What works today, exactly.

Subscriber access

• Access mode IPoE (DHCP), PPPoE or both on one router
  Active on delivery

  Chosen at install; changed later with dtvsol access mode.

• IPoE: DHCPv4 with a fixed address per subscriber
  Configured at commissioning

  Needs the access VLANs and their networks (dtvsol vlan add --role clients, or per PON port when an OLT is registered).

• One VLAN per PON port inside the OLT’s S-VLAN (QinQ), a fixed address per ONT
  Configured at commissioning

  Needs the OLT registered with this router’s S-VLAN and the uplink MTU (at least 1508 on the S-VLAN parent). C-VLAN = 100 + card × 16 + PON.

• DHCP Option 82: the address chosen by OLT port and ONT, no MAC needed
  Configured at commissioning

  The OLT inserts Option 82; set up with the OLT registration (dtvsol option82).

• Per-MAC clients (flat VLANs, the older model)
  Configured at commissioning

  dtvsol clients add <mac> <ip>; for networks taken over as they are.

• PPPoE server with local accounts
  Configured at commissioning

  Needs access mode pppoe or both, the PPPoE interfaces and an address pool. Each account gets a fixed address from the pool; its plan is its speed.

• PPPoE with your RADIUS (the router is a RADIUS client only)
  Configured at commissioning

  PAP/CHAP/MS-CHAPv2, accounting start/interim/stop, Framed-IP and pools, rate attributes, disconnect and change of authorisation (RFC 5176), Message-Authenticator required by default. Needs your RADIUS server’s address and secret. Tested end to end with Splynx and MikroWisp; other RADIUS billings are supported but not yet tested. One source per router: local or RADIUS.

• IPv6 for IPoE: DHCPv6 addresses and prefix delegation (IA_PD)
  Configured at commissioning

  Needs your IPv6 pools (a /64 per PON port, delegated prefixes); the routes for delegated prefixes are kept in step.

• IPv6 for PPPoE (IPv6CP, SLAAC, DHCPv6-PD)
  Configured at commissioning

  Off by default; needs the IPv6 link and PD prefixes.

• Suspend and resume; end dates enforced by the router
  Active on delivery

  From the API, CLI, monitor or billing; an end date suspends by itself.

• Suspended page: the subscriber sees your page, the ONT stays up
  Active on delivery

  Mode “page” is set on a fresh install; you add your logo, texts, pay link and allowed domains. Mode “cut” remains available. Not yet tested with a RADIUS-sourced suspension of an IPoE subscriber.

• Zero-touch installation: client entered first, ONU plugged in later
  Conditional

  Only with: an OLT the router provisions (see OLT management)

  Automatic, or “approve each ONU” (the default).

• Installation flows: who does each step, router or technician
  Active on delivery

  The built-in “manual” flow is the default until another is chosen.

• Technician card: the settings to type on an ONU without TR-069
  Active on delivery

  Printed for each new client.

• An ONU’s or CPE’s web page, opened through the router from the monitor
  Configured at commissioning

  Each ONU’s private LAN address stored once; admin and office roles only. Also for radio clients’ CPEs.

• Public IP for a subscriber (paid extra, outside the CGNAT)
  Configured at commissioning

  Needs a pool of public addresses routed to the router.

• Port forwards inside a subscriber’s own CGNAT block
  Configured at commissioning

  Off until you add one.

CGNAT and NAT

• Deterministic CGNAT: a fixed public address and port block per subscriber
  Configured at commissioning

  Needs the public pool; made with each clients VLAN.

• CGNAT lookup: public IP and port → subscriber
  Active on delivery

  dtvsol cgnat lookup; works as soon as CGNAT is set up.

• CGNAT mapping logs kept and backed up
  Active on delivery

  Part of the daily local backup.

• Dynamic NAT pools and inbound port forwarding (DNAT)
  Configured at commissioning

  dtvsol nat, dtvsol portforward.

Routing

• The router’s own ports, bonds, addresses, static and default routes, from its database
  Active on delivery

  Every change is shown first and undone after 120 s unless confirmed; a change that would cut the SSH/API path or the default route is refused.

• A VLAN for a role: clients, PPPoE, S-VLAN, C-VLAN, uplink, management, IPTV, plain
  Active on delivery

  The router sets the rest (DHCP, CGNAT, anti-spoofing, accounting); uplink and management changes wait for a confirm.

