Skip to content
Broadband Network Gateway v1.0 GA

One product.
Every service included.

Netvyn is a single broadband network gateway. Subscriber access, authentication, bandwidth control, address translation and filtering are not add-ons or premium modules — they are what the gateway is. You buy one product and every service below is in it.

Request a Demo Read the documentation
Product
Netvyn BNG / BRAS
Services
All included
Licence sized on
Sessions or throughput
Term
Perpetual or subscription
What you getone licence
NETVYN BNG one product
BNG / BRAS included
PPPOE included
IPOE included
RADIUS included
QOS included
NAT included
CGNAT included
FIREWALL included
VLAN included
every service, one gatewayno add-on licences

01 What is included

Nine services, one configuration, one commit

Each of these is normally a separate purchase from a separate vendor with its own change window. In Netvyn they are parts of the same gateway, applied to the same subscriber session.

Subscriber termination

BNG / BRAS

Subscriber termination and session management for PPPoE and IPoE on one gateway.

Included Access

PPPoE

Session-based access with full protocol handling and per-MAC session protection.

Included Access

IPoE

DHCP-driven access with Option-82 circuit identity, alongside PPPoE on the same gateway.

Included Authentication & accounting

RADIUS

Authentication, authorization and accounting against the RADIUS you already operate.

Included Traffic policy

QoS

Per-subscriber shaping nested under the real contention points in the access network.

Included Address translation

NAT

Stateful translation with the mapping behaviour real-time applications depend on.

Included Address translation

CGNAT

Shared public IPv4 with deterministic port blocks and one record per allocation.

Included Security

Firewall

Stateful filtering bound to the session, with address groups your billing system drives.

Included Access network & addressing

VLAN & IP management

Single-tag and QinQ access models, with address pools that extend while live.

Included
There is no feature list to negotiate. Enabling CGNAT, or turning on hierarchical shaping, or adding IPv6 is a configuration change on the licence you already hold — not a per-feature unlock or a premium module. Your licence is sized on capacity, never on which services you switch on. How licensing works.

02 BNG / BRAS

Subscriber termination

A broadband network gateway your operations team can actually run

The BNG is where every subscriber session begins, gets its identity, gets its address and gets its plan. Netvyn owns that whole boundary in one platform, so session state has one home instead of four.

Specification

Category
BNG / BRAS
Access types
PPPoE, IPoE
Address families
IPv4 + IPv6
Session limit
Licence-sized
Redundancy
active / standby
01

Unified session table

PPPoE and IPoE sessions live in one table with one identity model, so reporting and support do not fork by access type.

02

Policy bound at connect

Bandwidth, filtering and translation policy attach as the session comes up, and can be changed while it stays up.

03

Accounting your billing trusts

Start, interim and stop records with per-session byte and packet counters, in the format your AAA already ingests.

04

Controlled teardown

Disconnect a subscriber by username, address or session id — individually, per interface, or in bulk.

05

Live visibility

Session counts by access type and state, per-subscriber detail, and resolved policy with its source.

06

Redundancy

An active/standby pair replicates session, translation and accounting state so a failover is not a mass re-dial.

How it works

  1. 01

    Session request

    A subscriber’s CPE initiates PPPoE, or the access node relays DHCP for IPoE.

  2. 02

    Identity

    Netvyn presents the username, MAC or circuit ID to your RADIUS and waits for the verdict.

  3. 03

    Address

    The accepted session draws an address and, where used, an IPv6 prefix from the right pool.

  4. 04

    Policy

    Plan and filter policy bind to the session; accounting starts.

Full BNG / BRAS reference
netvyn cli
<Netvyn-BNG> show sessions
  Access    Sessions   State
  -------   --------   -----
  PPPoE       14 220   up
  IPoE         5 780   up

<Netvyn-BNG> show subscribers
  IP              Profile    Down   Up     Source
  100.64.10.14    res-100    100M   100M   radius

<Netvyn-BNG> clear session user "subscriber-id"

03 PPPoE

Access

PPPoE subscriber aggregation at ISP scale

PPPoE is still how most broadband subscribers connect, and it is where an access network is most easily destabilised by CPE that misbehaves. Netvyn handles the protocol completely and protects itself while doing it.

