Unlocking BT 2Wire 2700HGV Business Hub (wireless router)


Contents > BT v6.1 firmware:




Installing BT v6.1.1.22-enh.tm firmware

+ It can be unlocked for use on any ISP network using HTML source hack.

- Wireless Power output cannot be hacked.  Cannot be downgraded once BT v6.x firmware is installed.  The DHCP server cannot be disabled, so it cannot be used as a Wireless Access Point. This firmware is 'unfinished' so is likely to be 'buggy'. Be warned that this BT engineered firmware is likely to have the same bugs as found in the later v6.1.1.48 official release.

(Update 11 Nov 2011): Gnix reports that his two Singtel hubs with v6.1.1.22 can no longer connect to the home page or connect to the internet. He resolved the problem by adding static routes to block access to the BT provisioning servers.

This unfinished firmware existed in 2008 and was never released to the public.

It has mainly been tested by 2701HGV-W owners in Australia and New Zealand with varying degrees of success as an alternative to the ISP-locked Telecom v6.1.1.43 firmware. Some users in the UK have also tried v6.1.1.22 on their BT 2700HGV too.

There are two firmware files for BT v6.1.1.22-enh.tm

WARNING:  Install at your own risk.  It could brick your hub or the firmware may be incompatible with your ISP.  Please note there is no way of returning to any earlier v5 firmware or to the original firmware previously installed/supplied with your hub. 

Do NOT use this firmware to downgrade a model running a version of firmware significantly higher than v6.1 (eg. Current BT 2700/2701HGV models now use BT v6.3.x). There is a high probability of bricking the hub. Review the test results at end of this page before 'downgrading' any hub.




Full Recovery/re-installation file



Partial upgrade file (Not required)

(The files should be unzipped before use)

The larger 17MB looks like a full recovery/re-install file and this should be used in the first instance – it will delete all existing hub settings. The smaller 12MB file looks like an over the net upgrade file, perhaps only to be used to update from an earlier test release of BT v6.1 firmware to this v6.1.1.22 edition without losing or changing any hub settings based on my observations. I had no trouble installing the larger 17MB recovery file to a 2700HGV which was previously running Qwest firmware.

Extracted from previous test results by users who have installed BT v6.1.1.22:

BT v6.1.1.22 features compared to BT v6.1.1.48 production firmware

An HTML source edit hack can be used to unlock this firmware for any other ISP.

Enhanced Services is not available (Content Screening, Access Controls, Firewall Monitor, Link Monitor)

Wireless information is missing from the Settings > LAN > Statistics menu

No option to disable the DHCP server in the Settings > LAN > Private networks menu

The Local Network Devices list which shows active and inactive devices appears to actually work when OpenZone is disabled

Renaming function of devices listed in Local Network Devices List does not work.

Although the Link Monitor menu tab does is not visible under Diagnostics menu, it can be accessed via this direct link:


Ensure you are logged into the hub, otherwise the Link Monitor will not display any activity.

The firmware upgrade page on most 2wire 270x routers can be found at:

home/upgrade.html or home/tech/upgrade.html


Q. Does this firmware have Fusion wireless network ?

A. Yes, as does all BT v5.x and BT v6.1 firmware versions.

Q. Can the wireless power output be hacked ?

A. No, this firmware has all the 'limitations' of the later production v6.1.1.48.x firmware. ie. it is locked to setting '1' (25mW).

Q. Can I downgrade a BT 2700HGV with v6.3.9.63-plus.tm firmware using the BT v6.1.1.22 Re-install file ?

A. Kinmel has successfully downgraded a 2700HGV running v6.3.9.63-plus.tm to BT v6.1.1.22 using the 17MB recovery file. (updated 16 Nov 11)

Please note we also know that directly installing the older Qwest QT04- firmware directly onto a 2701HGV-C hub (BT v6.3.9.41-plus.tm firmware) will semi-brick the hub. However, one reader reports successfully installing the BT v6.1.1.22 17MB full recovery firmware onto 2701HGV-C. The Qwest firmware could then be applied afterwards – This has NOT yet been verified.

Q. Are there any issues downloading files greater than 2GB ?

A. There shouldn't be any issues as it pre-dates the Qwest QT04- firmware when the 2GB file download issue was first identified.

Q. If this is installed to a BT 2700HGV without the static route hack, will it be upgraded to a later release?

A. BT will not upgrade hubs running v6.1.1.22.

Q. Can I use this as a wireless access point ?

A. No. The option to disable the DHCP server has been removed. The Qwest firmware may be a better option if you wish to use it as a WAP.

Quick Setup Procedure

Change the hub's factory default system password

Go to Home > Settings > System Info > Password > I forgot the Password > I still can't remember the password
Set up a new System password.  You will need the WEP key found on the label on the underside of the hub when prompted.


