Module into Switch or Firewall?

[aronmal]

Hey, we are getting fiber internet and because I am already running a OPNsense firewall in a VM with Intel NICs connected to my switch, my question is, do I have to connect the moduel with a pci-e card (via passthrough) to the VM or could I (ideally) put the GPON module into the SFP port of my NETGEAR switch and have it via a VLAN connected to the NICs/VM/OPNsense interface?

Great project btw.

[kic68]

I connected it with my switch and after configuring the VLAN and limiting the speed to 1gbit/s the module was reachable. I am still seeing some error in the switch's configuration screen (unifi), but ssh'ing into the module works totally fine. Not having fibre yet though, so I cannot say anything about throughput, there should not be an issue though.

[jaseg]

@aronmal The module does not care what you plug it in to. Towards the host, over the SFP interface, it looks exactly like a normal 1Gbit optical transceiver. The host, be it a switch or a PCIe card, does not even realize that there is another whole linux inside that module. The only difference from the host/switch side compared to normal SFP transceivers is that it only speaks PPPoE and nothing else over the ethernet link on that SFP port. The entire management of the module happens in-band through a special subnet inside of this PPPoE tunnel.

If you connect it to a switch, be mindful that the module's management interface is in-band, so a private VLAN just for the module would be a good idea to make sure nothing else can connect to it.

[aronmal]

Thank you for the explanation. I am hyped on getting this set up as soon as we get the HÜP.

Do I understand it correctly, that I let Telekom do a (re-)discovery (or I could change the SN to the modems one they will provide so I could hot swap between them) and have to set the PLOAM password / Installationskennung in the module and it is ready to go by receiving the IPv4 and IPv6 Prefix via PPPoE?

[jaseg]

I have written down how I got mine to work with Telekom here. AFAIK Telekom insists on sending out a technician for any new fiber contract, who will then initiate the re-discovery. I did not have to change the modem's SN at all. I think that's mostly relevant for countries other than Germany, where internet providers might not be willing to do a re-discovery. In Germany, it's the law that you can bring your own "modem", and that means that Telekom must do a re-discovery when you request it, as that is necessary for any new modem to work due to the way the ITU-standardized authentication protocol works.

Make sure you get the VLAN stuff right as I wrote in the blog post, as this is telekom specific.