Cut down version of pfatt bypass from https://github.com/MonkWho/pfatt/

att.sh

#!/bin/sh
#
# CONFIG
# ======
#
# ONT_IF                  Interface connected to the ONT
#
# RG_ETHER_ADDR           MAC address of your assigned Residential Gateway
#
# Required Config
# ===============
ONT_IF="igb2"
RG_ETHER_ADDR="XX:XX:XX:XX:XX:XX"

##### DO NOT EDIT BELOW #################################################################################
ngctl=/usr/sbin/ngctl
ifconfig=/sbin/ifconfig
kldload=/sbin/kldload

logger() {
  /usr/bin/logger -st $@
}

logger "att" "starting att..."
logger "att" "configuration:"
logger "att" "  ONT_IF = $ONT_IF"
logger "att" "  RG_ETHER_ADDR = $RG_ETHER_ADDR"

logger "att" "resetting netgraph..."
$ngctl shutdown waneapfilter: >/dev/null 2>&1
$ngctl shutdown laneapfilter: >/dev/null 2>&1
$ngctl shutdown $ONT_IF: >/dev/null 2>&1
$ngctl shutdown $EAP_BRIDGE_IF: >/dev/null 2>&1
$ngctl shutdown o2m: >/dev/null 2>&1
$ngctl shutdown vlan0: >/dev/null 2>&1
$ngctl shutdown ngeth0: >/dev/null 2>&1

$kldload -nq netgraph
$kldload -nq ng_ether
$kldload -nq ng_vlan
$kldload -nq ng_eiface
$kldload -nq ng_one2many

logger "att" "configuring EAP environment for $EAP_MODE mode..."
logger "att" "cabling should look like this:"
logger "att" "  ONT---[] [$ONT_IF]$HOST"
logger "att" "creating vlan node and ngeth0 interface..."
$ngctl mkpeer $ONT_IF: vlan lower downstream
$ngctl name $ONT_IF:lower vlan0
$ngctl mkpeer vlan0: eiface vlan0 ether
$ngctl msg vlan0: 'addfilter { vlan=0 hook="vlan0" }'
$ngctl msg ngeth0: set $RG_ETHER_ADDR

logger "att" "enabling promisc for $ONT_IF..."
$ifconfig $ONT_IF up
$ifconfig $ONT_IF promisc

logger "att" "starting wpa_supplicant..."

WPA_DAEMON_CMD="/usr/sbin/wpa_supplicant -D wired -i ngeth0 -B -c /conf/att/wpa_supplicant.conf"

# kill any existing wpa_supplicant process
PID=$(pgrep -f "wpa_supplicant.*ngeth0")
if [ ${PID} > 0 ];
then
  logger "att" "terminating existing wpa_supplicant on PID ${PID}..."
  RES=$(kill ${PID})
fi

# start wpa_supplicant daemon
RES=$(${WPA_DAEMON_CMD})
PID=$(pgrep -f "wpa_supplicant.*ngeth0")
logger "att" "wpa_supplicant running on PID ${PID}..."

# wait until wpa_cli has authenticated.
WPA_STATUS_CMD="wpa_cli status | grep 'suppPortStatus' | cut -d= -f2"
IP_STATUS_CMD="ifconfig ngeth0 | grep 'inet\ ' | cut -d' ' -f2"

logger "att" "waiting EAP for authorization..."

# TODO: blocking for bootup
while true;
do
  WPA_STATUS=$(eval ${WPA_STATUS_CMD})
  if [ X${WPA_STATUS} = X"Authorized" ];
  then
    logger "att" "EAP authorization completed..."

    IP_STATUS=$(eval ${IP_STATUS_CMD})

    if [ -z ${IP_STATUS} ] || [ ${IP_STATUS} = "0.0.0.0" ];
    then
      logger "att" "no IP address assigned, force restarting DHCP..."
      RES=$(eval /etc/rc.d/dhclient forcerestart ngeth0)
      IP_STATUS=$(eval ${IP_STATUS_CMD})
    fi
    logger "att" "IP address is ${IP_STATUS}..."
    break
  else
    sleep 1
  fi
done
logger "att" "ngeth0 should now be available to configure as your WAN..."
logger "att" "done!"