Hey all,

This is going to be a post outside the normal scope of topics I typically blog about. Nothing to do with macOS, iOS or MDM, but just a post on how to use your own router with the Dutch ISP KPN. As I spent quite some time in configuring everything when I moved to our new house, I wanted to document it correctly in case I ever had to do it again (even if I do have the necessary backups of course).

As I document it for myself, I thought it may be a good idea to put it out here in case other people living in The Netherlands want to do the same.

The router I received from KPN is still in the box, and I went for a Netgate 4100 Max as my main router for my home network. Reason for doing so is that I’m not a fan of ISP routers (with or without backdoors for the ISP support agents), mainly because of the lack of functionality and flexibility in configuration. Especially because I’m running an extensive test lab with servers and iOT stuff. I also became a big fan of pfSense over the years, hence the choice for a Netgate branded router.

I’ve now been running my setup for 6 months, and I must say it has been very stable and performing very well. I got lucky as the previous owners of the house were using a Fritz!Box, with fiber directly entering the router via a SFP module. Hence no need for an FTU to convert to UTP cable. I ordered a customised SFP module (Customized 1000BASE-BX BiDi SFP 1310nm-TX/1490nm-RX 20km SC Transceiver Module) from https://www.fs.com. I must say the support (for a 10 dollar order) from FS was impressive! They helped me confirming what type of SFP I needed, the Cisco compatible version apparently to work fine with my Netgate, and customised because I needed the SC type connector.

Now, that was the easy part. Got the router, sorted out the right SFP module… now the configuration for the KPN Internet and TV boxes (IPTV).

My first go to was https://www.kpn.com/service/eigen-apparatuur.htm but as expected that did not give all the details you’d need to bring this project to a good end.

Then I found: https://venxir.tweakblogs.net/blog/12507/kpn-glasvezel-via-pfsense which helped me a lot, and allowed me to get things semi-working. All looked fine, Internet was working great and the TV was working… well, for about 5 minutes that was. After that I started repeatedly getting the stb-nmc-400 error on the TV. And only restarting the KPN TV STB boxes allowed the connection to kick in again…. for another few minutes… Something was obviously wrongly configured.

Continuing my search, I came across https://gathering.tweakers.net/forum/list_messages/2076232 but even following that (a bit different setup) did not resolve the problem. It’s only when I ended up finding https://github.com/HellStorm666/KPN-Routed-IPTV-with-OPNsense, that I managed to connect all the dots and land the project successfully.

I also want to call out the following YouTube video which gave me some clues along the route as well: https://www.youtube.com/watch?v=ZYX70pRpWUw

However, because I had to dig into different online resources, study a few things like IGMP, I hereby want to share the exact setup I ended up deploying, which allowed me to have no glitches or service interruptions for almost 6 months now.

For the completeness of the setup overview, this is the gear I currently have deployed across the house:

  • Netgate 4100 Max
  • SFP: Customized 1000BASE-BX BiDi SFP 1310nm-TX/1490nm-RX 20km SC Transceiver Module (Cisco compatible)
  • Netgear GS724Tv4 managed switch
  • Netgear GS108Tv3 managed switch (a total of 4 of them in the mean time, more about this later)
  • Netgear Orbi RBR850 Wifi 6 Mesh with some RBS850 Satellites in AP mode.

The end result is KPN iTV working fine on 2 STB’s (the biggest challenge), a stable 1Gbps ethernet across all rooms and an average between 600 and 800 Mbps on Wifi (I get closer to the 1Gbps in router mode, but even with ethernet backhaul it seems the RBR850 drops a bit in AP mode regardless of what tweaks I try in channels etc. But even with my eagerness in going for perfection, I’m ok with the 600/800 Mbps compromise).

Now, let’s look into the details of my pfSense config.

