FIOS router networking arcana - only for geeks

[donheff]

I have Internet through a Verizon FIOS G1100 gateway router to which I have added a DECO TP-Link S4 mesh network for wifi. I am confused about how this setup works as well as security implications. Verizon is not helpful and most of their technicians seem to know less about this stuff than I do. So, once again, I turn to ERdotOrg for insight since quite a few members seem to find techy weirdness interesting.

The Verizon router is in my basement. It's wifi was accessible throughout my house but sketchy in a couple of far corners. I have been streaming a few providers to various TVs and decided I need better wifi so I bought and installed the TP-Link mesh.

My VZ router gets its internet through the COAX. It has a WAN Ethernet port (as well as 4 LAN Ethernet ports) but VZ did not bring an Ethernet cable in from the ONT. When I setup the TP-Link it would not work when I connected it to one of the LAN ports as I would have expected to do. It only works when I connect it to the WAN port. Both the TP-Link and the FIOS router use 192.168.1.x as their LAN private Ip address range. I have the FIOS router wifi turned off and only use the TP link for my home network. I can see that the TP-Link has a routable 71.178.36.x IP address on the WAN side. I believe it is pulling down a separate WAN side IP address from FIOS but when I connect a laptop to a LAN port of the FIOS router I can't figure out what the router's WAN IP address is so I am not sure. In any event, since the TP-Link has a WAN address that is not in the 192.168 range it seems to me that it must be sitting out on the Verizon network on its own, not getting the benefits of any LAN side security features that may be built into the FIOS router.

Does this sound right? If so, does anyone know whether this is risky or does TP-Link provide a fairly secure connection?

Also, I am confused about the two LAN networks, both of which are 192.168. and neither of which can be changed (eg. to a 10.x private network) as far as I can determine. I can see that the FIOS router is able to contact the FIOS TV set top boxes thru the COAX on 192.168 addresses (that is where they get the guide, On Demand, etc). That was a little confusing to me since I had assumed that only WAN traffic would be over on the COAX side of the router but it must be able to handle both WAN and LAN over there. I am hopeful that the TP-Link is not passing any of it's LAN side 192.168 traffic back to the FIOS router's coax where it might collide with set top box traffic using the same 192.168 addresses but I don't know whether that is true. I restricted the range of the TP-Link LAN DHCP server so that it does not hand out addresses in the range that the set top boxes are currently assigned to just in case.

Any of you former network engineers doing anything similar with FIOS? Do you want to give me a crash course in what is going on?

[tulak]

Quote:

Does this sound right? If so, does anyone know whether this is risky or does TP-Link provide a fairly secure connection?

This sounds right to me. I'm guessing that you have two internal networks available: one is the LAN network from your FIOS router and the other from TP-Link (both are separate DHCP servers configured for an internal network of 192.168.1.x). I also suspect that when you plug in to the WAN port of your FIOS router, it is a direct connection to the internet which is what your TP-Link is configured to expect. In that case, as you noted, the TP-link is providing security for your internet access.

I originally wrote more, which I just deleted because I googled the following: I found that you can configure the TP-Link as an access point: https://www.tp-link.com/us/support/faq/1842/

I'm guessing if you do this, you can then plug the TP-Link into one of the LAN ports and it will work with all traffic going through the FIOS router.

You might also be able to disable the FIOS router and use the WAN port, but I'm not sure if that's helpful. Many ways to solve this problem, but since your FIOS is also supporting other devices over COAX, it probably makes more sense to route all traffic through the FIOS router.

Btw, a handy way to see your public IP address is to google 'whats my IP.' I wonder if this is the same or different if you are connected through the TP-Link or through one of the LAN ports on your FIOS router?

[tulak]

Also, regarding security, it could be that the TP-Link is more capable in this regard. All routers will provide basic firewall protection, but I find that 3rd party devices tend to offer more options and their software is better overall (also updated more often with security patches).

I'm not familiar with FIOS. I have Centurylink Fiber and I don't use their hardware, except for the ONT where I plug into the WAN port. I prefer to use my own networking hardware since it gives me more control over my network. In order to make this work, I had to configured the WAN connection to connect with Centurylink (not hard, instructions can be found on Google).

I might take back my original comment and say that if you are routing all of your traffic through the TP-Link and not using FIOS, you might be better off to keep using the TP-Link as you have it configured. The downside is that you won't be able to see any devices connected to the LAN port or COAX on the FIOS router.

[donheff]

Quote:

Originally Posted by tulak I might take back my original comment and say that if you are routing all of your traffic through the TP-Link and not using FIOS, you might be better off to keep using the TP-Link as you have it configured. The downside is that you won't be able to see any devices connected to the LAN port or COAX on the FIOS router.

