3rd party BT Infinity modem/router replacements

Hello all,

I am very concerned about the back doors BT has left in its router (Ports 161 & 4567) and as such prefer to install my own 3rd party modem and router.

I have done my own homework and AFAIK as long as the 3rd party modem/router supports VDSL and has a WAN port, it should be able to replace BT's modem and router with a single piece of kit.

Can anyone please confirm if the following modem/router will do the job?

http://www.ebuyer.com/291710-tp-link-450mbps-dual-ba...

Thanks.

Unless I am missing something, that is just a router, not a combined router and VDSL modem. Where does it say otherwise?

Edited by kasg (Fri 14-Sep-12 10:06:06)

Because it is in the "Networking > Wireless > Routers - Fibre / VDSL" category, so I assume it is also a VDSL modem.

Please correct me if I am wrong

In reply to a post by Anonymous:

I am very concerned about the back doors BT has left in its router (Ports 161 & 4567)

Assuming you are talking about the HG612 modem, these ports are only accessible from BT's Management platform via VLAN 301. They are not directly accessible from the internet which uses VLAN 101.

It is a router that will work with a VDSL service. It still needs a modem! You won't get a combined router and VDSL modem for anywhere near that price. And as per post above, you can disable VLAN 301 if it bothers you.

Edited by kasg (Fri 14-Sep-12 10:20:15)

You've overshot my competency, I am afraid

What is VLAN 301 and VLAN101 and where do I read up about them?

Thanks.

Looks just like a router with a wan port to plug the modem into, no mention of a built in modem.

Fritzbox 7390 will handle the VDSL2 side.

Yes that TP-Link is not suitable to replace modem. Datalink protocol would need to list VDSL2 which it does not.

Around the world it is pretty common to supply a VDSL modem. In fact for many countries same used to happen with ADSL, and people bought their own Ethernet router.

Where are you getting all this from anyway? No offence, but it seems odd that you know enough to be concerned about "back doors using ports 161 and 4567" (which I'd never heard of) but not enough to be able to recognise a VDSL modem or anything about VLAN 101 and 301.

P.S. you (and we) will find life a lot easier if you register!

VLANs are a method of providing Layer2 separation - simplistically creating separate connections within an Ethernet network.
A 'VLAN tag' is applied to the Ethernet frame to identify it.

With the BT FTTC service, there are effectively 2 connections, one (VLAN101) connects the modem to the internet via the ISP.
The other (VLAN301) connects the modem to BT management platform. These 2 connections operate separately from each other.

A search for 'VLAN tagging' or similar will return countless results.

What about the:

http://www.broadbandbuyer.co.uk/Shop/Reviews.asp?Pro...

Unfortunately it doesn't have gigabit ethernet capability

This does http://www.broadbandbuyer.co.uk/Shop/ShopDetail.asp?...

�Compliant with ITU-T G.994.1 and 997.1 VDSL2 Standard

So yes would work, but the no gigabit would put me off. But for those on a tight budget maybe worth a look.

In reply to a post by Anonymous:

You've overshot my competency, I am afraid

What is VLAN 301 and VLAN101 and where do I read up about them?

Thanks.

In simple terms those ports are on a different network. One that can be thought of as BT's private national network and nothing to do with the Internet. All things considered the security risks associated with them are going to be pretty small. I suppose that a disgruntled BT employee could use them to sabotage your connection but frankly it'd be easy for said employee to raise spurious disconnection requests or just drive round to your house in the dead of night and cut your telephone wires.

Alright, thanks for the explanation. I have three comments:

1) Open ports 161/4567

GRC's Shields up shows port 161 as not being stealthed. So are you sure it is only accessible via BT's VLAN 301 and not 101 as well?

2) So in theory BT can recognise if I disable VLAN 301 on their supplied modem or use a third party one with VLAN 301 and ports 161/4567 disabled.

Does anyone know of BT objecting to this breach of the ToS?

3) Theoretically what risks do I run by using a 3rd party router vs. a 3rd party modem/router?

