U-verse for BUSINESS? : 2Wire 3600HGV bridge mode? or another AT&T supported VDSL modem? [ Edited ]

[Treo600user]

I am having trouble properly configuring this AT&T 2Wire 3600HGV modem for my network. Maybe someone is aware of a different firmware for this product?

I am completely aware of how to setup the DMZ mode & router behind router setup in these boxes but that is NOT the point. (We have supported firewalled networked equipment working that has all the bells & whistles including QoS)

In the event of a factory reset of the AT&T 2Wire VDSL modem at this business, I want to properly insure the following business requirements are met:

- DHCP - OFF (at min, it appears you must leave one available?)

- WiFi - OFF (Yes this can be turned off, but bridging it always insured it was turned off in the past. ON is a security concern among just bad business i.e. conflict with other business WiFi, employees might see/use this non-content filtered WiFi, etc etc)

- & passing off internet service needs to be easy to another networked supported OUTSIDE of AT&T firewall. (I'm NOT asking for AT&T support on this, but in the bridge DSL world, this was EASY)

- if bridging this 2Wire is NOT an option, backing up the configuration settings would be a nice alternative but that is not available as well?

Bridging the old DSL modems always worked nicely but the 2Wire 3XXXHGV line appears to be the ONLY ones to support the AT&T VDSL Max Turbo speeds. 24Mbps down / 3 Mbps up which we use not only for normal business operations (credit cards, business email, web based training, etc) but this high speed is required to view onsite security video (3Mbps up) and offer customers FAST free WiFi!

AT&T U-Verse offers the right price, contract, speed, internet package & installers to properly handle our resturant locations company's data needs but I'm struggling with the their "business" support of this 2Wire VDSL modem product. We ONLY use the internet, no TV (not legally available for restaurants, yet). No Voip because POTS is our reliable backup. So it's just the internet service ...

For coverage on AT&T Uverse, we have over 50 locations lit up like a Christmas tree but sadly business support on this product is driving me nutz! Maybe because I now see this is listed under "Residential Gateway"? Is this AT&T 2Wire VDSL modem product not meant for business? Is anyone aware of another supported AT&T VDSL modem or a different 2Wire firmware available? Official AT&T support has me running in circles (AT&T U-verse support > AT&T Connecttech > AT&T Connecttech360 > AT&T U-verse support, rinse, repeat)  

help?

[SomeJoe7777 ACE - Expert · Accepted solution]

There is no true bridge mode on the 2Wire routers.  However, you can still configure it such that almost all functions of your own router will work properly.

1. Set your router's WAN interface to get an IP address via DHCP.  This is required at first so that the 2Wire recognizes your router.

2. Plug your router's WAN interface to one of the 2Wire's LAN interfaces.

3. Restart your router, let it get an IP address via DHCP.

4. Log into the 2Wire router's interface.  Go to Settings -> Firewall -> Applications, Pinholes, and DMZ

5. Select your router under section (1).

6. Click the DMZPlus button under section (2).

7. Click the Save button.

8. Restart your router, when it gets an address via DHCP again, it will be the public outside IP address.  At this point, you can leave your router in DHCP mode (make sure the firewall on your router allows the DHCP renewal packets, which will occur every 10 minutes), or you can change your router's IP address assignment on the WAN interface to static, and use the same settings it received via DHCP.

9. On the 2Wire router, go to Settings -> Firewall -> Advanced Configuration

10. Uncheck the following: Stealth Mode, Block Ping, Strict UDP Session Control.

11. Check everything under Outbound Protocol Control except NetBIOS.

12. Uncheck NetBIOS under Inbound Protocol Control.

13. Uncheck all the Attack Detection checkboxes (7 of them).

14. Click Save.

Your router should now be able to route as if the 2Wire was a straight bridge, for the most part.

Inbound port 22 might be blocked, and inbound ports 8000-8015 might also be blocked, and there's nothing that can be done about it.

This is how I have my 2Wire configured, and I have a Cisco 2811 behind it doing IPSec, IPv6 tunnels, etc.

[mewd80]

Hi,

Would you be able to give a hint as to how your 2811 is setup? Are you nat-ing inside source behind 2811 using overload? I've been trying to do the same with 1841 but having some issues.

Thanks

[SomeJoe7777 ACE - Expert]

Yes, I'm using NAT to the outside interface of the 2811.

