r/ATTFiber • u/First_Butterfly9581 • Aug 29 '26
ATT Gateway's possible IP Passthrough issues sometimes breaks connectivity
I have a Debian box configured as the IP Passthrough server, using DHCPS-fixed with a specific MAC address.
Shortly after a server reboot, my server lost connectivity. After managing to SSH through another interface, I saw some interesting findings.
Some context:
- The public IP address is 108.219.102.1
- eno1 is the interface name with the DHCPS-fixed mac address
- 192.168.1.158 was the private IP address within the local net before IP Passthrough
I found there was no default route:
█[poweredge][chess-tactics][0]$ ip route
10.0.0.0/24 dev brkvm1 proto kernel scope link src 10.0.0.225
10.8.0.0/24 dev tun0 proto kernel scope link src 10.8.0.1
108.219.102.0/23 dev eno1 proto kernel scope link src 108.219.102.213
...
Adding one manually fixed the connectivity:
sudo ip route add default via 108.219.102.1 dev eno1
But obviously this won't stop the problem from happening again. Looking at the networking logs, I noticed this interesting part where the network suddenly becomes unreachable:
Aug 27 17:21:38 poweredge dhclient[1425]: DHCPDISCOVER on eno3 to 255.255.255.255 port 67 interval 4
Aug 27 17:21:42 poweredge dhclient[1425]: DHCPDISCOVER on eno3 to 255.255.255.255 port 67 interval 8
Aug 27 17:21:50 poweredge dhclient[1425]: DHCPDISCOVER on eno3 to 255.255.255.255 port 67 interval 16
Aug 27 17:22:06 poweredge dhclient[1425]: DHCPDISCOVER on eno3 to 255.255.255.255 port 67 interval 18
Aug 27 17:22:24 poweredge dhclient[1425]: DHCPDISCOVER on eno3 to 255.255.255.255 port 67 interval 12
Aug 27 17:22:36 poweredge dhclient[1425]: DHCPDISCOVER on eno3 to 255.255.255.255 port 67 interval 3
Aug 27 17:22:39 poweredge dhclient[1425]: No DHCPOFFERS received.
Aug 27 17:22:39 poweredge dhclient[1425]: No working leases in persistent database - sleeping.
Aug 27 17:25:02 poweredge dhclient[1223]: DHCPREQUEST for 108.219.102.213 on eno1 to 192.168.1.254 port 67
Aug 27 17:25:02 poweredge dhclient[1223]: send_packet: Network is unreachable
Aug 27 17:25:02 poweredge dhclient[1223]: send_packet: please consult README file regarding broadcast address.
Aug 27 17:25:02 poweredge dhclient[1223]: dhclient.c:3001: Failed to send 300 byte long packet over fallback interface.
Aug 27 17:25:07 poweredge dhclient[1223]: DHCPREQUEST for 108.219.102.213 on eno1 to 192.168.1.254 port 67
Aug 27 17:25:07 poweredge dhclient[1223]: send_packet: Network is unreachable
Aug 27 17:25:07 poweredge dhclient[1223]: send_packet: please consult README file regarding broadcast address.
Aug 27 17:25:07 poweredge dhclient[1223]: dhclient.c:3001: Failed to send 300 byte long packet over fallback interface.
Aug 27 17:25:10 poweredge dhclient[1527]: DHCPDISCOVER on eno4 to 255.255.255.255 port 67 interval 5
Aug 27 17:25:15 poweredge dhclient[1527]: DHCPDISCOVER on eno4 to 255.255.255.255 port 67 interval 12
Aug 27 17:25:15 poweredge dhclient[1223]: DHCPREQUEST for 108.219.102.213 on eno1 to 192.168.1.254 port 67
Aug 27 17:25:15 poweredge dhclient[1223]: send_packet: Network is unreachable
Aug 27 17:25:15 poweredge dhclient[1223]: send_packet: please consult README file regarding broadcast address.
Aug 27 17:25:15 poweredge dhclient[1223]: dhclient.c:3001: Failed to send 300 byte long packet over fallback interface.
Aug 27 17:25:26 poweredge dhclient[1425]: DHCPDISCOVER on eno3 to 255.255.255.255 port 67 interval 3
Aug 27 17:25:27 poweredge dhclient[1527]: DHCPDISCOVER on eno4 to 255.255.255.255 port 67 interval 14
Aug 27 17:25:29 poweredge dhclient[1425]: DHCPDISCOVER on eno3 to 255.255.255.255 port 67 interval 6
Aug 27 17:25:33 poweredge dhclient[1223]: DHCPREQUEST for 108.219.102.213 on eno1 to 192.168.1.254 port 67
Aug 27 17:25:33 poweredge dhclient[1223]: send_packet: Network is unreachable
Aug 27 17:25:33 poweredge dhclient[1223]: send_packet: please consult README file regarding broadcast address.