What happens if you connect to the ports over the internet? 161 is an SNMP port.
TR-069 usies 4567 as part of the remote firmware upgrade functionality.

Being spotted on GRC scare site, is different to the device actually allowing anything over those ports.

Seen no objects by BT Retail to swapping out the HH3, and none to people swapping out Openreach modem. Though if ever reporting a possible fault, always double check with the original hardware.

3rd party router may have similar open holes. If people were exploiting the BT holes, then you can expect lots of publicity and work to resolve. If someone exploits poor security on provider XYZ hardware it might get a mention in the back of a dark hardware corner.

1) 2 Issues here:
a) Not 'stealthed' doesn't mean 'open'. As long as the port is closed it is not accessable.
b) The ports GRC are probing are on VLAN101, which is bridged to the router behind the modem. So it is testing the ports on the router, not the HG612 modem.

2) In theory, yes and it could perhaps be regarded as a breach. Reality is that others have replaced the modem without issue, but keep the HG612 to put back in the case of problems.

3) virtually none.

Port 161 is on the modem, not the router.

Only on VLAN301, which is not connected to the Internet.

I'm not sure the internet cares which vlan it's open on, but the fact remains that Port 161 is open to the BTAgent daemon which is running on the modem.

This means that Port 161 cannot be stealthed by forwarding the port on the router to a fake ip address, but the other ports can.

Open to the BTAgent daemon?
So what information can you get out of it by accessing over the internet?

Sorry, no idea. Mine is now stealthed though so I'm happy.

What happens if you connect to the ports over the internet? 161 is an SNMP port.
TR-069 usies 4567 as part of the remote firmware upgrade functionality.

Let's say you rent a house. Isn't it objectionable that the landlord would choose to leave two back doors open, to which only he has the keys to, without your knowledge and indeed your ability to put your own locks on them?

Such is it with the supplied BT Infinity modem/router. I understand they are making a product for the masses but they should have at least not dumbed down the admin interface so much that you can't lock down those ports, limit bandwidth of users, shut down WPS (Google: Reaver + WPS cracking), have CLI access and other things.

I'll admit I am not very computer savvy and am learning as I go (thank you to the informed posters here) but am objecting to these open ports on the principle of it, which are concepts even a child can grasp.

If you load the hacked firmware on the HG612, you can disable vlan 301. I think that stealths Port 161.

Which will have no effect on the (overzealous IMHO - but that's another issue) GRC test.
This is testing the ports on the router (HomeHub), not the HG612 modem.

VLAN301 is not accessable from the internet, only from BT's management platform.

The internet connection traverses VLAN101, which is bridged to the LAN1 interface and from there to the router.
The modem itself does not present any ports to the internet. It passes everything transparently through to the router behind. It is this router that presents ports to the internet.

It may perhaps be worth thinking of this in other terms.

As you know, (when unlocked, but with the default config and still operating as a bridge) the modem presents 'the internet' via the LAN1 interface.
The admin pages of the modem can only be accessed via the LAN2 interface.
i.e. The LAN1 interface and the internet are 'bridged'. It acts as a simple pipe allowing everything to pass back and forth between the two.
The LAN2 interface is only used to access the router itself. Any traffic on LAN2 is separate from LAN1.
The internet cannot be accessed from LAN2 and the modem cannot be accessed from LAN1.

Whilst the above uses two physical interfaces to separate the traffic (LAN1 & LAN2), the same is done on the WAN (internet facing) interface by using Logical Separation.
The physical WAN interface contains sub-interfaces (VLAN101 & VLAN301). These are logically separate, acting in a similar manner to the two LAN interfaces. One (VLAN101) is bridged to the LAN1 interface, the other terminates on the router itself.
Traffic from one cannot be accessed from the other.

In reply to a post by MrSaffron:

Fritzbox 7390 will handle the VDSL2 side.

Yes that TP-Link is not suitable to replace modem. Datalink protocol would need to list VDSL2 which it does not.

Around the world it is pretty common to supply a VDSL modem. In fact for many countries same used to happen with ADSL, and people bought their own Ethernet router.