Add static routes to block communications to BT provisioning servers

Click here for instructions.

Starting Point for establishing new ISP connection

Go to Settings > Broadband > Link Configuration
Use fake BT username such as: me@btbroadband.com
Also edit ADSL/ATM, DNS and MTU parameters as required.
Choose 'Disabled' for ATM PVC Search if you want the hub to use the displayed ATM parameters.
Save these settings. You should be prompted for the admin password.
"Configuration Successful" message should appear.

Adding own PPP username & password

(Update 11 Nov 11): See the new Opera-free instructions by Gnix in next section. I can confirm it works in IE9.

Credit to Aaron who came up with this method. You will need to download and install Opera web browser. Other web browsers such as Chrome may also work.

Point your Opera web browser to:          

http://home/xslt?PAGE=HURL13 or

If you witness an 'unknown error' message, check that Broadband Status Notification check box is ticked in the Settings > System Info > Event Notifications menu and try again.




If using a Telecom 2701HGV-W, try this file:  text file.

Otherwise, use this alternative file:  alternative text file.



(This image is from BT v6.

Re-attempting message will appear on screen to confirm your PPP username & password has been saved. The hub will now try to establish the internet connection.

See also the BT v6. firmware page for know bugs and issues that may also afflict this firmware.

More information about how to unlock this firmware for any ISP can be found here:

Unlocking Telecom 2701HGV-W with BT v6.1.1.22 firmware

Other useful information by Gnix

(New 11 Nov 2011):

Gnix originally provided information last year regarding his experience with the v6.1.1.22 firmware here. Here is an update a year and a half later.

BT blocking v6.1.1.22 firmware

My Singtel ADSL modems with BT V6.1.1.22 firmware have never upgraded to the newer BT firmwares. Instead, it recently started to lose its internet connection, and the Modem will reboot when I open IE. On further investigation, I can no longer use Home and gateway.2wire.net to access the Modem's home page. Power cycling the modem also could not resolve the problem. I have had to factory reset the Modem.

I can confirm it is not due to the Modem hardware problem, since I am using two separate Modems ( 2700HGV-2 and 2701HGV-E on ADSL connection) which both exhibit the same symptoms. By adding the two static routes, it seems to solve the problem, but still testing….

WAN Ethernet port

The BT v6.1.1.22 firmware is used on both the SingTel 2700HGV-2 and SingTel 2701HGV-E. The 2701HGV-E has an ethernet WAN port (like the BT 2701HGV-C) which happens to be disabled with the original Singtel firmware. But when the BT v6.1.1.22 firmware is installed, the WAN port can be utilised. ie. The 2701HGV-E can now be used as a pure router on a cable connection.

The 15 digit HURL13 method

The following method eliminates the need to using Opera we browser to edit the HTML source, for entering & saving the PPP username and passwords:

I’ve attached the file called HURL13.htm, by using this file, I can enter the user name and password without using Opera.

But before I can do that, I have to find the unique 15 digit value of the Modem with current power cycle, this 15 digit value will change with every Modem power cycle.

On BT firmware Home page, Go to Settings > Broadband page, then on the IE tool bar, select View > Source

Below is an example of the source code:

<form name="pagepost" method="post" action="/xslt?PAGE=C_1_1_POST&amp;NEXTPAGE=C_1_1_POST" id="pagepost">

<input type="hidden" name="NONCE" value="42cf005e6c7f7c8" />

<input type="hidden" name="THISPAGE" value="C_1_1" />

Highlighted in red above, is the required unique 15 digit value of interest.

I then use notepad to open this attached HURL13.htm file and find the similar 15 digit value (search for 'fffffffffffffff') and replace it with the newly acquired value, then save it as a .HTM file. (Link to Gnix's original HURL13.htm file)

Now I can use IE to open the newly saved HURL13.htm file and enter the username and passwords.

Enabling VOIP Service

The second VOIP.htm file is for enabling the VOIP service, like HURL13.htm file, before I can using this Voip.htm file, I need to use notepad to open the file and replace the old 15 Digit value (search for 'fffffffffffffff') with new one. (note: it needs to be updated in two places in the file). Afterwards, I can using IE to open the new file and enter the necessary VOIP parameter. I am not sure this file can be used on other BT V6 firmware to enable VOIP services. (Link to Gnix's original VOIP.htm file)

The VOIP service can also be used in pure router/cable mode on my 2701HGV-E.

Test Results

Installing BT v6.1.1.22-enh.tm firmware


Previous installed Version


Telecom 2701HGV-W


(1 Jul 09):  Aaron unlocks his 2701HGV-W as documented above. He came up with this HTML patch for the PPP Authentication page.

(3 Jul 09):  Reports his hub has crashed a few times when using wireless.  He is not sure what is causing this issue, but pointed out he is not using a 2Wire mains power adapter.  His substitute transformer based adapter is only rated at 12volts @ 1Amp, whereas the hub calls for a 12volts @ 2.2Amp rated adapter. 

