DO IT *chants feverishly*

Have any of you noticed that the Unifi network is spewing a truckload of random IPTV data into your home network? My PON unit LAN light is flickering like mad when my router is not even plugged in.. and a wireshark dump shows that its all IPTV traffic (tons of ARP request packets and even IPTV data such as the chanlist file). Wtf is TM doing?

No, there's something f-ed up going on and I'm trying to get in touch with their engineering/NOC team but the Unifi call center staff are being bloody idiots.

Seriously, TM only fixes shit when I scream 'IPTV EXPLOITTTT!!!!!' so here.

Wtf is going on TM? I wasted 30 mins+ of my time with a lady who says this kind of behavior coming from your IPTV network is 'normal'. She even tried to explain to me that when a network card receives traffic, 'the light is supposed to blink'. My home network is practically being flooded with all this junk traffic coming from your IPTV VLAN.

Next time people have any important information, I suppose they should just shut up till your network DDoS-es itself. >_>

http://athena.my/imagehost/iptvarp.png

http://athena.my/imagehost/iptvarp2.png

This only started 2 days+ ago and the LAN light on my fiberhome is blinking so fast you can practically get an epileptic fit from looking at it.

This post has been edited by rizvanrp: Aug 5 2010, 10:36 AM

Yeah, I'm guessing its a configuration issue on their side. They must have screwed something up (as usual).

I guess one way to fix this is to disable the IPTV VLAN in the fiberhome itself which is pretty easy

They wouldn't even let me change the name of the Unifi line owner before the installation began because as you said, they 'can't do anything about it'. >_>

Yes, this is possible because TM has also used the same default pass combination for the fiberhome and other BTUs. People can modify your fiberhome settings via the private network that the BTU connects to.

I just didn't think that people would start doing it so early <_>

Seriously, this is what TM gets for not securing everything properly.

Fixed the stupid packet flooding issue coming from the IPTV VLAN by disabling VLAN 600 at the fiberhome

EDIT : At this point I'm pretty sure that decent technical support for Unifi is pretty much non-existent. I requested for my Streamyx zone password last week and they said they said I didn't have access to that (despite being on VIP20) because I signed up on launch day. They kept saying they would call me back and I called in at least 5 times but no one ever returned that call. Today was the final telephone call and someone did call me back. They 'offered' me Streamyx zone access based on the condition that my contract would be 'restarted' today .. so instead of having been registered since the end of March, they would count it as though I registered starting today for a minimum period of 2 years.

Paying RM250/mth for this crappy service. The best part was when the girl told me the NIC light is supposed to blink when there's traffic because I complained about their IPTV VLAN flooding my home network with fragments of data from other users.. like this was some special ed phone call. Terrible customer support >_>

This post has been edited by rizvanrp: Aug 5 2010, 06:14 PM

I recommended using the DIR-615 as a VLAN switch for a few reasons :

1) You would easily be able to use your own router and still have IPTV access without flashing it to DD-WRT

2) You wouldn't have to buy new hardware like a DD-WRT router or a VLAN switch

3) You wouldn't have to buy a DD-WRT router which specifically supports PORT based VLANs -- I've been told only Broadcom chipsets support this. Other chipsets have the 'VLAN' option for port based VLANs hidden on their firmware Web UI

4) Everyone has access to the DIR-615 since its bundled with the package (and has a warranty) so everyone can setup their own router to work with Unifi without buying additional hardware. When TM wants to troubleshoot your line, they expect you to use the DIR-615. If you don't, even the team they send to your house will reset your DIR-615 to stock settings or bring their own. TM still doesn't grasp the concept of people wanting to use their own equipment.

If you guys have dd-wrt routers which support port based VLANs or just don't care about IPTV, feel free to use any DD-WRT router to setup your Internet and IPTV access. The reason why I have not recommended DD-WRT is because every DD-WRT build is different from one another. There are about 8+ different versions of DD-WRT and each of these versions are unique to the specific to the hardware they're being installed on. If I had a Broadcom based DD-WRT router with full VLAN (port + tagged) support, everything may work for me but another guy who has hacked DD-WRT onto his own RaLink based one may not be able to do the same. Some of you have pointed out that the port based VLAN page is hidden (192.168.1.1/Vlan.asp).. this is because your router probably doesn't support port based VLANs