Here is a representative configuration:

Current configuration : 12632 bytes
!
! Last configuration change at 16:51:56 CST Fri Mar 4 2011 by xxxxxxxx
! NVRAM config last updated at 16:14:07 CST Fri Mar 4 2011 by xxxxxxxx
!
version 15.0
no service pad
service tcp-keepalives-in
service tcp-keepalives-out
service timestamps debug datetime msec localtime show-timezone
service timestamps log datetime msec localtime show-timezone
service password-encryption
!
hostname inet.dw.2811
!
boot-start-marker
boot system flash 
boot-end-marker
!
logging buffered 51200 warnings
logging console warnings
enable secret 5 xxxxxxxxxxxxxxxx
!
clock timezone CST -6
clock summer-time CDT recurring
!
dot11 syslog
no ip source-route
no ip gratuitous-arps
!
ip cef
no ip dhcp use vrf connected
!
no ip bootp server
ip domain name thedanzone.net
ip name-server 192.168.160.20
!
ip inspect name fromLAN_ipv4 tcp
ip inspect name fromLAN_ipv4 udp
ip inspect name fromLAN_ipv4 esmtp
ip inspect name fromLAN_ipv4 ftp
ip inspect name fromLAN_ipv4 ftps
ip inspect name fromLAN_ipv4 isakmp
ip inspect name fromLAN_ipv4 l2tp
ip inspect name fromLAN_ipv4 pptp
ip inspect name fromLAN_ipv4 ssh
ip inspect name fromINet_ipv4 tcp
ip inspect name fromINet_ipv4 udp
ip inspect name fromINet_ipv4 esmtp
ip inspect name fromINet_ipv4 ftp
ip inspect name fromINet_ipv4 ftps
ip inspect name fromINet_ipv4 isakmp
ip inspect name fromINet_ipv4 l2tp
ip inspect name fromINet_ipv4 pptp
ip inspect name fromINet_ipv4 ssh
!
multilink bundle-name authenticated
!
voice-card 0
!
username wilsondr password 7 xxxxxxxxxxxxxxxxxx
!
ip ssh version 2
! 
interface FastEthernet0/0
 description Internal LAN
 ip address 192.168.160.1 255.255.255.0
 ip access-group internet_outbound in
 no ip redirects
 no ip proxy-arp
 ip nat inside
 ip inspect fromLAN_ipv4 in
 ip virtual-reassembly max-reassemblies 64
 arp timeout 600
!
interface FastEthernet0/1
 description DMZ AT&T U-Verse Internet Service
 ip address dhcp
 ip access-group internet_inbound in
 no ip redirects
 no ip proxy-arp
 ip nat outside
 ip inspect fromINet_ipv4 in
 ip virtual-reassembly max-reassemblies 64
 no cdp enable
!
ip forward-protocol nd
no ip http server
no ip http secure-server
!         
ip nat inside source list nat_eligible interface FastEthernet0/1 overload
ip nat inside source static tcp 192.168.160.20 80 interface FastEthernet0/1 80
!
ip access-list extended internet_inbound
 remark Allow traffic from 2Wire router
 permit ip host 10.0.0.1 any
 remark Allow Cisco to renew DHCP
 permit udp any eq bootps any eq bootpc
 remark Block IPv4 Bogons
 deny   ip 0.0.0.0 0.255.255.255 any
 deny   ip 10.0.0.0 0.255.255.255 any
 deny   ip 39.0.0.0 0.255.255.255 any
 deny   ip 102.0.0.0 1.255.255.255 any
 deny   ip 104.0.0.0 0.255.255.255 any
 deny   ip 106.0.0.0 0.255.255.255 any
 deny   ip 127.0.0.0 0.255.255.255 any
 deny   ip 169.254.0.0 0.0.255.255 any
 deny   ip 172.16.0.0 0.15.255.255 any
 deny   ip 179.0.0.0 0.255.255.255 any
 deny   ip 185.0.0.0 0.255.255.255 any
 deny   ip 192.0.0.0 0.0.0.255 any
 deny   ip 192.0.2.0 0.0.0.255 any
 deny   ip 192.168.0.0 0.0.255.255 any
 deny   ip 198.18.0.0 0.1.255.255 any
 deny   ip 198.51.100.0 0.0.0.255 any
 deny   ip 203.0.113.0 0.0.0.255 any
 deny   ip 224.0.0.0 31.255.255.255 any
 remark Block own assigned IPv4 space
 remark Block anything going to Windows RPC
 deny   tcp any any eq 135
 remark Allow all ICMP traffic
 permit icmp any any
 remark Allow NTP to the router
 permit udp host 192.5.41.41 eq ntp any eq ntp
 permit udp host 192.5.41.209 eq ntp any eq ntp
 remark Allow services to internal servers
 permit tcp any any eq www
ip access-list extended internet_outbound
 remark Prohibit any contact with Windows RPC-NetBIOS
 deny   tcp any any eq 135
 deny   tcp any any eq 137
 deny   tcp any any eq 138
 deny   tcp any any eq 139
 deny   udp any any eq 135
 deny   udp any any eq netbios-ns
 deny   udp any any eq netbios-dgm
 deny   udp any any eq netbios-ss
 remark Allow traffic from own assigned IP space
 permit ip 192.168.160.0 0.0.0.255 any
ip access-list extended nat_eligible
 permit ip 192.168.160.0 0.0.0.255 any
!
logging facility local1
logging 192.168.160.20
!
snmp-server community xxxxxxxx RO
snmp-server location Dan Wilson, Houston, TX
snmp-server contact Dan Wilson, Houston, TX
snmp-server enable traps tty
!
banner login ^C
###################################################################
#                                                                 #
# Dan Wilson Residence                                            #
# --------------------                                            #
#                                                                 #
# Dan Wilson Internet Border Router (Cisco 2811)                  #
# 76-238-185-187.lightspeed.hstntx.sbcglobal.net (76.238.185.187) #
#                                                                 #
# Unauthorized Access Prohibited - All access attempts are logged #
#                                                                 #
# Location: Dan Wilson Residence, Houston, TX                     #
#                                                                 #
###################################################################
^C
!
line con 0
 session-timeout 30 
 exec-timeout 30 0
line aux 0
line vty 0 4
 session-timeout 30 
 exec-timeout 30 0
 transport input ssh
 transport output ssh
!
scheduler allocate 20000 1000
ntp server 192.5.41.41
ntp server 192.5.41.209 prefer
end       

