Accessing the ONT¶

Accessing the management interface of your ONT from within your local network typically involves one of three configuration paths:

• Static IP

A direct and straightforward configuration, but its practicality is usually limited to the initial setup and provisioning of the device.

• Source NAT

The standard for a secure and permanent configuration, seamlessly managing access from behind your router firewall.

• Static Route

A workaround used only in cases where manual Source NAT (SNAT) is restricted or non-existent, such as with UniFi OS or various TP-Link offerings.

Before configuration, you must identify the ONT's management IP and subnet using manufacturer documentation, online sources, or a network scanning tool.

Default IP¶

Your ONT's default IP may conflict with your local network because both often use the same common Class C private range (192.168.0.0/16). To avoid this address confusion, it is recommended to move your local network to a less common private range such as Class A (10.0.0.0/8) or Class B (172.16.0.0/12). This ensures your router can clearly distinguish between your home devices and the ONT management interface.

The following ONTs commonly used in our guides have the following default IPs you will want to avoid:

If the IP is unknown, the industry-standard, cross-platform tool nmap can aid in network discovery. The following examples scan the three (3) private IP address ranges (RFC 1918).

nmap -sn 192.168.0.0/16 # (1)!
nmap -sn 10.0.0.0/8
nmap -sn 172.16.0.0/12

1. 192.168.0.0/16 is the most common default range used by consumer network equipment.

Static IP Point-to-Point¶

A static IP on the same subnet provides direct, local access to the ONT. This approach streamlines setup by establishing a simple local connection, allowing devices to communicate directly without requiring traffic to cross network boundaries or utilize a gateway.

While this configuration serves as a foundational exercise in core networking, it represents an incomplete solution for a typical SOHO setup. In these environments, the WAN interface must simultaneously maintain a public internet connection, which is generally incompatible with a dedicated static IP.

graph TD
  classDef lanNode fill:#fff,stroke:#475569,stroke-width:2px
  classDef linkNode fill:#f1f5f9,stroke:#475569,stroke-width:2px,stroke-dasharray: 5 5
  classDef titleNode fill:#1e293b,stroke:#1e293b,font-weight:bold,font-size:14px
  classDef ontNode fill:#f8fafc,stroke:#475569,stroke-width:2px

  subgraph PC_Group ["Admin PC"]
    PC_Title("<font color=white>Host Interface: Static Config"):::titleNode
    PC("<b>NIC</b><br/>IP: 192.168.11.2<br/>Subnet: 255.255.255.0"):::lanNode
  end

  subgraph Link_Group ["Physical Layer"]
    L_Title("<font color=white>L2 Broadcast Domain / Direct Ethernet"):::titleNode
    L2("<b>Layer 2 Path</b><br/>MAC Resolution (ARP)"):::linkNode
  end

  subgraph ONT_Group ["ONT"]
    O_Title("<font color=white>Local Subnet: 192.168.11.0/24"):::titleNode
    ONT("<b>LCT</b><br/>IP: 192.168.11.1 (Static)"):::ontNode
  end

  PC_Title --- L_Title
  L_Title --- O_Title
  O_Title ---|Within ONT Subnet| PC_Title

  PC ==>|<b>IP Packet</b><br/>DST: 192.168.11.1| L2
  L2 ==>|<b>Ethernet Frame</b><br/>SRC MAC: PC<br/>DST MAC: ONT| ONT

  linkStyle 0,1 stroke-width:0px;
  linkStyle 2 stroke:#475569,stroke-width:2px,stroke-dasharray: 3 3;

  style PC_Group fill:#f1f5f9,stroke:#cbd5e1,stroke-width:1px
  style Link_Group fill:#e2e8f0,stroke:#1e293b,stroke-width:3px
  style ONT_Group fill:#f1f5f9,stroke:#cbd5e1,stroke-width:1px

ip link show
ethtool <interface>
ip address show
ip address flush dev <interface>
ip route flush dev <interface>
ip address add 192.168.11.2/24 dev <interface>
ip address show dev <interface>

ifconfig <interface> 192.168.11.2 netmask 255.255.255.0

ifconfig_<interface>="inet 192.168.11.2 netmask 255.255.255.0"

Source NAT Router or Firewall¶

Source NAT (SNAT) provides stateful translation for traffic behind the firewall to reach the ONT, which resides upstream of the firewall on the public-facing WAN interface. This translation makes the ONT's management interface appear as a reachable local network device.

This configuration typically requires that the traffic be translated to a source IP on the same subnet as the ONT LCT because the LCT is generally restricted to its own subnet. This is commonly achieved by adding a secondary IP alias to the firewall's WAN interface. This translation ensures traffic originates from this local address, which enables access and overrides default firewall rules that would otherwise block traffic to private or bogon networks on the WAN interface.

