Huawei B220 exploration
I'm setting up a Huawei B220 3G router from MTN. Some brief notes as I go along.
It's a box with a built-in HSDPA interface. Ports on the back:
It appears to be locked to MTN. Possible unlock option (untested):
http://www.blog.gem-flash.org/2010/03/11/huawei-old-3g-modem-calculator/
Update:
my free unlocking guide.
It runs Linux. Telnet to its IP address (default 192.168.1.1, username admin password admin) and you get busybox.
# more /proc/version
Linux version 2.4.20 (x127667@old_server.com) (gcc version 3.2.3 with Broadcom modifications) #2 �� 9�� 2 11:08:05 CST 2008
(some of that line is control chars)
# more /proc/cpuinfo
system type : Broadcom BCM5354 chip rev 3
processor : 0
cpu model : BCM3302 V2.9
BogoMIPS : 237.56
wait instruction : no
microsecond timers : yes
tlb_entries : 32
extra interrupt vector : no
hardware watchpoint : no
VCED exceptions : not available
VCEI exceptions : not available
unaligned_instructions : 1
dcache hits : 0
dcache misses : 0
icache hits : 0
icache misses : 0
instructions : 0
# more /proc/meminfo
total: used: free: shared: buffers: cached:
Mem: 31207424 11071488 20135936 0 1736704 4157440
Swap: 0 0 0
MemTotal: 30476 kB
MemFree: 19664 kB
MemShared: 0 kB
Buffers: 1696 kB
Cached: 4060 kB
SwapCached: 0 kB
Active: 2848 kB
Inactive: 4484 kB
HighTotal: 0 kB
HighFree: 0 kB
LowTotal: 30476 kB
LowFree: 19664 kB
SwapTotal: 0 kB
SwapFree: 0 kB
# more /proc/mtd
dev: size erasesize name
mtd0: 00040000 00010000 "cfe"
mtd1: 00340000 00010000 "linux"
mtd2: 00281f40 00010000 "rootfs"
mtd3: 00060000 00010000 "resource"
mtd4: 00010000 00010000 "factory"
mtd5: 00010000 00002000 "nvram"
# lsmod
Module Size Used by
wl 560400 0 (unused)
et 21920 0 (unused)
So that looks like 32MB RAM.
(Most of the usual commands like df and uname don't work, hence the need to poke in /proc)
There's a bunch of hidden configuration webpages:
# cd /3w
# ls
en js index.asp res images css
# ls en/
wlan_status_adv.asp save_pin.asp fw_switch_h3g.asp
wlan_settings.asp route_cfg.asp fw_switch.asp
wlan_bridge.asp restorerouter.asp fw_remote_web.asp
wlan_basic_en.asp resetrouter.asp fw_port_forwards.asp
wlan_basic_cfg.asp pukcfg.asp fw_filter_mac.asp
wlan_adv_cfg.asp profile.asp fw_filter_ip.asp
wl_mac_filter.asp ppp_settings.asp fw_dmz_ipaddr.asp
wizard.asp pincfg.asp fw_app_special.asp
wan_status_adv.asp pin_message.asp footer.asp
w_hiden.asp pin_management.asp first.asp
upgrade.asp password.asp dialup.asp
umts.asp networklist.asp ddns_cfg.asp
u_version.asp networkcfg.asp content.asp
system.asp menu.asp connect_main.asp
syscfg_b220.asp mac_filter.asp conn.asp
syscfg1.asp logo.asp cardlock.asp
syscfg.asp log_error.asp basic_status.asp
sms_settings.asp lancfg.asp adv_settings_tim.asp
security_cfg_h3g.asp lan_status_adv.asp adv_settings.asp
security_cfg.asp fw_upnp_active.asp
(for example, http://192.168.1.1/en/cardlock.asp looks like an unlocking page, but requires an unlock code)
Some 'hidden' features:
ddyns_cfg.asp: dynamic DNS settings
sms_settings.asp: Voice Message Services number (?)
security_cfg_h3g.asp: The same as the security config page, but with no text (? I wondered if H3G was Hutchison 3G?)
syscfg.asp/syscfg1.asp/syscfg_b220.asp: Various mobile band options for different locales (GSM900/1800, GSM950/1900, etc)
fw_app_special.asp: Firewall punching. It looks like you configure an outbound 'trigger port', which causes a range of other ports to be opened when you connect. For example, I tried for the Twinkle SIP client (which refuses to work as it's behind symmetric NAT):
Name: SIP
Status: On
Trigger port: 5060
Trigger protocol: UDP
Open port: 5060,8000-8005
Open protocol: UDP
Common port:
But I can't make the Javascript accept the values (after clicking 'apply', all the buttons grey out and nothing else happens).