I heard that BTOR is doing trials of wires only FTTC, so you are just sent the modem/router with some filters and then fit it your self.

Be better than having to wait in for someone to install it.

I presume eventually they will do away with the separate modem and router and combine it all in one unit.

Object by not using the HH3, and then see what ports are apparently not stealthed.

Not being stealthed is different to not been open. I've seen GRC report ports, that have IP restrictions on them reported as visible, because you can infer a service is running on the port, but the router once it looks at src IP actually drops the packets.

With the keys analogy it is like insisting that the key hole is also located in a hidden place, so no visible key to even attempt a key in.

In reply to a post by panda:

Which will have no effect on the (overzealous IMHO - but that's another issue) GRC test.
This is testing the ports on the router (HomeHub), not the HG612 modem.

VLAN301 is not accessable from the internet, only from BT's management platform.

Have you actually seen the settings for Vlan 301 on the HG612 interface?

Yes and it is irrelevant as VLAN 301 is not connected to or accessible from the internet.
The only way to access services on VLAN301 is to also be connected to VLAN301.

The internet connection is on VLAN101.

Do you understand the concept of VLANs, sub-interfaces and logical separation?

One has to laugh.

Your explanation of how the setup normally works looked quite convincing, but has a basic flaw. Which for the moment I will leave you to discover within the text of your post.

In your first line you state quite categorically Which will have no effect on the (overzealous IMHO - but that's another issue) GRC test.

I suggest you stop arguing with BatBoy on this subject, due to the flaw in your explanation.

Then you are aware it's called TR069_INTERNET and it hands out routeable IP addresses from DHCP?

I wall take your sage advice.

Wall?

The Fritz!Box 7390 is an excellent modem/router for VDSL2. I am using it at the moment, though I'm having quality issues with the VOIP/telephone side of it, the DSL and networking side make up for that.

I can now alter my SNRM target rather than be stuck with what BT's DLM thinks is best (6 dB for example), and adjust some other parameters (still experimenting so I can't specifically say what does or doesn't work in that area, but I can confirm that DS SNRM target offset works fine!).

ARe you still using Annex A?

Please can you post full modem stats for examination as to what else looks different? I'm particularly interested in the Annex, and things like:-

VDSL2 framing
                        Path 0
B:              239             237
M:              1               1
T:              64              62
R:              0               16
S:              0.1349          0.5278
L:              14234           3850
D:              1               1
I:              240             127
N:              240             254

                        Counters
                        Path 0
INP:            0.00            0.00
PER:            2.15            8.18
delay:          0.00            0.00
OR:             88.96           31.29

Bitswap:        27495           15736

# xdslcmd info --pbParams
xdslcmd: ADSL driver and PHY status
Status: Showtime
Retrain Reason: 0
Max:    Upstream rate = 14365 Kbps, Downstream rate = 57492 Kbps
Path:   0, Upstream rate = 14343 Kbps, Downstream rate = 56626 Kbps

Discovery Phase (Initial) Band Plan
US: (0,95) (868,1207) (1972,2783)
DS: (32,859) (1216,1963) (2792,3959)
Medley Phase (Final) Band Plan
US: (0,95) (868,1207) (1972,2783)
DS: (32,859) (1216,1963) (2792,3959)
       VDSL Port Details       Upstream        Downstream
Attainable Net Data Rate:      14365 kbps         57492 kbps
Actual Aggregate Tx Power:        6.8 dBm          13.3 dBm
============================================================================
  VDSL Band Status        U0      U1      U2      U3      D1      D2      D3
  Line Attenuation(dB):  5.3     29.9    45.0     N/A    14.5    36.9    57.3
Signal Attenuation(dB):  8.3     29.0    43.8     N/A    14.5    36.9    57.3
        SNR Margin(dB):  6.1     6.2     6.2      N/A    6.3     6.3     6.3
         TX Power(dBm): -3.8    -12.5    6.3      N/A    11.0    7.8     3.5