[edited per user request] - pamelaz

[mewd80]

Wow! Thanks SomeJoe7777. much more involved than i envisioned. Thank you very much for the info. I will see if i can make it work with your config as guideline. Much appreciated.

mewd80

[twentw]

SomeJoe7777:

I just got a new wireless router and I'm trying to set it up as per your instructions.  (I did this before successfully a few years ago, but I can't remember how).  Anyway, I've followed your instructions, and everything seems set up correctly.  The router is getting an outside ip address.  My wireless devices are connecting fine with a valid ip address from the router's dhcp.  But, I get no internet.  I also have a desktop computer plugged directly into the router, and it has no internet.  The rest of the computers on my network are all working fine.  The only possible deviation is that the router is not plugged directly into the 2Wire, but is plugged into a switch connected to the 2Wire that all my other computers are connected to.  Would that make a difference?

Any help is appreciated.

One other thing that I just noticed: when looking at the connection info on my iPhone, it's showing the DNS address as the same address as the wireless router (it's actually showing that address twice).  That sounds suspicious to me.

[SomeJoe7777 ACE - Expert]

No, the switch should not make any difference.  That should work fine.

If devices that are connected to your router are getting DNS addresses that are the same as your router, that is correct.  Most home routers act as a DNS server, so they hand out their own address as the DNS server.  The router then forwards the DNS requests to the upstream DNS server.

Check your subnetting on the 2Wire RG and on your router carefully.  By default, the U-Verse RG's DHCP range is set to 192.168.1.x.  This is the same DHCP range that many home routers hand out.  If the two DNS ranges are the same, Internet will not work.  You must change the LAN addressing of your router to 192.168.2.x (router address: 192.168.2.1), or you must change the 2Wire DHCP range on this page:

http://192.168.1.254/xslt?PAGE=C_2_3

Once the two routers are using different LAN subnets (i.e. different router addresses and different DHCP ranges), you should have Internet.

[twentw]

OK, that's what I've found out also - I had both routers on the same subnet. If the wireless router is on a different subnet, everything works fine.  My problem is this - I need to be able to access all the devices on the network.  I can't access files on a computer that's on a different subnet.  How do I get around this?

[SomeJoe7777 ACE - Expert]

So you have some computers connected to the 2Wire router and some connected to your router?  Is there a reason that they're not all connected to your router?

[twentw]

One computer is by the router and there's only one connection to that part of the house.  I need to be able to access files on my network with my mobile devices also.