MTN DNS is quite slow, but I've yet to find a page to configure my own DNS servers (editing NVRAM might be an option).
Similarly:
# ls /3w/js/
wlansec.js u_connec.js networklist.js err_info.js
wlanadv.js puk.js networkcfg.js content.js
wlan_cfg.js pub_valid.js lancfg.js connection.js
wlan_bridge_cfg.js pub_ctl.js help.js band_cfg_b220.js
wizard.js pin.js global.js band_cfg1.js
u_version.js password.js frame_h3c.js band_cfg.js
Setting up is just like a normal router, nothing too special. The configuration interface is a bit clunky, but OK. Oddly it says it's doing 384kbps up/down when I'm actually getting about 3x that down, so the software must be confused between WCDMA (which it mentions) and HSDPA (which it doesn't, but is obviously using). (Later, it does show as using 7.2Mbps HSDPA)
Programs available:
# ls /sbin /bin /usr/bin /usr/sbin
/usr/sbin:
wlconf udhcpc ses ntpclient iptables epi_ttcp brctl
wl testmode sendpack nas4not ip drvtest ats
vconfig tc pppoecd nas httpd dnsmasq at
upnp syswatch pppd modload factory diagd
udhcpd ses_cl nvram looptest et ddns
/usr/bin:
wget telnetd nc free
traceroute route killall find
/bin:
umount rm mv mknod ln dd cat
sleep pwd msh mkdir kill date busybox
sh ps mount ls grep cp
rmdir ping more login echo chmod
/sbin:
write stats reboot lsmod insmod ifconfig erase
syslogd rmmod rc klogd init hotplug
# ps
PID Uid Stat Command
1 0 S init noinitrd
2 0 S [keventd]
3 0 R [ksoftirqd_CPU0]
4 0 S [kswapd]
5 0 S [bdflush]
6 0 S [kupdated]
7 0 S [mtdblockd]
8 0 S [khubd]
21 0 S httpd
91 0 S ats
92 0 S ats
169 0 S syslogd
179 0 S telnetd
182 0 S /usr/sbin/dnsmasq -H /tmp/hosts -n -i br0 -r /tmp/resolv.c
185 0 S nas /tmp/nas.lan.conf /tmp/nas.lan.pid lan
187 0 S diagd
189 0 S udhcpd /tmp/udhcpd0.conf
190 0 S syswatch
191 0 S diagd
196 0 S ses -f
197 0 S ses_cl -f
201 0 S pppd /dev/usb/tts/0 -g -i 0 -t 1500 -U 0
208 0 S -sh
262 0 R ps
Nothing terribly exciting there, except a notable lack of anything VOIP related. Which puzzles me as to why an RJ11 connector has been provided.
Aha, found the dmesg output (there's no dmesg tool):
# more /proc/kmsg
<4>Kernel addr reboot flag = 0xa1fff000, reboot_number = 0xa1fff004
<4>Kernel physical_mem =0x2000000 reboot flag = 0x12345678, reboot_number = 0x0
<4>CPU revision is: 00029029
<4>Primary instruction cache 16kb, linesize 16 bytes (4 ways)
<4>Primary data cache 16kb, linesize 16 bytes (2 ways)
<4>Linux version 2.4.20 (x127667@old_server.com) (gcc version 3.2.3 with Broadcom modifications) #2 �� 9�� 2 11:08:05 CST 2008
<4>Setting the PFC to its default value
<4>Determined physical RAM map:
<4> memory: 01fff000 @ 00000000 (usable)
<4>On node 0 totalpages: 8191
<4>zone(0): 8191 pages.
<4>zone(1): 0 pages.
<4>zone(2): 0 pages.
<4>Kernel command line: root=/dev/mtdblock2 noinitrd console=ttyS0,115200
<4>CPU: BCM5354 rev 3 at 240 MHz
<4>Calibrating delay loop... 237.56 BogoMIPS
<6>Memory: 30408k/32764k available (1565k kernel code, 2356k reserved, 112k data, 68k init, 0k highmem)
<6>Dentry cache hash table entries: 4096 (order: 3, 32768 bytes)
<6>Inode cache hash table entries: 2048 (order: 2, 16384 bytes)
<4>Mount-cache hash table entries: 512 (order: 0, 4096 bytes)
<4>Buffer-cache hash table entries: 1024 (order: 0, 4096 bytes)
<4>Page-cache hash table entries: 8192 (order: 3, 32768 bytes)
<4>Checking for 'wait' instruction... unavailable.
