The BT
2700HGV business hub is supplied to BT business broadband customers since
2006.This ADSL wireless router is manufactured by 2Wire. I believe 2Wire
utilise their own ADSL modem chipset, but the 802.11b/g wireless functionality is provided
by Atheros. The factory supplied firmware is locked to BT Business
Broadband which prevents it from being used with any other ISP,
but this can be overcome.
It has a growing reputation of excellent wireless coverage with hidden wireless
power boost settings when using earlier firmwares. Revised hardware
started shipping from 2007 but BT have continued with the same model name.
Here is the original full discussion thread on the-scream.co.uk for
unlocking the BT version of the 2700HGV wireless hub where v4.25.x or 5.29.x
firmwares were installed..
(Originally created by forum member 'unlokia', it has now grown to 30 pages long
as of May 2009)
BT started beta testing a new v6.x firmware featuring BT
OpenZone hotspot functionality towards the end of 2008, and started rolling it
out to their business customers from March 2009. Unlike the earlier
v4 and v5 firmwares, this new v6 firmware has a new graphical user
interface. As a result of these modifications, there is presently no
information on how to access and edit the wireless power and VOIP settings.
Fortunately, it is possible to unlock the BT v6.x firmware for use with other
ISP networks.
The majority of the tips and
workarounds described on this webpage have been obtained from reading messages
posted by contributors to the above forum, and elsewhere.
Full credit should go to these contributors. This page merely tries to bring all this information together
along with my own experience of using 2Wire products into one convenient
place.
The 2700HGV is provided to BT Business Broadband customers, so
if you pick one up on eBay or wherever, it will come with no guarantee or warranty
from BT. Dlink, Linksys and Netgear routers normally come
with 3 year manufacturer's warranty (although PSU may only be guaranteed for 1
year) if purchased.
Well, like all 2Wire routers past & present, there is
no support for uPnP.
VOIP was designed to work with BT services but there are
discussions in the-scream.co.uk about how to persuade the 2700HGV to work with
other VOIP providers. I'm afraid I have no interest with VOIP - please
refer to The-scream
forums. Most ppl have had most success with configuring 3rd party VOIP when using BT
v5.29.107.12/19, less success with v5.29.117.x firmwares, and so far no success
with BT's new v6.x firmware.
With BT's new 6.x firmware, there is presently no way of
editing the wireless power setting. The default power output is 25mW which
is a quarter of the maximum power permissible for use in the UK.
Hubs with earlier v4 or v5 firmwares are a better bet if you need higher
wireless power outputs. Single SSID hubs with v4 firmware can support up
to 400mW, and the any hub with v5 firmware will support up to 100mW.
As with all 2wire routers, the 2700 doesn't support
configuration via telnet. If you are looking for high level of configurability which you may have come
to expect from other makes of routers from the likes of Thomson, Linksys,
Netgear etc, then I'm afraid you will need to look elsewhere.
From my experience of using past 2Wire gateway products, they tend to be
engineered for ease of use for the likes of Joe Public. I've not yet had
to reboot a 2wire router because it has frozen/locked up unlike past Linksys and
Netgear routers I've had the misfortune to use.
(Update
31 May 09): If you
are planning to purchase a 2700HGV hub, we recommend you avoid hubs with
BT v6.x firmware.
The BT supplied 2700HGV
hubs are often referred to as 'single' or 'dual' SSID models. This refers to
whether the label on the rear of the hub has two SSID
and wireless security keys printed as shown on the right of the two
pictures below.
First generation 2700HGVs manufactured in early
2006 are supplied in a predominantly white
multicoloured box with splashes of colour including red and orange, but BT changed to shipping them later in white & grey
boxes from late 2006 onwards up to the present day.
The first four digits of the serial number is printed on
the label which can be found on the underside of the 2700HGV hub. The
serial number can be used to identify the original manufacture date
from my experience of using previous 2Wire routers. The first two
digits represent week of manufacture and next two digits representing year of
manufacturer. Where the serial number commences with a '9', it should be
interpreted as a '0'. eg. 9307 would represent week 3 of 2007. 1407
would represent week 14 of 2007.
The number
printed beneath the lower bar code is the 'Assembly Number' and usually begins
with '42'.
Tip: The serial
number is also duplicated onto the labels attached to the outside of the
cardboard shipping box. If you are planning to purchase a brand new sealed
boxed BT 2700HGV hub, you can use the manufacture date information contained in
the serial number to try and ascertain what the 'Assembly Number' is likely to
be. If the hub is still in its sealed box, then the factory installed
firmware on the hub should be as listed below for the relevant Assembly Number.
The example opposite shows a serial number
commencing '9408'. This hub was manufactured in week 4 of 2008, and
is for a hub which has Assembly No. 4201-003003-008 with factory
installed BT firmware v5.29.117.6
The Hardware version is reported by the firmware on the 'System' -> 'Details' page
on the web interface and usually begins with '27'.
Use any web browser and type 'home' or '192.168.1.254'
in the address box.
Now navigate to 'System' > 'Details' page.
In early 2007, BT
started shipping newer hardware. This coincided with Dual SSID labels
appearing on the hubs.
The following list of Assembly numbers is by no means complete or
accurate. The firmware versions listed below are believed to be what was
installed onto the hub when it was manufactured. Please note that BT regularly
upgrade the firmware on all 2700HGV hubs connected to their broadband networks.
As a result, the firmware that may be present on an 'used' example of a BT
2700HGV hub is likely to be newer than the version which was originally
installed at the factory.
BT Business Hub v2.0 shipped in grey/white
carton.
Dual SSID printed on label.
factory shipped firmware v6.1.1.48-enh.tm
The firmware on this
model cannot be downgraded to an earlier version.
factory preset key code: 528Y-27G4-A222-22BJ-B22V
Max wireless power: 25mW with BT v6 firmware
Cannot be used with 3rd party VOIP provider
Thanks to 'Ian' for this information:
Early examples appeared towards end of
2008.
eg. Serial no. commences 4308. Oct'08
production
Least desirable
model. Some bugs too. So best avoided.
If you have purchased
a sealed 2700HGV and it is manufactured before any of the dates
indicated above for a particular Assembly No., please drop me an
email.
The hub and mains adaptors are each packed
in their own individual sealed polythene bags when brand new. The serial
no. of the hub is also printed on the external packaging. The specific
Assembly no. you require can only be found on the label attached to the hub.
If your 2700HGV hub has an Assembly
number which differs from the above, I'd be grateful if you could send me
details so I can update this page. (Assembly no, Hardware version, factory
shipped firmware if known, factory preset key code)
Important: Please note that the
photos of the labels and information contained here are for the BT branded
2700HGV hubs offered in the UK. Please read the previous section carefully
to identify your BT 2700HGV hub before proceeding. If you
accidentally install the SBC v4.29 Recovery firmware onto a later model hub, you
will damage it. There is no way of recovering from this situation.
(Update
31 May 09): If you
are planning to purchase a 2700HGV hub, we recommend you avoid hubs with
BT v6.x firmware.
BT Business Broadband may also be blocking
hubs which have SBC or SingTel firmwares installed. If you are a BT
business broadband customer, I do not recommend changing the firmware.
If you have an early BT 'Single SSID' label with assembly
no. 4200-003003-004 to -006, there are several
options open to you. Hardware
version 2700-100588-005.
How to use BT v4.25.x firmware with an alternative ISP.
(Recommended
quick start option). Click here
Flash the firmware with SBC v4.25.19 Recovery firmware
(offers up to 400mW wireless power output). Click here
How to use BT v5.29.x firmware with an
alternative ISP. (Recommended quick
start option).
Click here
Flash the firmware with SingTel v5.29.117.3 Recovery
firmware (Tested by 3rd parties). Click here
BT v5.29.107.12 Recovery firmware can be used. Click here
How to use the BT v6.1.1.48 firmware with an alternative
ISP. (Verified) Click here
If you have an early BT 'Single SSID' label with assembly
no. 4201-003003-006, there are several
options open to you. Hardware
version 2701-100588-005.
How to use BT v4.25.x firmware with an alternative ISP.
(Recommended
quick start option).
Click here
Flash the firmware with SBC v4.25.19 Recovery firmware
(offers up to 400mW wireless power output). Use
with Caution. Click here
How to use BT v5.29.x firmware with an
alternative ISP. (Recommended quick
start option).
Click here
Flash the firmware with SingTel v5.29.117.3 Recovery
firmware (Tested by 3rd parties, some success). Click here
BT v5.29.107.12 Recovery firmware can be used. (Verified). Click here
Hugo from Portugal wrote to me to advise he had bought an
unlocked single SSID 2700HGV with SBC v4.25.19 recovery firmware
pre-installed. Unfortunately he discovered it simply would not work with
his ISP (Simplesnet, Portugal) He could not get the hub to sync at
all.
He eventually resolved the problem by installing the
SingTel v5.29.117.3 firmware.
As a result of receiving Hugo's email, this has resolved
the mystery surrounding the Assembly model no 4200-003003-006 and
4201-003003-006. Clearly the hardware versions are subtly different ie.
2700-100588-005 vs 2701-100588-005 respectively.
Update 18 Jun 08: Both Ted and Jay have since written
to me they own hubs with hardware version 2701-100588-005
and have no connectivity problems with their UK based ISPs.