Specification

Identity
username
Alternate
MAC address
Auth methods
PAP, CHAP, MS-CHAP
Address family
IPv4 + IPv6 PD
Protection
per-MAC / per-VLAN
01

Complete protocol handling

Discovery and link negotiation are handled in full, including the keepalive that detects a dead peer instead of leaking a session.

02

Authentication choice

PAP, CHAP and MS-CHAP are all available; Netvyn proposes the strongest method you allow and negotiates down only within that set.

03

Session protection

Per-MAC and per-VLAN limits, half-open session reaping, and rate limiting on discovery keep one bad CPE from becoming an outage.

04

Address fallback

If RADIUS returns no address, a configured pool takes over — so an AAA hiccup does not stop subscribers connecting.

05

Dual-stack

IPv4 and IPv6 negotiate on the same session, including a delegated prefix for the subscriber’s own network.

06

Diagnosable

Discovery counters and per-VLAN tracing tell you whether a failing subscriber is a tagging problem or an authentication problem.

How it works

  1. 01

    Discovery

    The CPE finds the gateway and a session is offered and confirmed.

  2. 02

    Negotiate

    Link parameters are agreed, including the maximum frame size for PPPoE.

  3. 03

    Authenticate

    Credentials go to RADIUS; the reply carries the subscriber’s policy.

  4. 04

    Address & go

    IPv4 and IPv6 configuration completes, policy binds, accounting starts.

Full PPPoE reference
configuration
[Netvyn-BNG] ppp interface add access0 access1
[Netvyn-BNG] ppp auth-protocol chap,pap
[Netvyn-BNG] ppp lcp-echo interval 30 failure 3
[Netvyn-BNG] ppp ipv6 enable
[Netvyn-BNG] commit
[Netvyn-BNG] save

# confirm
<Netvyn-BNG> show ppp
<Netvyn-BNG> show sessions

04 IPoE

Access

IPoE access without the PPP overhead

Where you do not want a session protocol between the subscriber and the gateway, IPoE gives you DHCP-driven access with the subscriber identified by the access network itself.

Specification

Identity
Option-82 circuit
Alternate
MAC address
Addressing
DHCPv4 / DHCPv6
Prefix delegation
supported
Coexists with
PPPoE, by VLAN
01

Identity from the network

The access node’s circuit and remote identifiers become the subscriber name, so identity does not depend on CPE configuration.

02

MAC-based authentication

Where circuit information is unavailable, the client MAC authenticates against RADIUS in the format your realm expects.

03

Coexists with PPPoE

Different VLAN ranges on the same port can run different access types, so a migration is gradual rather than a cutover.

04

Lease control

Lease time, subnet and DNS are configured centrally and handed to every subscriber on that access domain.

05

Same policy pipeline

IPoE subscribers get the same bandwidth, filtering and translation treatment as PPPoE subscribers.

06

Dual-stack

IPv6 addressing and prefix delegation are available to IPoE subscribers as well.

How it works

  1. 01

    Request

    The subscriber’s device sends a DHCP request; the access node adds its circuit identity.

  2. 02

    Identify

    Netvyn presents that identity, or the MAC, to RADIUS.

  3. 03

    Lease

    An address is leased from the pool selected for that customer or access domain.

  4. 04

    Policy

    Plan and filter policy bind to the session; accounting starts.

