L

Visitor

 • 

3 Messages

Thursday, May 19th, 2022 6:26 PM

Closed

Setting Aris SBG8300 to bridge mode

My current setup is (and I just added the Firewalla (FWG) firewall/router to front my home network.

Surfboard (SBG8300) (router mode) --> FWG (router mode) --> Eero Pro6 (bridge mode)

Double NATed with Surfboard and Firewalla Gold router/firewall (FWG). It works; however, I would like to have FWG as the top NAT and put the Surfboard in bridge mode. The FWG is set to DHCP.  I tried to put Surfboard into bridging mode. It was simple enough (https://arris.secure.force.com/consumers/articles/General_FAQs/SBG8300-Bridge-Mode-Setup/?l=en_US&fs=RelatedArticle). The Surfboard rebooted. I rebooted the FWG, but FWG cannot get the public IP address from Comcast. Instead it got 192.168.0.125 address, the Surfboard's private IP address range.

I deleted the WAN Network in FWG and re-added it. Rebooted it and I got the 192.168.0.125 address from the Surfboard again. Each time, I rebooted the FWG. By the wya, FWG is set to obtain IP address via DHCP.

I went into Surfboard and disabled DHCP option I could find and then put the Surfboard into bridge mode again. It rebooted. I checked and the Surfboard was still in bridge mode. Its WAN indicated no Internet. Its WAN address was greyed out. I rebooted both FWG and Surfboard. I rebooted FWG (BTW, FWG won't allow me to issue the reboot so I had to hard reboot it). The FWG still didn't get the public IP; as a matter of fact, FWG didn't get an IP address at all, not even from the Surfboard this time.

I tried to put in the static public IP address into FWG. Reboot FWG and it still cannot connect. What am I missing? The Surfboard is pretty plain Jane after putting it bridge mode.

I had to put back double NATed for the night (or the natives will be up in arms). Let me know what I am missing.

Is Xfinity fixed the MAC address to the assigned IP?  Do I need to contact Xfinity to provide you with the FWG MAC address? Could I change the FWG's MAC to the router's MAC address? 

I am missing something. I just want to remove the double-NATing.

Thank you in advance.

Visitor

 • 

3 Messages

3 years ago

This is as painful as calling Xfinity or using the Chat!  Just close the chat windows out of frustration.  Two hours and twelve exchanges of messages and we didn't even get passed the verification!  It took 20 minutes for the support guy to tell me that he will be sending the code (I replied right away) to tell me that the code is sent and then silent!  If I get on the phone, then it'll be three hours journey! 

This posting has been 2 hours old and yet 0 replies whereas other postings were getting replies.  WTH?

(edited)

Problem Solver

 • 

1.5K Messages

3 years ago

Just a thought, and it's down and dirty fast. 

Have you tried releasing the external dhcp lease on the SBG8300 before setting bridge mode option (and then, it looks like it reboots by itself when you change that option).  Maybe if that doesn't work, then change it back.  Do it again,but this time when it does the self reboot....yank the power cord?  Clean slate.

Buggy stuff is a bummer.  Wondering if you got to wipe out a table buried somewhere, or perhaps corrupt -- make invalid??  I don't know why dhcp server for internal lan would be active with bridge mode on.  That isn't how they say it works.

*oh, I would add powercycle FWG too, or at least pull the cable, then plug back it.  It thinks it has a valid lease.  It may not ask again until it's expired.  You want that to go through the whole if-down/if-up networking restart too for this first time.

(edited)

Visitor

 • 

3 Messages

@flatlander3​ thanks for the suggestion.  It was a simpler solution.  I simply need to leave the SBG8300 off longer (about 5-10 minutes) long enough for Comcast to release the reserved IP.  After which, I started the FWG and it took the public IP that Comcast handed out.  Thanks for suggestion.

Problem Solver

 • 

1.5K Messages

There can actually be a benefit to how you had it setup before.  Was it a 'double nat'?  Sure.  Sometimes that's not a bad thing.

If your firewall is capable of active intrusion detection and policy violation with notification or at least logging (Snort is an example), then it's another layer that will tell you if SBG8300 was compromised.  They might tip that over.  Fine.  Then they just bump their head on your firewall and you get the alert/log when they hit any port on your firewall (the only device on the SBG8300 internal lan), and you know there's a firmware problem with it or exploit before anyone else does. 

Latency add?  <1 ms.  Firewall going to pick up broadcast traffic on the SBG8300 network and alert/log it?  Sure.  That's OK.  Doesn't go anywhere.  The rest of your stuff is behind the firewall, so broadcast traffic works fine there.  Port forwards from SBG8300 just go to FWG and you handle where the traffic goes from there (decide who can talk to it, or traffic shape/fail-to-ban if it's capable of that -- I don't know FWG add-ons or options, others do, or build one that can).

Meh, it's simpler now and probably more 'zen'.  People don't look at you funny.   

forum icon

New to the Community?

Start Here