<4>POSIX conformance testing by UNIFIX
<4>PCI: no core
<4>PCI: Fixing up bus 0
<6>Linux NET4.0 for Linux 2.4
<6>Based upon Swansea University Computer Society NET3.039
<4>Initializing RT netlink socket
<4>Starting kswapd
<6>devfs: v1.12c (20020818) Richard Gooch (rgooch@atnf.csiro.au)
<6>devfs: boot_options: 0x1
<5>JFFS2 version 2.1. (C) 2001 Red Hat, Inc., designed by Axis Communications AB.
<6>Serial driver version 5.05c (2001-07-08) with MANY_PORTS SHARE_IRQ SERIAL_PCI enabled
<6>ttyS00 at 0xb8000300 (irq = 3) is a 16550A
<6>ttyS01 at 0xb8000400 (irq = 0) is a 16550A
<6>PPP generic driver version 2.4.2
<7>Physically mapped flash: Found an alias at 0x400000 for the chip at 0x0
<7>Physically mapped flash: Found an alias at 0x800000 for the chip at 0x0
<7>Physically mapped flash: Found an alias at 0xc00000 for the chip at 0x0
<7>Physically mapped flash: Found an alias at 0x1000000 for the chip at 0x0
<7>Physically mapped flash: Found an alias at 0x1400000 for the chip at 0x0
<7>Physically mapped flash: Found an alias at 0x1800000 for the chip at 0x0
<7>Physically mapped flash: Found an alias at 0x1c00000 for the chip at 0x0
<5> Amd/Fujitsu Extended Query Table v1.3 at 0x0040
<4>Physically mapped flash: Swapping erase regions for broken CFI table.
<5>number of CFI chips: 1
<5>Flash device: 0x400000 at 0x1c000000
<5>Physically mapped flash: cramfs filesystem found at block 1016
<5>Creating 6 MTD partitions on "Physically mapped flash":
<5>0x00000000-0x00040000 : "cfe"
<5>0x00040000-0x00380000 : "linux"
<5>0x000fe0c0-0x00380000 : "rootfs"
<5>0x00380000-0x003e0000 : "resource"
<5>0x003e0000-0x003f0000 : "factory"
<5>0x003f0000-0x00400000 : "nvram"
<3>sflash: found no supported devices
<6>usb.c: registered new driver usbdevfs
<6>usb.c: registered new driver hub
<4>USB20H fcr: 0x64
<4>USB20H shim cr: 0x8f7
<4>USB20H syn01 register : 0xfe00fe
<4>USB20H syn03 register : 0x1
<6>usb-ohci.c: USB OHCI at membase 0xb8003000, IRQ 6
<6>usb-ohci.c: usb-00:03.0, PCI device 14e4:471a
<6>usb.c: new USB bus registered, assigned bus number 1
<6>hub.c: USB hub found
<6>hub.c: 2 ports detected
<6>usb.c: registered new driver acm
<6>acm.c: v0.21:USB Abstract Control Model driver for USB modems and ISDN adapters
<6>usb.c: registered new driver serial
<6>usbserial.c: USB Serial support registered for Generic
<6>usbserial.c: USB Serial Driver core v1.4
<6>NET4: Linux TCP/IP 1.0 for NET4.0
<6>IP Protocols: ICMP, UDP, TCP
<6>IP: routing cache hash table of 512 buckets, 4Kbytes
<6>TCP: Hash tables configured (established 2048 bind 4096)
<6>IPv4 over IPv4 tunneling driver
<6>GRE over IPv4 tunneling driver
<4>ip_nat_pptp version 1.5 loaded
<4>ip_tables: (C) 2000-2002 Netfilter core team
<4>ipt_time loading
<6>NET4: Unix domain sockets 1.0/SMP for Linux NET4.0.
<6>NET4: Ethernet Bridge 008 for NET4.0
<1>802.1Q VLAN Support v1.7 Ben Greear
<1>All bugs added by David S. Miller
<4>msm gpio 0xc3
<3>devfs_register(gpio): could not append to parent, err: -17
<4>VFS: Mounted root (cramfs filesystem) readonly.