The first thing I did was creating the 2 VLAN’s we need for KPN Internet (VLAN 6) and KPN TV (VLAN 4). Both will be linked to the WAN port of your router. As my router has 2 WAN ports, I linked both to ix3 which is the WAN port with my SFP fiber connection:

The reason for doing that is because KPN is splitting Internet and TV on those VLAN’s, and the routers they provide do the same natively. Hence we have to mimic this configuration.

As you can see, I also have other VLAN’s configured (as I tend to lock down my home network Forth Knox style and I don’t trust ISP and iOT vendors, I need to isolate my test lab and protect my kid on the World Wide Web… ), but as you can see I also created a VLAN40. More about that later.

Next is assigning the WAN Interfaces. The only important ones are the one for Internet, linked to our VLAN 6, and the one for KPNTV on VLAN 4.

Let’s start with the WAN interface for Internet. Noting fancy here. Just select your WAN/VLAN6 interface in the “Available network ports:” dropdown menu and add it to your assigned interfaces. For my Negate 4100 that was ix3.6 (the ix3 WAN port connected over SFP to fiber and linked to VLAN 6).

This will add the Interface as “OPT”. If you already have a WAN interface listed, you can delete it. We’ll only be using the customised WAN interface which we configure here. Once the OPT interface is added, you can click on it to configure the settings and bringing the interface up and connected to KPN.

For the IPv4 configuration type we have to choose PPPoE. KPN uses PPPoE for internet and as per the online ‘guide’ from KPN, we can just use Internet/Internet as username and password:

That’s it for Internet! If all went well, you should now be connected to the Internet! You can check this under Status => Interfaces:

Whatever you do beyond that point regarding Internet and LAN is beyond the scope of this post. In my case I split the network up in different VLAN’s, use the 4 un-switched LAN port of my Netgate 4100 to isolate things, etc.. but the above should bring your Internet connection up and running.

Now the TV part… which was a bit of another story. Networking stuff, VLAN’s,… I’m quite comfortable with, but things like IGMP proxy and snooping were a bit outside my comfort zone. But hey! We learn new things every day!

First we need to add a WAN interface for TV, just like we did for the Internet connection. However, while KPN uses PPPoE for Internet, we need to use DHCP for TV. Additional to this we need to configure a few more options to make the IPTV with KPN work nicely.

First we select the VLAN4 interface on the WAN port under “Available network ports:“. For me this was again ix3, but now linked to VLAN 4. It will again be added as “OPT” interface on which you can click to configure the uplink.

Here we need to tweak the settings a bit:

  • Give the Interface a name (KPNTV)
  • Set the IPv4 Configuration to DHCP
  • Select “Advanced Configuration” under DHCP Client Configuration

In the advanced settings, under “Lease Requirements and Requests”, we need to set:

  • Send options to: dhcp-class-identifier “IPTV_RG”
  • Request options to: subnet-mask, routers, classless-routes

With this you should now also have your TV uplink up and running! Note that you should get an IP address like 10.x.x.x on this uplink, a private IP on KPN’s VLAN 4.

That’s it? Well, we’re not quite there yet unfortunately. There is a bit more to do:

  • DHCP options on your LAN (for the STB TV boxes)
  • IGMP proxy
  • IGMP snooping (optional, but quite important if you don’t want to overload you network with IPTV stream going to devices who don’t need it)
  • Firewall and outbound NAT

The first thing to do are the additional DHCP options. You could do this in the general DHCP Server settings for your LAN (pfSense -> Services -> DHCP Server -> LAN), but as I’m using different VLAN’s for different purposes on my network, I’m setting those options on the DHCP for my VLAN 40. This VLAN is only used by my KPN STB’s which I isolate via my managed switches and pfSense Firewall.