VDSL2 profiles:
        8a      Enabled
        8b      Enabled
        8c      Enabled
        8d      Enabled
        12a     Enabled
        12b     Enabled
        17a     Enabled
        30a     Enabled
        US0     Enabled
Phone line pair:
        Inner pair
Capability:
        bitswap         On
        sra             Off
        trellis         On
        sesdrop         Off
        CoMinMgn        Off
        24k             On
        phyReXmt(Us/Ds) Off/On
        TpsTc           AvPvAa
        monitorTone:    On
        dynamicD:       On
        dynamicF:       On
        SOS:            On
        Training Margin(Q4 in dB):      100
#

In reply to a post by Ixel:

I can now alter my SNRM target rather than be stuck with what BT's DLM thinks is best (6 dB for example), and adjust some other parameters (still experimenting so I can't specifically say what does or doesn't work in that area, but I can confirm that DS SNRM target offset works fine!).

I see from your thread in the other forum that you have managed to increase SNRM to induce increased stability.

Have you experimented with lowering it to below 6dB (say to 3 dB) in order to increase sync speeds?

I tried that with the HG612, but it seemed stuck at slightly over 6dB, determined by DLM.

In reply to a post by kasg:

It is a router that will work with a VDSL service. It still needs a modem! You won't get a combined router and VDSL modem for anywhere near that price. And as per post above, you can disable VLAN 301 if it bothers you.

If you mean the BiPAC 8200N, as in Anonymous's link, then you are mistaken.

It is a VDSL2 modem/router and I am currently using one and it makes a reasonable one box solution although it has a few speed issues with ECI DSLAM's which is being looked at by Billion's support engineers.

In reply to a post by simon194:

If you mean the BiPAC 8200N, as in Anonymous's link, then you are mistaken.

No, I was quite specifically referring to the original query about the TP-Link router.

In reply to a post by simon194:

If you mean the BiPAC 8200N, as in Anonymous's link, then you are mistaken.

If you click the links in the post headers you will find he is referring to the opening post.

In reply to a post by Ixel:

The Fritz!Box 7390 is an excellent modem/router for VDSL2. I am using it at the moment..

I can now alter my SNRM target rather than be stuck with what BT's DLM thinks is best (6 dB for example)..but I can confirm that DS SNRM target offset works fine!).

It would be great to see some screen shots of this.

cheers, a

In reply to a post by Ixel:

The Fritz!Box 7390 is an excellent modem/router for VDSL2. I am using it at the moment, though I'm having quality issues with the VOIP/telephone side of it, the DSL and networking side make up for that.

I can now alter my SNRM target rather than be stuck with what BT's DLM thinks is best (6 dB for example), and adjust some other parameters (still experimenting so I can't specifically say what does or doesn't work in that area, but I can confirm that DS SNRM target offset works fine!).

Interesting. I have never had a problem with the VOIP/telephone side of it, but my 7390 does not get as fast a connection as the BT-Supplied modem. I wonder if there are some Fritz! Box settings I don't have correct. Can you tell me what works best for you?

I see. Well as I recall the attainable rate was around a few megabits lower than what the OR modem could get, however I've noticed that there aren't as many CRC errors. I do however blame the stupidly longer Y cable supplied with the Fritzbox to be the reason why the attainable rate is lower. Is it actually possible to use a normal RJ11 cable on it (has anyone tested that)?

I've been messing around with the SNR margin offset for the downstream, via Telnet though as I have more flexibility compared to the web interface (control panel). My aim is to encourage DLM to set interleaving depth back to 1 (as close to Fastpath as possible) as a result of hardly any CRC errors and errored seconds. I haven't figured out a way to tweak the upstream SNR margin though.

As for the phone side, I got crackling noises occasionally on calls via landline and VOIP. Do you have DECT phones? I've tried mine with the router's own DECT station and the old base station in Fon0 port, both same results. I was told however that it could be a result of interference from an unshielded LAN cable (I didn't use the, apparently shielded, LAN cable supplied with the Fritzbox.

A normal rj11 lead works perfectly fine

Thanks. I'll switch back to the one I used with the OR modem in the morning, as I'm not using the PSTN phone side functionality of the router.