What about the:

http://www.broadbandbuyer.co.uk/Shop/Reviews.asp?Pro...

Unfortunately it doesn't have gigabit ethernet capability

This does http://www.broadbandbuyer.co.uk/Shop/ShopDetail.asp?...

�Compliant with ITU-T G.994.1 and 997.1 VDSL2 Standard

So yes would work, but the no gigabit would put me off. But for those on a tight budget maybe worth a look.

In reply to a post by Anonymous:

You've overshot my competency, I am afraid

What is VLAN 301 and VLAN101 and where do I read up about them?

Thanks.

In simple terms those ports are on a different network. One that can be thought of as BT's private national network and nothing to do with the Internet. All things considered the security risks associated with them are going to be pretty small. I suppose that a disgruntled BT employee could use them to sabotage your connection but frankly it'd be easy for said employee to raise spurious disconnection requests or just drive round to your house in the dead of night and cut your telephone wires.

Alright, thanks for the explanation. I have three comments:

1) Open ports 161/4567

GRC's Shields up shows port 161 as not being stealthed. So are you sure it is only accessible via BT's VLAN 301 and not 101 as well?

2) So in theory BT can recognise if I disable VLAN 301 on their supplied modem or use a third party one with VLAN 301 and ports 161/4567 disabled.

Does anyone know of BT objecting to this breach of the ToS?

3) Theoretically what risks do I run by using a 3rd party router vs. a 3rd party modem/router?

What happens if you connect to the ports over the internet? 161 is an SNMP port.
TR-069 usies 4567 as part of the remote firmware upgrade functionality.

Being spotted on GRC scare site, is different to the device actually allowing anything over those ports.

Seen no objects by BT Retail to swapping out the HH3, and none to people swapping out Openreach modem. Though if ever reporting a possible fault, always double check with the original hardware.

3rd party router may have similar open holes. If people were exploiting the BT holes, then you can expect lots of publicity and work to resolve. If someone exploits poor security on provider XYZ hardware it might get a mention in the back of a dark hardware corner.

1) 2 Issues here:
a) Not 'stealthed' doesn't mean 'open'. As long as the port is closed it is not accessable.
b) The ports GRC are probing are on VLAN101, which is bridged to the router behind the modem. So it is testing the ports on the router, not the HG612 modem.

2) In theory, yes and it could perhaps be regarded as a breach. Reality is that others have replaced the modem without issue, but keep the HG612 to put back in the case of problems.

3) virtually none.

Port 161 is on the modem, not the router.

Only on VLAN301, which is not connected to the Internet.

I'm not sure the internet cares which vlan it's open on, but the fact remains that Port 161 is open to the BTAgent daemon which is running on the modem.

This means that Port 161 cannot be stealthed by forwarding the port on the router to a fake ip address, but the other ports can.