Hey Broadband and Private WAN

So I've just had them switch their TP Link router to bridge mode so that I can use my router. However under WAN instead of a public IP address it's showing a 192.168 number which I believe is a private WAN IP behind a 'Carrier grade NAT',. I've never seen this before. Does this limit me from anything (port forwarding, VPN Client, DDNS etc) or can I just ignore it.

Thanks

As it's in bridge mode it won't have a WAN IP anymore. Ignore.

Thanks Carl. I would ignore however I now cannot port forward a port which seems a bit of a coincidence. Is that to do with this or is that another issue?

Thanks.

What "WAN" IP address is your router reporting?

Is this the same IP if you do a whatsmyip.org search?

doing whatsmyip it shows my public IP. on my router (not the bridge) is shows 192,168...

It's an ASUS. When I click on DDNS (not that I need that service) it tells me I'm on a private WAN. And I also cannot forward a port that I've always been able to (remote gate entry system) That led me to google and then to post here. Above my pay grade!

If your router is reporting 192.168.x.x on it WAN port then its behind an upstream device that is performing NAT. If the nearest upstream device (the ISP router) is *definitely* in bridge mode, then it would appear that the service provider is using CGNAT.

CGNAT should be in a 100.64.x.x/10 range. I'm wondering if bridge mode isn't actually bridge mode.

In reply to a post by CarlTSpeak:

CGNAT should be in a 100.64.x.x/10 range. I'm wondering if bridge mode isn't actually bridge mode.

Although thats the recommended range to use according to the RFC for CGNAT, they could also be using another private range like 10.x.x.x/8 (favoured by lots of mobile providers) or for that matter 172.16.x.x/12

Although 192.168.x.x/16 gives far fewer hosts, it is private, they could theoretically use it. Would be pretty odd though...

If the OP puts the TP-link ISP-side router back into router mode, wonder what WAN IP address his router gets then?

First you need to know you own router WAN MAC address. Go to the ISP router and set up fixed IP for your own router ie 19.168.1.100

Then on ISP router find DMZ setting and set that to 192.168.1.100 (What your own router is using). As by magic you should be able to port fowared with out issue.

Thanks for this. Trying to keep up. I'm assuming this will be why port forwarding isn't working? If that was, I woiulnt care to be honest.

Anyway, on my router, the WAN is 192.168.10.101. The gateway of the TP LInk (the bbidge is 192.168.10.1.

When I log in to that, it shows me the public IP adress and also a gateway showing 172.16 etc.

Now, Hey Broadband log in remotely to turn their TP Link to bridge mode. Advanced settings has been locked out. So I have no idea whether they have dome this successfully or not. Wireless signals are turned off (but I can do that).

Under networ4k map it shows one wired client (my router), PPOE, Google DNS and that's it. They then emailed me a username and password and told me to put my asus in to PPOE and use the credentials. So all is good other than this odd WAN IP, port forwrading and also it takes my wireless card about a minute to connect to the internet (but they may be another issue!)

In reply to a post by amiga_dude:

First you need to know you own router WAN MAC address. Go to the ISP router and set up fixed IP for your own router ie 19.168.1.100

Then on ISP router find DMZ setting and set that to 192.168.1.100 (What your own router is using). As by magic you should be able to port fowared with out issue.

Unfortunately I am unable to change any of that. The only settings that I can change are under NAT Forwarding. In that section I have Virtual Servers, DMZ and UPnP. Virtual Servers seems to have a lot of fields. Does that help!!?

What I know so far is:
1) You have Hay Broadband, package info no idea. Home/Business? 250/1000? https://heybroadband.co.uk/
2) You router you got from Hay Broadbank is TP Link, model/version no idea.
3) You have router. Make/Model/Version no idea.
4) You want to connect your own router (3) to ISP router (2).

As it Hey Broadband then using F&W FTTP.

Alright goto TP-Link 192.168.10.1. So select DMZ. In DMZ sould be only be one field and in there put in 192.168.10.101.

In reply to a post by jimmybond007:

Thanks for this. Trying to keep up. I'm assuming this will be why port forwarding isn't working? If that was, I woiulnt care to be honest.

Anyway, on my router, the WAN is 192.168.10.101. The gateway of the TP LInk (the bbidge is 192.168.10.1.

When I log in to that, it shows me the public IP adress and also a gateway showing 172.16 etc.

Now, Hey Broadband log in remotely to turn their TP Link to bridge mode. Advanced settings has been locked out. So I have no idea whether they have dome this successfully or not. Wireless signals are turned off (but I can do that).