Update 7 Sep 08: John wrote in to say he has been
using a 2701-100588-005 model with SBC firmware, but was experiencing daily
problems with laptops failing to connect to it. Rebooting the hub cured
the problem. He has now flashed the hub with Singtel v5.29.117.3 firmware,
and although the hub appears to be working, the flash may not have been a total
success. They 'System Summary' page apparently still displays the SBC
logo, and he is now unable to access the firmware upgrade page. 'System
Details' page is blank, and he is unable to change the keycode.
+ Easy
to unlock using Javascript save method. WPA-PSK2 wireless security. 4
wireless power level settings hack (25 - 100mW). Wireless MAC Filtering
(v5.29.117.x)
-
BT v5.29.117.6 and v5.29.107.19 are susceptible to upgrade to BT v6 OpenZone
firmware. (Consider installing alternative firmware or changing
the ACS URL to block the upgrade)
Update Mar 09: BT have
started to deploy v6.1.1.48 firmware. Hubs running v5.29.117.6 firmwares
with Assembly No. 4201-003003-008 are presently being upgraded to the newBT v6 firmware.
Update 16 Apr 09: A tested
method of blocking the BT v6 firmware upgrade has been developed.
Click here for details.
Click HERE
to open a new page for instructions
for how
to unlock the BT v5.29x firmware for use with with another ISP.
If your ISP has provided you with a BT wholesale IPstream
broadband connection, an alternative simple
workaround is to enter the username and password by executing the Setup Wizard..
Warning: if your hub has Enhanced Services such as Parental
Controls already present, the use of the setup wizard may result in the services
being deleted. You may not be able to recover the Enhanced services once they
have been deleted.
The following paragraphs describe the features of the
Dual SSID hub and v5.29.x firmwares.
BT Dual SSID Fusion models have revised hardware (version 2701-100589-005)
and begin with assembly no
4201-003003-007 or 008.
The router may come with factory installed v5.29.107.12 firmware or later.
I notice from the router's Detailed Log and
Provisioning Information page, The Dual SSID models connect to a
different BT provisioning server, 'pbthdm.bt.motive.com' for models
manufactured from around week 16 in 2007 and onwards.
Note
that earlier some Dual
SSID hubs with v5.29.107.x firmware, or any hub using the BT
v5.29.107.12 Recovery firmware will in fact try to connect to the old cwmp.cms.smehomehubrms.bt.com
server.
The 'Wireless Settings' page does not display the
Wireless Power Setting. It is however possible to edit the power level setting
using this described method.
(There is an alternative method described on the-scream.co.uk here.).
The factory default setting is '1' (25mW). Any setting above '4' is acknowledged in the
Detailed logs but
the actual transmitted power is restricted to100mW on Dual SSID hubs.
As well as Fusion wireless VOIP services, the v5 firmware also
supports WPA2-PSK wireless security. I do not use VOIP or WPA2-PSK so I
will not be commenting on these features.
The Dual SSID model connected to my BT IPstream ISP without any difficulties.
ADSL line speeds are comparable to what I have been witnessing with my other
Single SSID 2700HGV hub.
My Dual SSID hub was running v5.29.107.19 but it upgraded
automatically to
v5.29.117.6.
Click HERE
to open a new page
for Simon's instructions on how to enable Enhanced Services on BT v5.29.107.x firmware,
or to block the new BT v6.x firmware upgrade.
This firmware is not suitable for use on long phone
lines. The higher than normal default 8dB noise margin employed by this
firmware is likely to result in lower connection speeds. If you are on a very long
line and barely connect at 512 kbps, you may not even be able to establish a
connection using this firmware. However, if your target noise margin set
by your ISP is
greater than 8dB, then you can consider using this firmware.
Nigel advised there was a new firmware in circulation which can unlock both Single and
Dual SSID models. The new SingTel firmware could be found on the Comunidad
Underground de México forum where a list of firmware files for 2Wire
routers.
He has tested this SingTel firmware on his Dual-SSID 2700HGV model (hardware version
2701-100589-005 reported in
'System Details' page). He reports he now has 6 wireless power level settings, 13 wireless channels and support for WPA2-PSK
with this new firmware.
To enter the Management and Diagnostic Console (http://home/mdc), the
password is now 2wire
Enhanced services 'Internet Access
Controls', 'Content Screening' and 'Firewall Monitor' can be installed simply by entering the
regular
BT key code: 528Y-27G4-A222-22BJ-B22V.
Click HERE
to open a new page
for instructions on how to install the SingTel firmware.
+ Easy to
unlock using Javascript save method. WPA-PSK2 wireless security. 4 wireless power level settings
hack (25 - 100mW). Hack
available to install Enhanced Services.
-
Suitable for Single and Dual SSID models.
I downloaded this firmware via a link on the-scream.co.uk forum last year but
never got around to try it until recently.
WARNING: Flashing new firmware to your BT 2700HGV hub, is done so at
your own risk.
Click here for a zipped copy of this firmware.
Refer to the previous section for SingTel firmware for step by step instructions
to install the new firmware. This firmware cannot be used to
downgrade hubs which have the new BT v6.x firmware.
Refer to this page for
information on how to save changes made to the
Broadband Link > Advanced Settings page when configuring the hub with your ADSL login parameters to
connect to your ISP.
After testing it recently, I believe it was designed for earlier BT hubs with
assembly numbers up to 4200-003003-006 (Hardware version 2700-100588-005).
However as this was a v5 firmware it ought to work with old and newer models. I
have installed it on one of my dual SSID hubs (assy. no. 4201-003003-007, hw ver
2701-100589-007)
I immediately noticed quite a few things are now missing. The option to
check for upgrades is completely missing so it is not possible to install
Internet Access Controls and Content Filtering. The Internet Connection
Monitor also appears to be missing too.
From the Provisioning Information contained in the 'home/mdc' webpage, the provisioning server is
cwmp.cms.smehomehubrms.bt.com which is
further proof this firmware was intended for the earlier model BT hubs.
The detailed logs report the hub is unable to contact the above provisioning
server. The server cannot be pinged but DNS entry still exists.
Update (June 2008): BT
have decommissioned or blocked access to the provisioning
servers at smehomehubrms.bt.com so it
is no longer necessary to implement DNS Poisoning described later in this
section. Similarly, Enhanced services such as Content filtering and Internet Access Controls
can no longer be re-installed.
Update (Mar 2009): Refer
to the following section on how to possibly install Enhanced Services using
2wire provisioning servers.
Enhanced services such as Content Filtering and Time of Day access control on 2wire firmwares have always been an optional downloadable
service. The key code provided by the ISP determines what services are to
be downloaded and enabled.
Philip advised he was able to
install Enhanced Services on to his 2700HGV hub which had been flashed with BT
v5.29.107.12 recovery firmware.
This firmware by default polls the
decommissioned provisioning servers at smehomehubrms.bt.com.
Philip simply changed the ACS URL to
https://gw-5-29-117.cwmp.cms.2wire.com
The recently developed instructions
to change the ACS URL on BT 5.x firmwares are described by clicking on this link
here.
Details of Philip's 2700HGV are below:
Assembly No. 4201-003003-008. Early 2008 manufacture.
Factory shipped firmware BT v5.29.117.6. Later reflashed to
SingTel v5.29.117.3, and subsequently to BT v5.29.107.12.
For Enhanced Services, he used default BT key code: 528Y-27G4-A222-22BJ-B22V
ACS URL changed to https://gw-5-29-117.cwmp.cms.2wire.com
Other readers with Dual SSID hubs with BT v5.29.107.12 firmware have
successfully installed Enhanced Services.
From experience, Enhanced Services may not always download and be enabled
immediately. You may have to wait a few minutes/hours or days if the 2wire
provisioning servers happen to be off-line. Check the 'Home' page to see
if the link appears to enable you to 'View
available upgrades and options'.
With officially supported firmware, downloading of Enhanced Services can 'sometimes' be manually triggered by clicking on the menu option which appears on
the 'home' page to view available upgrades.
Test Results
Simon, Philip and others have noted when Enhanced Services is installed when
using ACS URL https://gw-5-29-117.cwmp.cms.2wire.com, the
hub appears to create and use a unique ACS username & password to establish
a connection with the provisioning server. The unique ACS username appears
to be partially formed from the serial no. of the hub.
'Vader' reports success installing Enhanced Services with his 4201-003003-008
Dual SSID hub running BT v5.29.107.12 recovery firmware with above ACS URL. He also quotes he no longer sees
the repeated failed attempts by the hub to contact the previous BT server which
normally flood the Detailed Logs.
'Simon' also reports success with his 4201-003003-007 Dual SSID hub running
BT v5.29.107.12 recovery firmware using same ACS URL.
(24 Mar 09): Barry reports success with his
4201-003003-006 (HW version: 2701-100588-005)
Single SSID hub using above ACS URL.
(24 Mar 09): Last week, Alan set up his
4201-003003-007 Dual SSID hub with BT v5.29.107.12 recovery firmware to point to
ACS URL: https://pbthdm.bt.motive.com/cwmpWeb/CPEMgt.
His hub was configured to use the BT keycode: 528Y-2374-A222-22BJ-B2QA.
