Nokia FastMile 5G Gateway 3.2 - Enable bridge mode?

[Spectrox]

I'm currently on Roger's 5G home internet plan. They've sent me a Nokia FastMile 5G Gateway 3.2; I currently have a double NAT configured for my home network since I have my own Asus router but I've been looking to put the modem into bridge mode.

It seems as though the option to disable "Route Mode" and enable Bridge mode is greyed out for me under the access point settings since the default APN cannot be changed.

I've created a new APN according to the instructions another ISP had posted Optus instructions but to no avail.

Has anyone been able to configure bridge mode for their Nokia Modem? Could someone at Rogers post an APN configuration to enable bridge mode on the Rogers network?

*Added Labels*

[travisbell]

Hi @Spectrox, I'm in the same boat! I'm stuck in double NAT land and would love to escape it. Seems like we're so close to getting this figured.

Clearly the FastMile is capable of it, so is this just Rogers blocking it, or something? Has anyone else figured this out yet?

[SHEEB]

Listening in...

[gareth01]

I would also like to find a solution for this. I'm also having issues with the onboard Speed Test function - it worked for the first month and hasn't worked since it always just comes up with an error. Anyone else having this issue?

[CurtissWright]

Yes, I need Bridge mode as well, otherwise this thing is useless to me.  Rogers?

[SamShares]

I'm using this modem on Telus, and I was able to get Bridge mode to "Connected"Main APN is still my first one: isp.telus.com and then second APN I added as Bridgemode and ticked off DATA I set it to sp.telus.com <<<< these are both valid Telus APN's and both are identical in functionality.

So I assume rogers would have the same way, they do have multiple APN's doing the same thing....example:

Under APN: fwach2.apn is the main APN for 5G Home Internet and you should be able to set second APN for Bridgemode only and leave other fields as Auto --> Be sure to tick DATA and set to: ltemobile.apn or ltedata.apn

Refresh to see if it says 'Connected'

LAN Settings -> Turn off DHCP for IPV4 and IPV6 and set a static route, should work under

[Spectrox]

Hey Sam, I've had no luck with these configurations.

[SHEEB]

Hmm, so even though Rogers requested that bridge mode be turned off for their APN (fwach2), by adding an additional APN it then becomes unlocked? I will try this shortly.

[RogersTony]

Hello All,

We have reached out to our Mobile Internet teams and they have confirmed that bridge mode is not supported on these devices.

I know this is not the answer you were hoping to hear.

RogersTony

[Spectrox]

Hey @RogersTony I appreciate you looking into this further for us. By any chance did the Mobile Internet Team specify a reason why bridge mode is implicitly disabled? Clearly the device supports the ability to go into bridge mode as seen within other ISPs; I don't see any viable reasons why Rogers would require bridging to be disabled?

[RogersTony]

Hello, @Spectrox 

Thank you for following up with us on this.

They did not provide us with any additional details only that the feature is not supported.

RogersTony

[-G-]

---

@Spectrox wrote:

Hey @RogersTony I appreciate you looking into this further for us. By any chance did the Mobile Internet Team specify a reason why bridge mode is implicitly disabled? Clearly the device supports the ability to go into bridge mode as seen within other ISPs; I don't see any viable reasons why Rogers would require bridging to be disabled?

---

How badly do you need Bridge Mode?  Does your router support an OpenVPN Ethernet Bridge client?  If so, you can connect to a VPN service such as this one and voilà.

[Spectrox]

It's not really about how badly I need bridge mode (yes, I would really like it alternatively to a double NAT); It's really about why we are unable to enable a basic feature. Yes - In theory I could make a VPN bridge, however there are a few issues with this. For one, this is unnecessarily complex for no reason. Second of all, this will add a ton of latency to a service that already has very high latency. Lastly, as soon as the LTE/5G connection decides to dip, the VPN service will drop my connection, leaving me without Internet temporarily. This is not a viable and or reliable alternative to a true bridge.

[-G- · Accepted solution]

---

@Spectrox wrote:

It's not really about how badly I need bridge mode (yes, I would really like it alternatively to a double NAT); It's really about why we are unable to enable a basic feature.

---

It's not quite that simple.  There are a number of architectural considerations as to why "bridge mode" would not be allowed.  However, I'm pretty sure that the main showstopper is that Rogers' mobile networks are built on an IPv6 core and requires 464XLAT for IPv4 connectivity.  That defeats "bridge mode" because there is no pool of IPv4 addresses that can be allocated to your router, nor does 464XLAT support direct inbound IPv4 connections from the public Internet.

[CurtissWright]

There are other issues to consider.  With my current Rogers 4G rocket hub, there has not been a single firmware update in 4 years.  This means that if you use this as your primary router, it is full of security holes.  I think it is a fair assumption that with the 5G Gateway it will be the same concern.  Rogers doesn't bother updating their firmware.  So the only safe way to use their equipment is bridged, behind your own router that gets regular firmware updates and security patches.....

[SHEEB]

It's funny you mention this. I had a Rogers ZTE MF-279Thotspot and even my more recent Rogers FWA hardware never received any kind of update. I do hope this Nokia 5G modem receives some kind of security update(s). I'd imagine Nokia does make them, but as to whether Rogers pushes them out is another story.

[-G-]

---

@CurtissWright wrote:

There are other issues to consider.  With my current Rogers 4G rocket hub, there has not been a single firmware update in 4 years.  This means that if you use this as your primary router, it is full of security holes.  I think it is a fair assumption that with the 5G Gateway it will be the same concern.  Rogers doesn't bother updating their firmware.  So the only safe way to use their equipment is bridged, behind your own router that gets regular firmware updates and security patches.....

---

Keep in mind that with Rogers using 464XLAT, your attack surface is greatly reduced because it does not allow for inbound IPv4 network connections from the public Internet.  It keeps nuisance traffic off the Rogers network and makes it rather difficult for "the bad guys" to probe for weaknesses in your router/gateway.

[msauer2000]

I'm not sure they are using 464XLAT for the 5G Home Internet. I am able to open ports and receive inbound traffic on the 5G Home Internet with the Nokia box using whatever IPV4 (or IPV6) address I currently have assigned.

[pjt]

---

@-G- wrote:

---

@Spectrox wrote:

It's not really about how badly I need bridge mode (yes, I would really like it alternatively to a double NAT); It's really about why we are unable to enable a basic feature.

---

It's not quite that simple.  There are a number of architectural considerations as to why "bridge mode" would not be allowed.  However, I'm pretty sure that the main showstopper is that Rogers' mobile networks are built on an IPv6 core and requires 464XLAT for IPv4 connectivity.  That defeats "bridge mode" because there is no pool of IPv4 addresses that can be allocated to your router, nor does 464XLAT support direct inbound IPv4 connections from the public Internet.

---

Does this mean port forwarding won't work either ?