A few months ago I wrote a guide to bypassing the AT&T fiber modem using a UniFi USG, and I’ve since upgraded to the UniFi Dream Machine Pro and wanted to write an updated guide since the process is a bit different.

To recap, the AT&T router/gateway has no true bridge mode, so it’s incompatible with the UDM Pro’s DHCP and my current home network. I’d end up in a double NAT situation unless I let AT&T’s modem handle everything like DHCP, firewall, port forwarding, etc. Not ideal!

Unfortunately the RG (that’s what AT&T calls the modem) authenticates with the AT&T fiber network with a special hard-coded certificate unique to each modem, so you can’t just throw the RG into a bin and plug your USG directly into the fiber ONT. It’ll fail the handshake and never go online. Unless you follow this guide. 🙂

The steps for the UDM Pro and the USG are slightly different, so here’s my new guide that I’ve cobbled together from other online sources.

Before you start

First we need a rooted NVG589 modem. AT&T may not have supplied you with this model (I was given a Pace 5268AC), but they can be found on eBay sometimes. Follow this guide that details rooting the device and extracting the needed certificate files.

OR you can do what I did and purchase the rooted files. For about $40 I was able to instantly move to the next step without waiting for a modem to ship and bumbling through rooting the device. A seller called maczrool on eBay sells unique rooted certificates and seems to have a lot of them.

In order to move forward you need the following files from your rooted RG (or eBay):

• CA_XXXXXX-XXXXXXXXXXXXXX.pem
• Client_XXXXXX-XXXXXXXXXXXXXX.pem
• PrivateKey_PKCS1_XXXXXX-XXXXXXXXXXXXXX.pem
• wpa_supplicant.conf
• The MAC address of the rooted device (printed on the back of the RG, or included with the files from eBay)
• The IP address, username, and password of your UniFi controller. In this guide I’m using 10.0.1.5 for the IP and admin for the username.

Instructions

Step 1

First we need to enable SSH access to the UDMP (UniFi Dream Machine Pro), which is configured differently from other UniFi products.

First navigate to the IP or hostname of your UDMP (ex: 192.168.1.1)

Then go to Advanced and toggle SSH on. You will also need to set a SSH password, so do that next and hit Confirm.

Step 2

Open a terminal window and copy your 4 certificate files to the UDMP. Replace 192.168.1.1 with your UDMP’s IP address. Your username is root and the password is the password you set in Step 1.

# switch to the directory where you saved your files
$ cd /path/to/*.pem
# copy the PEM files to the UDMP using SCP
$ scp ./*.pem root@192.168.1.1:/tmp/
# copy wpa_supplicant.conf to the UDMP using SCP
$ scp ./wpa_supplicant.conf root@192.168.1.1:/tmp/

Next SSH into your UDMP, and move the files to their final place.

# ssh into the UDMP
$ ssh root@192.168.1.1
# create the certificate directory
mkdir /mnt/data/podman/wpa_supplicant/
# copy files into the new directory
$ cp -arfv /tmp/*pem /tmp/wpa_supplicant.conf /mnt/data/podman/wpa_supplicant/

Step 3

We need to modify the wpa_supplicant.conf file with the correct file paths of your .pem certificate files. Run each of these commands only once!

$ sed -i 's,ca_cert=",ca_cert="/etc/wpa_supplicant/conf/,g' /mnt/data/podman/wpa_supplicant/wpa_supplicant.conf
$ sed -i 's,client_cert=",client_cert="/etc/wpa_supplicant/conf/,g' /mnt/data/podman/wpa_supplicant/wpa_supplicant.conf
$ sed -i 's,private_key=",private_key="/etc/wpa_supplicant/conf/,g' /mnt/data/podman/wpa_supplicant/wpa_supplicant.conf

Step 4

We need to install the wpa_supplicant-udmpro Docker image by pbrah, which will authenticate requests to the AT&T fiber network. There are instructions in the GitHub repo, and I am reproducing them here with some added detail.