Today, he reports his hub now has Enhanced Services installed. The
Detailed Logs continues to report this event 'cwmd: failed to build or validate cert-chain: depth=0, error=unable to get local issuer certificate'.
'Zedman' from The-Scream forums reports his Dual SSID
hub has been automatically upgraded to the new v6.1.1.48 firmware.
His 2700HGV Hub details:
Dual SSID model, assembly no. 4201-003003-007
Prior to upgrade: Official BT v5.29.107.19
DNS poison entries pbthdm.bt.motive.com
10.0.0.0 & cwmp.cms.smehomehubrms.bt.com
10.0.0.0
ISP is BT 'Home' Broadband.
The above DNS poison entries failed to block the
firmware update to v6.1.1.48. (I seem to recall when I used to use
BT v4.25.33 firmware on a Single SSID hub in late 2006, the DNS poison entry
also failed to block an automatic upgrade to v5.29.107.x at the time) I
have read the new BT v6.x firmware upgrade is to be delivered to hubs on BT
Business and BT Home broadband networks, but it isn't clear whether or not hubs used
outside of the BT networks will receive the upgrade too.
'Zedman' also tried to manually downgrade the firmware.
The home/tech/upgrade
page does not work.
The home/upgrade page
is accessible but any attempts to downgrade the firmware appears will fail:
Using BT v5.29.107.19 firmware update:
The upgrade was unsuccessful.
Unfortunately, the software upgrade could not be completed.
Please click "Back" to try again or click "Cancel" to return to the gateway page.
Failure detail:
image not safe for software after 5.29.107.
The upgrade was unsuccessful.
Unfortunately, the software upgrade could not be completed.
Please click "Back" to try again or click "Cancel" to return to the gateway page.
Failure detail:
image not intended for our platform 'shiva', limited to medusa
The upgrade was unsuccessful.
Unfortunately, the software upgrade could not be completed.
Please click "Back" to try again or click "Cancel" to return to the gateway page.
Failure detail:
image not intended for our platform 'shiva', limited to medusa
The home/mdc page is
also no longer accessible.
Some screen shots of the new firmware for the 'Home', 'Settings' and 'Site
Map' pages.
Some pages which were previously only accessible via the Management Console,
now appear to have been relocated for easier access. eg. DNS resolution
table and access to System logs.
Site Map webpage:
The hub also connects to provisioning
server: pbthdm.bt.motive.com
Once again, a big thank you to 'Zedman' for the information and pictures provided so far
on this new BT v6.1.1.48 firmware.
If you own a 2700HGV hub which has been upgraded with a version of BT
firmware which is later/newer than
v6.1.1.48.1-enh.tm, I'd like to hear
from you.
Frequently Asked Questions:
Is the new firmware being propagated to any 2700HGV with v5.29.107.19 or
v5.29.117.6 using BT keycode which are NOT on the BT business or home
broadband networks? BT
v5.29.117.6 Dual SSID hubs which were not on BT networks were targeted in
early March. Subsequent reports that all v6 upgrade had been suspended.
(23 Jun 09): I've had an
email from Ian B. (ISP: NewNet) to say his hub was upgraded this morning. Alan W. (IDNet user) has also
reported his hub was upgraded too. Both hubs were 4201-003003-008
models previously running v5.29.117.6, now running v6.1.1.48.1-enh.tm.
Have any Single SSID 2700HGV hubs been upgraded to
BT v6.x firmware? (2 Jul 09):
I now have one confirmed report from Chris who has a
single SSID hub (Assy No. 4200-003003-004) which has been upgraded to BT
v6.x fw. His ISP is ADSL24.
Can the v6 firmware upgrade be blocked using DNS
Poisoning? No. It doesn't work.
BT v5.29.107.x firmwares have a 'Remote Management' check box in the
Advanced Firewall menu. Will unticking it block the firmware
upgrade? No.
Can changing the key code block
any forced upgrade? No, as an o2 user
has reported he was using 2wire's manual setup generic key code.
Is there any other way of blocking the v6 upgrade?
Yes, Simon has developed a way of changing the name of
the provisioning server on a hub with BT v5.x firmware which can be used to
block upgrades.
Click
here
for details
Can the new BT v6 firmware be unlocked for use on other networks?
'Yes'.
Is any BT firmware immune from this v6
upgrade? We believe all
BT v4.x and the BT
v5.29.107.12 'recovery' firmware are immune - no guarantees though!
Alternatively, the Singtel firmware is presently immune until Singtel
choose to upgrade their firmware....
Has BT started shipping brand new 2700HGV hubs
with v6 firmware already pre-installed? Yes,
brand new Dual SSID hubs with Assembly no. 4201-003003-008
shipped with earlier v6.1.1.48-enh.tm with serial no. commencing 4308 (which
places the manufacture date around Oct 2008).
If I enable OpenZone function on my hub, does this mean it becomes an
OpenZone hotspot? Yes.
Does BT v6 firmware support uPnP ? From
observations and application tests with v6.1.1.48.1-enh.tm, there is no
evidence to suggests it supports uPnP.
Is the new BT v6 firmware better than BT v5 firmware? Simple
answer is 'No'. Wireless power cannot be changed at present on BT
version of firmware; Cannot be used
with 3rd party VOIP provider; and there are bugs in the firmware.
Is the new BT v6.1.1.48 firmware available as a file which I can use to
upgrade my 2700 hub? No. An early
trial BT
v6.1.1.22-enh.tm firmware is available - read the section about unlocking
Telecom v6.1.1.43 firmware.
What is the difference between v6.1.1.48-enh.tm and v6.1.1.48.1-enh.tm ?
v6.1.1.48.1-enh.tm contains an interim fix to
address a problem with VPN.
Ian brought this article to
my attention published by The
Register. It seems to imply BT have so far only rolled out the new
OpenZone firmware to 20,000 business customers with another 200,000 to follow in the next
few months. Link to Original
BT article.
(24 Feb 09 - 10 Mar 09 - summarised): Many
reports from readers (Ritchie, Simon, Linda, Andy, Sean, 'Vader', David and
myself) have surfaced in the past few weeks of hubs being upgraded to the new BT
v6 firmware. A common factor is they are all using BT v5.29.117.6
firmware, and appear to be the model with the latest Assembly
no. 4201-003003-008. The hubs have been connected to various ISP networks
including: o2 Home Access, PlusNet, IDnet, Fast (Entanet), and Karoo.
The hubs also had different key codes - Ritchie was even using the 2wire generic
manual setup key code: 5225-2374-WG62-22AS-BJ7P. OpenZone was
found to be disabled by default following the successful upgrade .
Andy reported full 4 entry DNS Poisoning failed to
block his attempted v6 upgrade. When Andy and Sean both saw the Power
Light on their hubs flashing amber/red shortly after switching on their hubs,
they both pulled the power cord out to abort the upgrade. Fortunately, the
hubs were not bricked, and they were subsequently able to reflash their hubs
with alternative firmwares.
It is evident that BT are deploying the new v6 firmware to all hubs running
v5.29.117.6 at the moment regardless of the connected ISP. DNS Poisoning
will not block the upgrade. After each successful upgrade, the hub
continues to function normally and all previous settings have been carried
forward to the new v6.1.1.48.1-enh.tm firmware.
(6 to 12 March 09): Thanks also to Pat,
'Vader' and 'Quandam' for their comments and reports.
End
This is the version number of the new BT firmware which is gradually being
rolled out by BT to their business customers with main rollout apparently
starting from November 2008.
6.1.1.48-enh.tm
Firmware versions reported to me since February 2009 appear to be:
6.1.1.48.1-enh.tm
The new v6 firmware enables BT OpenZone hotspots to be created.
The various methods described elsewhere for unlocking BT v5.x firmwares do
not work with the new BT v6.x firmware.
Yes it appears BT v6 firmware can be unlocked for any ISP !
Well done Simon, he deserves a medal. I can confirm
too I am able to change and save settings in the
Setting > Broadband > Link Configuration
page too.
Simon also notes that after the factory reset, the OpenZone function was
enabled by Default. When he clicked the 'Disable' button, the status
changed to 'Pending' with an explanation message:
The changes may not be instantaneous. It could take up to 30 minutes for the service to be fully enabled or disabled because of the need to communicate with the BT network. The status shows as pending until this process has completed.
With my own hub which was recently upgraded to v6.1.1.48.1, it took 2 or 3
working days to enable or disable OpenZone.
Wireless Power and other available Settings
The HTML source code for the Wireless LAN setup page has also been greatly simplified. Unfortunately, unlike v4 and v5 firmwares, any
and all code references to wireless power settings has been completely removed,
and so there is now no hint as to how one might be able to manipulate the HTML
to change the wireless power output. (Update 3 Jul
09): We have got hold of the HTML source code for the wireless
settings page provided Telecom v6.1.1.43 firmware which supports wireless power
setting. Unfortunately, we are still unable to hack the BT v6.1.1.48.1
firmware - BT have well and truly blocked any attempt to adjust the wireless
power setting in their BT branded v6 firmware.
'Simon' also notes that on the Settings > LAN >
Statistics reporting page, the wireless
power is displayed and appears to be set to '1' on his hub, but there is no means of
changing the value as this is an information only reporting page. My
own hub still reports a value of '2' which was how I had previously configured the
wireless power prior to the forced v6.x upgrade.
