i2i BNG
A software BNG on DPDK for PPPoE termination, carrier-grade NAT and dual-stack service tiers
Live sessionsIllustrative| Subscriber | Access | Gateway | IP | Status |
|---|---|---|---|---|
| FTTH-44120 | PPPoE | bng-01 | 100.64.18.23 | Authorised |
| FTTH-51877 | PPPoE | bng-02 | 100.64.22.140 | Authorised |
| ENT-2209 | IPoE | bng-01 | 203.0.113.14 | Authorised |
| WIFI-GUEST-88 | Hotspot | ap-lobby | 10.20.4.77 | Captive portal |
| FTTH-39002 | PPPoE | bng-02 | – | Rejected: expired plan |
4 authorised · 1 rejectedIP logs retained · Trace
Overview
i2i BNG is a software broadband network gateway that runs on standard x86 servers under Debian. It terminates PPPoE subscribers, authorises each one through RADIUS and applies the speed and policy the plan calls for. It supports dual-stack IPv4 and IPv6 service tiers and traffic security controls, and it runs carrier-grade NAT, either on the gateway or as a separate appliance in front of another BNG.
The forwarding engine is a customised VPP with DPDK network drivers, so packets are processed in user space rather than in the kernel. Operators work through a hierarchical command line with set, show, commit and rollback, a web interface, SNMP and Prometheus metrics. There is no proprietary hardware to buy.
At a glance
- Dual-stack IPv4 and IPv6 service tiers on standard x86 servers
- Speed and policy applied from RADIUS, changed live by CoA
- Traffic security controls and stateful CGNAT with NAT logs
- Commit, rollback and signed upgrades with auto-rollback
What is a broadband network gateway (BNG)?
A broadband network gateway, or BNG, is the router at the edge of an access network where subscriber sessions end. Customer routers connect over PPPoE or DHCP. The BNG authenticates each subscriber, usually by asking a RADIUS server, assigns an address, enforces the speed and policy of the plan and counts usage for accounting.
PPPoE, defined in RFC 2516, carries a point-to-point session over Ethernet. The BNG discovers the client, opens a session and keeps a session identifier for each subscriber. RADIUS then sets attributes such as rate limits, and Change-of-Authorisation lets the operator alter a running session without a new login.
Many operators also run carrier-grade NAT, or CGNAT, because they have too few public IPv4 addresses for every subscriber. CGNAT translates many private addresses onto a smaller public pool. Two modes are common. Dynamic NAT allocates ports on demand. Deterministic NAT maps each subscriber to a fixed public address and port block, which keeps logs small and lookups predictable. Traditionally BNGs were dedicated routers. Software gateways on commodity servers use kernel-bypass frameworks such as DPDK to move packets fast without special forwarding chips.
Capabilities
What i2i BNG does
Fast path
- VPP forwarding engine with DPDK network drivers
- Automatic tuning of workers, hugepages and queues at boot
- NIC role changes without a reboot
- Hardware capacity profiler for sizing
Subscriber termination
- PPPoE per RFC 2516 with VLAN and service-name filtering
- Duplicate-session policy: replace, reject or ignore
- Rogue PPPoE server detection
- Authentication-failure MAC blacklist
RADIUS and policy
- Authentication and accounting with Interim updates
- CoA and Disconnect on port 3799
- Named RADIUS groups per interface or VLAN
- Per-subscriber ACLs assigned by RADIUS
Speed and QoS
- Per-session policers set from RADIUS
- Live speed change through CoA
- Multi-tier speeds by destination prefix or DSCP
- IPv4 tiers, upload and download
Carrier-grade NAT
- Dynamic NAT44 and deterministic NAT
- Static mappings, session limits and timeouts
- NAT event logs by syslog and IPFIX
- Standalone CGNAT appliance image
Operation
- Set, show, commit and rollback command line
- Web interface with role-based access
- SNMP v2c and v3 with alarms and traps
- Signed upgrades with automatic rollback
Use cases
Where i2i BNG is used
PPPoE gateway for a regional ISP
An ISP places two or more x86 gateways at its aggregation site. Each subscriber logs in over PPPoE, RADIUS returns the plan speed, and support changes a speed with CoA when a customer upgrades. Capacity is added by adding another node.
Local and international speed tiers
A plan gives full speed to peering and local destinations and a lower cap to international traffic. Multi-tier QoS applies separate limits by destination prefix or DSCP, and a per-user tier override arrives from RADIUS.
CGNAT under IPv4 exhaustion
An operator with few public addresses puts subscribers behind deterministic NAT, so each subscriber maps to a known address and port block. NAT events go out as syslog or IPFIX to a log store such as i2i Trace for later lookups.
CGNAT in front of an existing BNG
A network already has a subscriber gateway it does not want to replace. It deploys the standalone CGNAT appliance image, which does translation and logging only and does not terminate subscribers, and leaves the existing edge in place.
FAQ
i2i BNG: frequently asked questions
Does i2i BNG work with i2i AAA?
Yes. It speaks standard RADIUS, including accounting and CoA, and i2i AAA carries the vendor attribute dictionary for it. It also works with other RADIUS servers such as FreeRADIUS, and dictionary installation steps are provided. Ask us for the tested pairing for your release.
Which subscriber types does it support?
PPPoE is the subscriber type this page covers, with RADIUS policy applied to each session so that speed and plan rules stay in your RADIUS system. Ask i2iCore about other subscriber models for your deployment.
How many subscribers can one node hold?
Capacity depends on your hardware, traffic and design, and the built-in hardware capacity profiler helps size a server. Ask i2iCore for sizing guidance for your network and share your expected subscriber count and traffic.
How does it secure subscriber traffic?
Per-subscriber ACLs assigned by RADIUS control subscriber traffic, NAT keeps the state for its translations and the gateway protects its own management services with rate limits. Ask i2iCore how these controls fit your security design.
Is a paired two-node setup supported?
Scope depends on your deployment. Ask i2iCore to agree a design for your sites, including how many nodes each site needs and how traffic is shared between them, before you plan a multi-node layout.
Which NAT modes and logs are available?
Dynamic NAT44 and deterministic NAT, with static mappings. Logging is syslog with mapping and unmapping events, and IPFIX port-block records for deterministic mode. Ask i2iCore about IPv6 service design for your network.
How is it installed and upgraded?
From a Debian 12 installation image onto bare metal, or from a signed upgrade package. Upgrades use an A and B image pair with automatic rollback, and the forwarding engine is not restarted during a control-plane upgrade. Ask i2iCore about other deployment formats.