I've finally sat down and completed my network migration from my ISP's (Telia LT) GPON terminal over to my own router using SFP module. This guide will provide step by step guide, how to do that.
To do that, you need a few things prior to starting, namely:
- GPON SFP(+) module with an unlocked serial number configuration (e.g. here),
- Router/Gateway to plug that module (e.g. UDM-Pro,
Please consider the following prior to proceeding,
- As my entire house runs on Unifi, this guide will be focused entirely on Unifi, but if you read through you should be able to customize it to fit your hardware.
- I'm not responsible for any damage to your equipment or loss of internet, do it at your own risk.
- My ISP provider is Telia and it is capable to provide internet of up to 2 gbit/s
I've managed to reverse engineer Telia's authentication setup. They are only dependant on Serial Number of your GPON terminal and nothing else. Knowing this, all we need is a GPON SFP module that allows changing Serial Number. We also need to know how to decode Serial Number from the GPON terminal label. Now let's proceed.
To complete this guide successfully, you need to have SSH access enabled in your gateway and/or router. For Ubiquiti specific setups, you can follow the official documentation here on how to enable it. If you're using different devices, then you should look for guide at your vendors website. Then, we ssh to the UDM Pro:
# Notes:
# - replace 10.10.10.1 with your IP of the gateway
# - username is `root` normally (for all users), but in some cases might be ubnt - check your product manual
ssh root@10.10.10.1
Enter your password that you can find in UDM Console settings.
Now we can plug the SFP GPON module to the UDM pro Wan port. In my example I used port 10 on the UDM Pro. One the module is plugged in, give it a few moments to boot up - you will be able to soon see it in the interface.
Important note: make sure that you also plug in your existing fibre to the SFP module. Otherwise it won't come up and you will not be able to ssh to it.
We now need to configure access to the module, so we're able to access it. To do so, we need to perform a few specific steps in order to achieve that.
GPON modules from fs.com comes with preconfigured IP address of 192.168.1.10 All we need to do is tell UDM how to route traffic to that SFP module.
Assuming you use Ubiquiti, the ports you see in the interface are mapped to an eth interface if you
subtract 1 from the displayed number.
Namely Port 10 will be eth9 and so on... (at least under normal circumstances).
So because i've plugged SFP to Port 10 I'll use interface eth9.
Use the following command to bring up the required subnet to the associated interface.
As per documentation (also on hack-gpon), our interface operates in the 192.168.1.x subnet()
with a default IP address of 192.168.1.10.
Let's add the subnet to the eth9 interface,
ip addr add dev eth9 local 192.168.1.2/24
Route all traffic from that interface to the 192.168.1.2 gateway address we created above,
iptables -t nat -A POSTROUTING -o eth9 -d 192.168.1.0/24 -j SNAT --to 192.168.1.2
To reverse the above changes, do the following to remove the POSTROUTING,
iptables -t nat -D POSTROUTING -o eth9 -d 192.168.1.0/24 -j SNAT --to 192.168.1.2
and the actual subnet from eth9,
ip addr delete dev eth9 local 192.168.1.10/24
To ensure your changes got applied you can review the output of,
ip addr
and for iptables,
iptables -t nat -L POSTROUTING
Now you should be able to access the GPON module by pinging its address from the UDM-Pro shell,
root@UDM-Pro:~# ping 192.168.1.10
PING 192.168.1.10 (192.168.1.10) 56(84) bytes of data.
64 bytes from 192.168.1.10: icmp_seq=1 ttl=64 time=0.656 ms
64 bytes from 192.168.1.10: icmp_seq=2 ttl=64 time=0.268 ms
64 bytes from 192.168.1.10: icmp_seq=3 ttl=64 time=0.259 ms
64 bytes from 192.168.1.10: icmp_seq=4 ttl=64 time=0.253 ms
64 bytes from 192.168.1.10: icmp_seq=5 ttl=64 time=0.266 ms
After ensuring you are able to ping the module, you should ssh to it.
As mentioned previously the default parameters of the FS GPON module are as follows,
| IP | 192.168.1.10 |
|---|---|
| user | ONTUSER |
| pass | 7sp!lwUBz1 |
Therefore, based on the above parameters you can ssh to the GPON module by using the following command,
ssh -oKexAlgorithms=+diffie-hellman-group1-sha1 ONTUSER@192.168.1.10
Note: it is important to use that specific (and outdated) algorithm as newer ones are not supported by the module firmware -- and that is OK
You need to get the device serial number which should be exactly 12 digits (normally).
However in my case Tealia had place Huawei HG8010Hv6 ONT Terminal and on the backplate serial number consists of 16 characters.
That is because vendor ID is in Hex format. To properly format your Serial Number, use this website reference to decode HEX into ASCII. In my case because ONT is from Huawei, I can see that first 8 numbers should actually be written as "HWTC" and then you write what's remaining after first 8 numbers.
HWTC 48575443 Huawei
Example: Huawei SN: 48575443XXXXXXXX
So we turn this into HWTCXXXXXXXX
Now that we know the Serial Number we set it on our new SFP module.
set_serial_number HWTCXXXXXXXX
or,
sfp_i2c -i8 -s "HWTCXXXXXXXX"
Important note: you will not be able to see the updated serial number in the module without doing a reboot first.
After applying the above commands, you need to reboot the module -- you can do that by using the following command,
reboot
Then after waiting for a few minutes for the operation to complete you can check that the serial number is changed to the desired one,
fw_printenv | grep nSerial
or by using,
sfp_i2c -g | grep nSerial
Without the | grep nSerial you will get the dump of the entire configuration.
Once your SFP module reboots, you should automatically connect to the internet as this is the only check Telia does on their end. Now you can turn off your old terminal and you'll have connecticvity via your router.
@huglester do you have auto negotiation enabled on your interface? UDM only supports 1gbit and 10gbit, but some SFP's will try to negotiate 2.5 and will not work so you have to manually set it to 1gbit.
I've had those EPROM errors too, also one more thing - sfp on UDM doesn't come alive unless it has fiber stuck in it.