graph TD
  classDef lanNode fill:#fff,stroke:#475569,stroke-width:2px
  classDef interfaceNode fill:#fff,stroke:#64748b,stroke-width:2px
  classDef natNode fill:#f1f5f9,stroke:#475569,stroke-width:2px,stroke-dasharray: 10 5
  classDef titleNode fill:#1e293b,stroke:#1e293b,font-weight:bold,font-size:14px
  classDef ontNode fill:#f8fafc,stroke:#475569,stroke-width:2px

  subgraph LAN_Group ["Admin PC"]
    PC_Title("<font color=white>LAN Client"):::titleNode
    PC("IP: 172.17.0.100<br/>(DHCP)"):::lanNode
  end

  subgraph GW_Group ["Gateway"]
    L_Range("<font color=white>LAN Range: 172.17.0.0/16"):::titleNode
    G_Title("<font color=white>Firewall - Stateful Translation"):::titleNode
    W_Alias("<font color=white>WAN Alias/Secondary IP"):::titleNode


    L_IF("<b>LAN Interface</b><br/>172.17.0.1 (Static)"):::interfaceNode
    NAT("<b>Source NAT Action</b><br/>Replace: 172.17.0.100<br/>With: 192.168.11.2 (Alias)"):::natNode
    W_IF("<b>WAN Interface</b><br/>Public IP: 203.0.113.42 (DHCP)<br/>Alias IP: 192.168.11.2 (Static)"):::interfaceNode

    L_Range --- G_Title
    G_Title --- W_Alias
    L_IF --> NAT
    NAT --> W_IF
  end

  subgraph ONT_Group ["ONT"]
    O_Range("<font color=white>Local Subnet: 192.168.11.0/24"):::titleNode
    ONT("<b>LCT</b><br/>IP: 192.168.11.1 (Static)"):::ontNode
  end

  PC_Title === GW_Group

  PC ==>|SRC: 172.17.0.100<br/>DST: 192.168.11.1| L_IF
  W_IF ==>|SRC: 192.168.11.2<br/>DST: 192.168.11.1| ONT
  W_Alias ---|Within ONT Subnet| O_Range

  linkStyle 0,1 stroke-width:0px;

  style LAN_Group fill:#f1f5f9,stroke:#cbd5e1,stroke-width:1px
  style GW_Group fill:#e2e8f0,stroke:#1e293b,stroke-width:3px
  style ONT_Group fill:#f1f5f9,stroke:#cbd5e1,stroke-width:1px

/ip/address add address=192.168.11.2/24 interface=sfp-sfpplus1 network=192.168.11.0
/ip firewall nat add action=src-nat chain=srcnat dst-address=192.168.11.1 out-interface=sfp-sfpplus1 to-addresses=192.168.11.2

Static Route Restricted environments¶

Static routes serve as a manual redirection mechanism in environments where granular outbound NAT controls or NAT policies are restricted or non-existent.

Configuring this route is difficult because it creates an asymmetric return path. While the router knows how to send traffic to the ONT, the ONT is typically a read-only device and does not know how to route return traffic back to the internal LAN. The 8311 community firmware overcomes this with a built-in reverse ARP daemon. This tool ensures the return path is defined and allows traffic to successfully cross network boundaries without manual ONT configuration.

graph TD
  classDef linkNode fill:#f8fafc,stroke:#475569,stroke-width:2px
  classDef titleNode fill:#1e293b,stroke:#1e293b,font-weight:bold,font-size:14px
  classDef routeNode fill:#fff,stroke:#475569,stroke-width:2px
  classDef logicNode fill:#f8fafc,stroke:#475569,stroke-width:1px

  subgraph LAN_Group ["Admin PC"]
    PC_Title("<font color=white>LAN Client"):::titleNode
    PC("IP: 172.17.0.100"):::linkNode
  end

  subgraph GW_Group ["Gateway / Router"]
    GW_Title("<font color=white>Static Route: 192.168.11.0/24"):::titleNode
    GW("WAN MAC: 00:00:5E:00:53:01<br/>WAN IP: 203.0.113.42"):::routeNode
  end

  subgraph ONT_Group ["ONT (8311 Firmware)"]
    O_Title("<font color=white>Local Subnet: 192.168.11.0/24"):::titleNode
    ONT("<b>LCT Port</b><br/>192.168.11.1"):::linkNode

    subgraph Daemon ["Reverse ARP Daemon"]
      TCPDUMP["tcpdump -i eth0_0_1_lct...<br/>Sniff ARP/IP Packets"]:::logicNode
      IP_NEIGH["ip neigh replace"]:::logicNode
    end

    ONT -.->|"3<br/>Detect Inbound Traffic"| TCPDUMP
    TCPDUMP -.-> |Extracts MAC/IP| IP_NEIGH
    IP_NEIGH -.->|"4<br/>Inject Neighbour"| ONT
  end

  PC_Title === GW_Group
  GW_Title --- |Matching Subnet| O_Title

  PC ==> |"1<br/>Target: 192.168.11.1"| GW
  GW ==> |"2<br/>Routed via WAN"| ONT

  ONT ==> |"5<br/>Frame to Router MAC"| GW
  GW ==> |"6<br/>Successful Return"| PC

  style LAN_Group fill:#f1f5f9,stroke:#cbd5e1,stroke-width:1px
  style GW_Group fill:#e2e8f0,stroke:#1e293b,stroke-width:3px
  style ONT_Group fill:#f1f5f9,stroke:#cbd5e1,stroke-width:1px
  style Daemon fill:#fff,stroke:#475569,stroke-dasharray: 5 5,stroke-width:1px