• BGP with your upstreams
  Configured at commissioning

  Needs the ASN, router ID, peers and your prefixes. Per peer: default route only or full table; primary or backup (local-pref, prepend); only your own prefixes exported; bogon and max-prefix filters; MD5 passwords; 120 s auto-undo. IPv4 and IPv6.

• BFD per BGP peer
  Configured at commissioning

  Measured on our lab: a dead peer detected in 0.92 s.

• RPKI origin validation
  Configured at commissioning

  Off until switched on; invalid routes dropped on full-table peers. Uses the five registries’ trust anchors (one is fetched at install; if that fetch fails, its routes validate as “unknown”).

• Blackhole for an address under attack (upstream community and local)
  Configured at commissioning

  Needs the upstream’s blackhole community.

• iBGP between Super Routers
  Configured at commissioning

  Needs two or more routers in one AS.

• OSPF
  Configured at commissioning

  Area, interfaces, default-route origination and acceptance.

• Looking glass: ping, mtr with AS numbers, route lookup, sessions, own-prefix check
  Active on delivery

  Read-only; the BGP parts need BGP set up.

• Public looking glass page for your customers and peers
  Roadmap

  Planned.

• BGP communities beyond blackhole, BFD for OSPF, BGP graceful restart
  Roadmap

  Planned.

• Kernel and network-card tuning for line rate (backlog, rings, RPS, IRQs, conntrack, NOTRACK)
  Active on delivery

  Computed from the machine and applied by the router; rings, rp_filter and the bond hash only when asked by name (dtvsol tune apply).

Speeds, plans and promotions

• Speed plans
  Active on delivery

  Created from the API, CLI, monitor, CSV import or the billing link.

• Speed enforced on the OLT (the default)
  Conditional

  Only with: an OLT the router provisions (Huawei MA5600T family)

  The plan’s line profile and traffic tables on the OLT.

• Speed enforced by the router, per client
  Configured at commissioning

  Chosen per client (dtvsol clients shaper <mac> router); PPPoE sessions are shaped by the router.

• Promotions: Saturday ×2, nights ×3, date ranges, an optional ceiling
  Active on delivery

  For subscribers shaped by the router.

• Promotions on the OLT’s traffic tables
  Conditional

  Only with: a Huawei OLT, on traffic tables that carry only this router’s subscribers

  The OLT accepts the change (lab-tested); a live ONU’s throughput following it is not yet proven by a speed test.

DNS resolver and blocking

• Own caching resolver for the subscribers, handed out by DHCP
  Active on delivery

  On by default and never open: it answers only the networks it serves; port 53 from the uplinks is dropped. DNSSEC validation comes from the system resolver’s default configuration, not from a router setting.

• Force all subscriber DNS to the router’s resolver
  Configured at commissioning

  Off by default.

• Blocked domains (NXDOMAIN or your notice page)
  Configured at commissioning

  Lists by hand or imported.

• Blocked addresses, networks and ranges (both ways, a counter per entry)
  Configured at commissioning

  Lists by hand or imported.

• Import of the authorities’ lists (lines, CSV column and delimiter, regex), fetched again on a timer, every change in the history
  Configured at commissioning

  Needs the authority’s file or URL.

OLT management

We add OLT vendors with our clients: an operator gives us access to its OLT, and we build and test the driver on it.

• Huawei MA5600T family: monitoring, provisioning, suspension, plans, SNMP reads and writes
  Active on delivery

  Once each OLT is registered (address, SNMP credentials, CLI login as backup, S-VLAN) — that registration is a commissioning step. Proven on an MA5608T; MA5600T and MA5683T use the same driver and commands. SNMP first, the OLT’s CLI as backup.

• OLT registration: read-write, read-only, or another company’s OLT
  Configured at commissioning

  A read-only OLT is watched and never written; one PON can be opened for work.

• Read-only guards on shared OLTs
  Active on delivery

  Another operator’s ONTs and S-VLANs are never touched; exec on a shared OLT only with --force.

• ONT optical levels, states, counters and alarms (polled)
  Active on delivery

  Per OLT; presets normal (5 min) or slow (15/30 min, at most 5 SNMP requests a second). History: hourly for 90 days, daily for 2 years.

• A PON or OLT outage as one event, its ONTs folded under it
  Active on delivery
• OLT configuration backups, versions, diff, and a “changed outside the router” alarm
  Active on delivery

  Owned OLTs: on by default; read-only OLTs: off by default.