Assuming your UDMP is connected to the internet via the RG and that your RG is attached to Port 8 (the ethernet WAN port, not the SFP+ port), run this command to download the Docker image:

$ podman run --privileged --network=host --name=wpa_supplicant-udmpro -v /mnt/data/podman/wpa_supplicant/:/etc/wpa_supplicant/conf/ --log-driver=k8s-file --restart always -d -ti pbrah/wpa_supplicant-udmpro:v1.0 -Dwired -ieth8 -c/etc/wpa_supplicant/conf/wpa_supplicant.conf

Only if your RG is attached to Port 10 (the SFP+ WAN port) run this command instead:

$ podman run --privileged --network=host --name=wpa_supplicant-udmpro -v /mnt/data/podman/wpa_supplicant/:/etc/wpa_supplicant/conf/ --log-driver=k8s-file --restart always -d -ti pbrah/wpa_supplicant-udmpro:v1.0 -Dwired -ieth10 -c/etc/wpa_supplicant/conf/wpa_supplicant.conf

Step 5

We’re in the home stretch! We need to make sure the Docker image runs every time the UDMP is rebooted. Fortunately there’s a UDMP Boot Script on GitHub that we can use for exactly this purpose.

SSH into the UDMP and download the script:

# SSH into your UDM
$ ssh root@192.168.1.1
# start UniFi OS shell
$ unifi-os shell
# download udm-boot_1.0.1-1_all.deb and install it
$ curl -L https://udm-boot.boostchicken.dev -o udm-boot_1.0.4_all.deb
$ dpkg -i udm-boot_1.0.4_all.deb
$ exit

We need to create a small shell script to finish up.

$ nano /mnt/data/on_boot.d/10-wpa_supplicant.sh

Copy and paste this snippet into nano:

#!/bin/sh

podman start wpa_supplicant-udmpro

then press Ctrl O then Ctrl X to save and close.

We need to make the script we just created executable, too.

chmod +x /mnt/data/on_boot.d/10-wpa_supplicant.sh

Step 6

Now reboot your UDMP and plug the ethernet cable from your fiber ONT directly into the WAN port of your UDMP. It’ll take a few minutes to boot up. Once it’s back online, you should have internet connectivity! You can also check it’s working by SSHing back into the UDM and viewing the Docker logs:

$ ssh root@192.168.1.1
$ podman logs -f wpa_supplicant-udmpro

If you see output like this, then it’s definitely working!

...
eth8: CTRL-EVENT-EAP-PEER-CERT depth=0 subject='/C=US/ST=Michigan/L=Southfield/O=ATT Services Inc/OU=OCATS/CN=aut03pltnca.pltnca.sbcglobal.net' hash=XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
eth8: CTRL-EVENT-EAP-PEER-ALT depth=0 DNS:aut03pltnca.pltnca.sbcglobal.net
eth8: CTRL-EVENT-EAP-SUCCESS EAP authentication completed successfully
...

Press Ctrl C to close the log viewer.

Additional resources

• I also have a guide for doing this on the UniFi USG
• wpa_supplicant-udmpro and udm-utilities on GitHub - most of this guide is adapted from their great work!
• Guide for rooting NVG510 and NVG589
• maczrool on eBay (I bought my certs from him)

I’ve been using 1Blocker basically since it came out to block ads, trackers, social widgets, and the like on my Mac and iPhone. It blocks pretty much everything and rarely breaks websites.

Along with the default lists, you can specify your own custom rules to block entire sites (like Facebook!), cookies, and… CSS elements.

Oh boy! Are you thinking what I’m thinking?

I have two simple principles:

1. Make the Web a more calm place. Daily tasks like shopping, budgeting, and reading the news should be task-oriented.
2. Fuck ads.

Ok let’s butcher some websites!

Amazon

The difference is shocking. At first, it feels like there’s something missing. But that feeling quickly goes away… especially once you remember that 100% of the garbage that Amazon puts in front of you isn’t actually relevant to what you’re searching for. But you know what is? The search bar!

It turns out the product page has a lot of redundant information, and all of the added clutter actually makes it harder to find the information you’re looking for. Without all of the extraneous information the product images are bigger too!

The default 1Blocker rules also don’t catch Amazon’s ads for pills, extended warranties, and their music service. None of which I ever plan to use.