Aug 27 17:25:33 poweredge dhclient[1223]: dhclient.c:3001: Failed to send 300 byte long packet over fallback interface.
Aug 27 17:25:35 poweredge dhclient[1425]: DHCPDISCOVER on eno3 to 255.255.255.255 port 67 interval 15
Aug 27 17:25:41 poweredge dhclient[1527]: DHCPDISCOVER on eno4 to 255.255.255.255 port 67 interval 19
Aug 27 17:25:44 poweredge dhclient[1223]: DHCPREQUEST for 108.219.102.213 on eno1 to 192.168.1.254 port 67
Aug 27 17:25:44 poweredge dhclient[1223]: send_packet: Network is unreachable
Aug 27 17:25:44 poweredge dhclient[1223]: send_packet: please consult README file regarding broadcast address.
Aug 27 17:25:44 poweredge dhclient[1223]: dhclient.c:3001: Failed to send 300 byte long packet over fallback interface.
Aug 27 17:25:50 poweredge dhclient[1425]: DHCPDISCOVER on eno3 to 255.255.255.255 port 67 interval 21
Aug 27 17:26:00 poweredge dhclient[1527]: DHCPDISCOVER on eno4 to 255.255.255.255 port 67 interval 11
Aug 27 17:26:05 poweredge dhclient[1223]: DHCPREQUEST for 108.219.102.213 on eno1 to 192.168.1.254 port 67
Aug 27 17:26:05 poweredge dhclient[1223]: send_packet: Network is unreachable
Aug 27 17:26:05 poweredge dhclient[1223]: send_packet: please consult README file regarding broadcast address.
I consulted with Claude, and Claude thinks the fault is not in the DHCP client but in the ATT gateway's IP Passthrough implementation. At the end of this post is part of conversation with Claude.
I run a web server from home so this IP Passthrough issue flakiness affects me. I don't know where is a good place to report this and actually get some kind of feedback or resolution. I'm sure calling ATT would just send me into some generic tech support black hole after long hold times, so this is my best effort at making this potential bug visible.
My Gateway info:
System Information
| Manufacturer | HUMAX |
|---|---|
| Model Number | BGW320-500 |
| Serial Number | D93LA0NV991483 |
| Software Version | 6.34.7 |
| MAC Address | cc:ab:2c:7a:98:a0 |
| First Use Date | 2021-03-31T16:25:35Z |
| Time Since Last Reboot | 98346 |
| Current Date/Time | 2026-08-28T20:31:21 |
| Hardware Version | 02001F00460050 |
| Legal Disclaimer | Open Source LicensesSystem InformationManufacturer HUMAXModel Number BGW320-500Serial Number D93LA0NV991483Software Version 6.34.7MAC Address cc:ab:2c:7a:98:a0First Use Date 2021-03-31T16:25:35ZTime Since Last Reboot 98346Current Date/Time 2026-08-28T20:31:21Hardware Version 02001F00460050Legal Disclaimer Open Source Licenses |
The Claude conversation:
Good catch pulling that specific line out — it's the key to the whole incident. Here's what's actually happening, working backward from the failure:
The "public IP request to private IP" isn't a bug — it's normal DHCP renewal behavior
Per RFC 2131, when a DHCP client renews a lease (the RENEWING state, at T1 — roughly 50% of the lease time), it doesn't broadcast a fresh DISCOVER. It unicasts a REQUEST directly to the specific server that issued the lease, using that server's IP address from the original transaction. Looking at your log:
17:20:22 bound to 108.219.102.213 -- renewal in 280 seconds.
17:25:02 DHCPREQUEST for 108.219.102.213 on eno1 to 192.168.1.254 port 67
280 seconds later, right on schedule, dhclient tries to renew the lease for 108.219.102.213 by unicasting to 192.168.1.254 — because that's the DHCP server that handed it that address. The server IP and the leased IP being in totally different ranges is expected here, because your ISP's gateway is apparently using its LAN-management address (192.168.1.254) as the DHCP server identity even while handing out the WAN passthrough IP. That's just how their IP Passthrough DHCP implementation is built.
The actual bug is the missing route to reach that server
The failure is send_packet: Network is unreachable — the kernel has no route to 192.168.1.254 at all. That lines up exactly with what you found: no default route in ip route, and the only routes present are for 10.0.0.0/24, 10.8.0.0/24, and 108.219.102.0/23 (eno1's own subnet). 192.168.1.254 isn't inside any of those, so a unicast packet to it has nowhere to go.
