OPNsense with KPN fiber and iTV

Introduction

You can use an OPNsense box as a modem for KPN fiber (KPN glasvezel) in the Netherlands. With this setup, you don’t need the KPN modem and you also can make interactive TV (iTV) work. You have full control over your internet connection at home over fiber this way. The setup below places iTV in a separate IoT VLAN. I also have telephony setup, which I will cover in a separate article. I used several resources which I modified to my needs or updated:

• OPNSense en KPN Glasvezel setup (2023) - Dutch

• Setting up OPNsense for KPN FttH (KPN Glasvezel)

KPN splits traffic on the physical in/out (WAN) port by defining 2 VLAN’s there. You’ll have to set this up in your OPNsense interface:

• A VLAN with tag 6 for “normal” internet

• A VLAN with tag 4 for iTV

The ranges for iTV are 10.0.0.0/8, 213.75.0.0/16 and 217.166.0.0/16. Don’t worry, if you follow the instructions below everything should become clear.

Hardware and software

You need decent hardware for your OPNsense box, as KPN fiber uses PPPoE: this requires a fast enough CPU, especially single-core performance is important. I use a Protectli VP2420 which is fast enough for 1 Gbit/s fiber up and down with iTV and telephony. At the time of writing I’m using OPNsense version 25.1 which is based on FreeBSD 14.2-RELEASE.

Installation

IoT VLAN on main LAN

If you want to follow this guide to the letter, you should create a IoT VLAN on your main LAN interface first (Interfaces-Devices-VLAN) and give it access to the internet and of course shield it of from the rest of your LAN. How to do this is beyond the scope of this article. You could also place the KPN iTV devices in your main LAN, but keep in mind that you should adjust some of the steps below. The IoT VLAN I created is called VL_IoT, but you can give it any name.

Create VLAN’s on main interface (WAN)

Go to Interfaces-Devices-VLAN and create 2 VLAN’s on the main (WAN) interface of your OPNsense box.

Assign interfaces to newly created VLAN’s

You can find Interface Assignments under Interfaces-Assignments:

• Assign WAN to the newly created VLAN with tag 6 (vlan00.06 in this example)

• Assign a new interface to the newly created VLAN with tag 4 (vlan00.04 in this example)

In the screenshot below you will see I have more VLAN’s in my setup. You will also see that the name of the Device in WAN is different from what you will see at home: that is because I already setup PPPoE here ealrier (I made the screenshot later) , we will setup PPPoE in the next step. As long as you select the right VLAN (with tag 6) you are good to go. Save and go to the next step.

Configure WAN interface

Under Interfaces-[WAN] (leave everything else unchanged):

Click Save and Apply Changes

Then in the same window under Point-to-Point configuration under Advanced click on the text that says: Click here for PPP-specific configuration options. Save first if you made changes. You can also reach this configuration by going to: Interfaces-Devices-Point-to-Point.

Click on the + sign and add the following information (leave the rest alone)

The username and password are not important, you can fill in anything.

Configure iTV interface

Under Interfaces-[VL_KPN_iTV] (leave everything else unchanged):

dhcp-class-identifier "IPTV_RG"

subnet-mask, routers, classless-routes

NB: The quotes are required under Send Options

Firewall settings

Under Firewall-Aliases make an alias for KPN iTV hosts and click Apply:

Firewall rules IoT interface

Under Firewall-Rules-VL_IoT (or whatever your IoT VLAN is called) make 2 new rules:

The end result is then:

Firewall rules KPN_iTV interface

Under Firewall-Rules-VL_KPN_iTV make 3 new rules:

The end result is then:

Firewall NAT outbound rules

Under Firewall-NAT-Outbound:

First check Hybrid Mode and Save.

Make a new Outbound Rule:

The end result is then:

IGMP Proxy

KPN uses multicast to deliver TV streams. To direct this traffic you should use IGMP Proxy. Furthermore, your switch(es) should support IGMP Snooping and of course you must enable it in the settings of your switch(es). The iTV boxes will switch to unicast if you don’t enable this (but it will still work as far as I know). Switching channels will be faster with this enabled.

To use it, you must install a plugin in OPNsense called IGMP Proxy.

• Navigate to System-Firmware-Plugins

• Find os-igmp-proxy and install it

Navigate to Services-IGMP Proxy and add an upstream and a downstream rule using the + sign:

The end result is then:

Conclusion

You should add your iTV boxes to the IoT VLAN.

You should now have working internet and iTV on KPN fiber.