Unlocked Firmware For Bt Business Hub 2700hgv **Upgrade at your own risk**

Hi, first post.
Have an 2700hgv from eBay which I use with little difficulty on my Metronet ADSL service. I have applied the DNS resolve modification for the smehomehubrms.bt.com set to 10.0.0.0.
Now running software 5.29.107.19.
I'm sure when I first used the 2700hgv the software was an earlier version, but an upgrade seems to have been automatically applied soon after my first use, and among other changes a Fusion service was activated which had not been present initially.
From the Detailed Log, contact seems to be made (?daily) with 'https://pbthdm2.bt.motive.com/cwmpWeb/CPEMgt'.
With reference to the above post on VOIP there could be an interesting page at
http://gateway.2wire.net/xslt?PAGE=J62


Hope some of this is of interest

John

Does it involve pwrid

Originally Posted by ydrol

It does, but I doubt in the way you are thinking...

All that is required is the Opera browser and 19 lines of HTML (courtesy of 2wire's own website).

Does anyone know the login/pw details for the remote mdc access port on all 2700hgv's?

Try this:

https://[insert_your_outwardly_facing_ip_here]:50001

You should get a requester for login details titled "MDC Access". I'm sure this has been discussed (BT remote logging in) on here, but I couldn't find it.

I'm would imagine this is hardcoded in the firmware, which brings an important security question: if this information became publically available, could anyone use this to remote login into the router? (im guessing the login or pw is based around either the serial number or the MAC code, otherwise this would be unbeliveably stupid by BT / 2wire).

OK, its been a while since I posted, but a while back I posted a new BT firmware upgrade that enabled the BT fusion stuff. Not much use to anyone without the servive I agree.

Anyway, I have managed to once again get my hands on a new BT Firware upgrade or as they call it a Re-install.

Its version bt-2700hgv_reinstall_voice_adsl.2sp dated 24/05/2007

I have not tested it on my router as I don't have a spare knocking around to screw around with and can't afford to be without the net so I am posting it for free download for anyone who wants to try it, and share the outcome and any new features etc... with the rest of us.

I can say this. It is genuine BT firmware from BT. Can't say how I got it though but it is genuine.

http://www.sendspace.com/file/n9oz92

Hope this has some nice new stuff, Let me know pls.....

Have fun

DV8.

It does, but I doubt in the way you are thinking...

All that is required is the Opera browser and 19 lines of HTML (courtesy of 2wire's own website).

Originally Posted by perpetualmotionuk

I was thinking any browser and a bit of modified HTML to submit the form parameters?

Hi, first post.
Have an 2700hgv from eBay which I use with little difficulty on my Metronet ADSL service. I have applied the DNS resolve modification for the smehomehubrms.bt.com set to 10.0.0.0.
Now running software 5.29.107.19.
I'm sure when I first used the 2700hgv the software was an earlier version, but an upgrade seems to have been automatically applied soon after my first use, and among other changes a Fusion service was activated which had not been present initially.

Originally Posted by carnwath

Hi what is your exact dns entry?

I was thinking any browser and a bit of modified HTML to submit the form parameters?

Originally Posted by ydrol

With opera you can manipulate the actual config page to include the necessary lines of code, thus allowing the page to still work correctly AND have the WIFI power level dropdown box on the page.

No messy long URL's to worry about.

Hi what is your exact dns entry?

Originally Posted by ydrol

Cut and pasted:

https://cwmp.cms.smehomehubrms.bt.com 10.0.0.0 User added

John

Cut and pasted:

https://cwmp.cms.smehomehubrms.bt.com 10.0.0.0 User added

John

Originally Posted by carnwath

As PM'd it should be

cwmp.cms.smehomehubrms.bt.com 10.0.0.0

Or

cwmp.cms.smehomehubrms.bt.com 127.0.0.1

[patioheater]

You're up late

hey Perpet can you tell us this wireless increase hack? dying to know lol

I have a two SSID (BT fusion and regular wi-fi) BT2700HGV. I bought it off ebay and wanted to get it set up for pipex ISP. It doesn't have the two SSIDs on the chasis sticker, but it does have a WEP key. It's on software 5.29.107.12,
hardware version 2701-100588-005 and serial number 30**********.