  • add option “60” – Text – “IPTV_RG”
  • add option “28” – IP Address or host – broadcast address of your LAN (or VLAN). For me this is 192.168.40.255 as my VLAN 40 on which I deploy my 2 KPN STB boxes is using subnet 192.168.40.0/24

Next we need to configure IGMP Proxy. As IPTV is using IGMP, we need to configure our router to make sure that the multicast transmissions go from our LAN (or VLAN you use for the STB’s) to KPN VLAN 4 and vice versa. For this to work we need to configure pfSense as IGMP proxy. In Services – > IGMP proxy we need to set the following:

  • Upstream: 213.75.0.0/16, 217.166.0.0/16, 10.0.0.0/8
  • Downstream: 192.168.40.0/24 (the subnet of your LAN or VLAN on which you run the STB’s)

Before we end up looking at IGMP Snooping, we have to do a few more things on the Firewall rules.

On the LAN side, we need to allow outbound traffic to KPN. For me this is on my VLAN40, but if you’re not isolating your STB’s on another VLAN, you need to change the LAN rule to allow “Allow packets with IP options to pass”:

I’m blocking everything from my STB VLAN into my other VLAN’s. Why? Because I have trust issues, and just like any iOT devices (on another isolated VLAN) I’m convinced the KPN TV boxes have no business with any other part of my network. I’m allowing all outbound traffic from the STB’s, but lock down the rest of my internal network.

On the WAN side, we need to add the following rules for UDP and IGMP:

The final thing we need to do on the Firewall is to configure outbound NAT. This to control how our IPTV traffic leaves our network, over the (private 10.x.x.x) IP address we got from KPN DHCP. As KPN is not sending out Gateway information on VLAN4 anymore, we need to fix this via outbound NAT rules.

To configure this I’d suggest to use “Hybrid Outbound NAT”, as this will allow us to continue the automatic outbound NAT rules (automatically set by pfSense for our Internet connection), as well as some manual rules we configure for KPN TV (and other purposes you may add later) which take preference on the automatic rules.

As I have a dedicated VLAN for my STB’s I’m setting this subnet as source. If you only have one general LAN setup, you’d set the rules below for each of your STB IP addresses on your LAN:

That’s it! With all the above your Internet and KPN TV should work fine! Test it out and make sure that TV continues to play for a good amount of time! If after a few minutes you get errors like stb-nmc-400 you probably have some mistakes in your Firewall rules (WAN, LAN or outbound NAT).

The final thing you may want to look at is IGMP Snooping. This is important so that the multicast traffic for IPTV is not send all over your network, but only to those ports or devices which need them. This because of the higher bandwidth multicast IPTV traffic uses. In our situation here: only the KPN TV STB’s should receive the IPTV traffic.

Unfortunately, this is not a task for our router or pfSense. For this we’d need a managed switch with IGMP Snooping capability.

This is where I bring in my GS724Tv4 and GS108Tv3’s. I’ll skip any in-depth discussion on the setup of those managed switches, but the reason I added those to my setup is because, in view of the other VLAN considerations I mentioned before, I wanted to have 2 KPN TV boxes, in rooms where other devices need to be on other VLANs. The 724 as main switch behind my router, and the 108’s in the room I need the VLAN’s. However, the fact of having those managed switches added the additional benefit of being able to implement IGMP Snooping.

Configuring this will be subject to the type of switch you are using, as well as the network layout on which you need to pass IGMP and multicast traffic. Hence I’ll not elaborate this further, and limit it to a screenshot showing the feature being enabled on the ports leading to my KPN STB’s. This would be my main switch, but if you are connecting other managed switches down the line, you’d need to configure those in a similar way all they way down to the final port your STB is connected to.

That’s it!

With all this you should be able to configure your pfSense router (or any other router with similar functionality/capabilities) to function with KPN Internet and TV.

I know this post is a bit out of my normal realm of topics I typically blog about. But as I needed to document this for my own, I assumed I could just post it out here in one go in case it may help anyone else.

If you struggle with any of the above, or if there are any inaccuracies in the tutorial above, don’t hesitate to reach out!

TTG

Brgds,