Telus Actiontec V1000H Hacks and Information

The Actiontec V1000H is a combination xDSL modem/wireless router/internet gateway device which also provides functionality for newer technologies such as VoIP (Voice over IP) and IPTV (Internet Protocol Television). Actiontec manufactures the hardware and markets the devices to third party companies like ISPs (Internet Service Providers). The third party companies then customize the device firmware for their specific needs and provide it to their customers. Actiontec only provides support and firmware updates for NCS (non customer specific) devices. All other devices are supported by the customer (ISP) who has provided the device to the end user, because they contain modified firmware which is specific to each customer.

Telus provides a branded version of this device to some of their High Speed Internet and Optik TV customers.

The Telus firmware for the V1000H has many hidden features and other details which I have decided to compile into a single blog post. This will hopefully be helpful to other users who have this device.

NOTE: Actiontec V1000H devices which are not Telus branded will use a different firmware and will not work the same way. The details provided in this post are specific to the Telus branded devices and may not work properly (or at all) on other devices.

Specifications:

Hardware

Board ID: Broadcom 96368VVW
Memory: 64MB
Flash: 32MB (AM29LV320MT)
Ethernet: 5 Ports (1 WAN)
Wireless: 802.11 (b, g, n)
HPNA: Yes
USB: Yes

Software

Release: 31.30L.48
Kernel: Linux 2.6.21.5
Build Date: Wed Sep 1 23:33:32 PDT 2010

Logging Into the Web Based Administration Interface

The device can be graphically configured and monitored through it’s web based interface. To connect to the interface, open a web browser and enter the internal network IP of the V1000H into the address bar. The default http address to connect to the web interface is: http://192.168.1.254/.

The interface will load the “Home” screen by default. This page displays all kinds of useful status information about the device (like device model, firmware version, MAC address, IP addresses and enabled interfaces). On the upper right side of the page there will be an area which you can use to login to the interface and change the device configuration.

The default username and password for the device is:

Username: admin
Password: telus

Once you have logged in you should change the admin password from the default.

For more information about connecting to the web interface or configuring the device options, please check out the Wireless Gateway Settings Guide, User Manual, or support site provided by Telus.

Web Interface Accounts and Default Passwords

The web interface allows for multiple usernames and passwords which can be used to login to the device. The links available from the main web interface and the pages which you can access change depending on the credentials which you provide.

Administrator

Username: admin
Password: telus

The admin account provides standard end user options for configuring the device, however many options are hidden.

Technician

Username: tech
Password: t3lu5tv

The tech account is used by Telus technicians and provides all of the options hidden under the regular admin interface.

Hidden Pages of the Web Interface

Telus has hidden several pages of the web interface from the end user by removing their links. The configuration pages still exist and function (most likely intended only for Telus technicians or support to use) but you need to know and access the URL directly.

To use any of these features, you must login to the regular web interface first, then open the complete URL of the hidden page (copy and paste them into the address bar of your web browser, or open the links provided below). If the internal network IP address of your V1000H is different from the default then replace it with the correct IP address in the URLs below.

UPDATE: Under standard Telus firmware version 31.30L.55 these pages will no longer work when logged in as ‘admin’. They will always return the error “HTTP 403 Forbidden”. To access these URLs you must login using the ‘tech’ account (the links are also not hidden if you use the ‘tech’ account, but you can still use the links below for quick access).

Advanced Settings:

DHCP Reservation

http://192.168.1.254/advancedsetup_dhcpreservation.html

DHCP Settings

http://192.168.1.254/advancedsetup_dhcpsettings.html

HPNA LAN

http://192.168.1.254/advancedsetup_hpna.html

LAN IP Address

http://192.168.1.254/advancedsetup_lanipaddress.html

LAN IP and DHCP Settings

http://192.168.1.254/advancedsetup_lanipdhcpsettings.html

LAN Subnets

http://192.168.1.254/advancedsetup_lansubnets.html

Remote GUI

http://192.168.1.254/advancedsetup_remotegui.html

Remote Telnet

http://192.168.1.254/advancedsetup_remotetelnet.html

VLAN

http://192.168.1.254/advancedsetup_vlan.html

Utilities:

Upgrade Firmware

http://192.168.1.254/utilities_upgradefirmware.html

Installing Firmware Using the Web Interface

Telus has hidden the firmware update page of the web interface from end users by removing links to it under the area accessed by end users. The page can only be found by entering the correct address into the address bar of your browser.