• OLT autosave ensured when the router takes control
  Active on delivery

  Relies on the OLT’s own autosave (daily and after a change).

• OLT time check, and “use this router as the time server”
  Active on delivery

  Owned OLTs only.

• OLT configuration audit: leftovers, mistakes, hygiene, router against OLT
  Active on delivery

  Reads only; one fix (an old untagged TR-069 service port) can be applied by the router.

• Live OLT console: every command and reply in the browser
  Active on delivery
• SNMP traps from the OLT (receiver, shadow mode)
  Conditional

  Only with: a Huawei OLT

  Shadow mode counts the traps and compares them with polling. On a read-only OLT the commands are printed for the operator; nothing is sent.

• Traps acting live (alarms from traps)
  Roadmap

  Planned: “live” is stored; its effects come in a later release.

• IPTV (unicast) on its own VLAN and service port, made with the client
  Conditional

  Only with: a Huawei OLT

  A set-top box receiving TV through it is not yet proven.

• Several operators on one OLT, each with its own Super Router
  Conditional

  Only with: Huawei OLTs; isolation with two routers on one OLT not yet tested

• Several ISPs on one Super Router
  Roadmap
• Handing a PON over to another ISP’s BNG (L2 bitstream)
  Roadmap
• Huawei MA5800 series
  Roadmap

  The same driver; never tried on one.

• ZTE OLTs
  Roadmap

  Planned within about a week. First parts working on a client’s OLT: monitoring reads only (ONU states, optical levels, cards, PON ports, counters) on a C320 V1.2.x; no writes.

• V-SOL OLTs
  Roadmap

  Planned after ZTE.

ONT provisioning and TR-069 ACS

Any ONT registers on the OLT. For TR-069 control (Wi-Fi from your billing), the Super Router uses a shared, DTVSOL-signed library of ONT models. When a client brings a model that isn’t in it yet, the router’s learn mode guides a technician through a few steps at the ONT, finds the right settings itself and proves them, and — if you allow it — sends the result to DTVSOL, which reviews it and shares it with every router.

• ONT registration with service ports, plan profiles and the PON’s VLAN, in one call
  Conditional

  Only with: an OLT the router provisions (Huawei MA5600T family)

• ONT reboot, via the OLT or via TR-069, its steps followed
  Conditional

  Only with: via the OLT: a Huawei OLT; via TR-069: a TR-069-capable ONT calling the ACS

• Own TR-069 ACS, a separate service apart from the routing
  Configured at commissioning

  Off by default; switched on, then the ONTs pointed at it (TR-069 VLAN, or DHCP option 43 for ONTs that read it).

• Device inventory, parameter tree, set parameters, reboot, factory reset, wake-up
  Conditional

  Only with: a TR-069-capable ONT that calls the ACS

• Wi-Fi name and password from the billing at first contact
  Conditional

  Only with: a learned model: one in the shared library, or learned on this router

• Learn mode for a new ONT model
  Active on delivery

  Guided, with a technician at the ONT; the router finds the right settings and proves them. A learn bench on a spare port works without an OLT.

• Shared, DTVSOL-signed library of ONT models
  Active on delivery

  Models today: Huawei HS8545M, TP-Link XC220-G3v, TP-Link XX530. A model learned on one router is sent to DTVSOL if you allow it (sharing is on by default and can be switched off per router); DTVSOL reviews it and shares it with every router. Used once the ACS is on.

• TR-069 setup through the OLT (OMCI) on ZTE and V-SOL OLTs
  Roadmap

  Comes with those OLT drivers.

• Firmware upgrades per model in waves; a speed test run from the ONT (TR-143)
  Roadmap

  Planned.

Migration tools

• CSV mass import (plans, networks, clients, services), our own format
  Active on delivery

  A dry run first, then all or nothing. Other vendors’ configurations are not read.

• Find where the router sits on an OLT, by listening only
  Conditional

  Only with: a Huawei OLT

  The MAC table is read over the OLT’s CLI.

• Take over a flat VLAN as it is
  Conditional

  Only with: a Huawei OLT registered read-only

  Anti-spoofing set to dynamic for it.

