Remplacer la Livebox par un EdgeRouter X d’Ubiquity

Motivation : Notre Livebox tournait depuis plus de 4 ans H24 et commençait à avoir des déconnexions fréquentes.

N’ayant plus la patience j’ai décidé de remplacer la partie flux internet de la LB par un routeur Ubiquity EdgeRouter-X.
J’ai parcouru pas mal de blogs, de forums et je n’ai rien inventé. Il faut juste etre rigoureux.

Source : https://lafibre.info/remplacer-livebox/tuto-edgerouter-erpro-8-pour-internet-livebox-dhcp-pour-tv-et-telephone/

Voici ma conf pour la version v1.10.7 :

téléchargeable directement ici : confOrange-Site.txt

firewall {
    all-ping enable
    broadcast-ping disable
    ip-src-route disable
    log-martians enable
    name WAN_IN {
        default-action drop
        description "WAN to internal"
        enable-default-log						  
        rule 10 {
            action accept
            description "Allow established/related"   
			log disable
            protocol all
            state {
                established enable
				invalid disable
                new disable
                related enable
            }
        }
        rule 20 {
            action drop
            description "Drop invalid state"
			log disable
            protocol all
            state {
                established disable
                invalid enable
                new disable
                related disable
            }
        }
    }
    name WAN_LOCAL {
        default-action drop
        description "WAN to router"
        rule 1 {
            action accept
            description "Allow established/related"
            state {
                established enable
                related enable
            }
        }
        rule 3 {
            action drop
            description "Drop invalid state"
            log disable
            state {
                invalid enable
            }
        }
    }
    receive-redirects disable
    send-redirects enable
    source-validation disable
    syn-cookies enable
}
interfaces {
    bridge br0 {
        aging 300
        bridged-conntrack disable
        description "bro -> eth0.838 LIVEBOX (VoD)"
        hello-time 2
        max-age 20
        priority 0
        promiscuous disable
        stp false
    }
    bridge br1 {
        aging 300
        bridged-conntrack disable
        description "br1 -> eth0.840 LIVEBOX (ZAPPING + CANAL 1)"
        hello-time 2
        max-age 20
        priority 0
        promiscuous disable
        stp false
    }
ethernet eth0 {
        description "eth0 VERS LIVEBOX"
							  
        duplex auto
        speed auto
        vif 832 {
            address 192.168.2.1/24
            description "eth0.832 LIVEBOX (INTERNET + VOIP + CANAL 2)"
        }
        vif 838 {
            bridge-group {
                bridge br0
            }
            description "eth0.838 LIVEBOX (VoD)"
            egress-qos "0:4 1:4 2:4 3:4 4:4 5:4 6:4 7:4"
        }
        vif 840 {
            bridge-group {
                bridge br1
            }
            description "eth0.840 LIVEBOX (ZAPPING + CANAL 1)"
            egress-qos "0:5 1:5 2:5 3:5 4:5 5:5 6:5 7:5"
        }
    }	
    ethernet eth1 {
        description "eth1 ONT (FIBRE RJ45)"
        duplex auto
        speed auto
        vif 832 {
            address dhcp
            description "eth1.832 (INTERNET + VOIP + CANAL 2)"
            dhcp-options {
                client-option "send vendor-class-identifier "sagem";"
				client-option "send dhcp-client-identifier 1:AC:3B:77:F6:1E:5E;"
                client-option "send user-class "\053FSVDSL_livebox.Internet.softathome.Livebox3";"
                client-option "send rfc3118-auth 00:00:00:00:00:00:00:00:00:00:00:1a:09:00:00:05:58:01:03:41:01:0d:66:74:69:2f:61:XX:XX:XX:XX:XX:XX;" <- remplacement a faire ici
                client-option "request dhcp-lease-time, dhcp-renewal-time, dhcp-rebinding-time, domain-search, rfc3118-auth;"
                default-route update
                default-route-distance 210
			    global-option "option rfc3118-auth code 90 = string;"
                name-server update
            }
            egress-qos "0:0 1:0 2:0 3:0 4:0 5:0 6:6 7:0"
            firewall {
                in {
                    name WAN_IN
                }
                local {
                    name WAN_LOCAL
                }
            }
        }
        vif 838 {
            bridge-group {
                bridge br0
            }
            description "eth1.838 (VoD)"
            egress-qos "0:4 1:4 2:4 3:4 4:4 5:4 6:4 7:4"
        }
        vif 840 {
            bridge-group {
                bridge br1
            }
            description "eth1.840 (ZAPPING + CANAL 1)"
            egress-qos "0:5 1:5 2:5 3:5 4:5 5:5 6:5 7:5"
        }
    }
    ethernet eth2 {		   
        address 192.168.1.1/24
        description LAN_ETH2
        duplex auto 
        speed auto
    }
    ethernet eth3 {
        disable
        duplex auto
        speed auto
    }
    ethernet eth4 {
        disable
        duplex auto
        speed auto
    }
    loopback lo {
    }
	
