket = (socket_function_type)dlsym(RTLD_NEXT, "socket");
if (!so_priority_socket) {
error_string = dlerror();
if (error_string) {
dprintf(2, "%s: unable to find the actual socket symbol: %s\n", SOPRIORITY_SO_NAME, error_string);
}
else {
dprintf(2, "%s: unable to find the actual socket symbol\n", SOPRIORITY_SO_NAME);
}
return 0;
}
return 1;
}
/* Read the priority value from the environment. */
static void so_priority_set_options() {
char *str;
str = getenv(SOPRIORITY_VALUE_EV);
if (str) so_priority_value = atoi(str);
str = getenv(SOPRIORITY_DEBUG_EV);
if (str) so_priority_debug = atoi(str);
so_priority_known = 1;
}
/* Wrapper around the actual socket() function that sets SO_PRIORITY by calling setsockopt(). */
int socket(int domain, int type, int protocol) {
int ret, setsockopt_errno, socket_errno, sockfd;
if (!so_priority_socket && !so_priority_get_socket()) {
errno = ENOENT;
return -1;
}
/* Actually call socket(): */
sockfd = so_priority_socket(domain, type, protocol);
/* Do not call setsockopt() if socket() failed: */
if (sockfd < 0) return sockfd;
/* Time for the actual work: */
socket_errno = errno;
if (!so_priority_known) so_priority_set_options();
ret = setsockopt(sockfd, SOL_SOCKET, SO_PRIORITY, &so_priority_value, sizeof(so_priority_value));
/* Ignore setsockopt() errors, except for debugging purposes. */
if (so_priority_debug) {
setsockopt_errno = errno;
dprintf(2, "%s: setsockopt(%d, SOL_SOCKET, SO_PRIORITY, %d, %zu) returned %d",
SOPRIORITY_SO_NAME, sockfd, so_priority_value, sizeof(so_priority_value), ret);
if (ret < 0) dprintf(2, "; errno is %d: %s", setsockopt_errno, strerror(setsockopt_errno));
dprintf(2, "\n");
}
errno = socket_errno;
return sockfd;
}
- Archlinux PKGBUILD
# https://git.kindwolf.org/so_priority.so/
# https://lafibre.info/remplacer-livebox/petit-ld_preload-pour-amateurs-de-setsockopt/
# USAGE : SO_PRIORITY_DEBUG=1 SO_PRIORITY_VALUE=6 LD_PRELOAD=/path/to/so_priority.so program arg1 arg2
pkgname=so_priority
pkgver=1.0
pkgrel=0
pkgdesc='Set SO_PRIORITY (aka skb->priority) right after each socket() call.'
arch=('i686' 'x86_64')
url="https://git.kindwolf.org/so_priority.so"
license=('GPL3')
source=(https://git.kindwolf.org/so_priority.so/raw/master/so_priority.c)
validpgpkeys=(
'SKIP'
)
sha256sums=(
'SKIP')
build() {
cd "$srcdir"/
gcc -shared -ldl -fPIC so_priority.c -o so_priority.so
}
package() {
cd "$srcdir"/
for s in *.so; do
install -Dm755 $s "$pkgdir/usr/lib/so_priority/$s"
done
}
Debug & Troubleshoot
- If you get no answer from Orange DHCP server and everything seems to be ok, try to force release multiple times and disconnect a few minutes the ONT (fiber link) to force DHCP lease expiration.
- In some case, you just have to remove dhcp client lease file (see relative documentation of each dhcp client).
- Sometimes, when switching hardware or interface on the same fiber link, you will encounter IAID issue. In this case the DHCPv6 server (ISP) will give NO PREFIX answer. You have to disconnect fiber link for at least 10-20min. Then reconnect and retry DHCP requests. You should have no issue with DHCPv4. Check also option 17 (vendor_opt) answer, if everything is correct, try again to disconnect fiber link for a few minutes.
-
Finally try to regenerate authentication options (90 for DHCPv4 and 11 for DHCPv6). Sometimes, it could be necessary to regenerate authentication options, after a few months for example…
- For COS 6 verification check the first line tcpdump trace, check :
'[vlan ${vlan}, p X]' : ..., ethertype 802.1Q (0x8100), length XXX: vlan ${vlan}, p X, ethertype IPv4 (0x0800), ...
