T-Mobile Thuis fiber with EdgeRouter X SFP (updated)

Last updated on October 16, 2021

Update 10-2021: I have updated this post at the end since it is for (some) new customers possible to configure only VLAN300 for both internet and television. So a router with built-in switch is not required.

In my previous post I have shown you my configuration with T-Mobile Thuis fiber with the EdgeRouter Lite. I’ve told you there that I still had a few configuration issues with IPTV. I wasn’t able to create a working scenario without a few (annoying) workarounds.
So to create a better working setup I have chosen to replace the EdgeRoute Lite with the EdgeRouter X SFP. As the name already tells you, this router has an built-in SFP (fiber) port. This router is alo has switching capabilities and PoE (Power over Ethernet) to directly power my Ubiquiti Access Points.

My set-up

I have updated my set-up a bit since my last post. I have added the (two) Ubiquiti AP’s to the PoE ports on the EdgeRouter instead of the managed switch, so I can get rid of the PoE converters. The T-Mobile settopbox is directly attached to the EdgeRouter. I can also chose to attach these to the managed switch, so I can add more settopboxes than two. All my other ethernet devices are attached to the managed switches (like my Tradfri gateway, PS4, SmartTV, HTPC, etc.)
Both switches are configured to deliver VLAN300 (internet) and VLAN640 (IPTV). Between both switches is a trunk configured to transfer both VLAN’s.

The configuration of the EdgeRouter X SFP

Below here is a copy of my configuration with a few details like port mappings, IP assignments and passwords cleared.
In short, i have the following configuration:

1. Configure ETH5/SFP as the WAN port;
2. Create an internal switch for seperating traffic to VLAN300 (internet) and VLAN640 (IPTV) and VLAN1 for the internal network;
3. Configure the PoE ports for the Access Points;
4. Configure the internal switch and assign the ports on the router for internet, internal network or iptv;
5. Configure default firewall rules, allow NAT, configure offloading, etc.

Click ‘read more’ to view the configuration details.

Robin@edgerouter:~$ show configuration
firewall {
    all-ping enable
    broadcast-ping disable
    group {
        network-group LAN {
            description "LAN Subnet"
            network 192.168.1.0/24
            network 192.168.100.0/24
        }
    }
    ipv6-receive-redirects disable
    ipv6-src-route disable
    ip-src-route disable
    log-martians enable
    name WAN_IN {
        default-action drop
        description "WAN to internal"
        rule 10 {
            action accept
            description "Allow established/related"
            state {
                established enable
                related enable
            }
        }
        rule 20 {
            action drop
            description "Drop invalid state"
            state {
                invalid enable
            }
        }
    }
    name WAN_LOCAL {
        default-action drop
        description "WAN to router"
        rule 10 {
            action accept
            description "Allow established/related"
            state {
                established enable
                related enable
            }
        }
        rule 20 {
            action drop
            description "Drop invalid state"
            state {
                invalid enable
            }
        }
    }
    receive-redirects disable
    send-redirects enable
    source-validation disable
    syn-cookies enable
}
interfaces {
    ethernet eth0 {
        description "LAN - To Managed Switch"
        duplex auto
        poe {
            output off
        }
        speed auto
    }
    ethernet eth1 {
        description "LAN - Wireless Living Room"
        duplex auto
        poe {
            output 24v
        }
        speed auto
    }
    ethernet eth2 {
        description "LAN - Wireless First Floor"
        duplex auto
        poe {
            output 24v
        }
        speed auto
    }
    ethernet eth3 {
        description "IPTV - Bedroom 1"
        duplex auto
        poe {
            output off
        }
        speed auto
    }
    ethernet eth4 {
        description "IPTV - Living Room"
        duplex auto
        poe {
            output off
        }
        speed auto
    }
    ethernet eth5 {
        description "WAN - Fiber"
        duplex auto
        speed auto
    }
    loopback lo {
    }
    switch switch0 {
        description Switch
        mtu 1500
        switch-port {
            interface eth0 {
                vlan {
                    pvid 1
                }
            }
            interface eth1 {
                vlan {
                    pvid 1
                }
            }
            interface eth2 {
                vlan {
                    pvid 1
                }
            }
            interface eth3 {
                vlan {
                    pvid 640
                }
            }
            interface eth4 {
                vlan {
                    pvid 640
                }
            }
            interface eth5 {
                vlan {
                    vid 640
                    vid 300
                }
            }
            vlan-aware enable
        }
        vif 1 {
            address 192.168.1.1/24
            description "Switch - VLAN - Local"
        }
        vif 300 {
            address dhcp
            description "Switch - VLAN - Internet"
            firewall {
                in {
                    name WAN_IN
                }
                local {
                    name WAN_LOCAL
                }
            }
            mtu 1500
        }
        vif 640 {
            description "Switch - VLAN - IPTV"
            mtu 1500
        }
    }
}
service {
    dhcp-server {
        disabled false
        hostfile-update disable
        shared-network-name LAN {
            authoritative enable
            subnet 192.168.1.0/24 {
                default-router 192.168.1.1
                dns-server 192.168.1.1
                domain-name vanbruggen
                lease 86400
                start 192.168.1.51 
            }
        }
        static-arp disable
        use-dnsmasq disable
    }
    dns {
        forwarding {
            cache-size 150
            listen-on switch0
            listen-on switch0.1
            listen-on switch0.300
            listen-on switch0.640
            options localise-queries
            options expand-hosts
            options bogus-priv
            options domain-needed
        }
    }
    gui {
        http-port 80
        https-port 443
        older-ciphers enable
    }
    nat {
        rule 5010 {
            description "masquerade for WAN"
            log disable
            outbound-interface switch0.300
            protocol all
            source {
                group {
                    network-group LAN
                }
            }
            type masquerade
        }
    }
    ssh {
        port 22
        protocol-version v2
    }
}
system {
    domain-name vanbruggen
    host-name edgerouter
       user Robin {
            authentication {
                encrypted-password ****************
                plaintext-password ****************
            }
            full-name ""
            level admin
        }
    }
    name-server 8.8.8.8
    name-server 8.8.4.4
    ntp {
        server 0.ubnt.pool.ntp.org {
        }
        server 1.ubnt.pool.ntp.org {
        }
        server 2.ubnt.pool.ntp.org {
        }
        server 3.ubnt.pool.ntp.org {
        }
    }
    offload {
        hwnat enable
        ipsec enable
    }
    static-host-mapping {
        host-name edgerouter {
            alias edgerouter.vanbruggen
            inet 192.168.1.1
        }
    }
    syslog {
        global {
            facility all {
                level notice
            }
            facility protocols {
                level debug
            }
        }
    }
    time-zone Europe/Amsterdam
    traffic-analysis {
        dpi disable
        export disable
    }
}

A screenshot from the EdgeRouter dashboard after the configuration:

Update: Television without seperate VLAN

It has been a while since I did something with the T-Mobile fiber network. My household has stopped using the T-Mobile television and switched to streaming services only so we have cancelled that subscription and only use the 1000mbit internet connection. I am using the EdgeRouter 6P now.

Last week I was asked to setup a T-Mobile fiber network at someone’s house. I have set it up with the EdgeRouter X SFP. I learned that (some?) new customers will get their fiber to the home using a GPON splitter. You will not attach the fiber cable to the router and will have an ethernet cable coming out of the splitter to your router.

I only had to configure VLAN300 and the TV signal was available without having to configure VLAN640. This made the setup very easy. Just a basic router setup, WAN on one of the ethernet ports using VLAN300. You can do this using the basic Edgerouter setup wizard.