Here’s what the magic looks like behind the scenes:

"rules": [
  {
    "content": {
      "action": {
        "type": "css-display-none",
        "selector": "#nav-upnav .nav-a, #nav-upnav, #pageContent, #productAlert_feature_div, #percolate-ui-ilm_div, #hqpWrapper, #center-28_feature_div, #dpx-giveaway_feature_div, #rhf, #nav-xshop > *, #icp-nav-flyout, #nav-link-prime, #sc-new-upsell, #cart-recs-carousel, #cart-item-recs, .prime-ad-banner-content, .recsWidgetContainer, #bia-hcb-widget, .nav-template.nav-flyout-sidePanel-content, .navFooterMoreOnAmazon, #bia_content, #vse-related-videos, .similarities-widget, .sims-carousel-holder, #ask-dp-search_feature_div, #nav-subnav, #nav-global-location-slot, #nav-xshop, #nav-main, #issuancePriceblockAmabot_feature_div, #mbb_feature_div, #navFooter, #smileEligibility_feature_div, #alternativeOfferEligibilityMessaging_feature_div, #image-canvas-caption, #edpIngress_feature_div, #digitalDashLowProminenceAccordion_feature_div, #addToWishlistAccordion_feature_div, #tradeInButton_feature_div, #moreBuyingChoices_feature_div, #olpLinkWidget_feature_div, #va-related-videos-widget_feature_div, #giveaway_feature_div"
      },
      "trigger": {
        "url-filter-is-case-sensitive": true,
        "url-filter": ".*",
        "if-domain": [
          "*amazon.com"
        ]
      }
    },
    "name": "Hide Amazon.com annoyances",
    "id": "593554FC-931F-4C98-AA3F-11CF048AC7CD"
  }
]

At the end of this post, I’ll include a download link that adds all of these rules to 1Blocker with one click.

Mint

While I wait for Monarch to launch, I must rely on Mint for basic budgeting and cashflow tracking. Mint makes money by selling your financial data offering you credit cards and financial services scattered throughout the Mint app.

Or at least they used to!

Mint actually becomes somewhat usable when you reclaim 50% of the screen from ads and use it for… I don’t know, financial analysis… instead.

Yes, most of the ads have close buttons. But they come back every time you log in, and I just don’t have the mental energy to be disappointed by my 401(k) and close a bunch of ads for credit cards that offer worse points-per-dollar and lower credit limits than what I already have.

Slickdeals

Don’t judge me.

Sometimes I do browse. Can’t have too many 8TB NAS drives or Staples pricing errors on ballpoint pens, right? The only problem is that most of the screen real estate is devoted to ads and promoted “deals” that aren’t vetted by the community.

Or, at least, it used to be! Now it’s only crowdsourced deals. Slickdeals is a great example of a site that I’d typically never visit becuase it’s just too infested with ads, misdirection, and clutter to be useful. But with 1Blocker custom rules, it actually can be a useful resource sometimes.

Get the Calm Web extension

You can download a pre-packaged Calm Web extension that includes support for Amazon, Mint, Chase, Target, MacRumors, Slickdeals, and a few more.

I put it up on GitHub in the hopes that folks will contribute their own custom rules. The Web is a noisy, frantic place full of ads, distractions, and clutter. Maybe we can calm it down a bit. 😌

As an eBay Partner, I may be compensated if you make a purchase.

Last week I discovered that AT&T had run fiber optic cable in my neighborhood. It was a no-brainer for me to switch from Comcast’s ‘gigabit’ (1000/40) service to AT&T’s symmetrical (1000/1000) fiber to the home. $10 cheaper, no less!

The onsite tech did an amazing job running a dedicated fiber line right into my garage and mounting the ONT right above my lab. And I’ve got near line speeds (~946 symmetrical on Ethernet), so everything is perfect.

…except the modem. Look at this chonker! It has its own ZIP code! And they somehow couldn’t fit the power supply inside the mammoth plastic shell, so it has a power brick too.

Also, it has no true bridge mode, so it’s incompatible with my UniFi Security Gateway and current home network. I’d end up in a double NAT situation unless I let AT&T’s modem handle DHCP, firewall, port forwarding, etc. Not ideal!

Unfortunately the RG (that’s what AT&T calls the modem) authenticates with the AT&T Fiber network with a special hard-coded certificate unique to each modem, so you can’t just throw the RG into a bin and plug your USG directly into the fiber ONT. It’ll fail the handshake and never go online. Or can you?

I tried two methods, and happily landed on the latter. This guide is a consolidation of a smattering of guides I found online.

Method 1: EAP Proxy

This method requires that you plug the RG into the WAN2/LAN2 port on the USG, and configures the USG to forward authentication packets between the RG and ONT. This bypasses the RG’s NAT and DHCP letting you run your network normally, as if there were a true bridge mode from AT&T.

This method is less desirable because it requires the huge bulky RG to be plugged in at all times.

