SFR/RED France FTTH IPv4 & IPv6 & Phone

Original Author: Philippe Gaultier

Introduction / Getting ready to make the connection

This guide is for SFR/RED France FTTH using DHCPv4 / DHCPv6 to connect.

The guide deals with internet connection and phone. Support for TV has not been tested.

Note

Before starting this guide, you should have the MAC address of your SFR/RED Box. In the guide you should replace xx:xx:xx:xx:xx:xx with your SFR/RED Box MAC address.

SFR/RED requires that the WAN interface assignment should look similar to this:

• WAN interface has MAC xx:xx:xx:xx:xx:xx which is the original WAN MAC of the BOX (spoofed),

• LAN interface has MAC 00:11:22:33:44:55 which is the original MAC of the firewall,

• DUID is 00:03:00:01:xx:xx:xx:xx:xx:xx it’s derived from the original WAN MAC of the BOX (spoofed).

Configuring the WAN Interface

Go to Interfaces ‣ Assignments and edit WAN.

In order to establish the IPv4 and IPv6 connection, SFR/RED requires that the correct parameters are passed for the DHCPv4 and DHCPv6 requests respectively.

Select options:

• IPv4 configuration: DHCP,

• IPv6 configuration: DHCPv6.

On the DHCPv4 request it is a requirement to pass the following:

Note

It is necessary to specify the following ”Send Options”:

Enter one option per line:

dhcp-class-identifier "neufbox_NB6VAC-FXC"

Note

It is necessary to specify the following ”Request Options”:

Enter one option per line:

subnet-mask
broadcast-address
time-offset
routers
domain-name
domain-name-servers
host-name
ntp-servers
nis-domain
root-path
merit-dump

On the DHCPv6 request we need to use raw options

Note

It is necessary to specify the following ”Send Options”:

Enter the vendor option on one line:

raw-option 16 00:00:a0:0c:00:40:6e:65:75:66:62:6f:78:5f:4e:42:36:56:41:43:2d:46:58:43

Note

It is necessary to specify the following ”Request Options”:

Enter one option per line:

domain-name-servers
domain-name

Note

Set Prefix delegation size to 56 and Optional prefix IAID to 1. The matching prefix delegation and prefix-interface statements are generated automatically.

Click ”Save” and then ”Apply”.

Configuring the LAN Interface

Interfaces / Settings

Select Interfaces ‣ Settings and set your DUID.

Note

The DUID is based on the SFR/RED Box MAC address : 00:03:00:01:xx:xx:xx:xx:xx:xx.

Click ”Save” and then ”Apply”

LAN assignment

On the Assignments page, edit LAN and set IPv4 to “Static IPv4” and IPv6 Configuration Type to “Track Interface (legacy)”.

Finally, set the following parameters as shown:

• the IPv4 address to the one wanted,

• the Parent interface to ”WAN”,

• the Assign prefix ID to 0x0.

Click ”Save” and then ”Apply”

Note

It is advisable at this point to reboot the system. This will allow you to retrieve an IPv4 address which will be used in next part.

Configuring NGINX to provision the SFR/RED BOX

In order to set up the phone, as the SIP parameters (user/password) are not public, we will add the SFR/RED box in our LAN. This will allow us to plug our regular phone in the SFR/RED box.

Note

This how-to does not cover installation of NGINX nor the use of SSH / shell commands.

First SSH into your OPNSense firewall and create a folder /srv/sfrredbox. In this folder, we will add the scripts used to spoof the SFR/RED Box requests.