Here is how I did it (no apparent need for a firmware up/down grade):


1. DNS poisoning trick: cwmp.cms.smehomehubrms.bt.com with the IP adress of 10.0.0.0
2. Run the System Setup Wizard and enter Key Code: 52AN-2374-WHE2-22AZ-B27S (and then continue through set up wizard)
3. If you want to edit any of the ISP settings in the "Broadband Link Advanced Settings" page, you can force the form to be submitted by copying and pasting the following into the browser address bar (and then hit Return)

javascript:document.pagepost.submit();

I was getting "Your PPP Username is not correct!" for my pipex username but fortunately it's a simple javascript verification function. Interesting viewing source of the web page.

With opera you can manipulate the actual config page to include the necessary lines of code, thus allowing the page to still work correctly AND have the WIFI power level dropdown box on the page.

No messy long URL's to worry about.

Originally Posted by perpetualmotionuk

I've access to a BT 2700HGV and a SBC 2700HG. Bookmarking the SBC wireless page and then using it to configure the BT works as the Event Log shows.
A more elegant solution would be better, particularly for single hub owners.

OK, its been a while since I posted, but a while back I posted a new BT firmware upgrade that enabled the BT fusion stuff. Not much use to anyone without the servive I agree.

Anyway, I have managed to once again get my hands on a new BT Firware upgrade or as they call it a Re-install.

Its version bt-2700hgv_reinstall_voice_adsl.2sp dated 24/05/2007

I have not tested it on my router as I don't have a spare knocking around to screw around with and can't afford to be without the net so I am posting it for free download for anyone who wants to try it, and share the outcome and any new features etc... with the rest of us.

I can say this. It is genuine BT firmware from BT. Can't say how I got it though but it is genuine.

http://www.sendspace.com/file/n9oz92

Hope this has some nice new stuff, Let me know pls.....

Have fun

DV8.

Originally Posted by DV8

This version removes the option to turn off remote access, therefore BT can always get in to the hub

This version removes the option to turn off remote access, therefore BT can always get in to the hub

Originally Posted by Jack sam

It looks like a lot of the BT locking features are at the HTML/client level only, so as long as you know which form variables to submit you may be able to bypass. The downside is that this information always needs to be readily available after a factory reset for example.

Using this router with the unlocked firmware. Initial thoughts were wow higher synch relatively stable.

But I am on a isp that has provided me with my own static ip range and I wish to allow all traffic to my pcs, pings etc.

It seems this router is very limited feature wise for such a configuration, it appears to offer either dmz mode which allows 1 ip full access but 1 pc only, or a default block inbound firewall where tcp/udp ports can be opened but no way to let icmp traffic through. Additionally disabling the misc protection on network attacks causes all traffic to fail to route through the router.

From what I see after much hours spent on this the router always operates in NAT mode even with static ips setup and appears to be limited feature wise, I couldnt even access firewall logs without using the management page.

For hardware thats designed for business use it is very dissapointing a proper LAN cannot be setup using this router.

If anyone has managed to get static ip routing working properly with this router with newer firmware or same firmware please tell me how thanks as the adsl synch is very good but without solving this problem the router is no good to me.

This version removes the option to turn off remote access, therefore BT can always get in to the hub

Originally Posted by Jack sam

Thanks for the info. best nopt be using it then. Will post any updates I get my hands on in the future.

DV8.

Using this router with the unlocked firmware. Initial thoughts were wow higher synch relatively stable.

But I am on a isp that has provided me with my own static ip range and I wish to allow all traffic to my pcs, pings etc.

It seems this router is very limited feature wise for such a configuration, it appears to offer either dmz mode which allows 1 ip full access but 1 pc only, or a default block inbound firewall where tcp/udp ports can be opened but no way to let icmp traffic through. Additionally disabling the misc protection on network attacks causes all traffic to fail to route through the router.

From what I see after much hours spent on this the router always operates in NAT mode even with static ips setup and appears to be limited feature wise, I couldnt even access firewall logs without using the management page.

For hardware thats designed for business use it is very dissapointing a proper LAN cannot be setup using this router.

If anyone has managed to get static ip routing working properly with this router with newer firmware or same firmware please tell me how thanks as the adsl synch is very good but without solving this problem the router is no good to me.

Originally Posted by Chrysalis

I'll fire off a question to 2wire but you may want to test it in bridged mode with a capable router (eg WRT54G). I *think* the OpenWRT firmware supports PPPoA directly without having to mess around with a PPPoE "mashup". Bridged mode can be hit-or-miss but I've seen one report with someone being very happy.

http://ask.metafilter.com/24414/How-...SL-Modemrouter

Read up on the WRT54GS models before grabbing a used one..

http://en.wikipedia.org/wiki/WRT54G#WRT54GS

I've got 4 32MbRam /8Mb Flash WRT54GS's in the attic if you're interested.