<6>Mounted devfs on /dev
<6>Freeing unused kernel memory: 68k freed
<3>cramfs: wrong magic
<4>eth0: Broadcom BCM47xx 10/100 Mbps Ethernet Controller
<4>eth1: Broadcom BCM4318 802.11 Wireless Controller 4.130.32.0
<4>Algorithmics/MIPS FPU Emulator v1.5
<6>vlan0: dev_set_promiscuity(master, 1)
<6>device eth0 entered promiscuous mode
<6>device vlan0 entered promiscuous mode
<6>device eth1 entered promiscuous mode
<6>br0: port 2(eth1) entering listening state
<6>br0: port 1(vlan0) entering listening state
<6>br0: port 2(eth1) entering learning state
<6>br0: port 1(vlan0) entering learning state
<6>br0: port 2(eth1) entering forwarding state
<6>br0: topology change detected, propagating
<6>br0: port 1(vlan0) entering forwarding state
<6>br0: topology change detected, propagating
<6>hub.c: new USB device 00:03.0-1, assigned address 2
<6>usbserial.c: Generic converter detected
<6>usbserial.c: Generic converter now attached to ttyUSB0 (or usb/tts/0 for devfs)
<6>usbserial.c: Generic converter detected
<6>usbserial.c: Generic converter now attached to ttyUSB1 (or usb/tts/1 for devfs)
<6>usbserial.c: Generic converter detected
<6>usbserial.c: Generic converter now attached to ttyUSB2 (or usb/tts/2 for devfs)
<4> RX status -2 RX status -2 RX status -2 RX status -2 RX status -2 RX status -2 RX status -2 RX status -2 RX status -2 RX status -2 RX status -2<6>br0: port 2(eth1) entering disabled state
<6>br0: port 1(vlan0) entering disabled state
<6>br0: port 1(vlan0) entering disabled state
<6>device vlan0 left promiscuous mode
<6>br0: port 2(eth1) entering disabled state
<6>device eth1 left promiscuous mode
<6>device eth1 entered promiscuous mode
<6>br0: port 2(eth1) entering listening state
<6>br0: port 1(vlan0) entering listening state
<6>br0: port 2(eth1) entering learning state
<6>br0: port 1(vlan0) entering learning state
<6>br0: port 2(eth1) entering forwarding state
<6>br0: topology change detected, propagating
<6>br0: port 1(vlan0) entering forwarding state
<6>br0: topology change detected, propagating
<4> RX status -2 RX status -2
usbfs is missing, so I had to mount it:
# mount usbfs /proc/bus/usb
# cat /proc/bus/usb/devices
T: Bus=01 Lev=00 Prnt=00 Port=00 Cnt=00 Dev#= 1 Spd=12 MxCh= 2
B: Alloc= 23/900 us ( 3%), #Int= 1, #Iso= 0
D: Ver= 1.10 Cls=09(hub ) Sub=00 Prot=00 MxPS= 8 #Cfgs= 1
P: Vendor=0000 ProdID=0000 Rev= 0.00
S: Product=USB OHCI Root Hub
S: SerialNumber=b8003000
C:* #Ifs= 1 Cfg#= 1 Atr=40 MxPwr= 0mA
I: If#= 0 Alt= 0 #EPs= 1 Cls=09(hub ) Sub=00 Prot=00 Driver=hub
E: Ad=81(I) Atr=03(Int.) MxPS= 2 Ivl=255ms
T: Bus=01 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 2 Spd=12 MxCh= 0
D: Ver= 1.10 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1
P: Vendor=12d1 ProdID=1001 Rev= 0.00
S: Manufacturer=HUAWEI Technologies
S: Product=HUAWEI Mobile
C:* #Ifs= 3 Cfg#= 1 Atr=a0 MxPwr=500mA
I: If#= 0 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=ff Driver=serial
E: Ad=81(I) Atr=03(Int.) MxPS= 16 Ivl=128ms
E: Ad=82(I) Atr=02(Bulk) MxPS= 64 Ivl=0ms
E: Ad=02(O) Atr=02(Bulk) MxPS= 64 Ivl=0ms
I: If#= 1 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=serial
E: Ad=84(I) Atr=02(Bulk) MxPS= 64 Ivl=0ms