My hub offers 13 wireless channels. Simon reports his hub also
offers an 'Auto' option.
New features
I don't recall this feature being available on v5 firmwares but you can now
set the speed of the four individual ethernet ports.
(Added 7 Mar 09) According to this BT
webpage, all brand new factory shipped BT 2700HGV hubs with v6.1.x
firmware pre-installed since January 2009 appear to have a default system
password. The password corresponds to the serial number of the
hub. The serial number can be found on the label attached to the
underside of the hub.
Removed Features
If you need to clone the hardware MAC address of your ISP supplied modem or
router, to a 2700HGV with BT v6 firmware, I'm afraid I have not been able to
find a menu option to allow you to change the MAC address of the hub.
Similarly, it is no longer possible to define a HOST name.
This is a bug which has crept into the v6 firmware.
If your working hub was upgraded from v5 to v6 by BT, then you probably will not
encounter the issue. However, if you subsequently enable and disable OpenZone functionality, or have a need to perform a factory reset of your v6
hub, you will encounter the issue described below.
A number of readers (Simon, Ian, 'Vader') have witnessed the problem
where the Local Network Devices List does not accurately display the exact status of ethernet
and wireless devices connected to the hub. My view is it seems like
the server process/daemon on the hub which discovers devices on the network and updates the v6 GUI is basically
broken - it looks like it is purely cosmetic and hub Firewall and Access Control
operations are not affected based on my own observations and tests.
When a brand new device (usually using DHCP) is introduced and connects to the
hub for the very first time,
the new device will appear as an 'active' device initially. Within a short
period of time, the status will suddenly change to 'inactive' status (ie. greyed
out). The hub also no
longer displays the correct number of active and inactive devices too.
If the device is subsequently switched off and switched back on later, the
hub continues to show the device as being 'inactive'. However, the device
works perfectly normally through the hub.
Simon also reports if a device joins the Fusion wireless network, it is
permanently displayed as 'active' even when the device is switched off.
If the device has a static IP address, it may not appear on the Local Network
Devices List
at all based on my own early observations of the problem.
Fortunately, as far as the Firewall is concerned, it is still possible to
manage the devices regardless of the device's status. The hub maintains a
separate database of ALL devices that have ever connected to it in the past and
present. ie. a
device may not be visible on the Local Network Devices List on the 'Home' page, but it is
still visible in the Firewall
and Access Control menus so can continue to be managed. (Warning: Using the
'Clear List' button in the Settings > LAN > Statistics
menu or
within the Resets menu will delete the devices database, and break all
device associations defined in the Firewall and Access Control menus)
Unfortunately devices with static IP addresses do not show up in the the Firewall
administration menus, but fortunately, you can create new rules for devices with static IP
addresses to get around this problem.
For devices that appear to be 'inactive' (greyed out), I can confirm the
firewall rules I have set up for said devices appear to function correctly.
However it is a different matter for Enhanced Services such as 'Content
Screening' and 'Time of Day Access control'. DHCP-ed Devices can be managed just like
with the Firewall, but unlike the Firewall, it is not possible to manage devices with static IP
addresses as they are not visible, and you cannot define your own Access Control
rules for
static IP devices.
I can also confirm that Access Control rules continue to work for devices
which are incorrectly reported as 'inactive' in the Local Network Devices List
on the 'home' page.
How to fix it?
Thanks to Simon, he has observed if you enable OpenZone functionality, the
Local Network Devices List suddenly starts behaving correctly. The
Local Network Devices List will even be populated with devices configured with static IP
addresses. (Warning: it can occasionally
take up to a day or two to enable or disable Openzone in my own experience
contrary to the 30 minutes maximum wait time which BT quote)
This is not an ideal solution at all given many hub owners will not want
OpenZone hotspot functionality enabled.
Soft Reboot & Connect issue
While testing
my own generic instructions for setting up a new ISP connection this morning, I
could not for the life of me persuade my hub to reconnect to my ISP. Every
time the hub came back up after I was prompted to perform a soft reboot
via the hub's menus, it just would not connect. After the umpteenth soft
reboot,
I decided instead to pull the power cord out and plug it back in this time as
opposed to performing a soft reboot via the Diagnostics Resets menu. The
hub connected straight away upon startup.
Wireless channel number changing syndrome
(8 Mar 09): It had been a day and a half since I
last rebooted my hub. I noticed this evening the wireless channel number
being used by the hub is not what I had originally configured. The
wireless setup menu clearly shows channel 5. The event logs also only show
references to channel 5 too. But the Settings > LAN >
Statistics page clearly shows I am on channel 13. Confirmed when I
use netstumbler on my wireless laptop to scan all wireless networks in the
vicinity.
I don't know when the wireless channel number changed, but looking through
the event logs, I note there is an unexplained event around 10 hours earlier
informing me the wireless channel had been set to channel 5. (The hub has
been running for over a day and a half) I do recall I did clear the
Devices List around that time.
I've not been able to reproduce the problem by clearing the Devices List.
(9 Mar 09): Simon reports this afternoon his hub
suddenly changed its wireless channel from 6 to 13. He became aware
of the change when one of his wireless devices appeared to stop working.
One further week later, there has been no repeat of this incident by either Simon
or myself.
If anyone else has witnessed a one-off wireless channel number change, please
let me know.
(3 May 09): A reader wrote in on behalf
of a BT Business broadband user, to advise that they had witnessed this changing
channels issue very frequently. Every time they tried to set the hub to a low wifi
channel number, after a few hours, the hub would decide to eventually jump back
to channel 13. They were considering whether to perform a factory
reset to see if it would address the problem. This was a particular
problem for them as the hub was located in a small hotel and they had guests
from the USA who's laptops only operate on channels 1 to 11.
(3 Jun 09): I've been running my hub with
BT v6.1.x firmware for about a week now. This morning, I noticed the
wireless channel number was different to the one I had configured. The status
page was showing Wireless Channel:
13 (5 (2432 MHz)) ie. configured to use channel 5,
but hub is in fact using channel 13....!
Unfortunately I don't know when this change took place. It may have
occurred earlier this week. As witnessed back in March when I last used
this hub, there is no clue in the logs to suggest why this is happening.
(4 Jun 09): The wireless channel
number changed again today. I know very early this morning, the
channel number was still set to channel 5 from yesterday. The status page is now
showing Wireless Channel:
13 (5 (2432 MHz)) once again.
Simon has previously commented his hub offers an 'Automatic' setting in the
wireless channel selection list box. I do not see an 'Automatic' option on
my hub.
OpenZone enabled by default after factory reset
If your hub was 'upgraded'
from BT v5 to BT v6 firmware, the OpenZone capability is disabled by
default. If however you factory reset the hub, OpenZone is Enabled
by default.....
Simon kindly provided this screen dump from his wireless laptop connected to
the OpenZone hotspot on his upgraded hub which is connected to his ISP, PlusNet.
PlusNet is though owned by BT.
Was this a slip-up by BT by allowing the hotspot to be created ?
We think BT Openzone traffic is tunnelled through your ISP's
network back to BT.
A past discussion on Thinkbroadband.com can be found here.
Up to 13 clients can connect, making use of up to 512kb of your
broadband bandwidth. On non-BT Business broadband networks, this
will affect users who have Usage allowances from their ISPs.
<== Click here for
list of service providers which appear in the list box
I've deliberately tried to enable
and disable OpenZone on my upgraded hub, which too
connects to PlusNet. With my own hub, it can take anything between a few
minutes to several days to enable or disable OpenZone. Once enabled, I am
able to see the OpenZone login screen as shown above as first reported to me by
Simon.
No uPnP Support
After reading a comment on
the IDnetters
sub-forum dedicated to the 2Wire 2700, it reminded me to report on our
findings regarding whether the BT 'v6.1.1.48.1-enh.tm' firmware supports
uPnP.
Contrary to earlier unconfirmed reports, we can find no evidence that uPnP is
available on this release of firmware. There are no menu settings within
the firmware to enable uPnP.
Simon performed a simple test of enabling 'uPnP' on his Sony PS3. The
PS3 reported 'uPnP unavailable'.
I have conducted a simple test using uTorrent bittorrent client. I
removed any port forwarding rules I had previously defined on the hub.
Ensured that uPnP was enabled within uTorrent. While uTorrent is running,
then opened a new browser session in IE and visited this URL to
test the firewall.
where XXXX is the Port number defined in uTorrent client. The
test failed.
Internet Connection Speed Monitor not working?
I notice the Internet Connection Speed Monitor accessed
through Settings >
Diagnostics >
Link Monitor didn't seem to be
reporting any activity when I am accessing the internet.
(24 Jun 09): It now transpires that you need to
log into the hub for the Link Monitor to display activity. The easiest way
of achieving this is to go to
Settings >
System Info >
Password
Once the password has been correctly entered, try the Link Monitor page again
and it should now display broadband activity.
Problems with VPN
There is a thread on BT
Business Support forum describing the problem with BT 'v6.1.1.48.enh-tm'
firmware. The newer BT 'v6.1.1.48.1-enh.tm' firmware
partially addresses the issue.
