Unfortunately CenturyLink provisions their fiber to the home with a PPPoE authentication over vlan 201, this makes replacing the router more difficult than it should be. I also had to call CenturyLink support to get the password for the PPPoE connection.
cnmac0 is the egress interface on my EdgeRouter Lite.
You also need to add match on pppoe0 scrub (max-mss 1440)