Thanks for the detailed response Tulak. I had looked at the access point approach but as near as I could determine, you lose the mesh network advantages with that. Each TP-Link AP device has to connect to the base router directly, not indirectly though another TP-Link device. I will recheck that to be sure. Thanks for the simple Google solution to find the IP address. I was surprised to see that the routable Internet address is the same for the FIOS router (laptop connected to a LAN port) and for devices wirelessly connecting to the TP-Link.

For now I will stay with my existing setup. I don't normally need any devices connecting to the FIOS router (except for the TV set top boxes). Everything connects to the TP-Link network. I am concerned about the addresses the boxes use conflicting with the addresses the TP-Link hands out but for now they all fall in a range I cut out of the TP-Link's DHCP server. I will watch to see if they change to in range addresses if they get rebooted.

[Ready]

I have Google WiFi running using Frontier FIOS (formerly Verizon). One of the Google WiFi pods acts as a router and the other five pods provide the mesh network across my house. It took quite a bit of effort to get rid of the Frontier provided router. They really don’t want you using a third party router but they don’t offer any mesh solutions that can work in my house. I remember needing to get Frontier to reconfigure the ONT but I don’t remember the details. Once they changed a setting on the ONT everything started working. But it was incredibly frustrating trying to figure it out.

The downside to this is that if anything goes wrong they refuse to help me unless I disable the Google WiFi router and reinstall their router, which I no longer have any more. So far I’ve been able to keep it up and running but it’s a little dicey to have it this way.

[target2019]

Turn off DHCP in the FIOS box.
The WAN address of FIOS box is found here: whatismyip.com
The LAN address of FIOS box is 192.168.1.1
Mesh router needs a static IP, like 192.168.1.10. It cannot be .1
DHCP scope in the mesh router would be 192.168.1.100 through whatever you need.

There are other ways to do this. Probably a good idea to read manuals for fibre modem and router. Also write down what you do in steps, so that you can back out changes if necessary.

[donheff]

Quote:

Originally Posted by target2019 Turn off DHCP in the FIOS box. The WAN address of FIOS box is found here: whatismyip.com The LAN address of FIOS box is 192.168.1.1 Mesh router needs a static IP, like 192.168.1.10. It cannot be .1 DHCP scope in the mesh router would be 192.168.1.100 through whatever you need. There are other ways to do this. Probably a good idea to read manuals for fibre modem and router. Also write down what you do in steps, so that you can back out changes if necessary.

Thanks Target. I have been reading the manual for the FIOS router but it's 220 pages quickly exceeds my knowledge base.

If I turn off DHCP in the FIOS box, won't that prevent the TV set top boxes from obtaining IP addresses? And, will that stop me from accessing the FIOS router from a laptop thru a LAN port? How will the laptop obtain an IP address? Or do they somehow work around that on the expectation that people have to be able to connect to the thing?

I discovered that "male vision" was preventing me from properly seeing my mesh network settings. I am so used to private IP networks running on 192.168.1.x that I thought I saw" those addresses on the TP-Link side. But the primary access is thru an IOS app that connects to it automatically without having to specify the address. I tried to connect from a Windows PC using 192.168.1.1 and got nothing. I looked up the network properties and discovered that the network is 192.168.68.x. The Gateway is 192.168.68.1 So all my worries about IP address assignment problems disappear. I guess I will go back in and set my DHCP setting back to default. Given that setup, I don't understand why the TP-Link couldn't obtain a 192.168.1.x address from a FIOS Lan port and then hand out 192.168.68.x address on the TP-Link LAN.

I'm still worried about the idea of turning off the FIOS DHCP.

[target2019]

Quote:

Originally Posted by donheff If I turn off DHCP in the FIOS box, won't that prevent the TV set top boxes from obtaining IP addresses? Also, the mesh router sets up 192.168.1.1 as the LAN side gateway address I see nothing in the online guide for it or in the advanced setting that would allow you to set an alternate IP address.

Details are important. You have TV set top boxes. What are those?

You want one DHCP server only. That is the bottom line. From your original description it sounds like you have two.

When you plug your TP-Link into the WAN port on fibre modem it picks up 192.168.1.1. That is why you must set the LAN IP to something other than 192.168.1.1. You also must not use the WAN port.

My set top TVs don't acquire IP addresses. But I don't have FIOS so I can't say for sure.

Your mesh network needs IP addresses from your TP-Link.

