How Cpehub connects to your network
Cpehub is a cloud platform. To manage your OLTs and CPEs, it needs to reach your network securely — that's where the VPN comes in.
Overview
Cpehub opens two independent VPN tunnels — one for the application and one for the ACS server — and both terminate at the same provider VPN endpoint.
Cpehub Cloud
Cpehub Application
ACS TR-069 Server
VPN Tunnel (Cpehub)
VPN Tunnel (ACS)
Provider network
ISP VPN endpointReceives both VPN tunnels
OLTs
CPEs / ONUs
From the ISP VPN endpoint, traffic follows two "paths":
- Cpehub ↔ OLTs — to discover ONUs, read signals, provision, and receive events.
- ACS ↔ CPEs — for TR-069 (WiFi, WAN, diagnostics), when applicable.
Protocols and what they're for
| Protocol | Between | Used for |
|---|---|---|
| SSH / Telnet | Cpehub ↔ OLT | Running commands, provisioning, discovering ONUs |
| SNMP | Cpehub ↔ OLT | Reading status, signals, and inventory |
| SNMP Trap | OLT → Cpehub | Real-time events (drops/recoveries) |
| OMCI | OLT ↔ ONU | ONU management by the OLT (used by Cpehub via the OLT) |
| TR-069 / CWMP | ACS ↔ CPE | Remote configuration of the customer's equipment |
Why is the VPN mandatory?
Without the VPN, Cpehub (in the cloud) has no secure way to reach equipment on the provider's internal network. The VPN tunnel creates that path. That's why the first deployment step is setting up the VPN. See Communication (VPN).
Cpehub supports different tunnel protocols (WireGuard, IPSec/L2TP, and OpenVPN — coming soon); choose the one that best fits your infrastructure.