<p>In the previous post I have had explained everything there is about using you own ONT. After some usages it seemed the combination of ONT module and EdgeRouter wasn't the perfect fit. The EdgeRouter's logs were filling up and every once in a while my whole network froze for several seconds.</p>
<h2>Background</h2>
<p>In my original post I explained allot of terminology about GPON, what it is. What you all need. etc. In this one, I will not. I will focus on what happened and what I tried and lastly, why I changed to make everything happy again. So for the full information, please also read <a href="/blog/2024-02-25-your-own-GPON-ONT-part-2">this blog post</a>.</p>
<p>First of, what happened? Well everything worked well for quite a while. But every so often my whole network froze, or at least my router did and thus al my network traffic. During the freeze it will not react to anything or route any traffic. After about 5 seconds it will unfreeze and continue if nothing ever happened. When inspecting the logs I noticed many messages like the once stated below.</p>
<pre><code>kernel: i2c-octeon 1180000001000.i2c: unhandled state: 0
kernel: Failed to read SFP EEPROM_0 at byte 29 val -5!!
</code></pre>
<p>After some investigation these messages started when I popped in the GPON module. I2C is a protocol which is commonly used over SFP to communicate with the EEPROM of these SFP modules. After allot of e-mailing between both Ubiquiti and fs-store I came to the conclusion that these the devices: The EdgeRouter-4 and GPON SFP module with MAC from FS.com, are incompatible. The module requires a I2C speed below 80KHz while the EdgeRouter's minimum is 100KHz.</p>
<h2>So now what</h2>
<p>I scoured the internet for alternative solutions. There where many. Initially I bought a UFiber instant module from Ubiquiti themselves. But I couldn't get it to work with my ISP even with a custom ROM flash. During this process I did find out that most of these "multi-propose" GPON module have the same PON SoC at their heart: the Realtek RTL960x. And from this family of products there where several options which were quite open and friendly to use to begin with. I poked around and talked to people from my ISP and in the end I landed on the ODI DFP-34X-2C2. You can find many of these sticks on aliexpress, I bought <a href="https://nl.aliexpress.com/item/1005003515456552.html?spm=a2g0o.order_list.order_list_main.11.21ef79d2wId0Gv&#x26;gatewayAdapt=glo2nld">this one</a> (watch out, the module is 48 euro's, you need to select your connection "color" first, I had an APC connection).</p>
<h2>Making it work</h2>
<p>Using the new module is actually quite easily. I did not load any custom software on it what so every. These modules all "expose" themselves via HTTP and SSH on a static IP: <code>192.168.1.1</code>. For me this is quite anoying, because my router's IP is <code>192.168.1.1</code>. To configure it I popped it into a switch, I put it into it's own untagged vlan along with another port which was connected to my laptop. I statically assigned my laptop <code>192.168.1.42</code> and I browsed to <code>http://192.168.1.1</code>. The module has a handy web interface from which I could assign an other IP, namely <code>192.168.20.2</code> and I could change the GPON SN of the module to my original GPON module's SN. This way I didn't have to contact my ISP and let them change the allowed GPON SN. You don't have to change your GPON SN if your provider allows you to run your own setup, you can email them the stated GPON SN and they will authorize you. If they don't... You can copy theirs instead... I also entered the LOID id and password from the old stick. I didn't think my provider uses it, but what does it matter. I  entered <code>1234567890</code> and <code>password01</code>. I popped it into my router and after a few minutes everything worked great!</p>
<h2>Accessing the module</h2>
<p>Unfortunately this module doesn't allow you to enter a gateway. So you cannot access it from another network. You can access it from your router so this gave me the following workaround. I assigned the interface which holds the GPON module the network <code>192.168.20.1/24</code>. Since my router has SSH I can SSH Tunnel a HTTP connection to the module using  <code>ssh -L 8080:192.168.20.2:80 192.168.1.1</code>. Now for as long as this ssh tunnel is open you can access the web panel of the module on <code>http://localhost:8080</code>.</p>


I ran into some issues with the combination of my GPON module and router. In this post I tell you what happened and how I resolved it.