[donheff]

Quote:

Originally Posted by target2019 Details are important. You have TV set top boxes. What are those? You want one DHCP server only. That is the bottom line. From your original description it sounds like you have two. When you plug your TP-Link into the WAN port on fibre modem it picks up 192.168.1.1. That is why you must set the LAN IP to something other than 192.168.1.1. You also must not use the WAN port. My set top TVs don't acquire IP addresses. But I don't have FIOS so I can't say for sure. Your mesh network needs IP addresses from your TP-Link.

I screwed up this thread because I was editing my previous post while you were responding to it. Sorry. If you look above you will see that I misread my TP-Link Lan side. It is 192.168.68.x, not 192.168.1.x like FIOS. BUT, the TP-Link (and for that matter the FIOS router) do not work if I connect the TP-Link to a FIOS Lan port. It only works if I connect the TP-Link to the FIOS WAN port. The TP-Link and the FIOS router BOTH share the same routable IP address from the ONT.

The FIOS TV set top boxes get their channel guide, On Demand, and some other stuff thru the Internet so they connect to the FIOS router over the hoouse COAX network. The whole thing is a bit mind boggling.

[target2019]

Ok. So the new information tells me that you must have DHCP on the 1.x network or your TVs won't work. You'll may be better off disabling all WiFi in the FIOS G1100 gateway router.

I read that 192.168.68.x is the default LAN segment of DECO TP-Link S4. That makes sense, since it won't conflict with the 192.168.1.x.

Your WAN address sounds like it is 71.178.36.x IP.

https://www.whatismyip.com/ will confirm your Verizon WAN.

[donheff]

Quote:

Originally Posted by target2019 Ok. So the new information tells me that you must have DHCP on the 1.x network or your TVs won't work. You'll may be better off disabling all WiFi in the FIOS G1100 gateway router. I read that 192.168.68.x is the default LAN segment of DECO TP-Link S4. That makes sense, since it won't conflict with the 192.168.1.x. Your WAN address sounds like it is 71.178.36.x IP. https://www.whatismyip.com/ will confirm your Verizon WAN.

Yes, you have it right. I disabled the FIOS wifi when I set the TP-Link up so I could use the same SSID and password which allowed all our devices to connect right up to the mesh network.

Now, everything seems fine on the wifi end but I still have a long time problem with my set top boxes (predating the TP-Link). Unfortunately Verizon has been helpless to fix it and now is leery of my setup. UGH. If I could get a couple of channels DW likes I would cut the cord and go with streaming only.

[target2019]

Verizon is your primary router. So the TP-LINK WAN port gets connected to a LAN port on the FIOS G1100. Says:
https://www.reddit.com/r/Fios/commen...h_the_verizon/

If what you have configured works, I wouldn't touch it.

[donheff]

Quote:

Originally Posted by target2019 Verizon is your primary router. So the TP-LINK WAN port gets connected to a LAN port on the FIOS G1100. Says: https://www.reddit.com/r/Fios/commen...h_the_verizon/ If what you have configured works, I wouldn't touch it.

Thanks. I can't figure out why it doesn't work connected to a FIOS LAN port. As near as I can see, the FIOS router will no longer connect to the Internet at all if I don't have the TCP-Link connected to the WAN port. All very odd since the FIOS router is able to connect to the WAN thru COAX or Ethernet cable (Wan port). But Verizon never brought an ethernet cable on from the ONT -- just coax. For a couple of years I had nothing connected to the FIOS Wan port and all was fine.

[target2019]

Routers are smart and have two faces. You can go into your control panels for both devices and see what happens as you change ports from WAN to LAN. With Auto Configuration the WAN side is assigned an external IP. The LAN side has a default, but can be changed.

If you change your TP-LINK WAN side to an address in 192.168.1.x space, it *should* work. TP-LINK would have 192.168.1.x on external side (WAN) and 192.168.68.1 on the internal (LAN) side.

I wouldn't change anything. But look in your TP Link to see what it has for WAN address, LAN address, gateway, DNS. Look in your FIOS to see what it has.

[donheff]

Quote:

Originally Posted by target2019 Routers are smart and have two faces. You can go into your control panels for both devices and see what happens as you change ports from WAN to LAN. With Auto Configuration the WAN side is assigned an external IP. The LAN side has a default, but can be changed. If you change your TP-LINK WAN side to an address in 192.168.1.x space, it *should* work. TP-LINK would have 192.168.1.x on external side (WAN) and 192.168.68.1 on the internal (LAN) side. I wouldn't change anything. But look in your TP Link to see what it has for WAN address, LAN address, gateway, DNS. Look in your FIOS to see what it has.