E: Ad=04(O) Atr=02(Bulk) MxPS= 64 Ivl=0ms
I: If#= 2 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=serial
E: Ad=85(I) Atr=02(Bulk) MxPS= 64 Ivl=0ms
E: Ad=05(O) Atr=02(Bulk) MxPS= 64 Ivl=0ms
Lots of exciting stuff in the NVRAM (private stuff altered):
# nvram show
wl_leddc=0x640000
sdram_config=0x0062
wl_radius_port=1812
wl0_disable=1
filter_maclist=
wl0_wme_sta_be=15 1023 3 0 0 off off
ntp_server=192.5.41.40 192.5.41.41 133.100.9.2
wl_lazywds=0
sdram_refresh=0
wl0_mrate=0
wan_ppp_service=
wl0_wme_sta_bk=15 1023 7 0 0 off off
wl0_antdiv=3
lan_proto=dhcp
lan_hwnames=
wl_mrate=0
wl_antdiv=3
vlan0ports=0 1 2 3 5*
wan_hwname=
wan_ppp_demand=0
wl_wme=off
wl_wme_no_ack=off
wl0_crypto=tkip
wan0_hostname=
dmz_ipaddr=192.168.1.103
wan_ping_disable=1
lan_dhcp=0
wl_akm=psk
wl_corerev=
wl0_nmcsidx=-1
wl_crypto=tkip
wan_desc=
wl_wme_sta_vi=7 15 2 6016 3008 off off
wl0_wpa_psk=secret
wan_route=
wl0_macmode=disabled
wan_unit=0
wl_wme_sta_vo=3 7 2 3264 1504 off off
wl_maclist=
lan_ifnames=vlan0 eth1
wl0_maxassoc=32
wan0_route=
ezc_version=2
wl_rateset=default
curprofile=p_MTN�High-Speed�Internet
wan0_ipaddr=10.201.1.30
et0mdcport=0
bxa2g=1
wan0_web_enable=0
wan0_ppp_ac=
wl_net_reauth=36000
vlan1hwname=et0
wl_reg_mode=off
os_date=
wl0_bcn=100
wan0_ppp_auth=2
wan0_wins=
ag0=2
LastConnectedIP=1728161984
wl0_radius_port=1812
need_relogin=0
wl0_wme_ap_be=15 63 3 0 0 off off
ure_disable=1
wl0_wme_ap_bk=15 1023 7 0 0 off off
wl0_nreqd=0
serno=DQ6RAB19B1500068
et0phyaddr=30
wl0_dfs_preism=60
wan0_ppp_service=
wan0_dns=212.0.138.13 212.0.138.12
pa0maxpwr=72
wl0_gmode=1
app_version=
wl_nreqd=0
pa0b0=0x125d
wl_sta_retry_time=5
pa0b1=0xfb6e
time_zone=PST8PDT
wl_afterburner=off
pa0b2=0xfec1
wl0_channel=11
wl_gmode=1
wl_phytype=b
dhcp_domain=wan
ezc_enable=1
wl0_wds_timeout=1
wan_telnet_ipaddr=
os_server=
wan_ppp_auth=2
il0macaddr=00:25:68:xx:xx:xx
wan_ifname=ppp0
no_sim_card_alert=1
filter_ip_enable=1
wl0_radio=1
wan0_ifnames=ppp0
wl_wme_ap_vi=7 15 1 6016 3008 off off
ses_wds_mode=1
wl_wme_apsd=on
wl_dfs_postism=60
p_MTN�High-Speed�Internet=MTN�High-Speed�Internet *99# 0 internet1 1 0
wl0_lazywds=0
wl_wme_ap_vo=3 7 1 3264 1504 off off
wl_radio=1
wandevs=et0
wl0_vlan_prio_mode=off
wl0_key1=
wl0_radius_key=
wl0_key2=
console_loglevel=1
wl0_key3=
wl0_key4=
clkfreq=240
wl0_wme=off
wl_key1=
wan0_telnet_enable=0
wan0_ppp_demand=1
wl_key2=
wl_wds_timeout=1
wl_key3=
wan_domain=
wan_lease=86400
wl_key4=
wl0_akm=psk
wl0_corerev=13
autofw_port0=
wl0_afterburner=off
os_name=linux
wan0_lease=86400
cctl=0
wl0_guest_ssid_1=
wl0_maclist=
wl0_guest_ssid_2=
wl0_guest_ssid_3=
wan_hwaddr=
wl0_guest_ssid_4=
wl_wds=
lan_wins=
wl0_rateset=default
sdram_ncdl=0xffe0a
ccode=0
boardnum=0x5347
wan_wins=
is_need_watch=enable
lan_ifname=br0
wan_hostname=
timer_interval=3600
wl0_dfs_postism=60
router_disable=0
wl_plcphdr=long
wan0_web_ipaddr=
wl0_frag=2346
wl_wep=disabled
build_app_version=248.11.00.03.102
product_name=B220
wl_frag=2346
fw_app0=
dhcp_end=192.168.1.230
http_wanport=
wl_nctrlsb=none
wl0_closed=0
restore_defaults=no_need
upnp_enable=0
wl_ap_isolate=0
rssisav2g=2
wl_closed=0
wl0_frameburst=off
lan_domain=
wl0_tpc_db=
wl_wme_sta_be=15 1023 3 0 0 off off
wan0_hwname=