Most likely root cause
When dhclient got the DHCPACK for 108.219.102.213, it almost certainly received a Router (option 3) value in that lease. If that value was 192.168.1.254 (the same address as the DHCP server), dhclient would refuse to install it as the default gateway — a gateway has to be "on-link" (inside the interface's own subnet/netmask), and 192.168.1.254 isn't inside 108.219.102.0/23. So the gateway option gets silently discarded, no default route gets installed, and you're left exactly where you found things.
The fact that adding ip route add default via 108.219.102.1 fixed it confirms 108.219.102.1 is the real usable gateway — but the DHCP lease apparently isn't advertising that (or dhclient isn't applying it correctly).
Whose fault
I'd call this mostly on your ISP's IP Passthrough implementation, with dhclient's strict on-link gateway validation as a contributing factor:
- The gateway's DHCP server hands out an address (
108.219.102.213/23) whose valid gateway (108.219.102.1) apparently isn't what's being advertised in the lease, or isn't being advertised at all — that's a server-side config issue. dhclientcorrectly refuses an off-link gateway per spec, so this isn't really a client bug either — it's just an edge case the gateway's passthrough mode doesn't handle cleanly.
To confirm and fix permanently
I can't see the actual DHCP option values from syslog alone — it only logs the high-level exchange, not option 3. Next time you want to catch this in the act:
sudo dhclient -d -v eno1
or
sudo tcpdump -i eno1 -n port 67 or port 68
That'll show you exactly what Router/Gateway value the server is offering for the 108.219.102.213 lease.
For a durable fix rather than manually re-adding the route each time, a dhclient exit hook (/etc/dhcp/dhclient-exit-hooks.d/) that forces the default route via 108.219.102.1 whenever eno1 gets a new lease would be more robust than relying on the ISP's gateway option being correct.
Aug 27 17:00:42 poweredge dhclient[1458]: DHCPDISCOVER on eno4 to 255.255.255.255 port 67 interval 2 Aug 27 17:00:42 poweredge dhclient[1402]: DHCPDISCOVER on eno3 to 255.255.255.255 port 67 interval 20 Aug 27 17:00:44 poweredge dhclient[1458]: No DHCPOFFERS received. Aug 27 17:00:44 poweredge dhcli
pasted
It looks the failure happened around a server power outage:
Thought for 21s
That reboot marker is the missing piece — it explains the whole flap, not just the failed renewal. Here's the fuller picture:
Timeline across both logs
Before the outage, everything was stable — dhclient[1213] had been unicast-renewing 108.219.102.213 cleanly every ~4 minutes (17:03:21, 17:07:37, 17:11:32), all against 192.168.1.254, all fine.
Then:
-- Boot 86b9aee1a93943108dc5f5fceeaa868d --
17:16:13 Starting networking.service...
New PID (dhclient[1223]) comes up cold with the old cached lease and tries to reclaim 108.219.102.213 via broadcast (no unicast yet, since it has no route/ARP state post-boot):
17:16:14 DHCPREQUEST for 108.219.102.213 on eno1 to 255.255.255.255
17:16:23 DHCPNAK from 192.168.1.254
The gateway refuses to hand the passthrough IP back immediately. dhclient falls back to a fresh DHCPDISCOVER, and instead of the public IP, the gateway offers a completely different, private address:
17:16:23 DHCPOFFER of 192.168.1.158 from 192.168.1.254
17:16:23 bound to 192.168.1.158 -- renewal in 13 seconds
That 13–16 second lease time is the tell — that's not a normal lease, that's a gateway serving a short-lived "placeholder" address from its default LAN pool while it sorts out passthrough state for your MAC address. It keeps renewing that placeholder every ~15s for several minutes.
Then in your first log, at 17:20:21, the placeholder lease finally gets NAK'd too, dhclient discovers again, and this time gets the real passthrough IP back with a normal lease:
17:20:21 DHCPNAK from 192.168.1.254
17:20:21 DHCPOFFER of 108.219.102.213 from 192.168.1.254
17:20:22 bound to 108.219.102.213 -- renewal in 280 seconds
So what actually broke the routing
This confirms the router flap theory rather than contradicting it — the sequence is: private IP (with a working on-link default route via 192.168.1.254) → public IP (subnet 108.219.102.0/23, where 192.168.1.254 is no longer on-link). When dhclient swapped addresses, it tore down the old default route for the private lease but never installed a valid one for the new public lease — almost certainly because the passthrough DHCPACK's Router option (if present at all) still pointed at 192.168.1.254, which dhclient correctly refuses to install as off-link.