[SomeJoe7777 ACE - Expert]

OK, so what was the main purpose of installing your own router?  What functionality were you seeking?

[twentw]

Higher speed, greater range.  My RG is stuck in a closet.  I can put the new router in a more open location.

[SomeJoe7777 ACE - Expert]

So you are only interested in the wireless aspect of the router?

In that case, you do not want to follow these directions at all, since you do not need special routing functionality.  Instead, all you want is a wireless access point.

To do this, do the following:

1. Turn off DHCP on your router.

2. Change the link between the 2Wire router and your router to use the LAN ports on both ends.  (In other words, plug the cable from one of the LAN ports of the 2Wire to one of the LAN ports of your router.  Leave your router's WAN port empty).

3. Change the LAN IP address of your router to a static IP on the same subnet as the 2Wire router.  For example, if the 2Wire router is using 192.168.1.x, and the DHCP range is 192.168.1.64 - 192.168.1.253, set your router to 192.168.1.10.

4. If necessary, configure the wireless parameters on your router, such as SSID, encryption, pre-shared key, and MAC filtering.

Your wireless computers connected to your router will now be able to communicate with wired computers on the 2wire router since everything will be on the same subnet.

[twentw]

Yes, that did it (now I remember that's how I had set up my old router).  I really appreciate your help.

[cmsret]

---

SomeJoe7777 wrote:

So you are only interested in the wireless aspect of the router?

In that case, you do not want to follow these directions at all, since you do not need special routing functionality.  Instead, all you want is a wireless access point.

To do this, do the following:

1. Turn off DHCP on your router.

2. Change the link between the 2Wire router and your router to use the LAN ports on both ends.  (In other words, plug the cable from one of the LAN ports of the 2Wire to one of the LAN ports of your router.  Leave your router's WAN port empty).

3. Change the LAN IP address of your router to a static IP on the same subnet as the 2Wire router.  For example, if the 2Wire router is using 192.168.1.x, and the DHCP range is 192.168.1.64 - 192.168.1.253, set your router to 192.168.1.10.

4. If necessary, configure the wireless parameters on your router, such as SSID, encryption, pre-shared key, and MAC filtering.

Your wireless computers connected to your router will now be able to communicate with wired computers on the 2wire router since everything will be on the same subnet.

---

SomeJoe

I have read your posts under this topic and also under the “Router behind Router Setup…” topic in this forum.  Thanks for the info.  At the moment I have a Linksys WRT160N router coupled to an AT&T DSL modem.  I am subscribing to UV Internet MAX (no TV or VoIP) and I am getting a 2WIRE-3801 gateway.  I would like to set up my Linksys router as a wireless access point as I prefer Wireless N and WPA2 to the Wireless G and WPA that comes with the 2WIRE.  If I set up the router as a wireless access point as you describe in Message 13 here (I assume that I should turn off the wireless on the 2WIRE also), will I have any kind of firewall protection, either from the UV gateway or the Linksys?  I do not need any special router functionality other than the wireless but I would like to have the extra protection that the router is now providing me with my current DSL setup.  Would you please elaborate on this?  Thank you.

[SomeJoe7777 ACE - Expert]

If you have a 2Wire 3801HGV, then setting your Linksys up in accordance with my post #13 (as a wireless access point) will still maintain firewall protection for your computers.  The 3801 has it's own firewall that will protect the entire network.

[cmsret]

In order to make the changes to the router in steps 1 and 3 of post #13, do I first connect the router directly to a PC and if so do I connect the Ethernet port of the PC to one of the LAN ports of the router or do I connect it to the WAN?  I realize that once the router is configured properly I would be connecting it LAN to LAN - 2WIRE to router.  I am a newbie on this, thanks.

[SomeJoe7777 ACE - Expert]

Yes, to perform steps 1 and 3, connect the router directly to a PC using a LAN port on the router.

Once you change the IP address in step 3, you will no longer be able to communicate with the router until the IP address on your computer is changed to an IP address in the same subnet as the router.  This shouldn't be a problem if you simply make sure the computer is getting an IP address via DHCP, reboot the computer, and let it pull an IP address from the 2Wire RG.  If you have configured the new IP address on your router correctly in step 3, you should then be able to communicate with it again.