The default address for the firmware update page is:

http://192.168.1.254/utilities_upgradefirmware.html

From here you can select and update the device firmware using a downloaded image file on your computer. You can use this to install official Telus firmware updates or custom firmware which you select.

NOTE: Firmware updates are not compatible between different customer specific devices. If you install the incorrect firmware for your device (like using Actiontec NCS firmware on a Telus branded V1000H) there is a huge risk of damaging or bricking the device!

UPDATE: Under standard Telus firmware version 31.30L.55 this page will no longer work when logged in as ‘admin’. You must login using the ‘tech’ account (see sections above for details).

Hacked Firmware to Remove Telus Limitations

There is a hacked version of the Telus 31.30L.48 firmware which removes many of the limitations in the standard Telus firmware. The download (file name: Actiontec_V1000H_31.30L.48-TELUS-1302125540.1.img) was initially provided on a thread in the DSLReports forum. This link no longer works. Fortunately, there is a copy available for download under this blog post by Chad Klassen.

You can install the firmware using the method described in the above section. Make sure you extract the image file if it in a compressed archive (like .ZIP or .RAR) so that you are uploading only the raw .IMG file to the device.

NOTE: Your device’s Telus firmware should be the same version (31.30L.48) as the hacked firmware to guarantee it will work properly.

UPDATE: Telus has automatically pushed firmware update version 31.30L.55 to their V1000H devices (including those running the hacked 31.30L.48 firmware). The hacked firmware provided above will no longer work on the devices which have been updated with version 31.30L.55, and it is no longer necessary. You can now access all of the hidden firmware features using the ‘tech’ account (details provided in the above sections).

Logging into the Console Using Telnet

The V1000H has a console which you can access over Telnet. The console can be used to control the device and configure low level options using command line instead of the web interface.

The Telnet service is disabled by default and must be enabled using the web interface. Login to the web interface and access this page:

http://192.168.1.254/advancedsetup_remotetelnet.html

You need to enable the local telnet service and configure the login user name and password which you would like to use. Once you apply the settings the Telnet service will be enabled.

You can access the Telnet port using the telnet command included in Windows. Under Windows Vista and newer the Telnet Client is not installed by default and you may need to add it first using the “Add/Remove Windows Components” wizard in the “Programs and Features” control panel (Start->Run and enter “rundll32.exe shell32.dll,Control_RunDLL appwiz.cpl,,2”).

Depending on your browser/system configuration, you may be able to open this link directly to open your telnet client:

telnet://192.168.1.254

You can also open a new Command Prompt (Start->Run and enter “cmd”) and then type in the following command:

telnet 192.168.1.254

NOTE: If your router IP address is different than the default 192.168.1.254 then you must change it in the URL or command above.

The telnet client should prompt you for the same login and password you configured in the web interface, and should display a shell prompt (“>”) upon successful login:

===Actiontec xDSL Router===
Login: admin
Password:
>

Console Commands

For a list of commands which you can use, enter “?” or “help” into the prompt. The following commands are listed:

?, help, logout, exit, quit, reboot, adsl, xtm, brctl, cat, loglevel, logdest, virtualserver, ddns, df, dumpcfg, dumpmdm, meminfo, syslog, psp, echo, ifconfig, kill, ping, ps, pwd, sntp, sysinfo, tftp, wlctl, arp, defaultgateway, dhcpserver, dns, lan, lanhosts, passwd, ppp, restoredefault, route, save, swversion, wan

I won’t go into the usage and function of every command here. There are many tiny custom tools which are for modifying or operating the device. Many of them are compact versions of regular Linux commands (you can lookup their details via online man pages).