TTLS-PAP merely runs PAP over a TLS connection. So, you can possibly use 2-factor authentication though I’ve only used one. I may add certificate authentication after this.

Just a couple of question on Unifi, do they install a single core fiber or 2 core fiber? I heard its a single core for two way communication. Its is possible for a single fiber for two way communication?

Th

What you must realize is that many ISPs use PTR records for a very different purpose than it was designed in the first place. There is no glue between the PTR and the actual A record (if there is any for that particular IP address).

To verify this claim, you need to do something like this :

1- Find the authority record for the reverse domain :

Asking dns1.chinaunicom.com.hk about 125.45.96.89 returns that information :

AUTHORITY RECORDS:
-> 45.125.in-addr.arpa
type = NS, class = IN, dlen = 19
nameserver = ns.halyptt.net.cn
ttl = 86400 (1 day)

This means that the server that holds the rights to provide authorized information about that request is ns.halyptt.net.cn.

2- Ask that server about the same IP address :

Name : hn.kd.ny.adsl
Address: 125.45.96.89

3- Try that same server with what it just gave as a PTR :

> hn.kd.ny.adsl
*** ns.halyptt.net.cn : Query refused

This means that this server is made to only accept PTR requests. Other ISPs do the same thing, sometimes with custom TLDs, sometime not. For example, tracing to aol.com returns one of the following hop from my location :

te0-1-0-1.ccr21.ymq02.atlas.cogentco.com

However, when trying to forward-request the IP of that PTR, cogentco’s own DNS system refuses the query.

Why do they remove the glue? I don’t know, but I also don’t know why they would provide it. For ISPs, the PTR records are a way to enable more verbose traceroutes. On the other hand, public A records would not provide any benefit. Most (if not all) ISPs have their own internal management infrastructure that is not only inaccessible from the Internet itself, but also relies on private DNS and IP networks.