Help please - Cloud Gateway Ultra & Plusnet Hub 2

[#1]

Hi all,

I'd really appreciate some help please. I have just added a Cloud Gateway Ultra to some Unifi APs we have round the house to spread wifi better through thick walls. Prior to this the APs were unadopted and caused several issues. At the moment, the Cloud Gateway is plugged into a LAN port on the back of the Hub 2. Everything is working but according to what I am reading I am causing 'double NAT-ing' by doing this. I sort of know what that is as a result of google-fu but genuinely don't know what I need to do to resolve this. I believe I need to put the Hub 2 into bridge mode and then in the Cloud Gateway I need to insert the settings found here (https://www.plus.net/help/broadband/broadband-connection-settings/) using the fibre broadband settings for FTTC (sadly we are too rural for FTTP at the moment). I just don't know how to do this and when I tried to out PPPoE settings into the Cloud Gateway I lost internet connectivity. I've gone back to DHCP and it's working fine.

If I do a NAT check (didn't even know such a thing existed until 10 mins ago) I get the following regardless if I am connecting to the Cloud Gateway Wifi or the Hub 2 Wifi - NAT Type Port-Restricted Cone NAT.... not sure what it really means.

I did ask a local internet Network Engineer company for help and they came but TBH had even less clue that me and wanted to rip out the Unifi kit to replace it with TP-Link Deco. 

I would be super grateful if anyone on here might be able to give me some simple directions on what I need to (or perhaps don't need to) do please!!

[#2]

@aaarrrrggggghhh 

When you setup the PPPoE settings in the CGU, what did you have the VLAN IDs set to ?

They should be OFF or DISABLED in the CGU,  as VLAN IDs should be handled by the Hub Two in bridge mode.

In the CGU, all you need to set is that the WAN connection is PPPoE, and the login name and password.

[#3]

@aaarrrrggggghhh 

When your Hub Two was in "bridge mode", was the status light a pink colour, or something else ?

[#4]

I think the problem here is that I don't actually know how to put the hub into bridge mode - how do I do that please? I also think it's possible the CGU then needs to be on LAN port 1 - which does not work on my Hub 2 (or am I wrong in thinking that?)

[#5 · Accepted solution]

@aaarrrrggggghhh 

To change a Hub two in Bridge Mode is here.

Navigate >Home >Advanced setting >Broadband >Internet. The option for Bridge Mode is at the bottom.

The Hub light should be 'Pink' in this mode after a reboot; you then connect your router to any LAN port

You follow the instructions here https://www.plus.net/help/broadband/broadband-connection-settings/ for using an Openreach modem

[#6]

@aaarrrrggggghhh 

I see that your UniFi Cloud Gateway Ultra supports RFC 4638 baby jumbo frames on it's WAN port

this means you could achieve a WAN MTU of 1500 on a PPPoE connection with a RFC 4638 capable modem,

whereas the Plusnet Hub Two in bridge mode can only achieve a WAN MTU of 1492 due to the 8 byte PPPoE overhead.

As an alternative to using your Hub Two as a VDSL modem, consider getting a DrayTek Vigor 167-K,

as this is probably the best VDSL modem available, it has a second ethernet port that you can connect to your LAN which enables monitoring and configuration from any PC on your network, and used UK models on eBay in pristine condition are often selling for less than £20 (as many people are selling them after upgrading to FTTP).

I currently have a Vigor 167-K modem with v5.2.9 firmware connected to my pfSense 2.8.1 box, achieving a 1500 WAN MTU.

[#7]

Thank you - I had to do some AI asking to understand that fully but will go hunting on eBay!!!

[#8]

@aaarrrrggggghhh 

On eBay, search for '168685735777'

That Vigor 167, looks to be a clean UK model, currently just one bid at £11.02 + £2.94 p&p

[#9]

@aaarrrrggggghhh 

I would concentrate getting connecting with the Hub two for now, I doubt changing MTU setting from 1492 to 1500 is not going to help that much.

Many folk use MTU 1492 and don't notice anything, but it's down to the individual what they choose.

[#10]

I've done it!!