I won’t go into detail on this method because the complete guide lives on Taylor Smith’s blog.

Method 2: wpa_supplicant

This method is vastly preferred because you can connect the USG directly to the ONT without needing the RG at all. It’s more work though—-you need the private key from a working RG (model NVG589) obtained by rooting the device.

Then you install the wpa_supplicant on the USG and instruct it to use the .pem files you obtained from the sacrificial RG.

This guide is adapted from a DSLReports forum thread on this topic. This guide may also work with the Unifi Security Gateway Pro and the Dream Machine / Dream Machine Pro but I haven’t personally tested it.

Instructions

Step 1

First we need a rooted NVG589 modem. AT&T may not have supplied you with this model (I was given a Pace 5268AC), but they can be found on eBay sometimes. Follow this guide that details rooting the device and extracting the needed certificate files.

OR you can do what I did and purchase the rooted files. For about $40 I was able to instantly move to the next step without waiting for a modem to ship and bumbling through rooting the device. A seller called maczrool on eBay sells unique rooted certificates and seems to have a lot of them.

In order to move forward you need the following files from your rooted RG (or eBay):

• CA_XXXXXX-XXXXXXXXXXXXXX.pem
• Client_XXXXXX-XXXXXXXXXXXXXX.pem
• PrivateKey_PKCS1_XXXXXX-XXXXXXXXXXXXXX.pem
• wpa_supplicant.conf
• The MAC address of the rooted device (printed on the back of the RG, or included with the files from eBay)
• The IP address, username, and password of your UniFi controller. In this guide I’m using 10.0.1.5 for the IP and admin for the username.

Step 2

Download wpa_supplicant from the DSLReports forum, then copy the file to a writeable folder on your USG.

# switch to the directory where you downloaded wpa_supplicant
$ cd /path/to/wpa_supplicant
# copy wpa_supplicant to the USG using SCP
$ scp ./wpa_supplicant admin@10.0.1.1:/config/scripts/post-config.d/

SSH into your USG using the username/password you use to log into your UniFi Controller software. I use SSH keys in UniFi, so no password needed :)

$ ssh admin@10.0.1.1
# move wpa_supplicant to the right folder
$ sudo mv /config/scripts/post-config.d/wpa_supplicant /config/scripts/

Step 3

Create a wpa_supplicant.sh script using the code below.

cd /config/scripts/post-config.d/
nano wpa_supplicant.sh

This will open a text editor in your terminal called nano. Paste the below script into your terminal.

#!/usr/bin/env bash

# Start EAP-TLS on eth0
# Check if already running to avoid multiple instances
# Created by AntiTrust on DSLReports.com on May 15, 2019
# https://www.dslreports.com/forum/r32391619-
  
IF_WAN=eth0
PROCESS_NAME=wpa_supplicant
PROCESS_PATH=/config/scripts/wpa_supplicant
PROCESS_COUNT=$(ps -A | grep $PROCESS_NAME | egrep -v "grep|$(basename $0)" | grep -c $PROCESS_NAME)
  
if [ $PROCESS_COUNT = 0 ] && [ -x $PROCESS_PATH ]; then
  $PROCESS_PATH -s -B -Dwired -i$IF_WAN -c/config/scripts/wpa_supplicant.conf -g/var/run/wpa_supplicant.ctrl -P/var/run/wpa_supplicant.pid
fi

To save the file, press Ctrl O then Ctrl X. Now set appropriate file permissions.

$ chmod +x /config/scripts/wpa_supplicant
$ chmod +x /config/scripts/post-config.d/wpa_supplicant.sh

Step 4

Back on your local terminal window, copy your files from Step 1 to your USG.

# switch to the directory where you saved your files
$ cd /path/to/*.pem
# copy the PEM files to the USG using SCP
$ scp ./*.pem admin@10.0.1.1:/config/scripts/post-config.d/
# copy wpa_supplicant.conf to the USG using SCP
$ scp ./wpa_supplicant.conf admin@10.0.1.1:/config/scripts/post-config.d/

And in the terminal window where you’re SSH’ed into your USG, move the files to the right places.

