How to configure the AT&T BG210 to enable IP Passthrough features in 5 minutes! 

I originally made this for a friend to follow

Thanks!

Thanks for the comment! I hope to have some new content soon. Hopefully everyone enjoys it.

Glad to hear

To be honest you shouldn't have to reboot the new router but if you want to, I'd say reboot it at the same time as the BGW210.

Can anyone verify? What should it be? Wouldn't dropped connections be pretty intolerable, even it were every 24 hours or ever?

Once you point outside traffic to the USG and follow the other instructions, you should be good to go. You will only need to forward any ports or setup UPnP for anything that needs to be accessible outside the network.

I think currently the secondary IP is for failure. I did notice that in the new firmware but haven't had the time to truly dig into it yet.

@@IDEAHomeandTech Multiple WAN IP's helps segment different services on the front end. You can add several, which is great if you have a need.

@@algheroman6476 I'm actually looking to do a backup cell circuit since l live in Texas and we just had that ice storm.

you shouldn't most devices configure the NAT settings on the fly as they anticipate you would be plugging them into a consumer based router/ISP .

I’m still having the Double NAT issue (not using a Google router though, I’m using a Deco mesh system). How did you disable Double NAT?

If you decide to had the role of dhcp solely to the mesh system then yes. Otherwise you will just have a subnet inside the router's subnet.

I have the same one I can’t talk in destiny 2 game chat and I was told it was my router trying to be defensive

It would be the mac address of the device you are forwarding to. So yes if you are forwarding to a netgear router it will be that device. If the netgear is plugged in it should show up in the device list.

The router you are using will see its WAN port as connected to the internet. You should only have to be connected to the BG210 to start.

@@IDEAHomeandTech so the new router doesn’t need to be connected to anything & just powered on while doing this ?

It should always be the WAN port. With that being said it looks like your router has 2 WAN ports, a 2.5 and a 1 gig. I would always use the faster WAN port which would be the 2.5 which appears to be by itself. I would imagine you can configure either to be the primary WAN and have a failover I'm the event you have a second ISP. That is probably managed in the router's menu somewhere.

Correct this requires hooking the At&t Modem up to a new device for routing network traffic.

Sorry just seeing this I've been in the process of moving. Yes I believe the USG needs to be on one of the ethernet ports of the BGW for the USG to register in its ACL table.

So the conventional way is to setup a static IP address both internally and and externally. The external static address would need to be requested through your ISP. If this is just for personal or semi-professional use, you can get away with having whatever domain hosting service you choose do the DNS forwarding to your external address. Some have services that you can run on your machine to let the service know if your IP has changed. As for internally, you could follow the instructions in the video and assign the mac address of the raspberry pi as your passthrough device. But this means all traffic would be forwarded to your PI. However, alternatively you could just open a specific port and have the domain records point to that port via URL forwarding rules. That way when someone types in that address the DNS service will forward to the internal server as long as the port is opened. If you have a range of external addresses you would still need to tell your modem where to go internally via network address translation rules. Hopefully this answers your question without too many details.

i also have fiber optic in my neighborhood if that helps

Sorry to respond so late I've been traveling for work. There could be a number of things causing issues. To clarify are you having speed issues wired and what equipment are you currently using?

Instructions should be the same. The weather station should get its DHCP address from the router not the BG210. Is the weather station connected via wifi or hardwired. If wireless you will either need the SSID and password of the router to match the BG210 after you disable wifi on the BG210 or you will need to login to the weather station and connect it to the new router before disabling wifi on the BG210.

@@IDEAHomeandTech oh weather station is hard wired

@@IDEAHomeandTech last question also when i am setting this up make sure I am hard wired to both devices right from my laptop two both AT&T’s and my own router? Once I am done with setup the AT&T stays connected with my router with cable even though settings are turned off? Wasn’t sure

Correct it's not true bridge mode which is why I refer to it as IP Pass-through in the title although "bridge mode" is easier for some to understand. ICMP is intentionally disable to allow the firewall to control which ports are opened. This was essential to gaining camera access and external NAS access prior to moving over to wireguard/tailscale (which I'm actually considering doing a video on). Most people who are looking to do this probably intend to open ports as the default At&t configuration is very restrictive. Before doing this I actually tried to call At&t to have them only open specific ports and it was a nightmare that ended with we can't help you. That's why I did the video in the first place because I assumed other people like me were searching for a way to get around this as well. IP Pass-through is well documented in multiple writeups on dslreports.com but I couldn't find any videos myself. I initially covered this and how to bypass the At&t modem (using a USG firewall) in 2 previous videos but the whole 802.x authentication process was just too many steps to repeat on my newer hardware. I'd prefer the extra hop through the modem at this point even with the NAT limitations. Most residential or small office setups won't exceed the NAT limitations of the At&t modem anyway. I've done the same for work in situations where we're forced to use At&t uverse as a backup circuit because nothing else is available. I really wish At&t would just let me plug the fiber directly into my modem and call it a day. But they want their $10 rental fees. And at home they are currently my best option for the closest thing to symmetrical speeds and no data cap for under $100. I actually moved to Comcast Xfinity for a brief moment but the near criminal 10 Mbps upload speeds aren't good for uploading gigs of video to RU-vid. I know it's particularly a limitation of the hardware and how DOCSIS functions but I just couldn't accept 10 Mbps. Anyways great observation definitely appreciate the critique. Sometimes my videos like my responses are long so it gets hard to know when to cut some information that could be vital for the sake of making a video too long and unwatchable. I'll definitely take this into consideration in future videos.

