Why does Afrihost’s default CGNAT profile break Metrofibre lines? (And why is front-line support blind to it?)

Assasin_Zer0 said:
Hi @Afrigirl,


Thanks for the clear explanation of how your RADIUS setup works! It makes sense that a rotated WAN MAC address looks like a brand-new device on your backend and automatically pulls down the default profile.

The problem I am facing is that I rotate my WAN MAC for security reasons on my UniFi gateway, and every time I do, the line completely falls apart on that default pool. I really want to find a way to stop this from happening, so I’m looking for some help and advice from you or the technical team on how I can resolve this.

1. Is there anything I can change or configure on my side to make the standard pool (100.x.x.x) stable?

On my side dropping into that default pool causes an immediate drop in performance. My 1Gbps line chokes down to under 50 Mbps, packets start dropping, and the connection flaps non-stop.
The second you move me to a public 102.x.x.x IP, it goes back to being 100% perfect. Either way, the long and short of it—and I'm honestly not sure why—is that getting a 100.x.x.x IP breaks my setup, and getting a 102.x.x.x IP seems to work flawlessly.

I want to know if there is a workaround or setting I can apply on my own hardware to fix this. Please note that I have already tried tweaking some of these settings on my side, but none of them worked—unless I am using the incorrect values. I would appreciate your guidance on the specifics:
  • Do I need to change my MTU or MSS clamping settings on my UniFi WAN port so it plays nice with your CGNAT routing? If so, what are the exact values I should use?
  • Are there any specific DHCP options I should be sending when the router authenticates?
2. If I can't fix it on my end, what is the best way to get back onto a public IP without the support nightmare?

Since rotating my MAC resets my profile on your RADIUS server, I get stuck in the default pool. Trying to get this sorted through standard support or the WhatsApp chatbot is incredibly frustrating. I always get trapped in a 3 - 4 hour loop of generic troubleshooting scripts and get threatened with an R800 MetroFibre call-out fee for a problem we both know is just a RADIUS mapping profile issue.

Is there a quicker, less painful escalation channel I can use to ask for the profile swap without having to jump through first-line support scripts or spamming your forum inbox?

Any tips or technical advice on what I can do to fix this would be massively appreciated!

Click to expand...
Maybe try leaving the ONT off for 20 mins or so then switching on again. That usually clears up any mac address binding on dhcp or cache issues on the ONT.

Easier than hours spent with support.

Obviously first prize is not to change the mac address. Or use pppoe if possible.
 
Unfortunately, as @Afrigirl already mentioned, changing your WAN MAC address fundamentally breaks the way we map subscribers to services, which is the ONLY way you can identify users on a DHCP network.
 
Thanks @Sparky43, but unfortunately, that doesn't really resolve the core issue in my situation.
To answer your points first:
  • PPPoE is not possible: I have already tried this route, but MetroFibre operates strictly on DHCP.
  • The ONT power cycle doesn't fix it: Leaving the ONT off to clear the cache doesn't solve what happens after the MAC is rotated.
I am in a specific situation where rotating the WAN MAC is a hard requirement, so I don't have much of a choice here. I completely understand @AfriNatic's point that changing the MAC breaks how Afrihost maps subscribers on a DHCP network.
In a nutshell, every time my MAC rotates, I am entered into a lucky draw with DHCP:
  1. If I draw a CGNAT IP (100.x.x.x): The connection completely falls apart. High packet loss, sub-50Mbps speeds, and it's practically unusable.
  2. If I draw a Public IP (102.x.x.x): The connection is 100% perfect.
Because a public IP works flawlessly instantly, the issue isn't related to ONT or DHCP cache. I also don't care about having a static IP—I'd actually prefer not to have one.
The real frustration happens when I lose that lucky draw and get stuck on CGNAT. I have to contact support, and even though I know exactly what needs to be done on the RADIUS backend, agents refuse to action it without forcing me through a 4-hour generic troubleshooting script.


Ultimately, since my environment necessitates regular MAC rotations, I'm just hoping to find a smoother way forward. Is there an efficient channel or a specific technical team I can reach out to when this happens? I'd love to avoid taking up frontline support's time with generic troubleshooting scripts when we already know it's a quick RADIUS profile adjustment on the backend.
 
