Quantum IPoE Platform
A line-rate IPoE BNG and the operator plane to run it.
Retire the chain of MikroTik-class boxes. One architecture on commodity x86 that grows by adding nodes — not by swapping in a bigger box.
One platform, two products
The forwarding plane, and the plane that runs it
Quantum IPoE ships as two cooperating products. QuantumBNG moves the packets; QuantumTouch is the single pane that lets a human operate the box. Each has its own page.
The forwarding platform
A disaggregated IPoE BNG: a VPP/DPDK data plane driven by a Node.js controller through a small gRPC translator. Forwards, polices, and accounts every subscriber at line rate.
- Two planes, three processes
- RFC 2698 green/yellow/red policing
- Prepaid captive-portal lifecycle
- Restart-safe — subscribers survive a restart
The operator plane
The management application composed over the headless BNG. One web front door onboards a box, harvests it every five seconds, and turns it into dashboards, audit, and snapshots.
- Guided setup wizard from bare install
- Live analytics + Prometheus surface
- Unified audit timeline, off-box to your SIEM
- Point-in-time configuration snapshots
Why we built it
Grow by adding nodes, not by buying a bigger box
A BNG sits at the edge of the access network and turns raw subscriber packets into managed, authenticated, rate-limited, accounted sessions — deciding who gets on, how fast they go, and how much they used.
The Quantum IPoE BNG does that job for IPoE subscribers on commodity x86, built to replace a chain of MikroTik-class boxes with a single architecture. One controller can drive multiple data-plane nodes: you add capacity by adding a node under the same operator-facing configuration.
- On the order of 100,000 concurrent subscribers on a commodity Dell R360-class server
- Horizontal growth — one controller, many data-plane nodes
- Runs standalone today with no RADIUS server at all
How it works
Two planes: the muscle and the brain
Everything hangs on one idea. The data plane forwards every byte at line rate and never touches a subscriber database per packet. The control plane holds all the intelligence — who is who, what plan they are on, when a session expires — and pre-programs the data plane.
In steady state, a connected subscriber's traffic is never seen by the controller. Only two tiny classes of packet are ever punted up: DHCP from an unknown subscriber, and inbound RADIUS CoA. That is why the box forwards at line rate while the controller's CPU stays low with a full session table.
See the forwarding architecture →What you get
Carrier-grade behaviour, honestly scoped
The capabilities below are real and running in the Community-Edition Alpha today. Anything still on the roadmap is called out separately, lower down the page.
Line-rate forwarding
VPP on DPDK drives dual Intel E810 NICs. Once a subscriber is set up, every packet is handled in userspace with no controller round-trip.
Three-colour policing
RFC 2698 two-rate policing meters every subscriber green / yellow / red, per direction — a rich per-subscriber usage picture, free on the fast path.
Prepaid captive portal
Expiry demotes a subscriber to a walled garden — same IP, next click lands on "top up to continue." The exact conversion path a prepaid operator depends on.
Restart-safe sessions
Session state is durable; timers rebuild from absolute deadlines. A controller restart doesn't drop 100,000 paying customers — and upgrades preserve live sessions.
Single-pane observability
QuantumTouch harvests the box every five seconds and renders live throughput, QoS bands, sessions, health, and hardware from one shared poll.
Audit & SIEM-ready
Four audit sources merged into one searchable timeline, shipped off-box to syslog/HTTP/S3 with at-least-once delivery. Prometheus at /metrics for your stack.
Built for prepaid fixed-wireless
Expiry is a conversion moment, not a disconnect
When a subscriber's prepaid time runs out, the BNG doesn't drop them. It closes accounting, keeps their IP, and flips them behind the captive portal. Their next browser action is a "top up to continue" page; the moment they pay, the portal calls the activate endpoint and they're connected again — same IP, no interruption.
- Captive is a property of the session, not a separate address pool
- DNS steering means no in-path HTTP interception to configure
- Unknown subscribers land directly in captive so they can sign up
For the NOC & network engineer
Every number on screen has a clock behind it
QuantumTouch is an observer and a controller-of-config — never a forwarder. If it's slow, restarting, or down, subscriber traffic is completely unaffected. VPP keeps forwarding; the controller keeps running the lifecycle.
One-glance verdict
A single Healthy / Degraded / Fault status with a plain-English reason sentence — because reading why beats reading what.
5-second heartbeat
A single sampler polls the controller, VPP, and the BMC on a fixed tick — the only lag you ever see is one tick, not four clocks drifting.
Prometheus + Grafana
~65 aggregate, reset-aware metric series at /metrics so your existing Alertmanager can page directly. Pull-based — no SNMP traps.
Snapshots & restore
Point-in-time snapshots across five configuration domains, content-hashed, with a careful locked restore and signed export/import.
Honest by design
Shipping today, and what's next
This is a Community-Edition Alpha. The forwarding path, lifecycle, captive portal, accounting counters, persistence, observability, audit, and snapshots are real and running. A handful of designed capabilities are named additions — we flag them rather than describe an aspiration as reality.
Shipping today
- Line-rate data plane — forwarding, anti-spoof, captive filter, policing, counters
- Full subscriber lifecycle — DHCP + embedded AAA, five-state machine, teardown
- Local authentication — open or gated; runs standalone with no RADIUS
- Prepaid captive portal and the activate/top-up path
- Restart-safe persistence; upgrades preserve live sessions
- QuantumTouch operator plane — onboarding, analytics, dashboards, audit, snapshots
On the roadmap
- Production RADIUS client — live sockets, failover, CoA/Disconnect listener, accounting-record assembly
- IPv6 — dual-stack / IPv6-only, DHCPv6, prefix delegation
- Prometheus-first analytics store (in-memory history is the store today)
- UI config writes for RADIUS / captive / pool (read cleanly today; diff-to-apply for now)
- Per-worker session tables — a path toward ~400k–500k per node
Resource Center
Watch the Quick Start series and grab the docs to deploy QuantumBNG.
Quick Start Series
Documentation
Get the QuantumBNG Community Edition
QuantumBNG is in alpha. Leave your email (optional) and we'll send new builds and feature updates through the alpha and beta — or just grab the download.
Stand one up on commodity hardware — today
The Community Edition runs standalone with no RADIUS server at all. It's the free-tier on-ramp to the full Quantum IPoE platform.