# move PEM files
$ sudo mv /config/scripts/post-config.d/*.pem /config/auth/
# make PEM files read-only
$ sudo chmod -R 0600 /config/auth
# move conf file
$ sudo mv /config/scripts/post-config.d/wpa_supplicant.conf /config/scripts/

Step 5

Log into your UniFi controller web interface. Go to Settings › Networks › WAN › Common Settings and enable Use VLAN ID and set it to 0

Step 6

We need to trick the AT&T Fiber network into thinking your USG is actually the RG. To do that, we’re going to spoof the USG’s MAC address to match the RG’s. The MAC address spoof feature isn’t present in the UniFi controller web interface, so we need to edit the config.gateway.json file directly.

$ ssh admin@10.0.1.5
$ cd /usr/lib/unifi/data/sites/default/
$ nano config.gateway.json

It should open a blank file. If it’s not blank, then you probably already know what you’re doing 🙂 Paste the following code into nano.

{
	"interfaces": {
		"ethernet": {
			"eth0": {
				"mac": "XX:XX:XX:XX:XX:XX"
			}
		}
	}
}

To save the file, press Ctrl O then Ctrl X. Now set appropriate file permissions.

$ chown unifi:unifi config.gateway.json

Step 7

We’re in the home stretch! In the UniFi Controller web interface, go to Devices › USG › Config › Manage Device and click the Provision button under Force Provision.

While you’re waiting for your USG to provision, unplug the RG from the ONT and USG, and plug the Ethernet cable coming out of the ONT into the WAN port on your USG.

After about 5 minutes, reboot your USG (unplug and plug it back in). Once it’s back online, try to browse the Web. It should work! If it does, go ahead and throw your thicc boi RG in a storage bin or something.

You can confirm it’s working by SSHing into the USG.

$ ssh admin@10.0.1.1 # the IP of your USG
$ tail -n 100 -f /var/log/messages | grep wpa_supplicant

If you see output like this, then it’s definitely working!

...
Mar  1 17:24:18 USG wpa_supplicant[5150]: eth0: CTRL-EVENT-EAP-PEER-CERT depth=0 subject='/C=US/ST=Michigan/L=Southfield/O=ATT Services Inc/OU=OCATS/CN=aut03pltnca.pltnca.sbcglobal.net' hash=XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
Mar  1 17:24:18 USG wpa_supplicant[5150]: eth0: CTRL-EVENT-EAP-PEER-ALT depth=0 DNS:aut03pltnca.pltnca.sbcglobal.net
Mar  1 17:24:57 USG wpa_supplicant[5150]: eth0: CTRL-EVENT-EAP-SUCCESS EAP authentication completed successfully
Mar  1 17:24:57 USG wpa_supplicant[5150]: eth0: CTRL-EVENT-CONNECTED - Connection to XX:XX:XX:XX:XX:XX completed [id=0 id_str=]
...

Additional resources

• AntiTrust’s guide on DSLReports - most of this guide is adapted from his great work!
• Guide for rooting NVG510 and NVG589
• maczrool on eBay (I bought my certs from him)
• DSLReports forum thread where I learned that this actually works on USG (previously it seemed it only worked on EdgeRouters and possibly UDM via Docker)

With summer approaching, we’ve been spending more and more time outside in the yard. We recently upgraded our media center with a Sonos Beam and I wanted to stay in the Sonos ecosystem with other speakers around my house-including outdoors.

My first surprise was that Sonos doesn’t have a battery-powered speaker. I sort of assumed based on the ubiquity of cheap Bluetooth speakers that Sonos would have a high-end version. Nope. Next, I checked the aftermarket for a battery dock or external battery add-on. No dice.

Getting creative

In my search, I found a post by James Callaghan where he added a microUSB port to his Play:1 with a boost converter to run off a standard 5v battery pack. One downside he discovered was the relatively low max volume due to the boost converter stepping down the amperage to get the necessary 24v out of the 5v USB supply.

I had an idea. USB-C Power Delivery is everywhere these days, and can deliver 20v at up to 5a. I did some searching and found a USB-C PD “decoy” board that has a USB-C port and a chip that tricks a PD-compatible charger into thinking it’s charging a device at 20v.

It works perfectly! Now I can bring my Sonos out into the yard with a 26800mAh battery pack and it lasts pretty much all day. Instructions below if you’re interested in making your own!

Instructions

Get yourself a Sonos Play:1 that you want to hack. This will void your warranty! So be careful and take your time. I’m not responsible for bricked Sonoses :)

1. Flip over your Play:1

2. Peel off the rubberized foot strip with a thin screwdriver or spudger. Go slowly to avoid damaging the adhesive. If you do it correctly, it’ll go back on at the end looking brand new.

