ATT Fiber Bypass with Unify 3.x

att-fiber-bypass.md

ATT Fiber Bypass with Unify 3.x

Based on Jim Angel's blog post and comment section.

This was ran against UniFi OS v3.2.9.

Reasoning

When moving from UniFi OS 1.x to 2.x, they switched their base OS distro to Debian, which removed the need for containerizing their applications. The original solution was to run wpa_supplicant from within a container on the host system's podman instance - however from 2.x this is no longer needed and the host system itself will run wpa_supplicant.

I did not realize this when I was updating, figuring it's about time to get on the latest version and having regular security patches again. These are the steps I followed after reading the comment section on Jim's original blog post.

Pre-reqs:

1. Get old router setup, been forever since it was plugged in, it wasn't able to forward the public IP to my UDM and I had to configure it to be on a different subnet so the UDM would pick up an IP from the ATT RG.
2. After getting UDM back online, you might as well update to the latest.
3. Find backups of certs + conf to copy back to UDM. These should be generated for you from the original blog's tool.

Steps:

1. ssh into UDM, replace 192.168.1.1 with your UDM's IP, however for the rest of these examples we're going to assume 192.168.1.1. Install wpasupplicant package.

ssh root@192.168.1.1

apt-get install wpasupplicant
mkdir -p /etc/wpasupplicant/conf

1. Now cache the files locally so we don't need the internet to install this package should something go wrong during an upgrade.

sudo apt-get reinstall --download-only wpasupplicant
mkdir /etc/wpa_supplicant/repository
cp /var/cache/apt/archives/wpasupplicant*.deb /etc/wpasupplicant/repository

Now in the event of the package being removed during an upgrade, assuming this directory remains in tact, you can run this command to install the service again:

apt install /etc/wpasupplicant/repository/*.deb

1. Update your conf file locally (easier than sed) to reflect the full paths of where you'll be copying to. These examples we're using /etc/wpasupplicant/conf so we'll prefix the paths with this. End result should look something like this:

network={
        ca_cert="/etc/wpasupplicant/conf/CA_001E46-xxxx.pem"
        client_cert="/etc/wpasupplicant/conf/Client_001E46-xxxx.pem"
        eap=TLS
        eapol_flags=0
        identity="8C:7F:xx:xx:xx:xx" # Internet (ONT) interface MAC address must match this value
        key_mgmt=IEEE8021X
        phase1="allow_canned_success=1"
        private_key="/etc/wpasupplicant/conf/PrivateKey_PKCS1_001E46-xxxx.pem"
}

1. Copy files over to UDM, run this from where your PEM and CONF files are saved (and backed up somewhere safe!)

scp -r *.pem root@192.168.1.1:/etc/wpasupplicant/conf/
scp -r *.conf root@192.168.1.1:/etc/wpasupplicant/conf/

1. Now use systemctl to edit the services properties

systemctl edit wpa_supplicant

We need to update the settings between the comment blocks to look like this

[Service]
ExecStart=/sbin/wpa_supplicant -u -s -Dwired -ieth8 -c /etc/wpasupplicant/conf/wpa_supplicant.conf
[Install]
WantedBy=multi-user.target

Use :wq to write the changes to disc and quit.

1. Use systemctl to start and enable the wpa_supplicant service.

systemctl start wpa_supplicant
systemctl enable wpa_supplicant

NOTE: You may see the following in error logs, but it appears to be benign

WMM AC: Missing IEs

1. (Maybe Optional) Update the MAC address of your WAN port to be what was included in your conf file. To do that in the UDM Web UI, go to Network > Settings > Internet and select the WAN you're using, switch Advanced to manual to enable the advanced options, and provide the address in MAC Address Clone.
2. (Optional/Troubleshooting) Some have said they needed to set the WAN to VLAN 0 as well, you can do that in this same screen if you need to.
3. Now you should be able to plug the ONT back into your UDM!

Viewing Logs

To view logs, use this command (run from the UDM)

grep wpa_supplicant /var/log/daemon.log