Assasin_Zer0 said:
Thanks @Sparky43, but unfortunately, that doesn't really resolve the core issue in my situation.
To answer your points first:
  • PPPoE is not possible: I have already tried this route, but MetroFibre operates strictly on DHCP.
  • The ONT power cycle doesn't fix it: Leaving the ONT off to clear the cache doesn't solve what happens after the MAC is rotated.
I am in a specific situation where rotating the WAN MAC is a hard requirement, so I don't have much of a choice here. I completely understand @AfriNatic's point that changing the MAC breaks how Afrihost maps subscribers on a DHCP network.
In a nutshell, every time my MAC rotates, I am entered into a lucky draw with DHCP:
  1. If I draw a CGNAT IP (100.x.x.x): The connection completely falls apart. High packet loss, sub-50Mbps speeds, and it's practically unusable.
  2. If I draw a Public IP (102.x.x.x): The connection is 100% perfect.
Because a public IP works flawlessly instantly, the issue isn't related to ONT or DHCP cache. I also don't care about having a static IP—I'd actually prefer not to have one.
The real frustration happens when I lose that lucky draw and get stuck on CGNAT. I have to contact support, and even though I know exactly what needs to be done on the RADIUS backend, agents refuse to action it without forcing me through a 4-hour generic troubleshooting script.


Ultimately, since my environment necessitates regular MAC rotations, I'm just hoping to find a smoother way forward. Is there an efficient channel or a specific technical team I can reach out to when this happens? I'd love to avoid taking up frontline support's time with generic troubleshooting scripts when we already know it's a quick RADIUS profile adjustment on the backend.
Click to expand...
I would be very interested to understand the potential security benefit of changing the MAC address for a firewall for a business, assuming that you want to keep the same external IP (since CGNAT is causing you issues I assume you want to be externally accessible).
 
killerbyte said:
I would be very interested to understand the potential security benefit of changing the MAC address for a firewall for a business, assuming that you want to keep the same external IP (since CGNAT is causing you issues I assume you want to be externally accessible).
Click to expand...
@killerbyte
I know that from a standard consumer perspective, rotating a WAN MAC looks like I'm just looking for a headache.

But looking at this from an enterprise security lens, it is standard compliance for us atleast. Atleast this is what they want from us. I wouldnt want to do this if i had the option, but they do tend to take it to the next level for some reason. I think personally it is over engineered, or maybe there is a method to their madness? Who knows!


As a remote engineer operating under a strict CIS Benchmark Policy, our perimeter security team explicitly requires this. Regularly rotating the WAN MAC prevents external reconnaissance, stops long-term traffic profiling, and breaks persistent tracking targeted at engineers working from home. Since the company covers the premium gigabit line and the UniFi infrastructure for WFH compliance, I am bound to their security checklists.

Also, just to clarify—I actually don't want a persistent or static IP address. I personally prefer pulling a random IP each time for privacy. The issue isn't that my IP changes; the issue is that Afrihost's default CGNAT pool completely chokes and collapses my line performance whenever it sees a new MAC address, forcing me to rely on a manual profile fix.
 
Out of giggles, maybe check out the thread about PPPoE should die thread where an ISP guy describes a solution (DHCP option 82)

Atomic Access

Post in thread 'PPPoE must die - Tech from 90s Holding Back Fibre Speeds'

repitah said:
Forgive my lack of knowledge or experience on PON, but do the ISPs get the ONT serial number, or is that an FNO only thing (OLT to ethernet and FNO drops that detail in transit to ISP)?

I'm sure that DHCP scales easily and well -- easy and proven, even quite powerful. Also, that means the ASIC/network acceleration can work on the fairly low power routers to achieve the gigabit+ forwarding speeds. The support team may even have an easier time instead of having to walk customers through initial setups or factory resetting routers and having the myriad of interfaces to figure out.

I...
Click to expand...

The changing of MAC addresses, for security, is interesting, but unless you're in hyper secure industries that need that (and charge for it; get a business fibre line), outside of changing the MAC OUI to mask the hardware vendor, it does seem a little bit of a far stretch to be changing your MAC address more than once. The risk of ARP attacks is not impossible, but would require someone on the same VLAN to be on the attack. Again, maybe look at a business fibre line with Seacom/OpenServe/LiquidTech and possibly another ISP that does PPPoE or says you have an IP range and this is your gateway but you can provide your own hardware.