- For ipv6 DUID/IAID/Prefix debug :
https://www.linuxquestions.org/questions/showthread.php?p=6259784#post6259784 https://ipv6.web.cern.ch/content/linux-client-doesnt-get-ipv6-address-dhcpv6
- tcpdump command lines
# prefer :
tcpdump -vnei wan1 '(udp port 546 or port 547) or icmp6'
# alternatives :
tcpdump -i wan1 -ne -vv "(udp port 546 and port 547)"
tcpdump -i wan1 -vvv -n ip6 “(udp port 546 and port 547)”
tcpdump -vnes0 -i wan1 udp port 67 or port 68 or port 546 or port 547
tcpdump -vvvvv -ttt -i wan1 'icmp6 and (ip6[40] = 134 or ip6[40] = 133 or ip6[40] = 135 or ip6[40] = 136 or ip6[40] = 129 or ip6[40] = 128 or ip6[40] = 3 or ip6[40] = 2 or ip6[40] = 1)' -w /tmp/capture.pcap # use wireshark to analyse /tmp/capture.pcap
- For DHCP response : https://lafibre.info/remplacer-livebox/durcissement-du-controle-de-loption-9011-et-de-la-conformite-protocolaire/24/ In DHCP response, there is an option (DHCPv4 [125] et DHCPv6 [17|vendor_opts_]) in return with 2 bytes information : 000100XXXX ffffffffff
-
- 00xx : OK, everything is fine
-
- 01xx : box model, firmware or line issue (0102:too aggressive requests, 0199:bad COS)
-
- 02xx : bad login/password (or encoding)
-
- 03xx : account already unregistered
-
- 04xx : billing issue
- If your connection is up and running, BUT (after some times) your download/upload speed is SLOW, it should be related to a QOS issue : The standard flow (everything except DHCP related traffic) QOS MUST be 0 (zero) Everything related to DHCP (DHCPv4/6 init|renew ; ICMPv6 ; ARP) QOS MUST be 6 (six)
Systemd-networkd
- use DUIDType=link-layer
- from tcpdump : client-ID hwaddr 44d4540axxxx ; IA_PD-prefix 2a01::xxxx::/56 ; IA_PD IAID:22882960xx
- check interface status : networkctl status <iface>
DHCP6 Client IAID: 0x8864a065 DHCP6 Client DUID: DUID-LL:000144d4540axxxx0000
tcpdump sample trace :
dhcp6 solicit (xid=6461b1 (rapid-commit) (IA_PD IAID:22882960xx T1:0 T2:0) (Client-FQDN) (user-class) (option-request opt_82) (client-ID hwaddr type 1 44d4540axxxx)
dhcp6 advertise (xid=6461b1 (IA_PD IAID:22882960xx T1:83812 T2:207360 (IA_PD-prefix 2a01:xxxx::/56 pltime:259200 vltime:259200)) (server-ID vid 0000055844455348) (client-ID hwaddr type 1 44d4540axxxx)
dhcp6 request (xid=76595c (server-ID vid 0000055844455348) (IA_PD IAID:22882960xx T1:0 T2:0 (IA_PD-prefix 2a01:xxxx::/56 pltime:0 vltime:0)) (Client-FQDN) (user-class) (client-ID hwaddr type 1 44d4540axxxx)
dhcp6 reply (xid=76595c (IA_PD IAID:22882960xx T1:86413 T2:207360 (IA_PD-prefix 2a01:xxxx::/56 pltime:259200 vltime:259200)) (server-ID vid 0000055844455348) (client-ID hwaddr type 1 44d4540axxxx)
Mikrotik
Sometimes, when switching hardware or interface on the same fiber link, you will encounter IAID issue. In this case ipv6 DHCP client will give you NO PREFIX answer from DHCP server.