Problems with Content Filtering with some 'upgraded' hubs
There is a thread on
BT Business Support forum. Resetting the hub apparently will not fix
the problem. I speculate the only solution is perhaps for BT to offer a
replacement hub to the affected business customer.
Settings > Logs (Added 27 Jun
09)
I've observed it typically takes around 14 seconds between clicking on
Settings > Logs
and the page eventually appearing. 14 seconds feels like an
eternity....
IE8 Diagnose Connection Problems
(Added 29 Jun 09)
Back in March 2009, around the same time my hub was upgraded to v6.x
firmware, I had also started to use Internet Explorer v8 (IE8). I noticed this
particular message kept cropping up frequently on my desktop PC with popular
websites which I visit, and far less frequently on the laptop. When I
entered the URL of a web page I wished to visit, this message appeared a bit too
often for my liking. If I retried the page again by pressing F5 key, the
page would load.
I dismissed the issue at the time as I suspected it was a problem with IE8
and that I wasn't the only person to experience this issue. Also, my ISP
PlusNet was experiencing DNS and routing issues at the time. This was later confirmed when I subsequently changed
back to
using my other 2700HGV loaded with BT v5.29.107.12 firmware, and I was
continuing to frequently experience this error message on my desktop PC.
The laptop PC appeared to be fine though with the BT v5x firmware.
When I eventually investigated, it transpired that there was a problem with
the Sun Java installation on the desktop PC. Completely removing it and
reinstalling the latest version seemed to resolve the problem, and I rarely
witnessed the problem again until I reinstated my 2700HGV with BT
v6.1.1.48.1-enh.tm firmware on the 23 Jun 09. At which point, I have noticed the
above message appearing on both wireless computers again.
The issue may have nothing whatsoever to do with the BT v6.1.1.48.1-enh.tm
firmware, but I thought I'd bring this observation to your attention in the
event you
too notice a change in behaviour of IE8 after your 2700HGV has been
upgraded to the new BT v6.x firmware. (Update 2 Jul 09):
The number of IE8 Connection messages appears to have subsided - the only
modification is I have updated Adobe Reader v9.10 to v9.12 on both computers
around 3 days ago. I should add I have been using Adobe Reader v9.10 since March.
It could be another dodgy add-on which IE8 didn't like, but why did the problem
only re-materialise when I started using my hub with BT v6.x firmware again ??
(Update 4 Jul 09): I'm still experiencing
the occasion every now and then where IE8 seems to just sit there doing nothing
when I attempt to load a new web page to view. After a prolonged delay,
the page suddenly appears. PlusNet doesn't report any major issues
except when Andy Murray was playing Andy Roddick in yesterday afternoon's
Wimbledon semi-final which resulted in a huge amount of BBC iPlayer streaming
traffic on their network. I'll continue to use this hub with v6
firmware for another week after Wimbledon has ended to observe whether there is
any improvement.
(23 Jun 09): Reports coming through that
BT may have restarted v6 upgrades. I had been using a 2700HGV with BT
v5.29.107.12 firmware for past two months, and decided to reinstate the hub with
the BT v6.1.1.48.1-enh.tm firmware to re-evaluate.
(30 Jun 09): A
thread
on BT support forum hints there is a v6.1.1.49 firmware version in existence.
The minor version number change suggests it is unlikely BT will have addressed
all the issues identified to date.
- Wireless Power output cannot be hacked.
Cannot be downgraded once BT v6.x firmware is installed. Be warned
that this BT engineered firmware appears to have a few bugs.
Click HERE
to open new page for Simon's instructions on how to unlock BT v6.1.1.48.x
firmware for use with other ISPs.
Wireless Power setting cannot be adjusted on BT firmware
I was browsing the Telecom NZ website's customer Help pages, and spotted the
Telecom v6.x firmware used on their 2701HGV-W gateways offer a wireless power
setting.
'Lokeynz' on the
Geekzone forum was kind enough to upload the HTML source code for the
wireless settings page from a Telecom 2701HGV-W hub. The code can be
viewed by downloading this file here
and saving it as a .TXT file for viewing..
The bad news is the code reveals the parameter name used for the wireless
power level is 'PWRID'. This is the same parameter name used in
previous 2wire v4 and v5 firmwares.
I tried using the relevant code to hack my hub running BT v6.1.1.48.1-enh.tm,
but as Simon discovered back in March, the hub appears to be ignoring the
PWRID
parameter. ie. BT have well and truly blocked any attempt to
hack the wireless power in their v6 firmwares.
- Wireless Power output cannot be hacked
when using BT v6.x firmware. Cannot be
used with 3rd party VOIP providers. Be warned
that this BT firmware contains a few bugs.
I would not normally document hacking other 2wire 2700/2701 models, but I
decided to include some information here simply because it made use of some
untested BT v6.1.1.22-enh.tm firmware files I had been previously given.
Aaron from New Zealand wanted to use his
Telecom 2701HGV-W hub with a
different ISP. The hub had
Telecom v6.1.1.43-basic.tm
firmware installed.
Click here for details of how
Aaron flashed his Telecom hub with BT
v6.1.1.22-enh.tm beta Recovery firmware.
Nov '08: Two interesting cases have come up recently.
One reader reports he was aware of a BT Business Broadband customer who had
bought a used Single SSID 2700HGV but was unable to make it connect to their BT
Business broadband connection. The hub
had been flashed with SBC v4.25 recovery firmware as the BT customer wanted easy
access to the wireless power level settings. Details are sketchy, but
basically the hub would always report the username and password were incorrect
(Sounds familiar?) when editing the Broadband Advanced Settings page.
Flashing with the SingTel firmware produced the
same results. The hub only connected successfully after it was
flashed with BT recovery firmware v5.29.107.12. He concluded BT
business broadband may now be blocking hubs which are using SBC or SingTel
firmwares.
If it is true, it is not clear what mechanism BT are using to block the
hubs. As the SBC and SingTel firmwares do communicate with the 2wire
provisioning servers, and the hub was connected to the BT business
network infrastructure where 2wire hub management exists, it is not inconceivable that
BT/2Wire are able to download a minor firmware patch to SBC and SingTel
firmwared hubs to block use on BT network(s). This is pure
speculation I should add.
In another separate case, a reader had recently migrated from BT Business
broadband to PlusNet. But was struggling to unlock their Dual SSID hub
with v5.29.117.6 firmware for use on PlusNet. According to the logs,
the Plusnet username was not being used during authentication even though it had
been correctly saved using the
Javascript method. The only other variable is the reader was using an
Apple Mac with Safari web browser. I can't see how using a Mac or Safari
would cause this issue - I have suggested to use a Windows PC. Otherwise if the BT firmware has been 'patched' to prevent
its use off
the BT network, then reflashing the firmware should resolve the problem too.
(Update 26 Nov 08): After Les provided me with
screenshots of the new BT V6.1.1.48
firmware, he more recently acquired a used single SSID hub for use on his BT
Home Broadband connection.
Hardware Version: 2701-100588-005
Software Version: BT v5.29.107.x
He downgraded it to SBC Recovery firmware v4.25.19 and used the
Manual Key Code:
5225-2374-WG62-22AS-BJ7P
The hub appears to work just fine on BT Home Broadband network - there were
no issues entering the ppp Username and password.
He also noted
in the Detailed Logs, references to second BT provisioning server in addition to
the regular pbthdm.bt.motive.com server:
https://pbthdmw2.bt.motive.com/cwmpWeb/CPEMgt
(These log entries were probably when the hub was previously using BT
firmware)
A solid green light for both 'Broadband' (DSL) and 'Internet'
indicators are a good sign that everything is working fine.
If you do not see a solid green Broadband (DSL) light, it usually
means there is a physical connection or hardware problem. The hub also
won't report downstream or upstream line speeds on the main 'home' page.
Check your ADSL wiring.
If Broadband (DSL) light is solid green but the Internet light
remains solid red, this usually means the ADSL settings are incorrect or there
is an authentication problem with your ISP.
Check the settings such as the PPP username & password and Connection Type under
Broadband Link->Advanced Settings.
Summary of indicator light status
Power - Light OFF
The hub is not getting power
Power - Blinking green (Slow)
The hub is undergoing Power On Self Test
Power - Solid green
Power is On.
Power - Blinking orange
The hub is undergoing a software upgrade
- Do not disconnect electrical power otherwise you may damage the hub.
Power - Solid red
System error. Hub has developed a hardware fault, or
incorrect firmware installed causing permanent damage.
Broadband(DSL) - Light OFF
The hub is powered off or is booting up.
Broadband(DSL) - Blinking green (Slow)
The hub is attempting to establish connection to your
broadband service/telephone exchange.
Broadband(DSL) - Blinking green (Fast)
The hub has been unable to connect to the DSL signal for
more than 3 minutes.
Broadband(DSL) - Solid green
The hub is connected to the broadband service/telephone
exchange.
Internet - Light OFF
The hub has been unable to detect a DSL signal, or DSL
signal has been detected and gateway is in process of training.
Internet - Blinking green (fast)
The hub is attempting to establish a connection to ISP's
network.
Internet - Solid red
The hub cannot connect to ISP's network. Check ADSL
settings.
Internet - Solid green
Hub is successfully connected to your ISP's network.