The cost of security is logarithmic. Chasing the highest scores can drive a person insane and bankrupt most SMME companies. Governments and multibillion dollar companies can afford the teams and resources for that level of security.
 
Assasin_Zer0 said:
@killerbyte
I know that from a standard consumer perspective, rotating a WAN MAC looks like I'm just looking for a headache.

But looking at this from an enterprise security lens, it is standard compliance for us atleast. Atleast this is what they want from us. I wouldnt want to do this if i had the option, but they do tend to take it to the next level for some reason. I think personally it is over engineered, or maybe there is a method to their madness? Who knows!


As a remote engineer operating under a strict CIS Benchmark Policy, our perimeter security team explicitly requires this. Regularly rotating the WAN MAC prevents external reconnaissance, stops long-term traffic profiling, and breaks persistent tracking targeted at engineers working from home. Since the company covers the premium gigabit line and the UniFi infrastructure for WFH compliance, I am bound to their security checklists.

Also, just to clarify—I actually don't want a persistent or static IP address. I personally prefer pulling a random IP each time for privacy. The issue isn't that my IP changes; the issue is that Afrihost's default CGNAT pool completely chokes and collapses my line performance whenever it sees a new MAC address, forcing me to rely on a manual profile fix.
Click to expand...
Interesting use case. Not going to argue the CGNAT performance and issues (it is truly horrible when I fail sites to the 5G backup). I think you may have to make an argument that the CIS benchmark policy may be excessively strict (first the baddies would need to be on the same vlan to sniff your MAC from your IP). The ONT serial/address number does't change, so the MAC address constantly changing is nearly pointless.
 
Assasin_Zer0 said:
Thanks @Sparky43, but unfortunately, that doesn't really resolve the core issue in my situation.
To answer your points first:
  • PPPoE is not possible: I have already tried this route, but MetroFibre operates strictly on DHCP.
  • The ONT power cycle doesn't fix it: Leaving the ONT off to clear the cache doesn't solve what happens after the MAC is rotated.
I am in a specific situation where rotating the WAN MAC is a hard requirement, so I don't have much of a choice here. I completely understand @AfriNatic's point that changing the MAC breaks how Afrihost maps subscribers on a DHCP network.
In a nutshell, every time my MAC rotates, I am entered into a lucky draw with DHCP:
  1. If I draw a CGNAT IP (100.x.x.x): The connection completely falls apart. High packet loss, sub-50Mbps speeds, and it's practically unusable.
  2. If I draw a Public IP (102.x.x.x): The connection is 100% perfect.
Because a public IP works flawlessly instantly, the issue isn't related to ONT or DHCP cache. I also don't care about having a static IP—I'd actually prefer not to have one.
The real frustration happens when I lose that lucky draw and get stuck on CGNAT. I have to contact support, and even though I know exactly what needs to be done on the RADIUS backend, agents refuse to action it without forcing me through a 4-hour generic troubleshooting script.


Ultimately, since my environment necessitates regular MAC rotations, I'm just hoping to find a smoother way forward. Is there an efficient channel or a specific technical team I can reach out to when this happens? I'd love to avoid taking up frontline support's time with generic troubleshooting scripts when we already know it's a quick RADIUS profile adjustment on the backend.
Click to expand...

Another option, find an isp that does pppoe on metrofibre.

Eg I was with websquad on metrofibre, they use pppoe.

The very same metrofibre line, afrihost use dhcp.

Talk to @websquadza
 
Sparky43 said:
Another option, find an isp that does pppoe on metrofibre.
Click to expand...
I'm on MetroFibre (dad on Vuma) with Accelerit. Cheap and cheerful, and PPPoE.
Generally don't have issues, though a bit of an uphill initially to get the PPPoE details (both mine and my dad's, but they do give it quickly when you log a ticket).
Their support is fairly decent (I email; dad is more a talk for a while -- I don't let them touch or reset the the routers because they are mine and reflashed with OpenWRT). Most issues are on the FNO side or generally resolved in a few hours without intervention.

Do be prepared to use LTE/5G for a bit if you change ISP.
 
You must log in or register to reply here.
Back
Top
Sign up to the MyBroadband newsletter
X