Under networ4k map it shows one wired client (my router), PPOE, Google DNS and that's it. They then emailed me a username and password and told me to put my asus in to PPOE and use the credentials. So all is good other than this odd WAN IP, port forwrading and also it takes my wireless card about a minute to connect to the internet (but they may be another issue!)

Reading your further posts above, I now don't think you are in a bridged connection state at all.

If you have been given PPPoE login credentials from H!B, then you do not need to use the supplied TP-Link router. Take it out of the equation completely.

For the benefit of testing, connect your PC/laptop directly to the Adtran (presumably) fibre ONT ethernet port, setup a connection using the PPPoE login directly. This will connect your laptop/PC directly to their network and the IP address assigned over that PPoE session will be the WAN address. This will doubtless be a DHCP assigned address, however knowing the address range will tell you if its is CGNAT or not - e.g. if this is of the form 172.16.x.x (as per your note above) then that is most certainly a CGNAT range.

I have FTTP 1Gbps up and down
Their router is TP-LInk Archer XR500V
Mine is Asus AX-86U

I cannot put the ONT directly to my router as it's a fibre connection which my router does not have. (only a WAN port)

Done. Said remote management conflict but it's set. So what has that done please?

When you say ONT do you mean the TP-LInk Archer XR500V as it is a GPON router. Does the incoming fibre connect directly to the TP_Link or is there some other hardware?

ONT to TP link via fibre optical cable. TP Link now in bridge mode (according to HB).. Ethernet cable from LAN 1 of TP link to WAN of Asus AX 86U (as per HB instructions).

TP link says PPoE as does Asus.

Public WAN on TP Link and private LAN on Asus.

Problems

1) cant port forward, use DDNS etc
2) wireless drops (but suspect that's a deep Asus router issue so dontt want to confuse matter or go off thread)

After you posted your update with a make and model, it became apparent that your Archer TP-link device is a GPON router. There is no ONT as such as that function is within the unit.

The management clash would appear to show that the TP-Link is still acting as a router and handing out 192.168.x.x local addresses rather than acting as a bridge.

sorry - didnt mean to mislead. I thought the box on the wall was the ONT which then connected to the TP LInk. How can I best explain to IT support (who dont know much) that it isn't in bridge mode...

Escalate to a higher level of support that understands.

You cannot have PPPoE active on more than one ‘network termination’ device on the same broadband service/connection.

Whatever device undertakes PPPoE client connection is granted the WAN address from the PPPoE server/concentrator back in the H!B network. That may or may not be a CGNAT derived address.

It’s then this device which has a direct internet connection and would be responsible for any routing (or indeed NAT, downstream DHCP etc, etc) on your internal network. Forgive me if I’m telling you how to suck eggs here.

Not at all!

HB tier 1 support say it's in Bridge mode. But under the TP link it says PPoE which they say is normal!!!

I have a friend with with HB and he says he cant even access the TP link router as it's been downgraded to a node basically. So something not right.

In reply to a post by jimmybond007:

I have FTTP 1Gbps up and down
Their router is TP-LInk Archer XR500V
Mine is Asus AX-86U

I cannot put the ONT directly to my router as it's a fibre connection which my router does not have. (only a WAN port)

How does the TP-LInk Archer XR500V connect to the ONT?

Does the ONT have an ethernet port?

just a fibre optic port which goes to the TP Link. HB are still insisting it's in Bridge mode as thats what their remote systems tell them.

There is no separate ONT, the TP_link is a GPON router so contains the ONT functionality, I think the OP was unsure and thought that the fibre connection on the wall was the ONT.

It looks like the TP_Link has not been set up in bridged mode by Hey customer support although they claim it has. It should not be doing the PPPoE connection.

In reply to a post by Realalemadrid:

There is no separate ONT, the TP_link is a GPON router so contains the ONT functionality, I think the OP was unsure and thought that the fibre connection on the wall was the ONT.

It looks like the TP_Link has not been set up in bridged mode by Hey customer support although they claim it has. It should not be doing the PPPoE connection.

I agree. Maybe the OP should connect a PC to the TP Link, then see if he can access the internet and if so find out what his public IP address is. He could then explain the situation to Hey.

I think that’s the whole point of the thread 🤣👍

In reply to a post by jimmybond007:

Not at all!

HB tier 1 support say it's in Bridge mode. But under the TP link it says PPoE which they say is normal!!!

I have a friend with with HB and he says he cant even access the TP link router as it's been downgraded to a node basically. So something not right.