Full IPoE reference
configuration
[Netvyn-BNG] dhcp mode ipoe
[Netvyn-BNG] dhcp interface add access2
[Netvyn-BNG] dhcp auth option82
[Netvyn-BNG] dhcp lease-time 3600
[Netvyn-BNG] ip dns 203.0.113.53 198.51.100.53
[Netvyn-BNG] commit
[Netvyn-BNG] save

05 RADIUS

Authentication & accounting

Your RADIUS stays your RADIUS

Netvyn does not want to be your subscriber database. It authenticates against the AAA you already run, takes each subscriber’s policy from the reply, and sends usage back in the records your billing system already reads.

Specification

Policy source
Access-Accept
Accounting
start / interim / stop
Mid-session
CoA + disconnect
Failover
ordered server list
Integrity
signing on by default
01

Policy from AAA

Rate, pool and filter policy arrive in the accept reply, so a plan lives in your billing system rather than in gateway configuration.

02

Mid-session changes

An upgrade, a speed boost, a suspension or a disconnect can be pushed to a live session without dropping the subscriber.

03

Server failover

An ordered server list with configurable timeout and retry count, plus per-server latency and failure counters.

04

Message integrity

Request signing is on by default, which is both current best practice and increasingly a hard requirement of modern RADIUS servers.

05

Usage records

Interim accounting at your chosen interval keeps usage current for quota and fair-use enforcement.

06

Operator login

Staff logins to the gateway itself can also be delegated to a RADIUS realm, with the role returned by the server.

How it works

  1. 01

    Request

    Netvyn sends the subscriber identity and access details to your RADIUS.

  2. 02

    Accept

    The reply carries the plan: rate, pool, filter policy, session limits.

  3. 03

    Account

    Start, interim and stop records report usage back for billing.

  4. 04

    Change

    Your systems can push a new plan or a disconnect to the live session.

Full RADIUS reference
configuration
[Netvyn-BNG] radius server add 198.51.100.10 secret <shared-secret>
[Netvyn-BNG] radius nas-id netvyn-bng-01
[Netvyn-BNG] radius interim-interval 300
[Netvyn-BNG] radius message-authenticator on
[Netvyn-BNG] commit

<Netvyn-BNG> show radius statistics

06 QoS

Traffic policy

Bandwidth control that matches what you sold

Every subscriber has a plan, and every access network has places where that plan competes with others. Netvyn enforces the plan per subscriber and nests it under the real contention points, so the network behaves the way your product promises.

Specification

Shaping
hierarchical
Direction
up + down
Rate source
RADIUS or static
Queueing
per-profile
Mid-session
supported
01

Per-subscriber shaping

Separate upstream and downstream rates with a configurable burst allowance for short peaks.

02

Hierarchical limits

Subscriber limits nest under an aggregate that represents a real shared resource, so oversubscription is enforced where it exists.

03

Queue behaviour you choose

Different queueing disciplines are available per plan, including modern fair-queueing for latency-sensitive traffic.

04

Rate from anywhere

A rate can come from the authentication reply, from a static assignment, or from the service default — and the resolved source is visible per subscriber.

05

Tuning without downtime

Queue tuning applies to new sessions immediately and migrates existing sessions gradually, with no forwarding interruption.

06

Honest speed tests

Overhead compensation accounts for framing so a customer’s speed test reads the number you sold them, not the number minus protocol overhead.

How it works

  1. 01

    Define

    A queue behaviour and a plan rate are defined once, as reusable profiles.

  2. 02

    Bind

    The plan attaches to a subscriber from RADIUS, or to an address range statically.

  3. 03

    Enforce

    Upstream and downstream traffic is shaped per subscriber under its parent aggregate.

  4. 04

    Adjust

    A new rate can be pushed mid-session, or the profile retuned live.

Full QoS reference
configuration
[Netvyn-BNG] qos queue-profile add res-fq fq_codel qsize 4096
[Netvyn-BNG] qos subscriber-profile add res-100 \
                 rate-down 100M rate-up 100M queue-profile res-fq
[Netvyn-BNG] commit
[Netvyn-BNG] qos assign add 100.64.10.0/24 subscriber-profile res-100
[Netvyn-BNG] commit ; save

<Netvyn-BNG> show qos bindings

07 NAT

Address translation

Translation that does not break your subscribers’ applications

Subscribers on private addressing need translation, and the way that translation behaves decides whether video calls, gaming and peer-to-peer applications work. Netvyn defaults to the behaviour that keeps them working.