In this directory create a file index.php

$currentFirewall = 'firewall.localdomain.intra';
// can probably be replaced with
// $currentFirewall = exec('hostname');
if (isset($_GET['ip_dhcp'])) {
    // adjust re0 to your WAN interface
    $_GET['ip_dhcp'] = exec('ifconfig re0 | grep \'inet \' | cut -d\' \' -f2');
    // if the ifconfig command does not work, set the external IP manually
    // $_GET['ip_dhcp'] = 'your.external.ip.address';
}
$_SERVER['DOCUMENT_URI'] = str_replace('/index.php', '', $_SERVER['DOCUMENT_URI']);
$parameters = http_build_query($_GET);
$url = $_SERVER['REQUEST_SCHEME'].'://'.$_SERVER['HTTP_HOST'].'/'.trim($_SERVER['DOCUMENT_URI'], '/?') .'?'.$parameters;
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $url);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_HEADERFUNCTION, 'readHeaderLine');
$data = curl_exec($ch);
$data = preg_replace('/<proxy([^>]+)>([^<]+)<\/proxy>/', '<proxy$1>'.$currentFirewall.'</proxy>', $data);
curl_close($ch);
header('Content-Length: '.strlen($data));
header('Content-Type: application/xml');
echo $data;

Warning

Code cannot be copied / pasted as-is, you will have to adjust the parameters and make it consistent with your own settings.

Services / Nginx / Configuration

Select Services ‣ Nginx ‣ Configuration

Activate NGINX

Services / Nginx / Configuration / HTTP(s)

Select Services ‣ Nginx ‣ Configuration ‣ HTTP(s)

Create a new config

Note

Important settings are:

• Description,

• URL Pattern,

• File System Root,

• Pass Request To Local PHP Interpreter / Threat Upstream.

Services / Nginx / Configuration / HTTP(s) / URL Rewriting

Select Services ‣ Nginx ‣ Configuration ‣ HTTP(s) ‣ URL Rewriting

Add a new rewrite rule

Services / Nginx / Configuration / HTTP(s) / HTTP Server

Select Services ‣ Nginx ‣ Configuration ‣ HTTP(s) ‣ HTTP Server

Add a new rewrite rule

Note

NGINX should be serving the page we have created.

Configuring Siproxd to provision the SFR/RED BOX

To allow phone to work, the easiest way is to set Siproxd on the firewall.

Services / Unbound DNS / General

Select Services ‣ Unbound DNS ‣ General

Add parameters to let SFR/RED Box discover the SIP proxy:

Warning

It appears OPNSense will drop support of functionality of advanced parameters so I don’t know if it will be possible in future releases to define the DNS stuff using:

• local-data: “_sip._udp.firewall.localdomain.intra. 180 IN SRV 10 60 5060 firewall.localdomain.intra.”

Services / Siproxd

Select Services ‣ Siproxd

Define basic parameters:

Services / Siproxd / Outbound Domains

Select Services ‣ Siproxd ‣ Outbound Domains

Create the configuration for outbound domain:

Note

The IP address and the port of outbound domain was discovered using an host request on the proxy returned by SFR/RED while provisionning the box. You will have to check the <proxy></proxy> fields of voip2.xml.

host -t SRV _sip._udp.residential.p-cscf.sfr.net

Note

the host request result gives available SIP servers with the port to use (in my case 5062).

_sip._udp.residential.p-cscf.sfr.net has SRV record 10 0 5062 mitry.p-cscf.sfr.net. _sip._udp.residential.p-cscf.sfr.net has SRV record 10 0 5062 corbas.p-cscf.sfr.net. _sip._udp.residential.p-cscf.sfr.net has SRV record 10 0 5062 trappes.p-cscf.sfr.net.

Configuring NAT to redirect SFR/RED BOX calls to NGINX

To allow correct Destination NAT (Port Forwarding), we will configure OPNSense to affect a static IP to the SFR/RED Box and we will create an alias for it.

Services / DHCPv4 / [LAN]

Select Services ‣ DHCPv4 ‣ [LAN]

Click on [+] to add a static mapping:

Firewall / NAT / Destination NAT (Port Forward)

Select Firewall ‣ NAT ‣ Destination NAT (Port Forward)

Add a new forwarding rule:

Note

Right now, everything should be ready. Restart the firewall, once ready plug the SFR/RED Box on your LAN and start it. You should be able to enjoy IPv4, IPv6 and Phone.