[cmsret]

---

SomeJoe7777 wrote:

Once you change the IP address in step 3, you will no longer be able to communicate with the router until the IP address on your computer is changed to an IP address in the same subnet as the router.  This shouldn't be a problem if you simply make sure the computer is getting an IP address via DHCP, reboot the computer, and let it pull an IP address from the 2Wire RG.  If you have configured the new IP address on your router correctly in step 3, you should then be able to communicate with it again.

---

Bear with me and my inexperience but how do I make sure that the computer is getting an IP address via DHCP?  OS is Windows 7 Home Premium.  Where do I verify this?  Or it is the standard config.

To be sure, I first change the router per steps 1 & 3, connect it to the 2WIRE LAN to LAN, reboot computer and then to get to the router I just go to the new IP address of the router???

[SomeJoe7777 ACE - Expert]

DHCP is the standard configuration of a Windows computer, but during configuration of routers like this, some people temporarily assign a static IP to the computer to facilitate communicating with a router on a different subnet.  If you didn't do that, then it isn't applicable.

Yes, your second statement is the correct procedure.

[Escapee]

Somethig got hung up saying it could not post and then it double posted. Could not find a delete button.

[Escapee]

I have found keeping a note book with the final settings and how I got there helps 6 months or 2 years from now when something breaks or gets changed by mistake. Print or copy SJ instructions out and remember where you put them.

[techniq]

What if I cannot get into the iNIDs web interface?  Acutally when the Uverse tech first gave me the ethernet gateway I was able to access the web interface, but did not have or could not find the password to make the needed changes.

After I register on the att.net site I could no longer access the web interface and a quick port scan shows it's not open.  Any ideas?  And once/if I get to it again, what was the password to make the advance changes?

I am an AT&T employee and the postings on this site are my own and don't necessarily represent AT&T's position, strategies or opinion.

[techniq]

not a prob, ended up rebooting the iNID and the web interface was accessible again.

[bpape]

Thanks for all of your time and information Joe.  I have a similar situation (I think) to what you described in post 13.

I have a Linksys router (not wireless) that I have all of my hardwired connections tied to (need more than the 4 ports and a different location than the RG).  I need to be able to communicate between the wireless clients and the wired clients as well as having all of the wired and wireless clients able to have outside internet access. 

Are your instructions in post 13 still applicable to accomplish this - hence letting the RG do all of the routing?

If I do this, can I also tie another wireless access point to that Linksys router so I can have 2 different wireless bands (my other one is an N wireless)?  This isn't AS important as the other - just wondering.  I do a lot of music streaming from my wired music server to both wired and wireless network players.

Previous setup was Charter so just cable modem -> WAN port of router -> wired out on 7 ports, one of which was then a wireless N access point centrally located in the house rather than in the basement wiring closet.

Thanks in advance!

[SomeJoe7777 ACE - Expert]

---

bpape wrote: Are your instructions in post 13 still applicable to accomplish this - hence letting the RG do all of the routing?

If I do this, can I also tie another wireless access point to that Linksys router so I can have 2 different wireless bands (my other one is an N wireless)?  This isn't AS important as the other - just wondering.  I do a lot of music streaming from my wired music server to both wired and wireless network players.

---

Yes.  Post 13 is exactly what you want.

If you use the 2nd router with the N wireless, the instructions are the same, but also make sure that the IP address you assign to the 2nd router doesn't conflict with the 1st router.  In the example I gave in post 13, the IP address of the 1st router you will assign as 192.168.254.10.  For the 2nd router use (for example) 192.168.254.11.

Everything will be on the same subnet (192.168.254.x) and the RG will be handing out addresses via DHCP.

[bpape]

Thanks

Just to be clear - my existing router (linksys) is not a wireless router - it's wired out only  I run one of the LAN ports out to an external wireless access point (N, not G)

[SomeJoe7777 ACE - Expert]

Yes, your first router (which has no wireless) is still hooked up in accordance with the directions in post 13.  By disabling DHCP on it and not using the WAN port, you are essentially turning it into a plain switch.

[bpape]

OK.  That's what I thought - just wanted to make sure.

One last question, since the default IP for the RG is 192.168.1.254 and the default IP for the existing routher is 192.168.1.1, I shouldn't have to change the IP on either if I'm thinking correctly?

[SomeJoe7777 ACE - Expert]

True, you don't have to change the IP as long as it's unique on the network.

That goes for both routers, though.  So if you leave the first one at 192.168.1.1, then you'll have to make sure the second one is something other than 192.168.1.1 or 192.168.1.254.