Specification

Placement
on the gateway
Extra appliance
none
Table size
memory bound
Timeouts
per protocol
Publishing
destination NAT
01

Application-friendly mapping

The default mapping model is the one interactive and peer-to-peer applications expect, rather than the strictest option.

02

Fragment handling

Fragmented traffic is translated correctly, so large-datagram applications do not silently freeze.

03

Port forwarding

A business customer’s service can be published on a public address and port, with ownership verified so one customer cannot claim another’s address.

04

Tunable timeouts

Per-protocol idle timeouts let you balance table size against how long an idle connection survives.

05

Policy-driven

An ordered policy list decides which subscriber ranges are translated, which bypass translation, and which get static treatment.

06

Diagnosable

Counters separate a missing mapping from an expired one from a fragment problem, so a one-way flow has an answer instead of a theory.

How it works

  1. 01

    Classify

    A subscriber’s traffic is matched against the translation policy list.

  2. 02

    Translate

    The private source address and port are rewritten to a public pair.

  3. 03

    Track

    The connection is tracked so replies are translated back automatically.

  4. 04

    Expire

    Idle connections age out on per-protocol timers you control.

Full NAT reference
configuration
[Netvyn-BNG] nat enable
[Netvyn-BNG] nat udp-mapping endpoint-independent
[Netvyn-BNG] nat policy add nat-rule 100.64.0.0/10 pool pub1
[Netvyn-BNG] commit

# publish a customer service
[Netvyn-BNG] nat dstnat add 203.0.113.5 proto tcp dport 8080 \
                 to 100.64.0.9 to-port 80
[Netvyn-BNG] commit

08 CGNAT

Address translation

Carrier-grade NAT you can still answer a subpoena with

CGNAT is how an ISP keeps growing after IPv4 has run out. The usual price is a logging problem: thousands of records per subscriber per hour. Netvyn assigns each subscriber a fixed block of ports, so one record covers the whole session.

Specification

Allocation
deterministic block
Log volume
per allocation
Sharing ratio
tunable
Traceability
single record
Deployment
inline or fronting
01

Deterministic allocation

Each subscriber gets a fixed, reproducible block of ports on a public address — the mapping is computed, not looked up in a log.

02

One record per block

Compliance logging volume is proportional to subscribers rather than to their connections, which is the difference between kilobytes and terabytes.

03

Traceability on demand

“Who held this public address and port at this time” resolves from a single self-contained record.

04

Tunable sharing ratio

Ports per subscriber is your dial between address efficiency and headroom for connection-hungry households.

05

Per-subscriber visibility

Block utilisation per subscriber distinguishes a heavy user from a genuinely undersized public pool.

06

Works with your existing edge

CGNAT can front an existing gateway, or run as part of the same Netvyn instance that terminates the subscribers.

How it works

  1. 01

    Allocate

    A subscriber address is assigned a fixed port block on a public address, and that allocation is logged once.

  2. 02

    Translate

    Every connection from that subscriber uses a port inside its own block.

  3. 03

    Return

    Replies to that public address and port map back to exactly one subscriber.

  4. 04

    Trace

    A request for a past address and port resolves from the block record alone.

Full CGNAT reference
configuration
[Netvyn-BNG] nat pool add pub1 203.0.113.10-203.0.113.20 \
                 ports 1024-65535 block 512 deterministic
[Netvyn-BNG] nat policy add nat-rule 100.64.0.0/10 pool pub1
[Netvyn-BNG] commit ; save

<Netvyn-BNG> show cgnat port-blocks summary
<Netvyn-BNG> show nat statistics

09 Firewall

Security

Filtering as part of the subscriber’s policy

A separate filtering appliance is another device to size, patch and correlate. Netvyn applies filtering as policy on the session it already owns, and lets your billing system move a subscriber into a restricted group without touching a rule.