5.1Volts @ 3Amps DC power
requirement. Barrel connector size: 3.9mm OD, Centre pin positive.
Reset
Restores current firmware to factory
default settings.
Phone Lines (RJ11)
For VOIP use. Use in conjunction
with Voice port doubler adapter cable.
USB-PC
For connecting to a PC which does not
have ethernet or wireless capability. Windows 98SE/ME/2000/XP/Vista
(32bit) driver can be found on BT setup CD, or from BT
website.
Local Ethernet (RJ45)
Four ethernet ports, supports 10 or
100Mbps, full or half duplex.
This section just re-iterates what has already been quoted earlier in this
webpage.
After you enter your ppp username and password and
press the 'Save' button, you will receive an error message regarding an 'Invalid PPP
username'. This is a feature of the BT firmware for the 2700HGV hub.
If you are using BT v5.29.x firmware, and you wish to manually edit
the ADSL
parameters on the following page:
If you are using BT v6.1.1.22, there is an additional step required to
successfully save your ppp username and password. Please refer to the
instructions for unlocking Telecom
2701HGV-W hub.
On v4 and v5 firmwares, the way the ATM settings are presented in the
Broadband Link > Advanced Settings
page can be misleading.
Similarly on v6 firmwares's
Settings > Broadband > Link Configuration page:
If 'ATM PVC Search' is set to 'Enabled', this instructs the hub to
search for best ATM settings to use from a predefined list.
The predefined list is believed to include (VPI/VCI): 8/32, 8/35,
8/37, 8/38, 8/81, 0/32, 0/35, 0/38, 0/105, 0/100.
When ATM PVC Search' is set to 'Enabled', do NOT rely on the
accuracy of the values displayed in 'ATM Circuit Identifier' and 'ATM Encapsulation'
- imho, those two settings really should be greyed out to avoid confusion.
The actual ATM settings can be found by logging into the Management Console
webpage: home/mdc
Unfortunately, I have not been able to find an equivalent page on v6
firmwares to provide the same details as above.
When ATM PVC Search' is set to 'Disabled', you may
edit the settings accordingly for 'ATM Circuit Identifier' and 'ATM Encapsulation'.
I have a BT IPstream connection and my ISPs have always recommended using
'Routed VC-Mux' for the ATM Encapsulation. For some bizarre reason, when
'ATM PVC Search' is set to 'Enabled', it always chooses to use 'Routed
LLC'. I am able to connect to my ISP using either Routed VC-Mux or
Routed-LLC on my exchange.
2Wire gateway products make use of Activation key
codes. One or more key codes are usually unique to each ISP that offers
2wire products. These help to speed up the process of configuring a new
hub during installation. They apply the most appropriate ADSL settings and
they can also enable certain Enhanced Services (eg. parental controls).
BT 2700HGV hubs users will be familiar with this key code
which is built into the firmware
Factory BT key
code:
528Y-27G4-A222-22BJ-B22V
Until recently, I have to admit, I didn't pay much
attention to the key code being used on my own BT hubs. Last September, I
performed a factory reset of my hub which had BT v5.29.117.6 firmware
installed. This resulted in the Enhanced services (eg. Parentel
Controls) being deleted. My ISP at the time was NewNet. I was aware of
similar cases so this seemed to concur with those observations at the time.
However, 'Peter'
wrote to me to recently ask why the following key code was specified on page 27 of his
copy of the Product Support Guide which is included with Dual SSID hubs,
Assembly No. 4201-003003-008, differed
to the one quoted one quoted above.
528Y-2374-A222-22BJ-B2QA
I entered this key code into my 2700HGV running
v5.29.117.6 firmware and low and behold, all the Enhanced Services subsequently
re-appeared. ie. Internet Access Controls, Firewall Monitor and Content
Filtering.
This key is unlikely to work with BT v5.29.107.12 recovery
firmware (Unverified at time of writing)
I subsequently performed another factory reset causing the
Enhanced Services to be deleted. The key code reverted back to the default
code ending in 'B22V'. I decided not to use the setup wizard
this time, and simply went straight to the 'Broadband Link ' -> 'Advanced
Settings' page and entered my ADSL parameters manually.
Shortly after reconnecting to my ISP, I noticed Enhanced
Services reappeared again. So I am none the wiser!
I should add that my ISP is PlusNet which is owned by
BT. So was this a glitch with my hub, or is Enhanced Services now
available for installation once more via any ISP, or is it only available via a
BT owned ISPs which include PlusNet?
This is the 2wire Activation key for ISP independent
setups. It can be found on 2wire's own webpage:
5225-2374-WG62-22AS-BJ7P
To change the key code:
Run the Setup Wizard which can be found on the main 'home' page:
You will then be prompted to enter the new key code.
Next, you will be prompted to select a Time Zone. The default is
London GMT.
Next, you will be prompted to enter your username and
password.
If you have a standard BT IPstream or similar ADSL connection, the hub should
successfully reconnect to your ISP's network.
Otherwise, it will most likely fail for any other type of non-BT ADSL connection.
But, the Activation key has now been successfully saved. Now you
simply have to go through the normal procedure described in: Setting up the 2700HGV (BT v5.x firmware).
Please note that changing the Activation key code will result in various
settings being altered or deleted or menu options being unavailable. So use with caution.
One nice little feature of BT v5.29.117.x firmware is the internet
connection speed monitor. It becomes accessible via the 'home' page if the hub
can
communicate with the current BT provisioning servers and after entering the BT
key code.
This feature is no longer visible on newly installed hubs with older BT
firmwares which communicate with BT's previous now decommissioned older provisioning
servers. If you have a hub with older BT firmware and the Internet
Connection Speed Monitor is present on the main home page, do not perform a factory reset on your hub.
Such an action will delete the feature from the main page and you will not be able to reinstall
the menu option.
However, Clive pointed out to me, this page is accessible on Singtel firmware based hub with BT keycode
using the URL:
This URL also works fine on a hub where I recently installed the BT
v5.29.107.12 recovery firmware and using BT keycode. This suggests the
functionality is built into the firmware by default.
Note that this functionality requires a Java enabled web browser on your
computer.
Following a suggestion by Alan from the IDnetters forum, I thought I'd create
this table.
On v5.x firmware, you can check what protocol is being used by navigating to:
Home > Broadband Link > Details
'G.DMT2+ Annex A' =
'G992.5 Annex A'
Firmware
G992.5 Annex A
G992.5
Annex M
SBC v4.25.19 Recovery
(added 20 Jun 09)
Yes (note 4)
probably No
BT v5.29.107.12 Recovery
Yes (note 1)
probably No
SingTel v5.29.117.3 Recovery
Yes (note 3)
No (note 3)
BT v5.29.117.6
Yes (note 2)
probably No
BT v6.1.1.48.x
probably Yes
?
Note 1: Personally tested on o2 'up to 8mb' LLU connection
Note 2:
Comments
posted by 'MisterW' on IDnetters forum. 20+Mbps
downstream, 1Mbps upstream
with ISP, Demon. I believe Demon is owned by THUS, and hence this
may be a C&W LLU ADSL2+ connection. DSLAM Vendor ID is reported as '50 00
00 00'. (Corrected)
Note 4: Nigel G. reports his hub is connected to BT ADSL2+
DSLAM withe Vendor ID IFTN
If you can assist me to complete and/or confirm the accuracy of the above table, please drop me an email.
I am trying to find out whether BT's currently available ADSL2+ WBC service
supports G992.5 Annex M specification.
Annex M offers
higher upstream speeds. Comments posted on various forums as far
back as 2008, suggest Annex M is to be introduced later. Some info about
WBC on Samsknows.com can be found
here.
BE/o2 LLU already supports Annex M for some of their 20-24 Mbps service where
2.5Mbps upstream speeds are available.
A new thread has been set up on the IDnetters forum to report BT WBC issues.
Click here.
Idnetters forum has reported an IDnet subscriber using a 2700HGV on ADSL2+
(BT WBC). Details from their hub are:
If you are experiencing problems with certain websites such
as hotmail, or you cannot log into Windows Live Messenger, you may need to check
your hub's MTU setting.
Tiscali for example have been migrating Pipex (and I
believe Nildram and Toucan) customers from BT's IPstream service to their own cheaper LLU broadband
infrastructure. The work is never openly publicised by Tiscali and so
customers are not given any warning. As a result, many Pipex customers who
experienced website access problems are usually unaware they needed to reduce the MTU
setting on their router from 1500 to 1458 or less to resolve the issue.
A reader contacted me to advise he was
experiencing difficulty accessing secure websites using his new Dual SSID 2700HGV on
TalkTalk LLU broadband. He tried adjusting the MTU on the router, but there was no
improvement. Eventually he reported he had to set the MTU on his PCs to 1400
(Hub MTU remained unchanged at 1500) before he got everything working properly.
Reader "Brunel"
wrote in and advised he has observed on his TalkTalk connection, when using a
2Wire 2700HG-B with SBC firmware, the maximum ping size supported is only
1400. But if he uses his Dlink 604T router, it supports up to 1500.
ie. 2Wire hub requires MTU of 1400 but Dlink is happy with MTU of 1500.
