Deutsche Telekom FTTH — Setup with a Custom Router
Deutsche Telekom FTTH works with any router that supports PPPoE and VLAN tagging — not just the Telekom-branded hardware. The connection requires exactly two things: a PPPoE dial-up with your credentials, and VLAN ID 7 tagged on the WAN interface.
This guide covers the setup for ASUS, Ubiquiti UniFi (UDM/UDM-Pro/UDM-SE), and OpenWrt. The Generic section at the end applies to any other router.
How It Works
Your ONT (the fiber media converter, usually a white box on the wall) converts the optical signal to Ethernet. Your router plugs into the ONT via a standard Ethernet cable. From the router's perspective, this is a standard PPPoE uplink — but Telekom requires all traffic to be tagged with VLAN ID 7 before the PPPoE handshake. Without VLAN 7, the PPPoE session will never establish.
The ONT itself has no configuration interface and requires no setup on your part.
Prerequisites
- Active Telekom FTTH connection with an ONT at the wall socket
- A router with a free Ethernet WAN port that supports PPPoE and VLAN tagging (802.1Q)
- Your Telekom PPPoE credentials (see next section)
PPPoE Credentials
Where to Find Them
Your credentials are in one of these places:
- The welcome letter or PDF Telekom sent when your connection was activated
- Telekom Kundencenter online: Verträge → Erweiterte Optionen → Internetzugang
Username Format
The username is constructed from three components on your access documents:
| Component | German term | Length |
|---|---|---|
| Connection identifier | Anschlusskennung | 12 characters |
| Access number | Zugangsnummer (formerly T-Online-Nummer) | variable |
| Subscriber suffix | Mitbenutzernummer | always 0001 |
Assembled format:
Example with placeholders:
Newer contracts (2024+)
Some newer Telekom contracts use "Easy Login" — Telekom automatically authenticates the connection and any username/password combination will work. If your connection activates without valid credentials, this applies to you.
Password
The password is your personal Zugangskennwort from the same Telekom document. It is separate from your MeinMagenta app password.
MTU
Set MTU and MRU to 1492 on the WAN/PPPoE interface. This is required for PPPoE over Ethernet (RFC 2516) and prevents packet fragmentation.
ASUS Routers
Tested with: RT-AX88U, RT-AX86U, and similar models with the ASUSWRT firmware.
Step 1 — WAN Connection Type
Navigate to WAN → Internet Connection:
| Field | Value |
|---|---|
| WAN Connection Type | PPPoE |
| Username | your assembled PPPoE username |
| Password | your Zugangskennwort |
| MTU | 1492 |
| MRU | 1492 |
| Authentication | Auto or PAP |
Step 2 — VLAN 7
Navigate to LAN → IPTV:
| Field | Value |
|---|---|
| ISP Profile | Manual |
| Internet VID | 7 |
| PRIO | 0 |
Apply and reboot.
Verify
Under WAN → Internet Status, the WAN status should show Connected with a public IP address (typically 80.x.x.x or 90.x.x.x).
Ubiquiti UniFi (UDM / UDM-Pro / UDM-SE)
Tested with UniFi OS 3.x and 4.x on UDM, UDM-Pro, and UDM-SE.
Step 1 — Open Internet Settings
In the UniFi dashboard go to Settings → Internet and select the WAN port connected to the ONT.
Step 2 — Enable VLAN
Under Advanced, enable VLAN ID and set it to 7.
Step 3 — PPPoE
Set IPv4 Connection to PPPoE and enter:
| Field | Value |
|---|---|
| Username | your assembled PPPoE username |
| Password | your Zugangskennwort |
Leave MTU on auto — UniFi handles PPPoE MTU negotiation (1492) automatically.
Step 4 — Apply
Save and apply. UniFi will attempt to establish the PPPoE session. The WAN indicator in the dashboard turns green when connected.