To determine what IAID will be used, convert internal ID of an interface on which DHCP client is running from hex to decimal. For example, DHCP client is running on interface pppoe-out1. To get internal ID use following command :
/interface> :put \[find name="vlan832-orange1"]
For example, you will get : *15
Now convert hex value 15 to decimal and you get IAID=21
routerOS command line to snif interface and send to a remote host :
xxxxxx] > /tool/sniffer/export
# apr/20/2023 19:01:18 by RouterOS 7.6
# software id = xxxxxx
#
# model = CCR2004-1G-12S+2XS
# serial number = xxxxxxx
/tool sniffer
set file-limit=100000KiB filter-interface=br-wan filter-ip-protocol=udp filter-port=bootps,bootpc,546,547 filter-stream=yes memory-limit=5000KiB memory-scroll=no streaming-enabled=yes streaming-server=192.168.xxx.xxx
VLAN 2800 mapping
In some cases, the ONU/ONT is mapping the VLAN 832 on VLAN 2800. See the post https://github.com/Anime4000/RTL960x/issues/282#issuecomment-2089248396.
You have to connect on the ONU/ONT and use command omcicli:
# omcicli mib get 84
XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
VlanTagFilterData
XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
=================================
EntityID: 0x1102
FilterTbl[0]: PRI 0,CFI 0, VID 2800
FwdOp: 0x10
NumOfEntries: 1
=================================
=================================
EntityID: 0x1103
FilterTbl[0]: PRI 0,CFI 0, VID 835
FwdOp: 0x10
NumOfEntries: 1
=================================
=================================
EntityID: 0x1104
FilterTbl[0]: PRI 0,CFI 0, VID 852
FwdOp: 0x10
NumOfEntries: 1
=================================
=================================
EntityID: 0x110b
FilterTbl[0]: PRI 0,CFI 0, VID 835
FilterTbl[2]: PRI 0,CFI 0, VID 852
FilterTbl[4]: PRI 0,CFI 0, VID 2800
FwdOp: 0x10
NumOfEntries: 3
=================================
# omcicli mib get 171
XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
ExtVlanTagOperCfgData
XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
=================================
EntityId: 0x101
AssociationType: 2
ReceivedFrameVlanTagOperTableMaxSize: 0
InputTPID: 0x8100
OutputTPID: 0x8100
DsMode: 0
ReceivedFrameVlanTaggingOperTable
INDEX 0
Filter Outer : PRI 15,VID 4096, TPID 0
Filter Inner : PRI 7,VID 851, TPID 5, EthType 0x00
Treatment Outer : PRI 15,VID 0, TPID 0, RemoveTags 1
Treatment Inner : PRI 7,VID 852, TPID 2
INDEX 1
Filter Outer : PRI 15,VID 4096, TPID 0
Filter Inner : PRI 6,VID 851, TPID 5, EthType 0x00
Treatment Outer : PRI 15,VID 0, TPID 0, RemoveTags 1
Treatment Inner : PRI 5,VID 852, TPID 2
INDEX 2
Filter Outer : PRI 15,VID 4096, TPID 0
Filter Inner : PRI 5,VID 851, TPID 5, EthType 0x00
Treatment Outer : PRI 15,VID 0, TPID 0, RemoveTags 1
Treatment Inner : PRI 4,VID 852, TPID 2
INDEX 3
Filter Outer : PRI 15,VID 4096, TPID 0
Filter Inner : PRI 4,VID 851, TPID 5, EthType 0x00
Treatment Outer : PRI 15,VID 0, TPID 0, RemoveTags 1
Treatment Inner : PRI 4,VID 852, TPID 2
INDEX 4
Filter Outer : PRI 15,VID 4096, TPID 0
Filter Inner : PRI 3,VID 851, TPID 5, EthType 0x00
Treatment Outer : PRI 15,VID 0, TPID 0, RemoveTags 1
Treatment Inner : PRI 3,VID 852, TPID 2
INDEX 5
Filter Outer : PRI 15,VID 4096, TPID 0
Filter Inner : PRI 2,VID 851, TPID 5, EthType 0x00
Treatment Outer : PRI 15,VID 0, TPID 0, RemoveTags 1
Treatment Inner : PRI 2,VID 852, TPID 2
INDEX 6
Filter Outer : PRI 15,VID 4096, TPID 0
Filter Inner : PRI 1,VID 851, TPID 5, EthType 0x00
Treatment Outer : PRI 15,VID 0, TPID 0, RemoveTags 1
