Seral - Part. 1a - OPNsense router 1-10 Gbps

This article covers building your own OPNsense router, based on a Lenovo m720q and a Nokia XS-010X-Q ONT, for 1 Gbps fibre, with a path up to 10 Gbps.

Hardware

Fibre connection

First job: find a rootable GPON ONT, i.e. a box you can actually take over.
hack-gpon.org has a fairly complete list, plus tutorials and datasheets. Read them. It is a goldmine.

I went with a 10 Gbps model compatible with my ISP: the Nokia XS-010X-Q.
To root it you need to solder onto the UART pins and use a USB-TTL adapter. Nothing fancy. Photos and a full walkthrough are on the link above.

The router

For routing I picked a small workstation that can run a firewall such as OPNsense.
Trade-offs:

• you add Ethernet ports yourself,
• there is no Wi-Fi radio that can run several decent APs (you will need another box).

On the security side that is a plus: Wi-Fi hardware is fully isolated from the main router.

The Lenovo m720q has a free PCIe slot, so you can add a NIC, including 4-port cards.

A solid tutorial covers preparing the m720q and which parts to buy:
Full guide here

If you want 10 Gbps, make sure:

• you buy a 10 GbE NIC,
• the m720q accepts it (Lenovo hardware whitelist),
• your ONT or bridged ISP router also supports that speed.

ONT alternative

You can also keep the ISP router and put it in bridge mode.
Routing then lives entirely on OPNsense, while Wi-Fi can stay on the ISP box.

Cost is then just the box behind it, around €200 for a Lenovo m720q.
Cheaper options exist depending on what you need.

GPON setup

Once the UART pins are soldered, connect to the board (with PuTTY, for example) at the right baud rate.
Install the right drivers for the USB-TTL adapter, usually FTDI.

You should get a prompt like the one on Hack GPON.
Switch to enable, follow the site procedure, then drop into a shell.

Goal: configure the ONT to impersonate the original router.
Depending on the ISP, checks can be more or less strict: GPON password, MAC, serial, vendor ID, hardware version, etc.

How to change those values is documented on Hack GPON.
How to get them:

• inspect a backup of the original router config,
• read physical labels (serial numbers),
• check lafibre.info — the community documents a lot of real cases.

For the brave, you can also try:

• getting a shell on the ISP router,
• or using an expensive optical TAP, something I might DIY one day, for the sport

Tip
If you cannot recover every value (IDs, GPON parameters, etc.), temporarily plug the ISP router back in. It authenticates, then you quickly swap the cable onto your own gear.
Caveat: a long reboot or power cut drops the auth and you have to do it again.

Configure the m720q

Install OPNsense

There are already plenty of OPNsense install guides. No need for another one.
You need:

• a display,
• a keyboard,
• a USB stick.

Flash the ISO with Rufus, boot it, done.

Useful links:

• Official docs
• OPNsense getting started

Configure interfaces

My box is not online right now (and I cannot be bothered to put an SSD back in just for screenshots). So read carefully.

LAN

You should see several NICs:
em0 (the Lenovo built-in port), igb0, igb1, igb2 and igb3.

Do not use em0 for LAN or WAN. It is slower. Use the extra ports if you want decent throughput.

Assign LAN and WAN first.
In the CLI, pick option 1:

• LAN → igb0
• WAN → igb3 LAN on the first port, WAN (the one that goes to the ONT) on the last.

Then option 2 for IPs, and select LAN. Answer as follows:

Configure IPv4 address LAN interface via DHCP: N
Enter the new LAN IPv4 address: 10.66.10.1
Enter the new LAN IPv4 subnet: 24
Configure IPv6 address LAN interface via WAN tracking: Y
Do you want to enable DHCP server on LAN: y
Enter the start address of the IPv4 client: 10.66.10.2
Enter the end address of the IPv4 client: 10.66.10.2
Do you want to change the web GUI protocol from HTTPS to HTTP: y
Do you want to generate a new self-signed web GUI certificate: y
Restore web GUI access defaults: y

Done.
LAN is ready. You can leave the CLI.

Plug Ethernet into the router, open a browser:

http://10.66.10.1

Default credentials:

• user: root
• password: opnsense

Change it immediately. Really.

WAN

WAN lives under Interfaces → [WAN].
From here it depends a lot on your ISP. Again, lafibre.info is your best friend.

On green.ch / Swisscom, you need VLAN 10 and some specific DHCP requests. Still no screenshots, so if you are in the same boat… breathe, then read slowly.

First: disable private networks and bogon networks. They have no business here.

Then:

• set the MAC address of the original ISP router,
• set MTU to 1492 (PPPoE).

Do not set DHCP or a static IP on this interface. IP settings stay None.

Go to Interfaces → Devices → VLAN, create a VLAN:

• Device: vlan0.10
• Parent: igb3 (your WAN interface)
• VLAN tag: 10
• VLAN priority: Best Effort
• Description: Internet

Once created, go to Interfaces → Assignments.
Under Assign a new interface, pick vlan0.10 Internet and name it Internet. Boring, effective.

Open Interfaces → [INTERNET] and set:

• Uncheck block private networks and block bogon networks
• IPv4 Configuration: DHCP
• IPv6 Configuration: DHCPv6
• MAC address: the original router’s again
• MTU: leave empty
• DHCPv6 client configuration: (depends on the ISP; Init7 example is in the other write-up)

In DHCP client configuration:

• use the same hostname as the ISP router (mine: fritz.box)
• protocol timing:
  • Timeout: 60
  • Retry: 15
  • Select Timeout: 0
  • Initial Interval: 1

In Lease Requirements, add the DHCP options the original router sent.
You can recover those with a Wireshark dump on the ISP router if you can.

I had to use:

dhcp-class-identifier "AVM DHCPC v9.04.395" ,dhcp-client-identifier ff:08:ec:b8:1d:00:03:00:01:MA_MAC_ADDRESS_HEHE

Now create a gateway so traffic exits via this VLAN. System → Gateways → Configuration, new gateway on VLAN_Internet, monitoring off, name it INTERNET_DHCP for example.

I know the “skip collecting every ONT value by hand” trick for a reason… In my case: reboot the firewall, plug the old router until it authenticates, then swap the cable onto the Lenovo fast.

Ugly. Works.

Your ISP might not need a VLAN or any of this witchcraft, and you can just set WAN IPs to DHCP. Best of luck.

Optional ports

Remember em0, igb1 and igb2? I do, and I want to use them.

Create a bridge across every port except WAN, so LAN is available on all of them.

Simple:

1. Interfaces → Assignments
2. Devices → Bridge
3. Bridge igb0, igb1, igb2 and em0.
4. Back in Assignments, assign bridge0 to LAN

The m720q is now fully usable.

Next: basic firewall setup.