Print Thread
btcracked
If you want to dump the BT HomeHub Kit and get a VOIP SIP phone working other than BT kit read on
My equipment is Draytek 2800 Combined with Siemens Gigaset C460 IP. I chose this SIP/PSTN DECT Dual phone as it means I can have ONE phone. Receive call's on both the landline ( 0207) number and take advantage of the VOIP offered by BT broadtalk ( 050 number) which comes partially free with home hub deal.When you pick up the Gigaset C460IP by defualt it's configure to use the Internet but you can switch to the landlines and rings on both. Hence you get the best of both worlds.
1) You need to understand BT are trying to obscure there setup, to get you base config first go to BT site
https://service.btbroadbandvoice.bt.com/bbv/online/consumerBBTalkMyAccount
a) Enter your number and login details,
b) Navigate to configure your setup, click the First Button "Configure Your equipment"
c) A Second button appears call "configure"
d) Right mouse click this and get properties
e) Cut and paste the whole URL into a text editor
f) To make it more legible put a carridge return before every "&" the remove the "&"
You will end up with something like this :-
http://api.home/voipsetup.api?
SIPTransportPort=5060&
SIPRegistrarAddress=btsip.bt.com
SIPRegistrarPort=5060&
SIPOutboundProxyAddress=sip.btsip.bt.net
SIPOutboundProxyPort=5060
SIPProxyAddress=btsip.bt.com
SIPProxyPort=5060
SIPPhoneNumber1=445XXXXXXXX
SIPUsername1=44XXXXXXXXX@btsip.bt.com
SIPPassword1=QMXXXXXXXXXXXXXXXX
2) The most important bit of information is SIPPassword1=QMXXXXXXXXXXXXXXXX This you will note is NOT the BT password BT gave you which you login into the site, which you might think is encrypted. It's plain text an is the password you need to use to authenticate against the proxy. Also understand that it's important you do not confuse the outbound proxy with the SIP proxy.
3) Translate the above settings into your SIP phone for example with my C460IP I have the following Settings
Authentication Name: 44XXXXXXX
Authentication password: SIPUsername1
Username: 44xxxxxxxxx
Domain: btsip.bt.com
Proxy server address: btsip.bt.com
Proxy server port: 5060
Registrar server: btsip.bt.com
Registrar server port: 5060
SIP port: 5060
RTP port: 5004
Use random ports: No
STUN enabled: No
Outbound proxy mode: Always
Outbound proxy: sip.btsip.bt.net
Outbound proxy port: 5060
4) This is not enough as BT do not advertise the domain btsip.bt.com. This means that you cannot register, as if you do an nslookup/dig on btsip.bt.com nothing comes back. BT have hacked this part into there equipment hence why people have so many problems.
However, sip.btsip.bt.net and btsip.bt.com are one of the same. So we have to fool the system so you can register with the btsip.bt.com domain name set which is an absolute requirement.
There are two methods the first if your using a system where you can take advantage a host file , second is where there is NO host file is present eg an embedded system eg like the Gigaset C460IP
a) Place a fake entry in your host file of you SIP phone or host your client software is running off
nslookup sip.btsip.bt.com take one of the returned IP's and fake an entry
mymachine:/var/lib/named/master # nslookup sip.btsip.bt.com
sip.btsip.bt.com canonical name = sip.btsip.bt.net.
Name: sip.btsip.bt.net
Address: 62.239.169.132
Name: sip.btsip.bt.net
Address: 62.239.169.136
.......
eg I've taken the first entry
cat /etc/hosts
btsip.bt.com 62.239.169.132
b) The second as with the C460IP, this device has a web front end, one of the options is to configure the device with either static of Dynamic IP. The static IP qives you the option to set a DNS server. So this method leverages an internal DNS to spoof the BT domain which is not advertised by BT.
To do this :-
a) I choose a static address for the device I then also set the preferred DNS server to point to my internal bind/named service. This is configure for it's own domain but is also configure with forwarders ie my router the Draytrek. With forwarders enable anything my DNS server does not know about it will ask the router. With this setup the C460IP can resolve both internal and external addresses
b) Set up a spoof on btsip.bt.com in your named.conf file make an entry like so :-
zone "btsip.bt.com" {
type master;
file "master/bt.db";
};
The zone name is important as we are not being master for the whole of the bt.com domain which would break things locally but just the sub domain btsip which is not advertised by bt, so is quite safe until BT change it to otherwise.
The database file should look something like the following, you can place as many A records as you wish. I original tried to put just a CNAME record into this file (CNAME are basically just aliases) but this basically did not work hence the A records.:-
# cat bt.db
$TTL 1W
;
@ IN SOA mymachine.my.internal.net. root.my.internal.net. (
20070212 ; serial
2D ; refresh
4H ; retry
6W ; expiry
1W ) ; minimum
IN NS mymachine.my.internal.net.
IN A 62.239.169.132
* IN CNAME sip.btsip.bt.net.
So that when your device trys to resolve the address btsip.bt.com the following happens.
# nslookup btsip.bt.com
Name: btsip.bt.com
Address: 62.239.169.132
Name: btsip.bt.com
Address: 62.239.169.136
Name: btsip.bt.com
.......
There is also a third possibility if your router is sophisticated enough and has a host file you could leverage this, and using DHCP have your embedded device dynamically receive it''s IP and DNS server being the router. The Routers host file in theory should take precedence. In this scenario you do not need to run a internal DNS and removes a dependency.
I now have one phone in the house which is DECT based with SIP and connected to my landlines. For me this is a good solution as a have server which is on all the time. The disadvantage is that there is a dependency on another box.
:-)