wan_proto=dhcp
filter_client0=
gateway_domain=e.home
wl_wme_sta_bk=15 1023 7 0 0 off off
wl0_reg_mode=off
curr_username=admin
wan0_proto=dhcp
lan_hwaddr=00:25:68:xx:xx:xx
wan_ppp_mru=1492
boardno=020RPY6R9B000158
wan_primary=0
wl_radioids=
wl_wpa_psk=secret
wl0_phytype=l
wl0_wme_no_ack=off
wl_auth_mode=none
wan0_ppp_idletime=600
dhcp_start=192.168.1.1
wl0_wme_sta_vi=7 15 2 6016 3008 off off
rssismc2g=2
wan_web_enable=0
wl_wpa_gtk_rekey=0
tl_timeout=600
cfe_version=
wl0_phytypes=l
wl0_wme_sta_vo=3 7 2 3264 1504 off off
wan_netmask=0.0.0.0
wan0_ppp_dialtime=120
stats_server=
lan_route=
wl_rts=2347
log_level=0
wl_nbw=20
rxpo2g=0xfff8
wl0_country_code=US
opo=12
wl_country_code=US
wl0_wpa_gtk_rekey=0
wl0_net_reauth=36000
wan_ppp_ifname=
wan_ipaddr=0.0.0.0
wl_key=1
build_os_date=Sep 1 2008 16:27:46
wl0_unit=0
ses_cl_enable=1
wan_ppp_ac=
first_used=1
wan0_ppp_mru=1492
wl_unit=0
wan0_primary=1
wl0_ssid=MTN_High_Speed_Internet
aa0=3
ses_enable=1
wan0_telnet_ipaddr=
lang_custom=en
wl0_wds=
wan_ppp_mtu=1500
wl0_wme_apsd=on
pa0itssit=62
wl_ssid=MTN_High_Speed_Internet
sromrev=3
wl_dfs_preism=60
wl_gmode_protection=auto
wl_vlan_prio_mode=off
filter_macmode=deny
wl_maxassoc=32
wl_disable=1
is_modified=1
wl0_nband=2
wl0_wme_ap_vi=7 15 1 6016 3008 off off
boardtype=0x048e
boardflags=0x750
dmz_enable=0
http_lanport=80
wl0_wme_ap_vo=3 7 1 3264 1504 off off
wl_nband=2
wl_wme_ap_be=15 63 3 0 0 off off
wl0_plcphdr=long
wan0_ifname=ppp0
is_default=0
wl0_auth=0
wl0_infra=1
watchdog=3000
wl0_wep=disabled
profile_number=1
wl_wme_ap_bk=15 1023 7 0 0 off off
fw_config=1
ses_status=Unknown
wl_auth=0
lan_netmask=255.255.255.0
wl_nmcsidx=-1
wl0_nctrlsb=none
dhcp_wins=wan
wl0id=0x4318
wl_infra=1
wl_macmode=disabled
rssismf2g=0
wan_ppp_idletime=600
boardrev=0x11
lan_ipaddr=192.168.1.241
et0macaddr=00:25:68:xx:xx:xx
et1phyaddr=0x1f
wan0_desc=Default Connection
wl0_rate=0
forward_port0=
wan0_unit=0
wan0_domain=
landevs=vlan0 wl0
wan_ppp_dialtime=120
wl0_mode=ap
wan_gateway=0.0.0.0
build_cfe_version=248.11.00.03.102
wl_rate=0
wan0_ppp_mtu=1500
wl_radius_key=
wl0_ifname=eth1
wl_mode=ap
wl0_nmode=-1
wan0_ping_disable=1
wl0_ampdu=
boot_wait=on
sdram_init=0x000b
user_passwd=secret
wl_ifname=
wan0_hwaddr=
wl_bcn=100
wl_nmode=-1
wl0_sta_retry_time=5
profile=p_MTN�High-Speed�Internet
auto_validate_times=3
admin_passwd=secret
log_ipaddr=
lan_lease=86400
auto_validate=on
lan_stp=1
fw_disable=0
wl_radius_ipaddr=
ses_event=0
br0_ifnames=vlan0 eth1
wl0_rts=2347
wan_dns=
wan_web_ipaddr=
wl0_nbw=20
tri2g=78
wan_ifnames=ppp0
filter_ipaddr0=
wl0_radioids=BCM2062
vlan1ports=4 5u
wl0_hwaddr=00:25:68:xx:xx:xx
wl0_ure=
wan_telnet_enable=0
vlan0hwname=et0
wl0_dtim=3
wl_channel=11
wan0_ppp_ifname=
wl_hwaddr=
wl0_key=1
wl_dtim=3
xtalfreq=25000
wan0_gateway=10.64.64.64
wl0_radius_ipaddr=
ses_cl_event=0
wl_phytypes=
wl0_gmode_protection=auto
wl0gpio0=11
wl0_leddc=0x640000
wl0_auth_mode=none
wan0_netmask=255.255.255.255
wl0gpio1=11
wl0gpio2=11
first_power_on=0
wl0gpio3=11
restore_ipaddr=192.168.1.1
jffs2_enable=disable
wl_frameburst=off
lan_gateway=192.168.1.241
wl0_ap_isolate=0
size: 6004 bytes (26764 left)
When I plug the router into my Ubuntu machine using the USB port, dmesg on the laptop says:
