Hacker News Reader

Comment by jason0597 | Hacker News Reader

It's funny to think that if you were to report all of your findings to your local newspaper (Turkish newspaper in this case), as to how Turkish ISPs have complete access to your router or how Huawei (China) has an SSH key for your router, people would go absolutely ballistic. But for us it's just another day of expected craziness and we're tired of talking about it

View on HN

> how Turkish ISPs have complete access to your router

You think it is going to blow people's socks off that a router provided and controlled by an ISP is accessible by that same ISP? Huh?

The Huawei SSH key is a little strange, but depressingly common for network equipment, even big names like Cisco[0].

[0] https://tools.cisco.com/security/center/content/CiscoSecurit...

> The Huawei SSH key is a little strange, but depressingly common for network equipment, even big names like Cisco...

There’s an understandable reason for this: the isp’s staff aren’t necessarily any more competent than the isp’s customers (some are, but there are so many ISPs that I suspect they are now a small minority). So just at the isp wants to be able to reset your interface devices remotely, so will Huawei and Cisco support for the ISPs themselves.

I am not implying that “understandable” means “justified”

>even big names like Cisco

Even? By now Cisco having hardcoded credentials and glaring security fuckups is a meme.

Turkish newspapers are almost universally subservient to the autocratic government. Any free press that's still somehow around has way more consequential dictatorial abuses of power to report on, if they dare.

CPE is just part of the ISP's infrastructure that happens to be in your house. There is no need to trust it. Just put your own router in front of it.

Indeed, I've had a linux box between the router and the local network since the days of dial-up (originally it was the dial-up box, which made and shared the 'net connection). The only reason I've ever had to upgrade the hardware has been because the original setup only had 10MBps NICs.

> if you were to report all of your findings to your local newspaper ... people would go absolutely ballistic.

You reckon? I don’t think they’d even be interested in hearing about it.

Where do you live and who is your local paper that leads you to believe they’d bother writing, let alone publishing, such a story?

I'm pretty sure my new CenturyLInk fiber router is similar. I tried to create a PPoE connection from my WRT1900 direclty to century link using the same credentials and I couldn't connect to my internet. However, now I am motivated to create a bridge and find out why.

For CenturyLink fiber I have two boxes:

Box A: the exterior fiber enters this box, the tech said it was a "translator"; and the port 4 ethernet on it goes to ...

Box B: the centurylink wireless router, which performs the PPoE with my credentials which were somehow hardwired because no one ever told me my username/password. I'm guesing TR-069? Then port 4 on this goes to ...

Box C: MY WRT1900AC, which then goes to other subnets for my cameras, lab, and office.

I figured Box B was redundant, but trying to remove it has been problematic.

"Box A" is an ONT or optical network terminal, which is really just a media converter with some additional intelligence related to how GPON schedules use of the media. It's more or less the same thing as an ADSL modem (actual modem only) except that GPON usually uses Ethernet while ADSL usually uses ATM. But both are used the other way sometimes.

For "Box B" you can use anything you wish as long as it supports PPPoE. Contact CenturyLink by phone or chat to tell them you need your PPP credentials, they'll have no trouble giving them to you. The only trick besides PPP is that CenturyLink usually uses a VLAN for customer equipment on their GPON, but that's pretty common with ethernet over ADSL as well so routers made for use with a DSL modem should have it in their UIs alongside the PPP info. Unfortunately most newer routers are made without this use case in mind so there may not be support, in which case you can always upgrade to something a little more configurable or use a computer as a router. You can ask the CSR for the VLAN ID but in every case I've seen it's 201.

I've done this a number of times and never had the CSR give me any trouble. They also don't seem to keep very good track of who has CL-owned CPE, I've ended up with "free" CenturyLink routers a couple of times because they fell through the cracks when switching to my own.

> PPoE with my credentials which were somehow hardwired because no one ever told me my username/password

They make it very hard to use your own "Box B", but I've set this up twice now (most recently last week). Get the username and password from CenturyLink (the tech that installs the service has this, or call them). Then, google search "century link vlan 201 wan tag". The trick is you need a router that has this functionality, most basic consumer ones don't.

Unfortunately, even if you follow all directions and it still doesn't work troubleshooting is a nightmare, very little or no help from their customer support.

Be aware that for many cheap routers you can't do the VLAN tagging the "normal" way via the web interface. Like this: https://blog.mapstrata.com/post/internode_openwrt/

For people with cheap/crappy hardware like me, if you have to set VLAN2 via the sub-interface then your config needs to look like this:

  config interface 'wan'
    option ifname 'eth1.2'
    option proto 'pppoe'
    option username 'your_internode_username@internode.on.net'
    option password 'SecretPassword'

All of the above can be set via the GUI, except the "eth1.2" part. The above works if you happen to be with Internode.

Ah I see. My WRT1900AC doesn't have that option. I was running OpenWRT but ran into some issues and panicked back to the default firmware. Now that I have another wireless router I might dare it again.

OpenWRT is fantastic when you get used to it. I prefer the CLI but the GUI works well too.

B probably exists so they can split fiber between multiple end users or support things like phone service over the same link. Did you use the same VPI and VCI? PPPoE also sends an identifier (the "Host-Uniq" tag if I'm understanding it right) that probably has to match what your ISP is expecting or has assigned.

I had CL fiber. VLAN tagging; The vlan tagging value was so high, OpenWRT didn't support it so I was left with the useless middle box. Your mileage may very.

OpenWRT does support VLAN tagging, it's Linux. Maybe it's a hardware support issue.

I was just about to re-install OpenWRT, but I guess I won't now.

i don't think too many people care about this. ( yes, i live in turkey )

Yeah, no one cares outside of hackernews.

Hell, I'd imagine my grandmother or other non-tech family would be glad the telephone company can pop in and fix it

If that stuff listen to the interface of your public IP which is most likely not the case, but yes it's still scary.

Reply on news.ycombinator.com