Specification

Rules
stateful, ordered
Grouping
named address lists
Driven by
RADIUS / API
Anti-spoof
source verification
IPv6
separate rule set
01

Stateful rules

An ordered rule list that understands connection state, so return traffic does not need a mirror rule.

02

Named address groups

One rule can cover thousands of addresses, and membership changes without editing the rule.

03

Billing-driven quarantine

Your systems can tag a subscriber into a group for the life of their session — walled garden on suspension, released on payment.

04

Anti-spoof

Source verification stops a subscriber sending traffic from an address that is not theirs.

05

Separate IPv6 policy

IPv6 filtering is its own rule set, so an IPv4 rule can never accidentally govern IPv6 traffic.

06

Per-rule counters

Every rule reports its own hit count, so you can prove which rule is doing the work.

How it works

  1. 01

    Define

    Rules and named address groups are defined once for the gateway.

  2. 02

    Bind

    A filter policy attaches to subscriber sessions, from configuration or from RADIUS.

  3. 03

    Enforce

    Traffic is classified against the policy on the way through.

  4. 04

    Adjust

    Group membership changes take effect immediately, mid-session.

Full Firewall reference
configuration
[Netvyn-BNG] firewall enable
[Netvyn-BNG] firewall urpf strict
[Netvyn-BNG] firewall filter add accept state established
[Netvyn-BNG] firewall filter add drop src-list quarantine
[Netvyn-BNG] commit ; save

# immediate, no commit needed
[Netvyn-BNG] firewall address-list add quarantine 100.64.7.12

10 VLAN & IP management

Access network & addressing

Access topology and addressing, managed together

How subscribers are tagged and how they are addressed are the two things that make an access network hard to change later. Netvyn keeps both declarative, so a new region or a new wholesale partner is configuration rather than redesign.

Specification

Single tag
802.1Q
Double tag
QinQ
IPv4 pools
live extend
Overflow
chained pools
IPv6
prefix pools
01

Single and double tagging

One VLAN per subscriber, one per access node, or an outer tag for the segment and an inner tag for the line.

02

Ranges mapped to service

A VLAN range binds to an access type and a policy set, so residential, business and wholesale traffic separate cleanly on shared ports.

03

Pools that grow live

Extending an address pool takes effect on commit, with no disturbance to subscribers already holding addresses from it.

04

Overflow pools

A pool can chain to a successor, so a busy region degrades to a second range instead of refusing connections.

05

IPv6 prefix pools

Carve subscriber /64s and delegated prefixes from named blocks, selected by product or by RADIUS.

06

Utilisation alerting

Pool usage is exposed so exhaustion is a monitored threshold rather than a support queue.

How it works

  1. 01

    Tag

    Physical ports carry tagged sub-interfaces for the access network.

  2. 02

    Map

    Each VLAN range binds to an access type and a service policy.

  3. 03

    Address

    Subscribers draw from the pool selected for their product or region.

  4. 04

    Grow

    Pools and prefix blocks extend live as the subscriber base grows.

Full VLAN & IP management reference
configuration
[Netvyn-BNG] interface access0 add vlan v100 100
[Netvyn-BNG] interface access0 add vlan v10 100 10
[Netvyn-BNG] pool res range 100.64.10.10 100.64.10.250 \
                 gateway 100.64.10.1 prefix 24
[Netvyn-BNG] pool res next overflow
[Netvyn-BNG] ipv6 pool res 2001:db8:100::/40 assign 56
[Netvyn-BNG] commit ; save

<Netvyn-BNG> show pool

See the gateway on your network

One demo covers the whole product — your access model, your RADIUS attributes, your address plan. Thirty minutes with a network engineer, no sales deck.

Request a Demo Pricing