[93414.400168] usb 3-1: new full speed USB device using uhci_hcd and address 2
[93414.560144] usb 3-1: configuration #1 chosen from 1 choice
[93414.575380] usb-storage: probe of 3-1:1.0 failed with error -1
[93414.585197] usb 3-1: USB disconnect, address 2
[93415.312175] usb 3-1: new full speed USB device using uhci_hcd and address 3
[93415.486174] usb 3-1: configuration #1 chosen from 1 choice
[93415.507149] usb-storage: probe of 3-1:1.0 failed with error -5
[93415.514507] usb-storage: probe of 3-1:1.1 failed with error -5
[93415.539658] usb-storage: probe of 3-1:1.2 failed with error -1
[93415.561257] usbcore: registered new interface driver usbserial
[93415.561303] USB Serial support registered for generic
[93415.561486] usbcore: registered new interface driver usbserial_generic
[93415.561494] usbserial: USB Serial Driver core
[93415.572485] USB Serial support registered for GSM modem (1-port)
[93415.572754] option 3-1:1.0: GSM modem (1-port) converter detected
[93415.572977] usb 3-1: GSM modem (1-port) converter now attached to ttyUSB0
[93415.573011] option 3-1:1.1: GSM modem (1-port) converter detected
[93415.573199] usb 3-1: GSM modem (1-port) converter now attached to ttyUSB1
[93415.573252] usbcore: registered new interface driver option
[93415.573260] option: v0.7.2:USB Driver for GSM modems
[93524.695704] usb 1-1: USB disconnect, address 2
lsusb says I have a:
Bus 003 Device 003: ID 12d1:1003 Huawei Technologies Co., Ltd. E220 HSDPA Modem / E270 HSDPA/HSUPA Modem
Indeed, I can connect just fine to the 'internet1' APN with NetworkManager using that modem device.
On Windows, a USB mass storage device comes up and tries to install various drivers.
20/4/2010:
Right, I've now figured out how the the configuration interface operates. It's terrible... everything is done in Javascript on the user's browser (and Opera doesn't work, but Ubuntu Firefox does). The action happens in a script called http://192.168.1.1/en/apply.cgi (which I think is built into the /usr/sbin/httpd on the router). The parameters POSTed to the CGI are the NVRAM values to change. For example:
curl --user admin:password --basic -d "dmz_enable=1&dmz_ipaddr=192.168.1.123&page=fw_dmz_ipaddr.asp&action=Apply" http://192.168.1.1/en/apply.cgi
will turn on the DMZ and set its IP address by setting dmz_enable=1 and dmz_ipaddr=192.168.1.123
I think the page= parameter is just the page to redirect you back to afterwards. That means, while some of the hidden setup pages don't work (perhaps because they need to be actioned in the full frameset), you can configure them by looking in the page source, finding out the NVRAM values to set and setting them this way.
22/4/2010:
It seems this B220 is quite similar to the Huawei B970 and E960. Some resources on those:
https://dev.openwrt.org/ticket/2711
http://mybroadband.co.za/vb/archive/index.php/t-146724.html
Particularly interesting is the nvram key to enable the DDNS menu:
# nvram set ddns_cfg_enable=on
Which does work on my router. Possibly some of the other hidden pages can be activated in this way. So far I haven't been able to find the source for the B970 or E960 to poke around for other keys.