Some of you have asked if its possible to wire your modem directly into the BTU. I've heard this is possible on the ZTE VDSL2 BTUs and newer Fiber optic based BTUs (huawei and stuff) but its definitely not going to work with the Fiberhome in my experience. Furthermore, another thing you should note about most BTUs is that they re-download their configuration and settings from a remote server every single time you reboot the unit. Any changes that you make will not be saved in the unit so it makes this method pretty impractical :/

I'm just a degree student finishing off his final year project so I don't get any hardware donations or lots of money to buy additional hardware to test Unifi with, nor do I have much time to mess with Unifi anymore since I'm already running fine on pfSense (without IPTV) If you guys have some equipment that you think you should be able to get working with Unifi but you can't, you can always pass it to me and I'll see what I can do (like many other members have done in the past) or better yet.. get it working yourself and list down the configuration steps so that we can have a hardware compatibility list and the methods to get it working.

I don't really understand what you mean by 'Don't really like/would prefer to have my own firewall rather than rely on the router which TM Provides.'

Using the DIR-615 as a VLAN switch allows home users who are experiencing issues with their DIR-615 (weak wireless/connections drops/router crashes) to use their own hardware to manage the PPPoE connection, NAT and router security. It's the easiest solution I can think of. Of course, in your case you're using a Linux box and thanks to the 8021q kernel module you're pretty much good to go. Why would you mention power consumption anyway? A dedicated PC as a router (unless its a laptop or Atom chipset) would pretty much run at about 200watts on average (?) compared to using an additional embedded system (DIR-615) which peaks at 12.5watts. Since its running on Linux, you can also easily setup IPTV support provided you have the needed amount of NICs.

I could ask everyone to purchase a Mikrotik RB750G/450 to handle the VLAN tagging, IPTV and PPPoE link but many people would not be able to setup an IP router to do this using the command line interface alone. They would also still need to purchase an additional AP/router for WIFI access. I understand your concerns about power consumption and I did take this into account but I figure the DIR-615 doesn't even use as much power as a light bulb :/ Anyway, you can blame TM for not giving you a BTU which can perform VLAN tagging/untagging as needed

---

I tried my best to look for a solution that would suit everybody's needs and the DIR-615 as a VLAN bridge was the best that I could think of. I can't recommend dd-wrt because there's a unique configuration for each router. -pWs- for example has his dd-wrt router replace the WAN interface with the default one every time he reboots the system.. so in his case he needs a startup script to reset this glitch. 76radius had his dd-wrt router screw up the iptables rules everytime it rebooted.. he also needed a startup script to fix this problem.

There's no way you can have stability without sacrificing low power consumption and vice-versa. I myself use pfSense because I need rock solid stability but I've also used the DIR-615 in bridge mode for 1 week+ without having it crash on me even once.

This post has been edited by rizvanrp: Aug 8 2010, 06:08 PM

My pfsense is running on a celeron M laptop rated at 60w

If you have 2 NICs, that's enough for IPTV and Internet. You just wire your BTU -> switch -> PCs + Router (NIC1)

NIC2 goes to the STB directly

Since the PPPoE connection is made over a VLAN interface you can run LAN traffic + WAN traffic over the same switch.

Yea get it if you can. The McDs I mean

You need to setup VLAN 500 on your physical WAN port then set your WAN interface assignment to <WANinterfacename>.500 . All of this is done in the Networking page, no need to touch the VLAN/port based VLAN page. Though I have to tell you, I had a lot of problems getting it to dial initially (even though all the settings were correct) and had to use Wireshark + an old 10mbps hub to sniff the PPPoE auth traffic and see what was going on.

Full dd-wrt flashing + configuration guide for the TM DIR-615 G1 and Unifi is up -- http://unifi.athena.my/index.php?option=co...id=53&Itemid=65



This post has been edited by rizvanrp: Aug 9 2010, 05:34 AM

I'm under TTDI but mines running well. It's been running fine without any downtime since April actually, lol. Is your VOIP phone or IPTV working?

This post has been edited by rizvanrp: Aug 9 2010, 10:03 AM

Hey babybee, I can't be 100% certain what's going on with your unit unless I take a packet capture of the traffic between the BTU <---> Linksys. However, based on what you're telling me it seems the case is either :

1. Your Linksys is sending out untagged traffic on vlan1 despite you setting the WAN port assignment (hence no response)
2. You've selected the wrong port, vlan1 is not your WAN port and tagged traffic is being sent out on something which is not connected to the BTU

The reason I say this is because should the BTU side have received any vlan 500 tagged traffic at all, you would have received at least a single ethernet frame (couple o' bytes) as an acknowledgment to your initial PPPoE broadcast.