UDM-Pro / UDM-SE with SFP+ Direct Fiber
If you use a compatible GPON SFP module (e.g. Zyxel PMG3000-D20B) in the UDM-Pro's SFP+ port instead of an external ONT:
- During Telekom fiber activation, select Router mit integriertem Glasfasermodem and choose FritzBox as the device type — the SFP handshake is identical
- In UniFi, set WAN1 to port 10 (the SFP+ port)
- Configure VLAN 7 and PPPoE as above
- After saving, fully power-cycle the UDM-Pro (unplug, wait 30 seconds) — a software reboot is not sufficient to activate the SFP module
IPv6
IPv6 provisioning on UniFi with Telekom is possible but requires additional DHCPv6-PD configuration and is not covered here.
OpenWrt
Tested with OpenWrt 22.03 and 23.05 via LuCI.
Step 1 — Create a VLAN Interface
Go to Network → Interfaces → Add New Interface:
| Field | Value |
|---|---|
| Name | wan_vlan7 (or any name) |
| Protocol | PPPoE |
| Device | eth0.7 (your WAN ethernet port with VLAN 7 tag) |
The device name depends on your hardware. Common WAN interfaces are eth0, eth1, or wan. Append .7 to add the VLAN tag — e.g. wan.7.
Step 2 — PPPoE Settings
Under the interface Protocol tab:
| Field | Value |
|---|---|
| PAP/CHAP username | your assembled PPPoE username |
| PAP/CHAP password | your Zugangskennwort |
| MTU | leave empty (let PPPoE negotiate 1492 automatically) |
Step 3 — Firewall Zone
Assign the interface to the wan firewall zone.
Step 4 — VLAN Switch (older hardware)
On older devices using a switch-based VLAN configuration (Network → Switch), add VLAN 7 with:
- CPU port: tagged
- WAN port: tagged
- All LAN ports: off
Step 5 — Apply
Save and apply. Check the interface status under Network → Interfaces — the wan_vlan7 interface should show an IP address.
Performance
For faster throughput, enable flow offloading under Network → Firewall → General Settings → Software flow offloading (or hardware offloading if your device supports it).
Generic Setup (Other Routers)
Any router that supports PPPoE and 802.1Q VLAN tagging can connect to Telekom FTTH. Regardless of the manufacturer, these are the required settings:
| Setting | Value |
|---|---|
| WAN protocol | PPPoE |
| VLAN tag on WAN interface | 7 |
| VLAN priority (CoS) | 0 |
| PPPoE username | <Anschlusskennung><Zugangsnummer>#0001@t-online.de |
| PPPoE password | Zugangskennwort |
| MTU / MRU | 1492 (or auto if supported) |
| Authentication | PAP or auto |
Look for VLAN settings under the WAN or internet configuration — sometimes labelled "VLAN tagging", "802.1Q", "WAN VLAN", or "ISP VLAN".
Verify the Connection
Once configured, check that a public IP has been assigned:
A Telekom FTTH IP typically starts with 80., 87., 90., or 91..
From the router UI, the WAN status should show: - Status: Connected - IP: a public address in the ranges above - Uptime: incrementing
Optional Settings
DNS — Telekom's DNS servers are assigned automatically via PPPoE. You can override them with public resolvers:
| Provider | Primary | Secondary |
|---|---|---|
| Cloudflare | 1.1.1.1 |
1.0.0.0 |
8.8.8.8 |
8.8.4.4 |
UPnP — disable unless required by a specific application. UPnP allows devices on your LAN to open ports automatically, which is a security risk in most homelab setups.
Common Issues
| Symptom | Likely cause | Fix |
|---|---|---|
| PPPoE session never establishes | VLAN 7 not configured | Verify VLAN ID 7 is tagged on the WAN interface |
| Wrong IP or no IP | Incorrect PPPoE credentials | Double-check username format and password from Telekom documents |
| Connection drops repeatedly | MTU mismatch | Set MTU/MRU to 1492 explicitly |
| UDM-Pro SFP not recognised | Soft reboot only | Full power-cycle required after SFP configuration |
| "Router not supported" warning | Telekom app | Cosmetic warning only — connection works fine |