Summary of suggested MTU values for various UK ADSL broadband Internet
Providers
(There are also URL links to official and unofficial user
support forums for the respective ISPs mentioned below)
UK Internet Provider
MTU
Notes
AOL
1450
Link
to Kitz webpage. One hub user reports not
being able to access 'home' (192.168.1.254) page - this was eventually
resolved by removing the AOL software.
In 2006, up to 16,000 Plusnet customers were
migrated to Tiscali LLU. PlusNet customers can determine what gateway
they use by visiting this PlusNet webpage.
The page will also report whether it is a LLU connection.
o2 Broadband are currently providing a free-loan Thomson Speedtouch TG585 v7
wireless router to new customers.
o2's '8Mbps Standard' and '16Mbps Premium' LLU services use
ADSL2+ (G992.5) Annex A. The '20Mbps Ultimate' LLU service uses ADSL2+ Annex
M. The o2 Home Access product is a BT 8Mbps BT IPstream wholesale product.
It's unclear which minimum version of firmware (if any) is required
to support the higher upstream capability of ADSL2+ Annex M.
Below are verified settings for o2 LLU broadband use and tested with a
hub with v5.29.107.12 firmware. I believe the settings are identical for
BE broadband.
Do not use these settings if you have subscribed to o2
'Home Access' broadband service.
When the 'Connection Type' is set to Direct IP (Static or
DHCP), the PPP username and Password fields are not used and are ignored.
The 'Save' button can be used to save the settings when tested on v5.29.107.12
firmware.
I forgot to obtain a screenshot, but I recall the hub
successfully connected with 8000+ kbps downstream and 1000+ upstream line speeds
on the 8Mb o2 Standard LLU service. The attenuation and noise margin figures were comparable to those
reported by the o2 Wireless box II. The hub also reported it was connected
at 'GDMT 2+ Annexe A' if memory serves me right.
Interestingly, I observed using Netstumbler, the wireless
broadcast strength from the o2 Wireless box II (TG585 v7) was significantly
higher than BT hub with default wireless power of 1 (25mW).
But the signal strength reported by Windows XP didn't seem to be any different when tested in a room furthest
away from the routers.
Paul wrote to say he installed the Singtel firmware on his
4201-003003-008 hub. He went through the setup wizard and entered the BT
key code and an invalid username and password for PPPOE connection. The
setup wizard eventually came back with an error with regards to the connection,
but the key code was successfully accepted. Editing the DSL settings in
Advanced Broadband menu enabled the hub to connect to BE Broadband. He adds his DG834G syncs at 13mbps but the
2700HGV only syncs
at 11mbps - this is probably attributed to the 8db noise margin figure used by
the Singtel firmware.
(Update Nov 08): Reader 'v105'
advised he installed the Singtel firmware on to his
4201-003003-008 hub, but discovered it was able to sync with the exchange but
was unable to connect to the internet. After further investigation, it
transpired he needed to clone the hardware MAC
address of his original o2 wireless box to his 2700HGV before it
successfully connected to the o2 broadband service..
If your ISP has provided you with multiple static IP
addresses. Here is a link for instructions on how to configure a 2700HGV
with v5 firmware accordingly.
For the majority of users, there probably won't be any need
to specifically allocate an IP address to any of your devices (PCs, games
consoles etc).
One nice feature of the BT hub is that it remembers the IP
address it previously assigned to a device, so even if the hub loses power
momentarily and/or is rebooted, the
hub will remember what it previously assigned to various devices, and therefore won't attempt to supply a
previously assigned IP address to a different device.
If you specifically wish to use your hub's DHCP server
to reserve and allocate a specific IP address from the DHCP pool to an
existing device, go to this menu:
Home > Local Network
> Advanced Settings
Click on 'EDIT ADDRESS ALLOCATION' as shown
below.
A new page will appear. Choose the existing
device you wish to assign a new fixed IP address from the DHCP pool.
(Note: the names of the detected devices have been
intentionally blanked out in above picture)
Click on the list box, and you will be presented with a
list of possible addresses from the DHCP pool which you can choose to use.
Once you have made and saved your changes, you may need
to restart the device (eg. PC) for the new changes to take effect.
As mentioned previously, when using SBC v4.29.107.19
recovery firmware, I have encountered an issue with Windows XP when using an
earlier version of BitComet to download a large file via bittorrent. (I
forget the exact version number of BitComet, but was whatever the latest version
was circulating during summer 2007)
What I observed was my XP computer (3Ghz Pentium 4) at the
time would virtually seize up within a few minutes of initiating the download
session using BitComet. Mouse pointer wouldn't move. The only
way to recover from the situation was to unplug the power from the desktop
computer.
I had used BitComet as my preferred bittorrent client for a
few years and never
experienced any real issues with it. The only factor that was different
this time, was I had started using a 2700HGV with SBC firmware. As soon as
I switched back to the 2700HGV with BT v5 firmware, the lockup problem with BitComet
disappeared.
Another more recent issue was reported by a reader.
Ian had acquired a brand new 2700HGV hub with BT v5.29.117.6 firmware. He
was reporting his new hub appeared to lose port 80 access (ie. web browsing)
after a short while and the only way to recover from the situation, was to
literally perform a factory reset and re-enter all hub setup parameters.
To cut a long story short, it transpired he uses bittorrent
quite a lot. He was able to finally cure his loss of port 80 after I
suggested he check his 'Attack Detection' settings in the firewall settings of his
hub.
He found that unticking the 'Miscellaneous' and 'Excessive
Session Detection' check boxes resolved his problem.
Whenever the 2700 hub loses and subsequently re-establishes
its internet connection while you are online and surfing, your web browser will
display Broadband status notifications. This can be particularly annoying
as the only way to rid yourself of the message is to close down and restart your
web browser.
On v5.x firmware, you can disable these notifications by
navigating to this page and disabling the setting.
Discovered one Sunday morning my BT hub had lost connection to the
internet. It appeared to be synchronised to the exchange but log revealed
that login authentication was timing out. I tried rebooting the
router, even tried another 2700HGV and a usb modem, all with the same
results. It looked like a problem with my ISP. Being a Sunday, I was
unable to contact my ISP as they only operated a helpline Mondays to Saturdays.
A couple of hours later, I remembered there was a BT test login ID for ADSL
IPstream (and datastream?) connections so I tried the login details:
The hub immediately connected successfully and I was able to navigate to BT's
test URL.
I then changed the ppp username & password back to my own ADSL login
details. To my surprise, the hub now successfully connected and I was back
online.
Later on in the day, I learned about stale
sessions. This is the first time I had witnessed this
problem.
Leif wrote to say he had been using a single SSID 2700HGV for over 3 years
without problems. Then recently, the hub went into a loop where it was
repeatedly rebooting itself, then eventually the power light was just Red all
the time.
He checked the open circuit voltage from the mains power supply and it was
outputting 5.1 volts, so he concluded the hub was probably faulty.
He acquired a replacement brand new 2700HGV only to discover that behaved in
exactly the same manner as described above when using the original 3+ year old
power supply. The new power supply worked fine with both hubs.
The original power supply unit (rated at
5.1volts DC @ 3 Amps) was clearly faulty under
'load' conditions.
Comments posted on IDnetters forum suggest there may be a growing trend in
failing UK power supply units coming to light with older hubs.
Apparently,
www.digidave.co.uk offer
replacement compatible PSUs for UK use for around £10 including UK delivery but
these appear to be rated at 2 Amps. Acquiring a cheap 2700HGV from eBay
may be more cost effective method of sourcing a replacement PSU.
'Thomas' asked if it was possible to use the 2700HGV as a wireless access
point (WAP),
connected to a different ADSL router.
ie. the 2700HGV would serve as a
Wireless access point, the ADSL/WAN port and DHCP service on the 2700HGV
router would be disabled, and the DHCP services would then be provided by an
alternative server (eg. the other ADSL router) if required.
Initially I thought this could not be achieved with the 2700HGV, but after
further thought and a bit of googling,
it was evident this was indeed possible.
To verify it myself, I brushed the cob webs off my old BT1200 router (not
wireless enabled) and hooked it up to my ADSL line.
Then fired up the 2700HGV and went to the management console
Note that I assigned an IP address of 192.168.1.254 with subnet
255.255.255.0 to the 2700HGV, but you will probably want to use an IP
address that is local to the subnet you plan to create. eg. my BT1200
router's DHCP server creates a local subnet beginning with 172.16.0.1, so I
should have assigned 'router address' of say 172.16.0.200 with subnet
255.255.0.0 to my 2700HGV if I wanted to be able to continue to manage the
2700HGV hub.
I then used a crossover ethernet cable and connected the BT1200 router to
the 2700HGV hub.
Next, I powered up my wireless desktop PC and it successfully obtained an
IP address from the BT1200 hub via the 2700HGV wap as shown below.
The PC was successfully able to surf the internet.
My Vistron MX-200i Reciva based wireless internet radio reported port 80
error. However, when I configured it with static IP settings, it
successfully connected to the internet via the 2700HGV wap.
Zane from Singapore wrote to me recently with an interesting observation.
He owns a Singtel 2700HGV-2 (Assy no. 4200-006006-000, HW ver. 2700-100657-005).
He observed when he entered the BT keycode on his hub, the MAC address entry was
blanked out.
I personally believe this is purely a cosmetic issue. If the hub had no
hardware MAC address, then surely it would not function at all.