Enhanced Services is not available on this release of firmware.

BT 2700HGV dual SSID


(4 Jul 09):  Ian F. reports Aaron's original HTML patch didn't seem to work on the 2700HGV.  I provided an alternative HTML patch, which I lifted from v61.1.48 firmware, for the PPP Authentication page for Ian F. to use.  He subsequently successfully connected to his ISP, PlusNet.  

Ian also reports the wireless power hack does not work, and the Wireless data is missing from the Settings > LAN > Statistics menu. 

The option to disable the DHCP server in the Settings > LAN > Private networks menu is also apparently missing.

Aaron and Ian F. both report that they subsequently installed the smaller 12MB bt-270x-pppoa_download_enh.2sp file, and could not see any difference.

BT 2700HGV single SSID


(5 Jul 09):  John C. also flashed a BT 2700HGV Single SSID model.  Unlike Aaron's image of the System Information page where you can see a line drawing of 2wire 2701 with BT branding, John's image here shows a classic BT branded 2700.  He successfully connected to his ISP, PlusNet, using the alternative HTML patch.

Telecom 2701HGV-W

(16 Feb 10): Scott M. wrote to advise he had to use the alternative text file containing the 'PASSWORD' field instead of the 'ADM_PASSWORD' field, when he reflashed his Telecom 2701HGV-W so he could use it with his new ISP, Orcon. 

He added he also had to change the VPI/VCI to 0/100 otherwise he observed the hub appeared to be 'connected' but there was no 'internet connection'.

Telecom 2701HGV-W

(30 May 10): Thommy recently moved from Telecom to Vodafone for his broadband services.  Vodafone provided a Dlink 526B modem and this connects at 12Mbps.   He successfully installed the BT v6.1.1.22 firmware and edited the PASSWORD field to establish a connection.  Unfortunately, he had to report the best downstream speed his Telecom 2701HGV-W could achieve was no more than 4.5Mbps.  

SingTel 2700HGV-2

SingTel 2700HGV-E


(12 Jun 10): Gnix from Singapore.  Click here for original details

Telecom 2701HGV-W

(26 Jun 10): Mike M. is using his Telecom 2701HGV with BT v6.1.1.22 firmware on his Telecom ADSL2+ broadband service running at 15mbps.  He has observed when one computer is downloading at full speed (ie. 1.5MB/s), the other computers on his network struggle to connect to any websites - this was not an issue with a previous Linksys router he owned.

Telecom 2701HGV-W

(4 Jan 11): Landyn is successfully using it on his Slinghot network in New Zealand for several months, but it then mysteriously stopped working.  He deduced the hub would no longer permit 0/100 vc-mux PPPoA settings to be used.

He then found a Qwest v6. firmware in circulation and found it worked far better than the BT beta firmware, without the need for any hacks.

BT 2700HGV

Qwest QT04-

Some reports here. Success cross flashing from Qwest to v6.1.1.22 and vice versa.

BT 2700HGV

BT v6.3.9.63-plus.tm

Downgrading to v6.1.1.22 is unknown at this time. It may brick the hub.

SingTel 2700HGV-2

SingTel 2700HGV-E

(11 Nov 11): Gnix. My Singtel ADSL modems with BT V6.1.1.22 firmware have never upgraded to the new BT v6.3 firmware. Instead, it recently started to lose its internet connection, and the Modem will reboot when I open IE. On further investigation, I can no longer use Home and gateway.2wire.net to access the Modem's home page. Power cycling the modem also could not resolve the problem. I have had to factory reset the Modem.

I can confirm it is not due to the Modem hardware problem, since I am using two separate Modems ( 2700HGV-2 and 2701HGV-E on ADSL connection) which both exhibit the same symptoms. By adding the two static routes, it seems solve the problem, but still testing….

BT 2700HGV

Qwest QT04-

(12 Nov 11) Myself. Testing with static route hack.

Configured hub with no ADSL cable attached. Hub successfully connected to ISP but disconnected after 10 minutes. Power cycling and re-entering PPP username & password failed to resolve problem.

Factory reset hub and configured hub with ADSL cable attached. Now working fine.

Gnix's 15 digit HURL13 method works in IE9. ADSL2+ line speed is similar to v6.1.1.48 & v6.3.

First 10MB of 2+GB files download ok. Menus seem to navigate faster than v6.1.1.48.

BT 2700HGV,



(16 Nov 11) Kinmel has downgraded to the BT v6.1.1.22 full recovery firmware (17MB file). He reports no problems so far.

BT 2701HGV-C


(24 Dec 11) Arobertson545 reports he is also using v6.1.1.22.

Use 'Back' button to return to previous page or click here to return to main menu