It wouldn't be the first time a first or second line support are poorly briefed/trained/unaware of some configuration details especially if its not a mainstream option.

If they are remotely putting their device into a bridge mode, then it stands to reason that you should not effectively be able to locally login to it - it becomes much like an ONT which is transparent to the end user, and effectively a fibre modem. Your own router would then need to handle the PPPoE session to establish connectivity back to the H!B network, etc etc. Just check they haven't missed giving you a step, like power down/power cycling the device or something silly like that.

Keep at them. Good luck.

All sorted. TP Link was NOT in Bridge (as you all suspected). It now is, my Asus shows a public WAN and I can port forward!

Thanks for everyones help!!

In reply to a post by jimmybond007:

All sorted. TP Link was NOT in Bridge (as you all suspected). It now is, my Asus shows a public WAN and I can port forward!

Thanks for everyones help!!

Great! Presumably the public address wasn't CGNAT'd after all.

Interesting. I have HB too and I too have their Archer router in Bridge Mode so my Draytek 2865 can run the show over it’s WAN2 port.

I can still access the WebGUI of the Archer though via it’s LAN2-4 portal, turn on the WiFi and connect devices to it. My devices get a 192 address. They have internet access too.

I don’t understand how that can be though as Bridge mode should mean turning the Archer into basically a modem.

knowing what I know - you're TP link isn't actually in bridge mode. what's the WAN IP address showing on your Draytek?

It’s definitely in Bridge Mode. My Draytek WAN port has the public IP, I run my own published sites plus I can VPN to my Draytek directly.

strange you can access it. what operation mode does it say on the main page? Mine stiil said PPoE and the WAN address. I've now got proper admin rights to the TP Link if i need it so I can sort out any bridge issues myself (as you know HB lock advanced settings out). However not bridge mode is fully activated i cant access it anyway.

So I've just been to try this again. Connected to the Archer via Ethernet to LAN2 and I can get to the Router's WebUI on 192.168.10.1. I find this very strange as 100% the Router is operating in Bridge Mode as the public IP is on the WAN port on my Draytek and the Draytek is doing the PPPoE dial in......but I can still connect clients to the Archer and browse the web. Perhaps the Archer is routing its traffic back to my Draytek and back out again via itself (?????!!!!!).

....and just to preempt any questions, the Archer has no port forwarding, DMZ or similar settings configured. Its like the Archer is operating in Bridge Mode through its port 1 but is NATing any other clients through its other ports.

With 25 years in IT, I've never seen that before.

they havent commissioned it fully. Something similiar happened to me although it was in full DHCP mode!!! Call them.

In reply to a post by nofappingway:

Its like the Archer is operating in Bridge Mode through its port 1 but is NATing any other clients through its other ports.

Technically quite possible if the Archer was provided with multiple public IP addresses.

In reply to a post by jimmybond007:

they havent commissioned it fully. Something similiar happened to me although it was in full DHCP mode!!! Call them.

Your Asus router is connected back to which LAN port of the Archer 500V? Port 1?

Conversely if you connect a laptop/PC to any other LAN port (2,3 or 4) on the Archer do you get an IP address allocated by it and internet connectivity?

In reply to a post by jchamier:

In reply to a post by nofappingway:

Its like the Archer is operating in Bridge Mode through its port 1 but is NATing any other clients through its other ports.

Technically quite possible if the Archer was provided with multiple public IP addresses.

H!B could actually be running multiple VLANs on the WAN side and keep the default/native VLAN active. When a customer requests “bridge mode” they bring up another VLAN so that customer can run a separate PPPoE client on their own kit out via LAN port 1.

Which would make some sense otherwise how would H!B not lock themselves out of the “higher level” remote administration of the Archer (for example to set the box into or out of a “transparent” bridge mode) of the device.

Deeper GPON level OAM / optical network profiles and diagnostics would presumably be done by a different team and management tools.

I have a Draytek Vigor 130 VDSL modem. With that I can talk both PPPoE *and* native IP to its management address on the same ethernet port. It can also act as a DHCP server.

So maybe the OP's router is picking up an IP address via DHCP on the WAN side, *and* is running PPPoE at the same time - in that case it would have two WAN addresses.

In reply to a post by candlerb:

I have a Draytek Vigor 130 VDSL modem. With that I can talk both PPPoE *and* native IP to its management address on the same ethernet port. It can also act as a DHCP server.

The BT Openreach Huawei HG612 are much the same in that respect.