Your own GPON ONT pt. 2

<p>Update: The module and router combi stated in this article don't interact that well. Please read my <a href="/blog/2024-02-25-your-own-GPON-ONT">followup</a> for an alternative module.</p>
<p>Some people just go out of there way to really own their internet service to the fullest. I am one of those people. I really dislike having gear from my internet service provider (ISP) at home. Especially because I know for a fact that my own gear is faster, more reliable, more configurable and cannot be screwed with by them. Now of course, this also means they cannot help me if I have internet issues. But honestly with my own gear, these incidents are few and far between.</p>
<h2>What are we working with</h2>
<p>I am using allot of ubiquiti's unifi gear, like the unifi AP's an switches. But for the routing I preferred the EdgeRouter-4, it is beefy enough, it has a SFP port and it s a bit cheaper (and allot smaller) than the USG 4 pro. And for a full sized managed switch I got a Cisco SG300-52 which I bought as a second hand cheaply. For this blog we would only need a router with an SFP slot, and the SFP module to put in it.</p>
<ul>
<li>EdgeRouter-4</li>
<li><a href="https://www.fs.com/de-en/products/133619.html">GPON SFP module with MAC</a></li>
</ul>
<p>Here in the Netherlands, it is a right to run your own networking gear. So they cannot disallow me for running my own gear, trying to fiddle with theirs, etc. The connection is on my premise, the gear is on my premise, thus I am allowed to use it however I want. Moreover in the Netherlands Fiber is quite common and, most often, more affordable than alternatives because of better competition. I got my own network setup already hooked up to an ISP (Tweak), but unfortunately, they have been bought by a bigger company, so I moved to another ISP named Jonaz. Sadly Jonaz uses GPON which requires other SFP modules than I am used to.</p>
<h2>GPON vs AON</h2>
<p>As I found out during this period, not all fibre networks are made the same. Besides the different fibre connectors and wave-length there  is also a difference between active (AON) and passive networks (PON). Passive networks need special protocols with authentications called GPON of XGS-PON used. In my case, Tweak used AON with LC as a connector. This was as as easy as buying the correct module from fs.com, plugging it in, assigning the provider's VLAN, and done.</p>
<p>My new provider (Jonaz) uses a PON network with SC as a connector and GPON as protocol. Initially these modules are already more expensive on fs.com. Moreover there are less total "options" to choose from but the terminology is really confusing.</p>
<h2>Choosing the "right" GPON SFP stick</h2>
<p>When you browse for GPON SFP sticks you will be hit with some weird terminology, lets go through most of them. First of, GPON has two sides to a connection, your provider, which is known as the OLT (optical line terminal) and the consuming side, known as ONU (optical network unit) or ONT (optical network terminal).</p>
<p>Next to this you have sticks with MAC and without MAC. This isn't referring to a MAC address (which I initially thought). But it refers to the capabilities of the stick itself. Sticks without a MAC need to be paired with gear specially designed to handle PON connections. All the packets send through PON network are special and they need to be handled and decoded as such. Sticks with MAC can do these things on the stick itself, basically it is a whole modem on a stick!</p>
<p>I didn't have special gear handling PON connections. I could buy a "Ubiquiti UFiber" instead. But I didn't wanted to add new gear. I wanted my fibre to go straight into my EdgeRouter 4. So I bought the <a href="https://www.fs.com/products/133619.html">GPON ONU Stick with MAC SFP</a>. Perfect.</p>
<h2>Getting the "right" Serial</h2>
<p>Most GPON ONU devices will have the serial used during GPON authentication on the stick or on the packaging. Unfortunately. fs.com , for unknown reasons, does not. Confusingly they add a serial number to the box, but that is the product serial number. Not the serial used during GPON authentication. If you have a PON capable device and added a stick you should be able to read the PON serial right from it. But as said before I did not have such gear. I bought a stick to handle that itself. So I needed to log into the module itself to retrieve (or set) it.</p>
<p>These SFP sticks come with their own mini server. You cannot do allot with it. By default when you plug it in it will use an IP of <code>192.168.1.10</code> and you can log into it using SSH. The challenge is how to do it from the EdgeRouter. If you already use the <code>192.168.1.0/24</code> network you will be in quite of a pickle. What I did was have a SFP capable switch in the target network (<code>192.168.1.0/24</code>), add the module to it, logged into the stick with the steps below and change the ip address. The commands for this are shown on <a href="https://hack-gpon.org/ont-fs-com-gpon-onu-stick-with-mac/#setting-management-ip">this website</a>. You should set the management IP to a network which you are not currently using.</p>
<p>Now plug it into your EdgeRouter, add a static IP to the SFP interface with the IP of the management IP's gateway the stick expects. By default it will be <code>192.168.1.1/24</code>. Wait a few seconds for it to fully boot. And now you can ssh into it from anywhere in your network. The stick uses some older SSH specs so we would need to enable some insecure algorithms.</p>
<pre><code>ssh -oHostKeyAlgorithms=+ssh-rsa -oKexAlgorithms=+diffie-hellman-group14-sha1 ONTUSER@192.168.1.10

password: 7sp!lwUBz1
</code></pre>
<p>Now we are in the stick and we can ask for it's GPON serial used during authentication with  <code>fw_printenv | grep nSerial</code>. This is the serial your ISP needs to talk with your stick.</p>
<h2>Would you recommend?</h2>
<p>Well, most of the time: NOOOO. Don't get me wrong, it works wonders. And it is doable and the SFP module is not that expensive. But if you are not fully experienced with networking gear and how to debug (common) problems with networks, it is hard to recommend.</p>
<p>There are no big benefits, but there is one big drawback. Your ISP will not be able to help you if you have problems. If you are unlucky they will not help you because you run your own gear. But most of the time, they won't be able to help because they don't have the tools they normally have. Normally ISP's have build in tool in their own gear to debug common problems. But without their gear in your network, they cannot use those, and thus they are blind.</p>
<p>But I am quite happy with it! There is one less (literal and figurative) black box from my ISP in my networking closet. I can inspect more about the PON connection when / if I need to. But other than that, no difference.</p>
<p>Hopefully this writeup was useful to some people.</p>


Running your own network setup can be fun. But this isn't always as straight forward as you might expect. Read more how to hook up the GPON network of your provider to your own gear.

Blog posts