You can of course spoof a MAC address by navigating to:
Home > Broadband
Link > Advanced Settings > Hardware Address Override
The spoofed MAC address should then appear at the bottom of the page in:
I was browsing the IDnetters forum and came across references to a Line
Monitoring tool called RouterStats, developed by John Owen. There are two
versions: the 'Lite' edition works with 2700 hubs.
(Above image is reproduced from John Owen's web page for 'RouterStats')
I downloaded the zipped version of 'RouterStats Lite' v4.6. The
zip file contained a single executable called RouterStatsLite.exe
Once extracted to my Windows XP computer, I ran the file and followed the
simple instructions to enter my router model (2Wire 2700HG-B, -V) and confirm
the IP address of my 2700HGV hub (ie.
192.168.1.254). I didn't enter my router login name & password.
Sample screen dump of RouterStats Lite connected to my hub running BT
v5.29.107.12 firmware.
I thought I'd pass on some of my experience with a variety of Wireless 54G
PCI cards I have tested and used with 2700HGV wireless router under
Windows XP. Note that you may get different results with other makes of
wireless routers.
I currently have a desktop PC based on Intel G33 motherboard chipset located
in a room upstairs. The 2700HGV is located downstairs and the distance between
the two is less than 10 metres. Due to the position of the desktop computer, the
aerial (and rear of PC) is always facing away from hub. Windows signal
strength reports 'Excellent' in 802.11b 11mbp wireless mode. I also
believe I suffer from some sort of local wireless interference every so often
which seems to result in complete loss of wireless connectivity between this
computer and the hub. My laptop which is used in different part of the
house is not affected by these aforementioned outages. The hub's wireless
power level setting is set to default value of '1' (ie. 25mW).
Make & model of card
Wireless chipset
Comments
Belkin F5D7000 v3000uk
(used for a year to 2008)
RaLink RT2500
Excellent signal strength in
802.11b mode. In 802.11g mode, I'm not able to
achieve full 54mbp speed. Drops out frequently using latest Belkin
XP v2.2.7 drivers (Known problem) even in 802.11b mode. Much improved with just the
occasional dropout using better RT2500 drivers v3.2.0.0 from Ralink
website. Try installing the newer driver using the "Don't
Search, I will choose the driver to install" from disk method, otherwise, I
recall I had to hack the RT2500.INF file to persuade the newer driver to
install. My modified driver files can be found here.
Also tested with Thomson TG585v7 router (Wifi signal strength seems to be
better than WMP54G v4.1 below)
Belkin F5D7000 v7***uk
(tested for a week)
Realtek RTL8185L
Excellent signal strength in
802.11b mode. In 802.11g mode, I'm barely able to achieve 35mbp. Drops out frequently using latest Belkin
XP v5.87.19.106 drivers even in 802.11b mode. I've also felt Windows XP becomes unstable
when using this card and driver in my PC. I downloaded and hacked
the INF file to force the very latest Realtek RTL8185L v1105 XP drivers to
install - 54mbp wireless G mode connectivity was awful with this later
driver as it kept falling back to 11mbp. Not
Recommended.
Linksys WMP54G v2
(used for a year to 2007)
Broadcom
Excellent signal strength in
802.11b mode. Average signal strength in 802.11g mode. I'm not able to
achieve full 54mbp speed. Drops out occasionally using latest albeit
ancient Linksys driver. I also tried using latest driver from
Windows Update but signal strength was far worse so I reverted back to the
Linksys driver. Supplied with a big
20cm aerial.
Linksys WMP54G v4.1
(currently in use)
RaLink RT256x/RT61
Excellent signal strength in
802.11b and 802.11g modes. The latest Linksys driver is quite old
and reputed to be not very good. Currently using the circa 2007 RT256x/RT61 drivers
v1.2.3.0 from Ralink
website. Installed the newer driver using the "Don't Search,
I will choose the driver to install" from disk method and
choosing '802.11g PCI Wireless Adapter'.
Supplied with a
big 20cm aerial. (Note: earlier v4.0 card is cosmetically similar
except it is utilises the RT2500 wireless chipset). I also tested this
against a Thomson TG585v7 router and signal strength was very poor.
The
Edimax EW-7218G appears to use the same RaLink chipset and hence drivers as
the WMP54G v4.1.
Play.com are offering it for £11.99. I may look at acquiring one to
evaluate the wireless perforance, as the repositionable aerial should be more
flexible than the swivel aerials fitted to the majority of PCI wireless cards.
SBC v4.25.x firmware offers 10 wireless power settings (25 to
400mW) on early Single
SSID hubs. No enhanced services are installed.
SingTel v5.29.x firmware offers 6 wireless power settings (only 4
are valid on Dual SSID hubs, 25 to 100mW) and is compatible with old and later hubs. Enhanced
services are available to download/install if the BT key code is used.
The BT v5.29.x firmware is favoured over the new v6.1.x
firmware simply because it is possible to hack the wireless power setting at
this moment in time.
The new BT v6.1.x firmware contains quite a few bugs and is
best avoided.
Please note that my ADSL line stability observations are
based on the 2700HGV units in my possession and my less than perfect ADSL
line (line attenuation 49dB). It is a BT IPstream ADSL connection
utilising Alcatel DSLAMs at the telephone exchange. This has been provided through
my past ISPs: Pipex (pre-Tiscali), NewNet, and now
PlusNet. You may experience different results with your 2700HGV.
After moving to PlusNet recently (Still no o2 LLU in my
area yet), I noticed Openreach have
increased my target noise margin from the default of 6dB to 9dB. I've been
aware in the past that the 6db target noise margin was fractionally too low for my
dodgy line. But since it has been raised to 9dB, it so far has been far
more stable with no disconnections in almost 2 weeks - it is still early days
though.... The only downside is the line sync speed is lower too - best of
5,600 kbps instead of 6,200+ kbps.
Flashable to SBC v4 firmware
Flashable to SingTel v5 firmware
Flashable to BT
v5....12 firmware
Editing wireless power settings using Opera.
(Power Output)
Comments
Early 2700HGV
fw: BT v4.25.27
hw: 2700-100588-005
assy: 4200-003003-004
Yes
Yes
Yes
Yes
levels 1-10
(25 - 400mW)
This old firmware tries to connect to old BT provisioning servers at smehomehubrms.bt.com
Early 2700HGV
fw: BT v4.25.33
hw: 2700-100588-005
assy: 4200-003003-004
Yes
Yes
Yes
Yes
levels 1-10
(25 - 400mW
Upgraded from
v4.25.27 to v4.25.33 from 'home' page, but by 2nd day, the router decided by itself to upgrade
again to
v5.29.107.19.
This old firmware tries to connect to old BT provisioning servers at smehomehubrms.bt.com
Early 2700HGV
fw: v5.29.107.19
hw: 2700-100588-005
assy: 4200-003003-004
Yes
Yes
Yes
-
Provisioning
server URLs 'initially' differ to Dual SSID model with same v5.x of
firmware.
This old firmware tries to connect to old BT provisioning servers at smehomehubrms.bt.com
Early 2700HGV
fw: SBCv4.25.19
hw: 2700-100588-005
assy: 4200-003003-004
Flashed
Yes
Yes
Menu shows
levels 1-10
(25 - 400mW)
I had to input the following manual key code
using the Setup Wizard to recover all 11 wireless channel numbers and 10
wireless power level settings.
5225-2374-WG62-22AS-BJ7P
The Setup Wizard also would not complete after entering a valid ADSL
password, so I had to Quit the setup wizard and enter all ADSL &
login parameters manually.
This firmware connects to 2Wire
provisioning servers at 2wire.com
I have read some AT&T
badged 2700HG versions may have wireless channel options limited to channels 5,6
& 7 only. These are usually shipped with v4.x firmware. The restricted
number of wireless channels may perhaps be a keycode issue.
I can be emailed at:
logikir100oXogooglemail.com
(replace the 'oXo' with an '@' symbol)
Please note I cannot answer any direct questions regarding compatibility of
the firmwares quoted on this website with other 2wire 2700/2701 model hubs.
The firmwares are intended for hubs utilising ADSL/ADSL2 Annex A over normal
PSTN phone lines.
Generally speaking, 2wire firmwares usually have a degree of 'backward
compatibility'.
It is my belief the SBC v4.x Recovery firmware should in theory be compatible
with models up to 2700, which begin with 2700 in the Hardware version with
factory/ISP installed v4 or v5 firmware. ie. do NOT install it on 2701
hardware versions.
The v5.x Recovery firmwares should in theory be compatible with 2700 and 2701
hardware versions with factory/ISP installed v4 or v5 firmware.
If there is sufficient interest, I could add a new section to this page and
collate reader's attempts to flash their non-BT 2700/2701 hub with
alternative BT, Singtel or SBC firmware. The information I would require
would be:
Model description (eg. 2700HGV)
ISP brand, Country (eg. BT, United Kingdom)
Assembly no. (eg. 4201-003003-008)
Hardware version (eg. 2701-100588-005)
Pre-installed firmware version (eg. v5.29.117.6)
Flashed firmware version (eg. Singtel v5.29.117.3)
Is the flashed firmware working successfully?
Yes or No
URL to forum/message thread discussing subject (Optional)