3. Remove the four Torx #10 screws from the base, then remove the base by lifting straight up.

4. Remove the metal screen by sliding it straight up and off the unit. You may need to squeeze the sides a bit to clear the ethernet port and grounding lug.

5. Flip over the unit and remove the four Torx #9 screws from the sides of the top cover.

6. Carefully remove the top cover. It is wedged on tightly with foam and a little bit of adhesive. Don’t yank it off or you might damage the delicate ribbon cable connecting the buttons and indicator light. Once it’s loose, tilt it up towards the back of the device (away from the speaker).

7. Unlatch the ribbon cable with your finger. There is a small plastic flap holding the cable in place. Swing it open and the cable will fall out. Set the top cover aside.

8. Flip the unit over so that it’s speaker-side down. Gently peel off the foam tape on either side of the rear cover. Go slowly. It’s easy to tear this tape and ruin it, but it is possible to cleanly remove it in one go. Set the strips aside—we’ll reuse them during reassembly. Don’t worry if you tear the tape. You can either piece it back together or replace it with vinyl electrical tape if needed.

9. Remove the six Torx #9 screws from the rear cover and gently pry the rear cover away a few mm from the unit. Don’t pull too far—there are cables connecting the two halves that need to be disconnected first.

10. With your fingers, unlatch the speaker cable near the top of the rear cover. Fold the rear cover down so that the bottom edge of the rear cover is resting against the inside of the main unit.

11. With your fingers, unlatch the power cable near the bottom of the rear cover.

12. Remove the two Torx #6 screws securing the Wi-Fi card. If the screws are covered with hot glue, carefully cut the glue away first. Pull the Wi-Fi card straight out from the connector to avoid damaging it.

13. Remove the six Torx #10 screws securing the motherboard to the rear case. Gently pry the motherboard out, being careful not to touch the thermal pad on the rear of the heatsink.

14. Strip about 5mm off the ends of a 15cm piece of 24awg silicone stranded wire. You can use any kind of wire you like, but I prefer silicone because it’s easy to work with and very flexible. One black (negative) and one red (positive).

15. Flow some solder on the positive and negative pads of the ZYPDS decoy USB-C board, and tin the leads of the silicone wire. Solder them together, then put a small piece of heatshrink tubing over the board and shrink it down.

16. Solder the other ends of your positive and negative wires to the DC output on the back of the motherboard. Run the wires down towards the ethernet jack and secure with electrical tape.

17. Time to make a hole in the rear case to accommodate the USB-C port. I chose to drill out the mounting terminal since I never mount my Sonos speakers. It’s the perfect size for the USB-C port and has the added bonus of not needing to cut the metal screen. I used a 3/8” wood drill bit with some WD-40 as lubricant. Go slowly! Let gravity do the work. Eventually you’ll break through. Take care to clean up all your chips and the lubricant after you’re done… you don’t want any of the zinc shavings shorting out the electronics!

18. Time for a dry fit. Feed the USB-C connector through the hole you made. If it fits, center the port in your hole using a spare USB-C lead. Place the motherboard back into the rear case to check the clearance. Fill in the gaps around the connector with hot glue from the outside. Once it’s dry, fill in from the inside as well. Cut the excess glue on the outside flush with the foam.

19. Re-assemble the Play:1 following the previous instructions in reverse.

20. The moment of truth—time to test it out. Re-attach the ribbon cable to the top case and plug in a USB-C power supply. A white light means it’s working!

21. The USB-C port is slightly larger than the mounting hole opening in the plastic. I used a Dremel to widen the hole a bit where the port lined up. It didn’t turn out as clean as I hoped, but fortunately it’s on the back of the device where no one will really see it.

At this point, you’re pretty much done. But I also went a step further by painting the screen white to match the Sonos One in my living room. I used Krylon Fusion all-in-one White for this project and it matches almost perfectly.

Result

I’m very happy with how these turned out (oh, I made two!) They work brilliantly in the yard. I also set up AirConnect on my Synology DS918+ so that they appear as AirPlay devices in iOS! Normally you need the newer Sonos One for that.

The volume gets loud. I was able to turn it up well beyond the maximum comfortable listening volume. USB-C Power Delivery works like a champ!

Thanks:

• Battery powered portable Sonos Play:1 - James Callaghan
• Sonos Play 1 Motherboard Replacement - iFixit Repair Guide
• Painted my white Play1 so it’s actually white - /u/Candlejaack