@@IDEAHomeandTech The video was excellent, was just trying to see how others went about the restrictions on the att micromanagement. I def agree with you on all of those aspects and think this video should help most out. It's really a shame with how ATT conducts themselves when more "tech-savvy" users wish to modify their LAN to conform with their needs and they just shut them down and say "It's unsafe" or "We won't be able to manage it anymore so we can't do that". Great vid nonetheless and seems like I am where you are with configs to the network!

Lan on the firewalla would be everything inside its network. And since you want dhcp coming off of that you would connect your switch and or access points to that port. WAN is going to be the "internet" so that would connect to one of the 4 network ports on the At&t modem. To do IP pass-through to the firewalla yoy are going to use the mac address of the firewalla. You are basically telling the At&t modem to pass all internet traffic to the device belonging to the mac address you supply.

What mesh system. If you don't have a true hardwired mesh, the slowdown can be because of how many hops your device has to go through. In a mesh network where additional APs are connected to the main unit via wireless, every link, or “hop,” between routers will decrease the bandwidth by half. This happens because wireless links outside of some of the newer wifi 6 APs can only transmit or receive. In a chain of mesh links you will continue to cut your bandwidth as you go from one to the other.

@@IDEAHomeandTech I have the to link deco m4 and I have them all back hauled via Ethernet and I have my at&t rg already in pass through mode

Forgive me if my questions seem patronizing but I always start from the bottom and go up the list. Next question, are your devices on the 2.4 ghz or 5 ghz spectrum and are your APs mostly clear of any solid object. The Decos I think only get 300ish on the 2.4 frequency and 800ish on the 5ghz frequency under ideal conditions. Do you know if the Deco model you have supports band steering to try and point 5ghz capable devices to the 5ghz spectrum?

None but in my case I'm using a device that will be my firewall as well as router.

The bypass method should be fairly similar. It's been a while since I've used that modem so I had to "phone a friend" I helped bypass about 2 years ago. Here's what we did Settings -> LAN -> LAN IP allocation Find your modem and assign it for WAN IP mapping to router WAN IP address Address assignment to public Disable the firewall click save Restart your router

you would then need to do port forwarding from the new router instead of the modem.

These options shouldn't matter once the bypass is in place. You are essentially passing your public IP and all routing functions to your secondary device. In my case it a ubiquiti firewall. In your case it would be whatever device you choose to perform the functions of routing like a netgear router.

@@IDEAHomeandTech Thanks it all worked it. 👍

Why would you need to pass through from an At&t router to a Verizon router? I'm not sure I understand the need here.

@@IDEAHomeandTech The Verizon router is newer with wi-if 6

I'm not sure what you are trying to do is possible without access to modify the firmware on the Verizon router/modem. These devices are usually designed to try and connect back to their own company networks and validate that the device is authorized on the network via certificates. So even though the Verizon device is connected to the AT&T device, it will want to connect back to Verizon. This is why most people would look into something like a net ear Nighthawk, a Ubiquiti UDM or an Eero setup for example when bypassing their ISPs router/modem combo device.

@@IDEAHomeandTech thanks for explaining! I’ll look into getting one of the routers you mentioned for wi-if 6 capabilities.

There are others but those are the 3 I've used in the past year.

What model netgear are you using? If you have bypassed the At&t modem, everything should be running through your netgear. Unless your router has an option to disable the lan ports its unusual that your router could issue dhcp addresses wirelessly but not hardwired.

Hi André, Can you clarify what you are referring to by better results? Do you mean faster speeds, lower ping or fewer dropped packets. Also what gaming router are you using. And just verifying you are hardwired.

What device are you using for bypass? Are you running speed tests over wifi or hardwired? Also, there is a hard reset button on the back of the modem that will allow you to return it vendor defaults. Once you enable bypass the external IP is being passed directly to the secondary device so the modem will no longer have an address.

