If you currently have Fibre (to the cabinet) broadband in the UK, with an ISP that utilises MAC Encapsulation Routing (MER) – replacing the provided router can be difficult. MER, otherwise referred to as DHCP option 61 is a capability not always found on 3rd party routers by default, including on the Ubiquiti Security Gateways (Ubiquiti Dream Machines now have some support for this setting).
This article details how to replace your ISP’s provided router with a Ubiquiti Security Gateway, and also mentions some additional equipment you will need.
The Equipment
Other than a Ubiquiti Security Gateway, you will also need a ADSL / VDSL modem, to act as an interface between the phone line coming into your premises, and the RJ45 WAN port on your Security Gateway. A modem of choice is the DrayTek Vigor 130 (modem V130-K), designed for use within the UK, and compatible with most major ISP’s. Alternatively, you could utilise a compatible 3rd party ADSL/VDSL router, setup in bridge mode.
For the rest of this article, the following equipment is used:
- Ubiquiti Security Gateway (USG-Pro-4)
- DrayTek Vigor 130 modem (V130-K)
- Unifi Controller OS, running on a host device such as a Linux server, etc
Step 1) Configure DrayTek Vigor 130 Modem
To configure the modem, you first need to power this up and connect a device to it directly, i.e. plugging in a laptop into the LAN port on the back of the modem.
Assuming the device is factory reset, you can then access the web interface of the modem via your web browser. Navigate to http://192.168.2.1:80 and login with the default credentials:
- Username: admin
- Password: admin
Once logged into the modem’s web interface, navigate to Internet Access > General Setup in the navigation pane on the left. The following settings need to then be configured on this page:
- Change DSL Mode from Auto to VDSL2
- Enable VLAN Tag Insertion for VDSL2, and set the Tag Value to 101
- Click OK and select Save with current config, then wait for the modem to reboot
Once the modem has rebooted, log back into the interface and navigate to Internet Access > PPPoE / PPPoA in the navigation pane on the left. The following settings need to then be configured on this page:
- Disable PPPoE/PPPoA Client
- Click OK and select Save with current config, then wait for the modem to reboot
Once the modem has rebooted, log back into the interface and navigate to Internet Access > MPoA / Static or dynamic IP in the navigation pane on the left. The following settings need to then be configured on this page:
- Enable MPoA (RFC1483/2684)
- Leave Multi-PVC channel set to Channel 2
- Set Encapsulation to 1483 Bridged IP LLC
- Set VCI to 101
- Leave Modulation set to Multimode
- Set MTU to 1492
- Ensure Bridge Mode is enabled
- Click OK and select Save with current config, then wait for the modem to reboot
Once the modem has rebooted, log back into the interface and navigate to LAN > General Setup in the navigation pane on the left. The following settings need to then be configured on this page:
- Ensure 1st IP Address does not clash with any already in use on your network
- Ensure 1st Subnet Mask is correct
- Under DHCP Server Configuration (on the right), select Disable Server
- Click OK and select Save with current config, then wait for the modem to reboot
Once the modem has rebooted, you may no longer be able to access the modem’s web interface, as it is purely in bridge mode.
Now disconnect your device from the LAN port of the modem, and connect the LAN port of the modem, to the WAN port of your Security Gateway.
Step 2) Configure Ubiquiti Security Gateway
These steps are based on configuration of a USG-Pro-4, with the DrayTek Vigor 130 modem connected to the 1st WAN port on the Security Gateway. If you are connecting your modem to a different port on the Security Gateway, or you are using a different model of Security Gateway, you will need to alter the ethernet port numbers in the configuration detailed below.
First step in configuring your Security Gateway is to SSH into the device. To do this, you will need an SSH client application such as PuTTY. The following details are then needed to SSH into your Security Gateway:
- IP Address of your Ubiquiti Security Gateway
- Device SSH Authentication Username
- Device SSH Authentication Password
If your Security Gateway is already adopted by your Unifi Controller, you can find the Device SSH Authentication details by going to the following settings page in your Unifi Controller: Settings > System Settings > Controller Configuration > Device SSH Authentication
If your Security Gateway is not yet adopted by your Unifi Controller, the default credentials are:
- SSH Username: ubnt
- SSH Password: ubnt
Once you have successfully logged into your Security Gateway via SSH (in PuTTY or other application), you will need to run the following commands:
configure
delete interfaces ethernet eth2 address dhcp
commit
set interfaces ethernet eth2 dhcp-options client-option "send dhcp-client-identifier "macaddress";"
set interfaces ethernet eth2 address dhcp
commit
save
exit
rebootOnce the above commands have been executed, your Security Gateway should reboot. Following this, the Security Gateway should then successfully connect to the internet, via your DrayTek Vigor 130 modem.
Step 3) Making your Security Gateway configurations persistent
Your Security Gateway may lose the configuration just completed in Step 2 whenever it reboots, provisions, or upgrades. To ensure the Security Gateway is able to connect to your ISP’s internet connection via your modem every time, the configuration needs to be saved somewhere persistent.
Some guides recommend saving the configuration to your Security Gateway directly, however this may cause issues provisioning new configuration from your Unifi Controller. In this article, we would recommend saving the minimal configuration to the Unifi Controller itself, for the specific site where the Security Gateway in question is adopted.
First step in saving this configuration to your Unifi Controller involves creating a configuration file to upload to the controller. The minimal configuration needed is included below:
{
"interfaces": {
"ethernet": {
"eth2": {
"address": [
"dhcp"
],
"dhcp-options": {
"client-option": [
"retry 60;",
"send dhcp-client-identifier " macaddress";"
],
"default-route": "update",
"default-route-distance": "1",
"name-server": "no-update"
}
}
}
}
}
The above code needs to be saved in a JSON file, named config.gateway.json
We then need to connect to the device hosting Unifi Controller, using a file explorer application such as FileZilla. To FTP into your Unifi Controller’s host device, you will need the following details:
- IP Address of host device / your Unifi Controller
- Device Admin Username
- Device Admin Password
Once connected to your device, you will need to navigate to the Unifi Controller’s root directory. The location of this will vary depending on the operating system of your host device, or where Unifi Controller may have been installed to (if not using default setup). With Unifi Controller setup using the default settings on a Linux host OS, the Unifi Controller root directory can be found in: /var/lib/unifi/
Once in our Unifi Controller’s root directory, you need to navigate to your site’s specific directory. You will need to find the unique ID of your site, from within your Unifi Controller. This can be found by logging into your Unifi Controller in your web browser, and switching to the site where your Security Gateway has just been configured. The site’s unique ID can be found in the address bar: https://controllerIP:8443/manage/siteID/
With your site’s unique ID found, you can navigate to the specific directory for it back in your FTP client. If your Unifi Controller is hosted on a device running Linux OS, the directory in question is /var/lib/unifi/data/sites/siteID/
Once you have navigated to the correct directory for your site, you can then upload the config.gateway.json file saved earlier.
With the config.gateway.json file uploaded to the site’s directory on your Unifi Controller, the configuration for connecting to your ISP’s internet connection via your modem should now persists. This means, should your Security Gateway restart, reprovision, or upgrade it’s firmware – it should be able to reconnect to the internet without issue.