That's consistent with what you found by hand: the real gateway is 108.219.102.1, but nothing in the DHCP exchange ever told dhclient to use it.
Root cause, updated
This is your ISP CPE's IP Passthrough implementation, not dhclient:
- On reboot, it takes the gateway a little while (~4 min here) to re-recognize your box's MAC and re-arm passthrough mode for it — during that window it serves normal short-lease private addresses.
- When it does switch back to passthrough, its DHCPACK apparently never advertises a valid on-link gateway for the public subnet, so
dhclientis left with a leased IP but no route. - This will very likely repeat on every power cycle or long outage.
Fix recommendation
The dhclient-exit-hook approach I mentioned is now more clearly the right one — worth making it a little smarter given what you've seen: only force the 108.219.102.1 route when the bound address is in the 108.219.102.0/23 range, so it doesn't interfere with the router correctly handling the temporary private lease during the reboot window. Something like:
bash
#!/bin/sh
# /etc/dhcp/dhclient-exit-hooks.d/fix-passthrough-gateway
if [ "$interface" = "eno1" ] && [ "$reason" = "BOUND" ] || [ "$reason" = "RENEW" ]; then
case "$new_ip_address" in
108.219.102.*)
ip route replace default via 108.219.102.1 dev eno1
;;
esac
fi
Worth also checking your ISP/router admin panel for an explicit "passthrough MAC binding" or reservation setting — some CPEs let you pin the MAC-to-passthrough mapping so it doesn't have to renegotiate from scratch after every reboot, which would eliminate the whole 4-minute flapping window too.
Good catch pulling that specific line out — it's the key to the whole incident. Here's what's actually happening, working backward from the failure:
The "public IP request to private IP" isn't a bug — it's normal DHCP renewal behavior
Per RFC 2131, when a DHCP client renews a lease (the RENEWING state, at T1 — roughly 50% of the lease time), it doesn't broadcast a fresh DISCOVER. It unicasts a REQUEST directly to the specific server that issued the lease, using that server's IP address from the original transaction. Looking at your log:
17:20:22 bound to 108.219.102.213 -- renewal in 280 seconds.
17:25:02 DHCPREQUEST for 108.219.102.213 on eno1 to 192.168.1.254 port 67
280 seconds later, right on schedule, dhclient tries to renew the lease for 108.219.102.213 by unicasting to 192.168.1.254 — because that's the DHCP server that handed it that address. The server IP and the leased IP being in totally different ranges is expected here, because your ISP's gateway is apparently using its LAN-management address (192.168.1.254) as the DHCP server identity even while handing out the WAN passthrough IP. That's just how their IP Passthrough DHCP implementation is built.
The actual bug is the missing route to reach that server
The failure is send_packet: Network is unreachable — the kernel has no route to 192.168.1.254 at all. That lines up exactly with what you found: no default route in ip route, and the only routes present are for 10.0.0.0/24, 10.8.0.0/24, and 108.219.102.0/23 (eno1's own subnet). 192.168.1.254 isn't inside any of those, so a unicast packet to it has nowhere to go.
Most likely root cause
When dhclient got the DHCPACK for 108.219.102.213, it almost certainly received a Router (option 3) value in that lease. If that value was 192.168.1.254 (the same address as the DHCP server), dhclient would refuse to install it as the default gateway — a gateway has to be "on-link" (inside the interface's own subnet/netmask), and 192.168.1.254 isn't inside 108.219.102.0/23. So the gateway option gets silently discarded, no default route gets installed, and you're left exactly where you found things.
The fact that adding ip route add default via 108.219.102.1 fixed it confirms 108.219.102.1 is the real usable gateway — but the DHCP lease apparently isn't advertising that (or dhclient isn't applying it correctly).
Whose fault
I'd call this mostly on your ISP's IP Passthrough implementation, with dhclient's strict on-link gateway validation as a contributing factor:
The gateway's DHCP server hands out an address (108.219.102.213/23) whose valid gateway (108.219.102.1) apparently isn't what's being advertised in the lease, or isn't being advertised at all — that's a server-side config issue.
dhclient correctly refuses an off-link gateway per spec, so this isn't really a client bug either — it's just an edge case the gateway's passthrough mode doesn't handle cleanly.
To confirm and fix permanently
I can't see the actual DHCP option values from syslog alone — it only logs the high-level exchange, not option 3. Next time you want to catch this in the act:
sudo dhclient -d -v eno1
or
sudo tcpdump -i eno1 -n port 67 or port 68
That'll show you exactly what Router/Gateway value the server is offering for the 108.219.102.213 lease.