• New ONTs “our way” on an existing OLT (stage B)
  Conditional

  Only with: a Huawei OLT with this router’s S-VLAN on its uplinks

• Move ONTs from a flat VLAN to the per-PON model without touching the ONU (stage C)
  Conditional

  Only with: a Huawei OLT

  A pilot first, then groups (2, then 4/8/16); each ONT watched for up to 5 minutes and put back by itself on failure; keep the address or take a new one; move back a whole PON.

• Plans kept from the OLT’s tables during migration (“waiting for billing”)
  Active on delivery

  Clients listed with --pending-plan until a plan arrives.

Billing integration

• REST API: clients, services, plans, OLTs, alarms, health
  Configured at commissioning

  An API key and the allow-list (dtvsol protect add): closed to everyone but the router until your NOC is added.

• Compatibility API on TCP 8728 (the binary router API many WISP billings speak)
  Configured at commissioning

  The port is opened by the allow-list; its password is shown once at install. Covers leases and clients, PPP secrets and sessions, simple queues, firewall rules and address lists (a blocked list → the suspended page), web proxy, traffic flow. Tested with Splynx and MikroWisp. Not supported: hotspot and IP binding. A bridge to start with your billing unchanged; the native API is the way forward.

• UISP billing
  Conditional

  Only with: the compatibility API on TCP 8728 opened to UISP

  Compatible through the MikroTik API (queues, address lists, PPP accounts), not yet tested by us. Not supported: hotspot and IP binding.

• NetFlow v5/v9 and IPFIX per-subscriber totals to a billing
  Configured at commissioning

  Off by default; needs the billing’s collector. Can be limited to that billing’s subscribers.

• Signed webhooks to your systems
  Configured at commissioning

  To the endpoints you set, signed with HMAC-SHA256.

• DTVSOL One link: plans, PPPoE accounts, ONU clients, online report
  Active on delivery

  Comes with dtvsol join.

• Existing clients sent to DTVSOL One to be created there
  Configured at commissioning

  dtvsol one inventory; per OLT, never a password.

• Live inventory to the dtvsol.network map
  Configured at commissioning

  Off by default; no names or addresses are sent.

• SNMP agent: interfaces and per-client traffic
  Configured at commissioning

  Needs a community and your monitoring system’s address.

Firewall and protection

• Management allow-list for the API, the monitor and the compatibility API
  Active on delivery

  Only the router itself until you add networks (asked at install).

• SSH by keys only (when the admin gave a key)
  Active on delivery
• Brute-force bans (API key, SSH, monitor) with reasons and history
  Active on delivery

  A banned allow-listed address raises an alarm.

• Anti-spoofing: IP + MAC + VLAN binding, IPv4, IPv6 and ARP
  Configured at commissioning

  dtvsol antispoof on (strict or dynamic, per VLAN). Spoofing between subscribers inside one VLAN is for the OLT’s split horizon to stop.

• Integrity check: release files, system programs, persistence places
  Active on delivery
• Root command audit and recorded root shells
  Active on delivery
• Security channel: signed, chained security records sent to DTVSOL
  Active on delivery

  Comes with dtvsol join.

Monitor (web)

• Web monitor over HTTPS: home, client card, OLTs and ONUs, alarms, routing, settings, tools
  Active on delivery

  The admin user is made at install.

• Roles: admin, viewer, office, investigator (enforced by the router), per-user rights, audit log
  Active on delivery
• Two-factor sign-in (authenticator app), passkeys, trusted browsers, idle sign-out
  Active on delivery

  2FA required for admins at the first sign-in. Passkeys need the router’s name and certificate (next row).

• Router name <label>.<code>.dtvsol.cloud with a Let’s Encrypt certificate
  Active on delivery

  Given through the licence after join.

• Languages: English, Spanish (Latin America), Portuguese (Brazil)
  Active on delivery

  Per user, the subscriber-facing pages too. The command line stays in English.

• Phone and tablet layouts
  Active on delivery
• 24/7 wall screen (read-only display links, revocable)
  Configured at commissioning

  One link per display; its network on the allow-list.