Treatment Inner : PRI 1,VID 852, TPID 2
INDEX 7
Filter Outer : PRI 15,VID 4096, TPID 0
Filter Inner : PRI 0,VID 851, TPID 5, EthType 0x00
Treatment Outer : PRI 15,VID 0, TPID 0, RemoveTags 1
Treatment Inner : PRI 0,VID 852, TPID 2
INDEX 8
Filter Outer : PRI 15,VID 4096, TPID 0
Filter Inner : PRI 8,VID 835, TPID 5, EthType 0x00
Treatment Outer : PRI 15,VID 0, TPID 0, RemoveTags 1
Treatment Inner : PRI 8,VID 835, TPID 2
INDEX 9
Filter Outer : PRI 15,VID 4096, TPID 0
Filter Inner : PRI 8,VID 832, TPID 5, EthType 0x00
Treatment Outer : PRI 15,VID 0, TPID 0, RemoveTags 1
Treatment Inner : PRI 8,VID 2800, TPID 2
INDEX 10
Filter Outer : PRI 15,VID 4096, TPID 0
Filter Inner : PRI 15,VID 0, TPID 5, EthType 0x00
Treatment Outer : PRI 15,VID 0, TPID 0, RemoveTags 3
Treatment Inner : PRI 15,VID 0, TPID 2
INDEX 11
Filter Outer : PRI 14,VID 4096, TPID 5
Filter Inner : PRI 14,VID 4096, TPID 0, EthType 0x00
Treatment Outer : PRI 15,VID 0, TPID 0, RemoveTags 3
Treatment Inner : PRI 15,VID 4096, TPID 3
INDEX 12
Filter Outer : PRI 15,VID 4096, TPID 0
Filter Inner : PRI 14,VID 4096, TPID 5, EthType 0x00
Treatment Outer : PRI 15,VID 0, TPID 0, RemoveTags 3
Treatment Inner : PRI 15,VID 4096, TPID 2
AssociatedMePoint: 0x101
If you are in this case, you just have to change the VLAN 832 with 2800 in your router configuration.
Annexes
DHCP Option 125
Here’s how to generate it correctly, from right to left:
-
Take the model name of your box as a plain text string, for example “Livebox 7”, and convert it to hexadecimal: “Livebox 7” → 4c697665626f782037
-
In front of that, prepend the half-length of the hex string, expressed in hexadecimal. In this case, the string 4c697665626f782037 has 18 characters, and 18 / 2 = 9 = 0x09, so we prepend 09.
-
In front of that, prepend 06, which is the “tag 6”.
-
Take the ONT serial number as a plain text string, for example “SMBS02C3D435”, and convert it to hexadecimal: “SMBS02C3D435” → 534d42533032433344343335
-
Prepend the half-length of the resulting hex string. It has 24 characters, so 24 / 2 = 12 = 0x0c, hence we prepend 0c.
-
Prepend 05, which is the “tag 5”.
-
Take the MAC address in uppercase, without separators, and keep only the first 6 characters. Convert this 6-character string to hexadecimal. For example, “581DD8” becomes 353831444438.
-
Prepend the half-length of the resulting hex string. It’s always 6 bytes (12 hex characters), so we prepend 06.
-
Prepend 04, which is the “tag 4”.
-
Prepend the half-length of everything you’ve written so far (after the fixed header, see below). In this example, we’ve written:
- Tag 4: 2 (tag + length) + 12 = 14 chars
- Tag 5: 2 + 24 = 26 chars
- Tag 6: 2 + 18 = 20 chars
- Total: 14 + 26 + 20 = 60 hex characters = 30 bytes → 0x21 (Note: it seems the total is actually 66 characters in your example, so 66 / 2 = 33 = 0x21)
-
Finally, prepend the fixed header: 00000de9
So in this example, option 125 becomes:
00000de9210406353831444438050c534d4253303243334434333506094c697665626f782037
Sources
There are lot of sources which helped me to write this article. Here are the most importants.
https://lafibre.info/remplacer-livebox/index-des-solutions-de-remplacement-de-la-livebox/
https://lafibre.info/remplacer-livebox/filtrer-les-raw-socket-avec-nftables/
https://lafibre.info/remplacer-livebox/remplacer-la-livebox-par-systemd-networkd-nftables/24/
https://github.com/luneth/OpenWRT-Livebox
Special thanks to lafibre.info forum and its members !
#nbux/orange #nbux/mikrotik #publish #cyasssw/orange