Perhaps you can try creating a bridge (br0) and adding all three vlans in (vlan0,vlan1,vlan2).. then set VLAN tag 500 on br0. After that, use br0.500 as your WAN port assignment and see if it can dial in? I would also try to eliminate the possible problems here so its best that while you're attempting to get PPPoE running.. don't set any port based vlans.

This post has been edited by rizvanrp: Aug 9 2010, 11:00 AM

Another LYNer here who uses dd-wrt with Unifi (rogue I think) set his WAN port to a bridge interface to get it to work so I'm guessing it can connect through that (as long as all your interfaces are in the same bridge). A while ago when I was writing my Unifi VLAN forwarder, I basically had to analyze PPPoE auth packet captures for 4 hours straight because my application had to rewrite source/dest MAC addresses as well as add a 4 byte VLAN tag after those MACs.. I pretty much know how the BTU will respond to spoofed PPPoE packets so based on that knowledge I'm making those two guesses above.

But yeah, I can't be sure of anything until I see an actual packet capture. Hacked hardware like dd-wrt does not always function the way we assume it does :/

If you send a valid PPPoE discovery request but it has no VLAN tag on it, the BTU will ignore it. If you send a valid PPPoE discovery request with a VLAN tag, you will get an acknowledgment from the BTU side. If you send a PPPoE discovery request with the VLAN tag but with an invalid source MAC address, you will get an ack but your session will not progress from there

This post has been edited by rizvanrp: Aug 9 2010, 11:12 AM

W'okay but its easier to use an old hub (which mirrors traffic to each port) or a managed switch with port mirroring If you're using *pcap based software like Wireshark, you must also perform the capture in Linux because Windows NIC drivers which don't support VLAN tags (nearly all realtek cards) will automatically strip off VLAN tags from your capture so you won't know what's really going on.

---

Added on August 9, 2010, 11:18 amThis is an ADSL2 modem+router combination right? I'm just guessing because it has ATM VC based PVIDs

Edit : doh, just saw the ADSL thing up there haha

This can only be used with DSL providers which send certain services over VLANs.. can't be used with Unifi.

This post has been edited by rizvanrp: Aug 9 2010, 11:18 AM

Its only for ADSL based services AFAIK. Like a service provider will be able to do what Unifi does (separate VOIP/Internet/Video) but within an ATM link instead. A VLAN tag is just a 4 byte array of data anyway.. although to you guys it's probably the most annoying 4 byte string since it prevents you from using your own hardware with Unifi

Backtrack will be fine

Standard TM DNS - 202.188.0.133/202.188.1.5 but people should use GoogleDNS if possible

Don't be silly, there have been many people who have been able to replace the DIR-615 completely It's just that no one ever posts back here once they get their system fully set up ! I myself have replaced the DIR-615 with a Cisco rvs4000 configured as a switch to handle VLAN tagging. I'm sure that you can purchase a cheap managed switch such as the Mikrotik RB250GS and configure that for Internet + IPTV access.

Then there are port based VLAN routers (running WRT firmware) which are on the market but no one has tried to use them yet :



You can also use a dedicated Linux box with 3 NICs for an IPTV + Internet router.. there are many ways to do this.

If you do not have the hardware to replace the DIR-615 (in the event it fails), I suggest you guys keep aside a Linux LiveCD which you can configure VLAN tagging + PPPoE on so you can wire your PC directly into the Fiber/VDSL BTU and connect to the internet. If its just light browsing you're after while waiting for a replacement, there's also my VLAN forwarder app for Windows so that you can use the Windows PPPoE dialer with the Unifi BTU directly.

I don't really think the failure rate for DIR-615's can be as high as you guys say it is. There was even another thread here about how to get your ipod/itouch/ipad working with the DIR-615 wifi and Unifi support claimed his router was faulty/spoilt because they didn't know what was causing it. Some of you here have said the orange light keeps blinking, this means your DIR-615 may have entered emergency room mode by mistake. Normally when the router is physically damaged, there will be no lights on it. Having orange lights blinking/constant reboots indicates a software problem that could be fixed by a re-flash in Emergency Room mode.

Truth be told, the DIR-615 G1 is a decent router using a standard router chipset + hardware. The only thing causing many of these bugs is the firmware that TM has placed in it. I've been torrenting for 3 days straight after flashing my DIR-615 G1 to dd-wrt and its been really stable. Since it has a 384Mhz proc + 32MB RAM (which is way better than some of your linksys 54g models), it can easily handle 10,000+ connections with a custom conntrack table size.