Replacing the SFR Box 7 Plus

This article describes replacing an SFR Box 7 Plus with an Altice ONT7-SFU, using an x86 laptop behind it and a Xiaomi router configured as a “Dump AP” for wireless connectivity.

Why?

The box works well, so why replace it?

Flexibility.

Having complete control over my local network lets me do almost anything I want. It would also be nice if the box could act as a NAS by connecting a few HDDs or SSDs, and if I could connect to my local network from anywhere and from any device, right?

That is exactly my use case. I will go through the communication process with the ONT, the setup of the replacement “box”, and the configuration of its access point (AP).

Why an external ONT matters

At the outset, the network looked like this: SFR → Fiber → Box 7.

No ONT? There was one, but it was built into the box.

That was the main problem: I did not have a PC or SBC (single-board computer) capable of receiving a fiber connection directly.

I had an old laptop with an i3-5005U (2 cores / 4 threads) and 8 GB of RAM, with no screen, that I had recovered from a friend, as well as a Xiaomi Redmi AC2100.

I looked into external SFR ONTs, the kind used with the non-Plus Box 7, and came across the Altice ONT7-SFU. There was one catch: SFR rents it out, and there was no way to convince customer service to downgrade my setup to an ONT and a box.

OwN iT

What if people were selling them on eBay? Well, they were—and for only €20 more!

Once it arrived, I needed to find a way to communicate with it. From what I could tell, it primarily supported Telnet and SSH.

Now I had to find the username and password…

I knew the box communicated with the ONT to retrieve information about the fiber connection, temperature, and so on (all accessible through the box’s API), so the box had to have the credentials.

After some searching, I found a dump of an older Box 7 firmware. The box’s files did indeed contain the credentials it used to communicate with the ONT over Telnet. I will not publish those credentials here, for obvious reasons.

To connect over Telnet, I had to plug my computer directly into the back of the ONT and assign it a static IP address in the 192.168.4.0/24 subnet (255.255.255.0). I chose 192.168.4.100, then ran arp -a to find the ONT on the subnet.

One response caught my attention: 192.168.4.254, both because of its IP address and because it was the only response that differed from the others on the network.

I tried connecting with the credentials and bingo, I’m in! On the first attempt!

Since it was my first time using Telnet, I ran a few commands to get familiar with the interface.

show gpon slid displays the “fiber password”, as it is called in the Box 7 web interface.

And… it was blank. Completely blank.

The SLID is displayed in two formats: hexadecimal and ASCII. In hexadecimal, it showed 0x20202020202020, which is just spaces in ASCII. It looked like an ONT that had fallen off the back of a truck :)

I decided to try rewriting it with mine. The command set gpon slid ascii <my_slid> lets me do that and, after a reboot, my SLID was displayed correctly!

There was no other set command, so I figured I could try the ONT on my fiber connection.

I connected everything. The LEDs cycled through every color, and two of them stayed orange for about a minute… then the ONT switched off.

I left it alone for a while, in case it came back to life. Good thing I did: about a minute later, it powered back on and, this time, all the LEDs were green. Phew!

Replacing the box

I had already completed this step at my parents’ place, so I was able to get it set up quickly.

I naturally went with OpenWrt because I know it very well, but also because it is one of the best systems for this kind of setup. My access point would run the same system, which was another reason to use it.

After flashing the operating system onto a USB stick (USB 2.0 is enough, since the system is loaded entirely into RAM during boot), I also installed two 1 TB SATA SSDs to run them in RAID 1 with mdadm, and set up SMB and DLNA/UPnP shares.

The laptop naturally had only one RJ45 port, so a USB 3.0-to-RJ45 adapter provided an additional port for the LAN.

Here is my network configuration (/etc/config/network):

config interface 'loopback'
        option device 'lo'
        option proto 'static'
        option ipaddr '127.0.0.1'
        option netmask '255.0.0.0'

config globals 'globals'
        option ula_prefix 'fd1b:8136:589b::/48'
        option packet_steering '1'

config device
        option name 'br-lan'
        option type 'bridge'
        list ports 'eth0'

config interface 'lan'
        option device 'br-lan'
        option proto 'static'
        option ipaddr '192.168.1.1'
        option netmask '255.255.255.0'
        option ip6assign '60'
        list dns '1.1.1.1'
        list dns '1.0.0.1'

config interface 'wan'
        option device 'eth1'
        option proto 'dhcp'
        option vendorid 'neufbox_NB6V-XXXXXXXXXXXXX'
        option peerdns '0'
        list dns '1.1.1.1'
        list dns '1.0.0.1'

First, packet_steering is enabled to distribute the software load across multiple cores, because under full load a single core is not fast enough for WAN-to-LAN traffic.

Next, the RJ45 ports are assigned to the interfaces, which makes it possible to SSH into the machine easily. Until then, I had been virtualizing the operating system with QEMU and using the USB stick as its disk (thanks, QEMU, for making that possible!), so changes were applied directly to the stick. This also allowed me to configure the system and install several packages.

Finally, the most important part, in my opinion: vendorid. This option spoofs the vendor ID so that the new box appears to the ONT as an SFR box. Based on my tests, having neufbox in the name is enough for it to accept the box, but I preferred to follow the same pattern as the old box.

I booted the laptop and, after about a minute, it received a WAN IP address! Great: I officially had Internet access and could successfully ping external hosts.

Dump AP

What would a home network be without Wi-Fi? This part was fairly straightforward: I had already flashed my Xiaomi with OpenWrt using the web exploit. I had to reset the router to start from a clean baseline, then disable DHCP because the laptop would handle it from then on.

But why “Dump AP”?

Simply because the router only receives the wireless traffic and forwards it to the PC. It does nothing at the network layer: no firewall, no WAN-to-LAN routing, no forwarding to another subnet—nothing.

Its sole purpose is to broadcast an access point on both 5 GHz and 2.4 GHz; the rest of the work is delegated to the box. This is very practical because the Xiaomi tops out at around 300 Mbit/s in WAN-to-LAN mode, whereas this setup lets me saturate the connection without any trouble.

Conclusion

Great fun. I learned a lot about how an ONT works—more than I learned about the box itself, thanks to what I had already done with this setup—but it was still exciting to see the green LEDs light up and a ping make it through!

I would like to thank the lafibre.info forums, which helped me greatly in finding what I was looking for, even though much of the essential information was “hidden”.

I chose not to cover the SMB/DLNA setup in detail because I consider it outside the scope of this article: it does not really differ from a traditional setup. The environment changes, but the overall process remains essentially the same. The same goes for Docker.

All that remains is to call SFR and ask them to switch me to IPv4 Full Stack instead of CGNAT (because of the IPv4 shortage), since I believe that is why my ports cannot be reached from outside.

Thank you for taking the time to read about my adventure.