Unlocking BT 2Wire 2700HGV Business Hub (wireless router)

 

Contents > BT v6.3 firmware:

 

 

 


Blocking the Provisioning server

Nov 11: A number of reports from readers experiencing random rebooting of their hubs. Affecting modified and unmodified hubs with various firmwares including BT v6.3.x, v6.1.1.22, & Qwest. There seems to be some sort of issue with motive.com servers. Blocking communications with the servers seems to resolve the issue with BT firmwares.



Key features

+ Blocks all upgrades and communications between hub and BT motive.com servers.

+ It may improve performance/reliability by not running Enhanced Services. Fixes 2+GB file download bug in BT v6.3.9.41-plus.tm.

- Enhanced Services (Content Screening, Access Controls, Firewall Monitor, Link Monitor) is disabled if applied before establishing first internet connection after a factory reset of the hub.



Adrian C. wrote to say he had found a way of blocking communications between his hub running BT v6.3.x firmware and the provisioning servers at motive.com.   Here is an edited copy of his email.

 

You can stop the hub from contacting the BT/Motive update servers by adding a static route. I've got hold of a 2701HGV-C hub and I'm currently using it on a Virgin Media ADSL line.  My initial thought was to try adding a DNS Resolution entry, but the router ignored it and still contacted the update/provisioning server (Editor's note: This has been tried and does not work).   However, adding a pair of static routes that cover the Motive.com IP subnets, does seems to work.

I added these two entries under Setting > Broadband > Routing


IP: 66.193.112.0     Subnet: 255.255.254.0     GW: 192.168.1.100
IP: 64.186.176.0     Subnet: 255.255.240.0     GW: 192.168.1.100


If IP address 192.168.1.100 is likely to be used on your network, use a different unused local IP address. eg. 192.168.1.250 in this image:




After adding them, the System log now shows:

cwmd: retried session started, server: 'http://pbthdmw.bt.motive.com/cwmpWeb/CPEMgt', event code(s): '4 VALUE CHANGE,0 BOOTSTRAP'
cwmd: httpc_poll_dispatch - Connection timed out
cwmd: session failed...


 

A step by step guide for the BT 2701HGV-C can be found here.





Note that the Link Monitor menu can be accessed on v6.x firmwares via this direct link: http://home/xslt?PAGE=C_5_1

Ensure you are logged into the hub, otherwise the Link Monitor will not display any activity on v6.1 firmwares.

Link Monitor is available on v6.3 firmwares from the How Fast? Link found on the hub's home page.






Troubleshooting



Q. I get a subnet mask error when I try to enter 66.193.112.0 and 64.186.176.0 subnets.

A. You need to factory reset the hub and add the static routes before permitting the hub to successfully to connect to the internet. I have witnessed this issue with v6.1.1.48.1 firmware.



Q. I get a 'Page not found' error message when I try to access Settings > Broadband > Routing page.

A. If the hub is brand new or has been factory reset, edit the Settings > Broadband > Link Configuration page by entering valid PPP username (or use fake me@btbroadband.com PPP username) and ATM parameters. It may also help if you untick the 'ATM PVC Search' check box too. Then try accessing the above page again.






List of known Provisioning servers at motive.com

Server URL:

Last known IP address

pbthdm.bt.motive.com

66.193.112.93

pbthdmw2.bt.motive.com

64.186.176.40

pbthdmw.bt.motive.com

66.193.112.94






Test Results

(25 Sep 11): Alan B. reports this works on a hub with BT v6.1.1.48.1-enh.tm firmware.

(7 Oct 11): I have had one report from another reader that it does not seem to work on their 2700HGV with BT v6.1.1.48.1-enh.tm.

(26 Oct 11): I've also tried entering the static routes into my active 2700HGV with BT v6.1.1.48.1 firmware – I get a subnet mask error message. However, I now believe you need to apply the static routes before establishing a connection to the internet. Ensure broadband link parameters have been entered or use fake me@btbroadband.com PPP username and possible untick the ATM PVC Search check box, otherwise you may encounter a 'page not found' error when trying to access the Settings > Broadband > Routing page. Applying static routes hack this way, also fixes the active Network Devices List when OpenZone is disabled.

(10 Nov 11): My 2701HGV-C with v6.3.9.41-plus.tm firmware with the static route hack appears to be more reliable in operation – ie. No unexplained spontaneous restarts during the day time. It also fixes the 2GB download issue with this particular firmware release.

(11 Nov 11): According to Gnix, BT v6.1.1.22-enh.tm firmware appears to require this hack. He had been successfully using this firmware for over a year, and started witnessing random reboots recently with both his 2700HGV-2 and 2701HGV-E.



(16 Nov 11): Edd experiencing random restart issues with both 2700HGV flashed with Qwest QT04-6.1.5.48.2 firmware lately. Qwest fw doesn't permit static routes to be created.

(24 Nov 11): My own unmodified 2700HGV with BT v6.3.9.63-plus.tm spontaneously restarted this afternoon for no obvious reason. I was using a different laptop and it is too much of a coincidence I witnessed this problem with my unmodified 2701HGV-C (v6.3.9.41) several weeks ago. Finger of suspicion pointing to motive.com servers.

(7 Jan 12): My 2700HGV rebooted again after 2+ weeks of uninterrupted use when I was waiting for a 'File Save' dialogue box to appear in IE9 after clicking on a link to download a file. I will try the static route hack later this month on this hub. In the mean time, I've returned to using my 2701HGV-C (v6.3.9.41-plus.tm with static route hack) which I know to be stable from previous endurance testing last year – see earlier (10 Nov 11) entry.




This in theory should work on BT v5.29.117.6 firmware too by adding Static routes through the home/mdc  Advanced > Static Routes. However, modifying the Provisioning server URL is a better solution imho.

 

Word of warning: Motive.com could choose to change the IP addresses of their motive.com servers rendering the above static route hack ineffective.

 

 




Use 'Back' button to return to previous page or click here to return to main menu