Right now the TCP-Link WAN address is 71.178.36.109. That is a routable address from the FIOS ONT and is the same WAN address that the FIOS router is using. When I have some time (and DW doesn't mind being cut off from the Internet for a while) I am going to experiment a bit. I want to see if I can get this FIOS router to connect to the Internet with nothing connected to the WAN ethernet port. I seemed to be failing to do so last time I checked.

[eytonxav]

I have a VZ setup in my house with the TV cable boxes. My VZ router is connected to a cable splitter that feeds the various cable TVs that I have hooked up and is fed from a cable coming from the ONT. Also have cat5 coming from the ONT that is plugged into one of the 4 LAN ports on the router. Then my Nest Mesh network is also connected to one of the LAN ports on the VZ router for my wifi network. Wifi has been disabled on the VZ router and everything is working as expected. Is it possible to run a cat5 from the ONT to your VZ router and then I suspect your TP mesh could then be connected to a LAN port. Disclaimer - I know very little about these networks other than mine is working OK.

Edit- maybe I am incorrect in assuming the cat5 was coming from the ONT. On second thought, the cat5 from the VZ router may be getting its signal from the cable and then feeding my homes cat5 wiring that I only have hooked up to my living room TV.

[donheff]

Well, the weirdness never stops. Here are the results of my latest experiments. If I turn off the TP-Link and reboot the fios router I do not get an Internet connection. I can connect to the FIOS router with a laptop on a LAN port and reach the management interface but no Internet and the fios light shows red. BUT, if I connect my printer to the FIOS WAN port, the FIOS router connects to the Internet and works fine. At that point, if I connect the TCP-Link to a LAN port it picks up a 192.168.1.xxx address from the FIOS router and sets up it's 192.168.68.x LAN network as expected. I am on it now. So, it appears that the FIOS router demands a live device connected to its WAN port -- bizarre. I would expect my printer to be unreachable with this setup but it works fine. Is it possible that my printer is connected thru the ethernet cable on one subnet and wifi on another?

[tulak]

Lots have happened on this thread since I last looked and I haven't had time to go through it all, but I was thinking about:

Quote:

If you change your TP-LINK WAN side to an address in 192.168.1.x space, it *should* work. TP-LINK would have 192.168.1.x on external side (WAN) and 192.168.68.1 on the internal (LAN) side.

I wonder if it's failing to route back to the TP-Link since the 192.168.x.x space is non-routable?

But this might conflict with Don's last comment:

Quote:

At that point, if I connect the TCP-Link to a LAN port it picks up a 192.168.1.xxx address from the FIOS router and sets up it's 192.168.68.x LAN network as expected.

And you're able to access to the internet through the TP-Link from the 192.168.68.x network?

There are some handy tools you can use to help understand how things are being routed and if they are reachable. Use 'ping <ipaddress>' to see if a device is accessible on the network. Keep in mind that the device needs to respond to ping requests and not all devices do. I'd recommend testing ping on the device first to make sure it works before you move it to different networks. The other command is 'traceroute' or 'tracert' on Windows. This will trace your network path and can tell you what networks you're traversing.

[tulak]

Regarding the printer on the WAN port, maybe it is on Wifi? This doesn't make sense to me.

Since you're committed to using the FIOS router, I would look at the IP configuration of the FIOS when it is booted. You say that there's no internet access, but what's reported on the FIOS router? You should be able to see that status for each interface and if there are any IP addresses assigned to the interface. You should see the external IP address on the COAX connection. I would be curious to know what's reported on the WAN interface when something is connected, such as the TP-Link?

I would think that only one WAN connection is active. I'm puzzled by an earlier comment that the external IP is the same for devices downstream of the COAX and WAN port.

target2019 gave good advice above:

Quote:

But look in your TP Link to see what it has for WAN address, LAN address, gateway, DNS. Look in your FIOS to see what it has.

I would do the same for the FIOS. I'd also avoid changing cables around or be very detailed in what your doing when recording these results, otherwise you might accidentally confuse yourself (speaking from personal experience).

[donheff]

I am probably going to leave things be as I have them now. The TCP-Link is properly connected to the LAN side of the FIOS router and it's mesh network is working well. The only odd factor is that the FIOS router will not connect to the Internet unless I have a live device (of any sort) connected to it's WAN port. For now I have a printer connected to that port. If I log into a LAN port on the FIOS I can see that my laptop and the TP-Link are connected via ethernet, and my TV set top boxes are connected via coax. The WAN side says active DHPC connection and shows the routable IP address. The printer connection in the WAN ethernet port doesn't show up.

While all of this was going on I have been trying to install all new boxes for the TVs. They wouldn't install when I had the TP-Link connected via the WAN port. But now that it is on the LAN side I was able to install all the set top boxes and the main media server and they are working fine.

At this point I consider myself lucky, if confused.