	    switch switch0 {
        address 192.168.5.1/24
        description Local
        mtu 1500
        switch-port {
            interface eth3 {
            }
            interface eth4 {
            }
            vlan-aware disable
        }
    }
	
}
protocols {
    static {
        route6 ::/0 {
            next-hop fe80::ba0:bab {
                interface eth1.832
            }
        }
    }
}
service {
    dhcp-server {
        disabled false
        global-parameters "option rfc3118-auth code 90 = string;"
        global-parameters "option SIP code 120 = string;"
        global-parameters "option Vendor-specific code 125 = string;"																 
        hostfile-update disable
        shared-network-name LAN {
            authoritative disable
            subnet 192.168.1.0/24 {
                default-router 192.168.1.1
                dns-server 8.8.8.8
                dns-server 8.8.4.4
                domain-name ER-DOMAIN
                lease 86400
									  
                start 192.168.1.3 {
                    stop 192.168.1.254
                }
            }
        }
        shared-network-name LIVEBOX {
            authoritative enable
            subnet 192.168.2.0/24 {
                default-router 192.168.2.1
                dns-server 81.253.149.9
                dns-server 80.10.246.1
                domain-name orange.fr
                lease 86400
									  
                start 192.168.2.30 {
                    stop 192.168.2.50
                }
                subnet-parameters "option rfc3118-auth 00:00:00:00:00:00:00:00:00:00:00:64:68:63:70:6c:69:76:65:62:6f:78:66:72:32:35:30;"
                subnet-parameters "option SIP 00:06:73:62:63:74:33:67:03:41:55:42:06:61:63:63:65:73:73:11:6f:72:61:6e:67:65:2d:6d:75:6c:74:69:6d:65:64:69:61:03:6e:65:74:00;"
           subnet-parameters "option Vendor-specific 00:00:05:58:0c:01:0a:00:00:00:00:00:ff:ff:ff:ff:ff;"

            }
		}
        use-dnsmasq disable
    }
    dns {
    }
    gui {
        http-port 80
        https-port 443
        listen-address 192.168.1.1
        older-ciphers enable
    }
    nat {
        rule 5001 {
            description "MASQ: WAN"
            log disable
            outbound-interface eth1.832
			protocol all
            type masquerade
        }
    }
    ssh {
        listen-address 192.168.1.1
        port 22
        protocol-version v2
    }
    upnp2 {
        listen-on eth0.832
		listen-on eth2			  
        nat-pmp enable
        secure-mode disable
        wan eth1.832
    }
}
system {
    config-management {
        commit-revisions 50
	}
	domain-name ER-DOMAIN
    host-name ubnt
	conntrack {
        expect-table-size 4096
        hash-size 4096
        table-size 32768
        tcp {
            half-open-connections 512
            loose disable
            max-retrans 3
        }
    }
    login {
        user ubnt {
            authentication {
                encrypted-password XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
            }
            level admin
        }
    }
    name-server 8.8.8.8
    name-server 8.8.4.4
    name-server 208.67.222.222
    name-server 208.67.220.220							  
    ntp {
        server 0.ubnt.pool.ntp.org {
        }
        server 1.ubnt.pool.ntp.org {
        }
        server 2.ubnt.pool.ntp.org {
        }
        server 3.ubnt.pool.ntp.org {
        }
    }
	    offload {
        hwnat disable
        ipsec enable
		}
    syslog {
        global {
            facility all {
                level notice
            }
            facility protocols {
                level debug
            }
        }
    }
    time-zone Europe/Paris
}


/* Warning: Do not remove the following line. */
/* === vyatta-config-version: "config-management@1:conntrack@1:cron@1:dhcp-relay@1:dhcp-server@4:firewall@5:ipsec@5:nat@3:qos@1:quagga@2:suspend@1:system@4:ubnt-pptp@1:ubnt-udapi-server@1:ubnt-unms@1:ubnt-util@1:vrrp@1:webgui@1:webproxy@1:zone-policy@1" === */
/* Release version: v1.10.7.5127989.181001.1227 */