Missed out on the modem on the auction but I but my big boy pants on and enabled bridge mode on the Hub 2 and then adjusted the settings on the CGU. As you all said, PPPoE on, plusnet account and password and it worked!

THANK YOU ALL!

[#11]

Perhaps a little hasty.

So it's working but I've had 5 brief disconnections since going into Bridge mode with PPPoE. 

Bridge mode set on the Hub2 via the Wifi portal which I can no longer access (assume I factory reset the Hub 2 in order to get back in).

Cloud Gateway set to PPPoE with my plusnet credentials. I've not done anything with the VLAN credentials etc.

Not sure what might be the cause - TBH it was more stable when I was double NAT-ing with the Hub2 as a router - perhaps I ought to go back to that?

[#12]

I doubt whether the Hub Two being in "router mode" or "bridge mode" would make ANY difference regarding disconnections.

It is more likely that with all the recent messing about with the Hub Two, that you've upset the FTTC cabinet DLM, which is now trying to recover from what it thinks was a period of instability, by performing brief line re-syncs with different line parameters.

If I were you, leave it as it is in "bridge mode", and don't mess with it for a few days, and see whether the DLM settles on its own.  On my line it typically takes about three days for the DLM to re-learn a new stability baseline (and stop doing the frequent re-syncs), although in theory it can take up to ten days (but I've rarely seen that happen).

If it is still playing up in say 5 days, then we can take a look at your DSL line stats, and possibly recommend other modems.

[#13]

I'm wondering whether it is worth you setting up a free ThinkBroadband Broadband Quality Monitor (BQM)

This will create a 24/7 monitor that displays the patterns of latency and packet loss on your VDSL broadband, which might visually give a clue as to what is going on with your disconnections and what was happening at the time.

If your Plusnet connection has a dynamic IP address, then you will also need to configure your router and the BQM settings with a dynamic DNS service - so that the remote ThinkBroadband server can track your router's WAN IP if it changes.

I believe that your Cloud Gateway Ultra supports the following free DDNS services -

• No-IP DDNS
• afraid DDNS

Once you have the chart working, go to - https://www.thinkbroadband.com/my-profile/broadband-quality-monitor 
find and press the [Share] button under your chart,
look in the "Share Live Graph" section and copy the <Direct Link> URL,
then paste that URL in your reply here - so we can all see what is going on with your connection.

Make sure that you allow your Cloud Gateway Ultra's WAN interface to reply to ping requests !

To make the Cloud Gateway Ultra (UCG-Ultra) reply to incoming ping (ICMP Echo Request) on its WAN interface, you need to create a firewall allow rule for traffic destined to the gateway itself.

By default, UniFi gateways drop unsolicited ICMP on the WAN. The correct destination is the Gateway zone (or Internet Local in older interfaces), not Internet In / WAN In.

Modern UniFi Network (9.x / 10.x – Policy Engine / Zones)

This is the current method on recent firmware:

1. Go to Settings → Policy Engine → Policy Table (or Settings → Zones).
2. Preferably open the zone matrix and click the cell where External meets Gateway.
3. Create a new policy with these settings:
   • Source zone: External
   • Destination zone: Gateway
   • Action: Allow
   • IP Version: IPv4 (add a second rule for IPv6 if needed)
   • Protocol: ICMP
   • ICMP Type Name: Echo Request (or Any)
4. Give it a clear name (e.g. “Allow WAN Ping”).
5. Make sure the policy is higher in the list than any broader block rules covering External → Gateway.
6. Apply / Confirm the change.

You do not need a separate rule for Echo Reply — the gateway is allowed to send replies outbound by default.

Older interface (Network 8.x and earlier – classic Firewall Rules)

1. Go to Settings → Security → Traffic & Firewall Rules → Advanced.
2. Create a new rule:
   • Type: Internet Local (this is the key setting — traffic to the gateway)
   • Action: Accept
   • Before Predefined: enabled
   • IPv4 Protocol: ICMP
   • IPv4 ICMP Type Name: Echo Request
   • Source / Destination: Any (or restrict to specific monitoring IPs if preferred)
3. Save the rule.