• Web terminal for dtvsol commands only (no shell), with the user’s rights
  Active on delivery
• First-run “Set up your router” wizard
  Active on delivery
• Router hardware view: cards and ports as on the machine, blink a port
  Active on delivery
• Traffic make-up: encrypted, plain HTTP, other (by port only)
  Active on delivery

Alarms and notifications

• Alarm register: checks every minute by area (OLT, ONUs, network, server, services), history, acknowledge, close, notes
  Active on delivery
• Alarm on a failed change; drift check (running state against the database)
  Active on delivery
• Disk safety: RAID state, boot copies on each disk, SMART health
  Active on delivery
• dtvsol doctor health check
  Active on delivery
• Notifications by email (SMTP), Telegram (bot), WhatsApp (approved template), SMS
  Configured at commissioning

  Each channel needs your own account: SMTP server, Telegram bot, WhatsApp Business API, SMS provider. Critical alarms by default; at most 30 messages an hour per channel.

Lawful log and DTVSOL Super Keeper

• Level 1 on the router: who held which public address and port block, and when
  Configured at commissioning

  Off until switched on. A sealed SHA-256 chain (dtvsol lawful verify), every search logged with its case, 12 months by default (6–120), CSV output, never in a backup that leaves the router.

• Level 2: every connection, sent to a DTVSOL Super Keeper
  Conditional

  Only with: a Keeper server on your premises, paired with the router

  Records wait on the router while the Keeper is down.

• Keeper: sealed hourly records, search by public address and port, subscriber or destination, PDF reports, web with roles
  Conditional

  Only with: the Keeper installed (one package, Ubuntu 24.04) and paired

• Keeper users managed from DTVSOL One; police accounts approved by the operator
  Roadmap

  Planned; the router side of the account list is built.

• Keeper flow statistics: traffic views, top clients, attack detection
  Roadmap

  Planned.

Flow export

• Sampled IPFIX to your Akvorado, both sides of the CGNAT, interface details over SNMP
  Configured at commissioning

  Off by default; needs the collector, the source address and the sampling rate.

Backups

• Daily local backup (configuration, data, CGNAT logs, OLT configuration versions), 30 days + 12 months
  Active on delivery

  On the system disk by default.

• Backup to a mounted disk or share
  Configured at commissioning

  dtvsol backup location set <path>.

• Configuration versions with diff and restore
  Active on delivery

  Every change is a version.

• Restore drill
  Active on delivery

  dtvsol backup drill.

• Encrypted copy off the router
  Conditional

  Only with: the DTVSOL Backup agent installed and enrolled with a DTVSOL Backup server

  DTVSOL Backup is a separate service, in beta.

Updates

• Signed releases, A/B install, checks before and after, automatic rollback
  Active on delivery

  Policy “notify” by default (manual, automatic in a window, or security-only automatic). An update does not restart PPPoE sessions: you restart the PPPoE service (accel-ppp) when it suits you.

• Channels: stable and beta
  Active on delivery

  Stable unless the router trusts the test key.

• System packages and security updates by apt
  Active on delivery

  Ubuntu security updates daily, no automatic reboot; the router’s own engine packages are held and come only inside signed releases.

• Included-updates period set by DTVSOL One; security releases always
  Active on delivery

  When included updates have ended, only security releases install; rollback is always allowed.

Licence, join and DTVSOL One

• dtvsol join <code>: licence, DTVSOL One link and security channel from one code
  Active on delivery

  The code comes from DTVSOL One (Internet → Super Router → Add a Super Router); valid 24 h, single use.

• Machine-bound licence, renewed daily; a warning 14 days before it ends
  Active on delivery

  If DTVSOL is unreachable: your subscribers stay connected.

• Self-service trial (e-mail → code → 30 days)
  Roadmap

  Planned; the ISO offers “continue without registration” today.

Speedtest server

• Ookla speed test server on the router
  Configured at commissioning

  Installed by dtvsol speedtest install (downloaded from Ookla). TLS from a Let’s Encrypt certificate (needs a host name that resolves to the router, and port 80) or your own certificate. A listing on speedtest.net needs your own registration with Ookla. Not yet run at a real operator.

Hardware and availability

• Standard x86-64 server, Ubuntu 24.04
  Active on delivery

  The ISO refuses virtual machines.

• Two disks as RAID1 (both disks bootable)
  Configured at commissioning

  Chosen in the ISO’s boot menu with exactly two similar disks, or by hand in the disk screen. Watched by the alarms from then on.

• LACP bonds
  Configured at commissioning
• High availability: automatic failover to a second router
  Roadmap

  Not built. Today a failed server is replaced and restored from the backup (DTVSOL moves the licence). Two routers can share routing (BGP/iBGP, OSPF), but subscriber state, DHCP, PPPoE sessions and CGNAT do not fail over.