I would assume it would since the BGW210 would no longer be handling routing across a subnet and would only send external traffic to one mac address.

@@IDEAHomeandTech Are the ip passthrough steps the same for the U-verse NVG599 model?

I'm not sure about the current firmware but here are the steps from dslreports.com I used to use: www.dslreports.com/faq/17734

I know this is months late, but for anyone else wandering, it has no effect on the phone line whatosever.

In IP passthrough mode, your selected device gets the public IP address, but other devices connected directly to your router will get local IP addresses and still be able to connect to the internet through it network address translation (NAT). In bridge mode, the ISP routes the internet traffic via your modem/router device without carrying out any routing functions. When you set your modem/router in bridge mode it only passes the WAN/ public IP to the next device, your router/firewall.

No specifically as a denial of service attack is designed to make a device unavailable by essentially disrupting the connection to that device. The better way to prevent denial of service attacks would be to have firewall rules in place or a device/router serving as a firewall with default rules in place to prevent such attacks.

I've stop the Eero for a few people including my mother in law. If I had to suggest one it would be the Eero.

Depending on what you have from AT&T and what you will use as part of your bypass potentially yes. I also did it back then for the control and stability.

I'd have to do a bit more research. But on just what I see, Helium miners are a completely separate technology.

If you simply want a vpn connection look into wireguard or tailscale. I currently use tailscale even on my NAS. As I travel alot for work these days I literally drop a file on the NAS for my wife to run the 3d printer or laser engraver (video coming soon) while I'm away. Both are software based with tailscale being based off of wireguard and allowing for easy authentication.

Almost every network device has a sticker on the back or bottom labeled Mac address.

You are correct it hops to At&t first. There are many write up as I've mentioned in the past that will allow you to use a device such as the UDM Pro to do a true bypass. The most common technique when I was doing it on my USG was via WPA supplcant but that began to feel like more trouble than it was worth to setup. I just didn't want to brick my $400 firewall and have to rebuild it like I did getting it setup on the USG. Maybe one day if the process gets a little more streamlined.

@@IDEAHomeandTech I was discussing this with one of my teammates today and we THINK that if you pay for a static IP, you will be able to have a true WAN handoff to your firewall or secondary router. I think the reason AT&T doesn’t allow this is because they don’t want to lose remote access to their devices. The only way for them to hand off a static to an additional device is if you pay for a block of addresses and the secondary addresses can be assigned to multiple internal LAN devices. This is merely speculation. I will try this with one of my clients next week and maybe be able to shed some more insight.

That's correct but the only way I know that they will allow that us with a business data plan which costs more. The company I work for we deploy SD-WAN and s9me sites have the newer BGW320 as our failover "cheaper" circuit. I've asked since the 320 has an SFP stick8ng out of it if we can just go into our equipment but the techs we usually get aren't sure. And the whole point of the circuit is a cost effective failover so we haven't put much effort into getting confirmation.... yet

Depends on you router and if you can clone the certificate of the BG210. You can clone the cert and apply it to your own router. I've done it on my USG and I'm considering doing it on the UDM pro this weekend while the wife and kid are gone.

@@IDEAHomeandTech how would go about doing this, i use openwrt for router. Could you make a video guide on such? Was also interested in WPA_supplicant or EAP proxy, prefer wpa_supplicant though but the guides are long and hard to understand.

I haven't used openwrt since college on a linksys wrt54G.... (that brings back memories) so unfortunately I currently don't have any equipment to try it with. However, with the settings I used in the video I didn't have to do any NAT configuration since the UDM pro is give the public ip address. Anyway here is a link for configuring openwrt to bypass the AT&T gateway hope this helps: pyther.net/2020/05/03/bypass-att-gateway-openwrt.html

@@IDEAHomeandTech thanks. Was hoping to get rid of the modem itself completely. Wpa supplicant I think can do that. Anyways appreciate it

@@Limeayy If youre only using your own router to get better wifi speeds/better connectivity for multiple devices and not for other reasons such as QoS or custom DNS, then setting your other router in AP mode will be fine. Basically it will make the ATT gateway the main router and your own router an access point to get to the main router, and the NAT will only occur in the ATT gateway

Sorry I'm not familiar with a BG210. If I'm not mistaken the BG stands for broadband gateway so BGW would be broadband gateway (wireless).

Could you clarify what you mean? I was still able to call At&t and another subscriber actually called them to help setup bypass before getting stuck and watching this video. This is a normal function of the Modem so you really aren't doing something At&t doesnt intend. I would say it's useful to have your own firewall if that's what you mean as the At&t modem only block normal traffic and does nothing to alert you to any threats like the UDM Pro I have as my routing device or say a box running pfsense or pihole.