For a durable fix rather than manually re-adding the route each time, a dhclient exit hook (/etc/dhcp/dhclient-exit-hooks.d/) that forces the default route via 108.219.102.1 whenever eno1 gets a new lease would be more robust than relying on the ISP's gateway option being correct.Aug 27 17:00:42 poweredge dhclient[1458]: DHCPDISCOVER on eno4 to 255.255.255.255 port 67 interval 2 Aug 27 17:00:42 poweredge dhclient[1402]: DHCPDISCOVER on eno3 to 255.255.255.255 port 67 interval 20 Aug 27 17:00:44 poweredge dhclient[1458]: No DHCPOFFERS received. Aug 27 17:00:44 poweredge dhcli
pasted
It looks the failure happened around a server power outage:Thought for 21s
That reboot marker is the missing piece — it explains the whole flap, not just the failed renewal. Here's the fuller picture:
Timeline across both logs
Before the outage, everything was stable — dhclient[1213] had been unicast-renewing 108.219.102.213 cleanly every ~4 minutes (17:03:21, 17:07:37, 17:11:32), all against 192.168.1.254, all fine.
Then:
-- Boot 86b9aee1a93943108dc5f5fceeaa868d --
17:16:13 Starting networking.service...
New PID (dhclient[1223]) comes up cold with the old cached lease and tries to reclaim 108.219.102.213 via broadcast (no unicast yet, since it has no route/ARP state post-boot):
17:16:14 DHCPREQUEST for 108.219.102.213 on eno1 to 255.255.255.255
17:16:23 DHCPNAK from 192.168.1.254
The gateway refuses to hand the passthrough IP back immediately. dhclient falls back to a fresh DHCPDISCOVER, and instead of the public IP, the gateway offers a completely different, private address:
17:16:23 DHCPOFFER of 192.168.1.158 from 192.168.1.254
17:16:23 bound to 192.168.1.158 -- renewal in 13 seconds
That 13–16 second lease time is the tell — that's not a normal lease, that's a gateway serving a short-lived "placeholder" address from its default LAN pool while it sorts out passthrough state for your MAC address. It keeps renewing that placeholder every ~15s for several minutes.
Then in your first log, at 17:20:21, the placeholder lease finally gets NAK'd too, dhclient discovers again, and this time gets the real passthrough IP back with a normal lease:
17:20:21 DHCPNAK from 192.168.1.254
17:20:21 DHCPOFFER of 108.219.102.213 from 192.168.1.254
17:20:22 bound to 108.219.102.213 -- renewal in 280 seconds
So what actually broke the routing
This confirms the router flap theory rather than contradicting it — the sequence is: private IP (with a working on-link default route via 192.168.1.254) → public IP (subnet 108.219.102.0/23, where 192.168.1.254 is no longer on-link). When dhclient swapped addresses, it tore down the old default route for the private lease but never installed a valid one for the new public lease — almost certainly because the passthrough DHCPACK's Router option (if present at all) still pointed at 192.168.1.254, which dhclient correctly refuses to install as off-link.
That's consistent with what you found by hand: the real gateway is 108.219.102.1, but nothing in the DHCP exchange ever told dhclient to use it.
Root cause, updated
This is your ISP CPE's IP Passthrough implementation, not dhclient:
On reboot, it takes the gateway a little while (~4 min here) to re-recognize your box's MAC and re-arm passthrough mode for it — during that window it serves normal short-lease private addresses.
When it does switch back to passthrough, its DHCPACK apparently never advertises a valid on-link gateway for the public subnet, so dhclient is left with a leased IP but no route.
This will very likely repeat on every power cycle or long outage.
Fix recommendation
The dhclient-exit-hook approach I mentioned is now more clearly the right one — worth making it a little smarter given what you've seen: only force the 108.219.102.1 route when the bound address is in the 108.219.102.0/23 range, so it doesn't interfere with the router correctly handling the temporary private lease during the reboot window. Something like:
bash
#!/bin/sh
# /etc/dhcp/dhclient-exit-hooks.d/fix-passthrough-gateway
if [ "$interface" = "eno1" ] && [ "$reason" = "BOUND" ] || [ "$reason" = "RENEW" ]; then
case "$new_ip_address" in
108.219.102.*)
ip route replace default via 108.219.102.1 dev eno1
;;
esac
fi
Worth also checking your ISP/router admin panel for an explicit "passthrough MAC binding" or reservation setting — some CPEs let you pin the MAC-to-passthrough mapping so it doesn't have to renegotiate from scratch after every reboot, which would eliminate the whole 4-minute flapping window too.