I've also got a block of IP's (Probably same ISP as you?) so I may give this a spin and report back.

PM/email me regarding 2wire.

Personally I think if it can bridge well with a hacked WRT54G then it's worth it for the quality of ADSL modem alone. You can bump a hacked WRT54G wireless transmit power up to 100mW also.

Hope this has some nice new stuff, Let me know pls.....

Originally Posted by DV8

Thanks DV8, if we get enough versions we should be able to do some interesting things in the future. So keep them coming !

just done this little tut and mine has worked a treat thank for all your help

Personally I think if it can bridge well with a hacked WRT54G then it's worth it for the quality of ADSL modem alone. You can bump a hacked WRT54G wireless transmit power up to 100mW also.

Originally Posted by ydrol

Quick update. Bridging PPPoA is very messy with the 2wire.
One method is to use OpenWRT + some PPPoA module + some Speedtouch firmware + a router that can take the ATM signal (via USB I think).
Horrible.

But it is possible to route directly to multiple IPs bypassing the NAT,
using either

Bridge Network + Address Allocation + DMZ Plus (if your Router IP is the start of your IP Block)

OR

Route Network + Address Allocation + DMZ Plus (if your router address is outside your IP Range)

Note you CAN have multiple machines in DMZ Plus mode when Briding or Routing the network.

[seya]

For info:
Singapore Telecom ADSL use 2wire 2700HGV, someone posted its firmware, the link below:
http://download.yousendit.com/C3DCD15E092BA521

For info:
Singapore Telecom ADSL use 2wire 2700HGV, someone posted its firmware, the link below:
http://download.yousendit.com/C3DCD15E092BA521

Originally Posted by seya

Hi do you have a link to the forum for some context?

[seya]

Hi do you have a link to the forum for some context?

Originally Posted by ydrol

Refer to this:
http://forums.hardwarezone.com/showt...2&page=6&pp=15

I have three 2700HG-B two of them are perfect with the unlocked software, the third branded AT&T will not sync with the ADSL.

Could this be a software problem, or is it plain broken??

All the usual checks have been carried out, and set up exactly as other two.

Brunel

Mongoose,
I have a way of changing the WLAN power output that doesn't require firmware hacking. PM me for more.

Originally Posted by perpetualmotionuk

Any chance you could let me into your little secret.
Many thanks in advance.

Any chance you could let me into your little secret.
Many thanks in advance.

See 3/4 way down this page
http://logikir100.tripod.com/ir1002700HGV.htm

You could also use any browser to save the page .. edit the html and load it again.

Another tip, move your main extension from the filter thats ahead of the router, into the LINE jack at the back ( It acts as a passthru ).
This further reduces noise on the line, and may give a little higher sync on troublesome lines.

Anyone tried that Singapore Firmware on a 2SSID model yet

Hi everybody.
I got Bt 2Wire Business Router with the initial software version 5.29.107.12, I used it on other ISP (not BT) for about 20 days, there's no problems. Then, about 10 June 2007, I updated the software to 5.29.107.19. from that on, the router keep rebooting itself. sometimes after rebooting i can gain the internet access, but sometimes not, i have to swich off the main power and swich on again to gain internet access.

Following this thread's front page, I up/downgrade the sofeware to recover 425 firmware. It worked perfectly. I also put my power lever on 10, and chose channel 6 (i got 1 to 11) which gave me 'Excellent' signal in windows XP wireless Network Monitor and 96% in Linksys wireless adaptor's indication.


As i want to use the VOIP in this router with voipstunt.com, i tried the Singapore Firmware. Again, it's working perfectly. I got the Voip configue page again. But I still do not know how to make it working with other voip rather than bt.

Just one problem, with the Singapore Firmware, i can access http://gateway.2wire.net/ and confirgue what i want, but when i want to access 'http://gateway.2wire.net/management (or managment, whichever),it asks for an MDC password. I set my system password, but this password is not valid for MDC. Some guys suggested there's a sticker under serial no, so called system password can do the work. but i cannot find such system password on my router.

Can anybody help me with this. thanks.

To halifaxuk.
Try 2wire as MDC password.

To halifaxuk.
Try 2wire as MDC password.

Originally Posted by Guest

Interesting , not come across that before. If that doesnt work then 'Wireless' is 2wire's default apparently...

http://www.mydigitallife.info/2007/0...s-singtel-mio/

Halifaxuk, Could you report back if you get into MDC page ok.