I tried setting the wan_dns and wan0_dns, but I couldn't override the PPP-supplied DNS servers. MTN uses Sudatel's, which are pretty poor:
$ java -jar browsermob-dns-perf.jar 212.0.138.12
BROWERMOB DNS PERFORMANCE TOOL v 1.0.1
This tool checks DNS lookup times (no caching) for the Alexa worldwide top 1000.
It checks runs three rounds of tests against Google, OpenDNS, and (optionally)
the DNS servers of your choice (we recommend you try your ISP's DNS servers).
At the end of the test, select the best score for each provider, and then send us
your results by adding a comment at http://browsermob.com/perf-dns.
Note: We see you are testing a custom set of DNS servers. Please make sure you are
are using DNS servers that aren't simple relays to another service, such as
your wireless router, which does caching and will give skewed results.
This service is brought to you by BrowserMob, which provides cloud-based website
monitoring and load testing service - all using real Firefox browsers. Check us
out at http://browsermob.com to try out our free services
Starting test...
Test 1: Google
772560 ms for 1000 records
Test 2: Google
514982 ms for 1000 records
Test 3: Google
696747 ms for 1000 records
Test 1: OpenDNS
682921 ms for 1000 records
Test 2: OpenDNS
706675 ms for 1000 records
Test 3: OpenDNS
544984 ms for 1000 records
Test 1: Your DNS
1021057 ms for 1000 records
Test 2: Your DNS
802216 ms for 1000 records
Test 3: Your DNS
991916 ms for 1000 records
The DNS servers are 212.0.138.12 and 212.0.138.13. The latter resolves to ns1.sudatel.sd - so I wouldn't be surprised if half the network infrastructure of the entire country is run off this pair of DNS servers. (Sudatel is the biggest telco). Currently they're just refusing to resolve some names (eg translate.google.com, but www.google.com is fine).
It's a box with a built-in HSDPA interface. Ports on the back:
- 4 ethernet
- 1 USB B for power and connection to PC (maybe the HSDPA shows up as a USB dongle, haven't tried yet. The manual mentions about setting up phonebook etc)
- Female SMA (or maybe reverse SMA) for wifi antenna (there's an internal antenna too, and an external/internal slide switch). EDIT: This is the 3G antenna, not for wifi. It's the opposite SMA sense from wifi (I think that makes this connector normal SMA).
- 1 RJ11 for telephone. The manual says this is for connecting a phone, but the configuration interface makes no mention of it at all. An integrated VOIP ATA would be very nice. EDIT: This is the voice interface to the GSM modem. In other words you can make GSM calls using a conventional analogue handset - like a fixed cellular terminal which are common in Africa. There's no VOIP.
It appears to be locked to MTN. Possible unlock option (untested):
http://www.blog.gem-flash.org/2010/03/11/huawei-old-3g-modem-calculator/
Update:
my free unlocking guide.
It runs Linux. Telnet to its IP address (default 192.168.1.1, username admin password admin) and you get busybox.
# more /proc/version
Linux version 2.4.20 (x127667@old_server.com) (gcc version 3.2.3 with Broadcom modifications) #2 �� 9�� 2 11:08:05 CST 2008
(some of that line is control chars)
# more /proc/cpuinfo
system type : Broadcom BCM5354 chip rev 3
processor : 0
cpu model : BCM3302 V2.9
BogoMIPS : 237.56
wait instruction : no
microsecond timers : yes
tlb_entries : 32
extra interrupt vector : no
hardware watchpoint : no
VCED exceptions : not available
VCEI exceptions : not available
unaligned_instructions : 1
dcache hits : 0
dcache misses : 0
icache hits : 0
icache misses : 0
instructions : 0
# more /proc/meminfo
total: used: free: shared: buffers: cached:
Mem: 31207424 11071488 20135936 0 1736704 4157440
Swap: 0 0 0
MemTotal: 30476 kB
MemFree: 19664 kB
MemShared: 0 kB
Buffers: 1696 kB
Cached: 4060 kB
SwapCached: 0 kB
Active: 2848 kB
Inactive: 4484 kB
HighTotal: 0 kB
HighFree: 0 kB
LowTotal: 30476 kB
LowFree: 19664 kB
SwapTotal: 0 kB
SwapFree: 0 kB
# more /proc/mtd
dev: size erasesize name
mtd0: 00040000 00010000 "cfe"
mtd1: 00340000 00010000 "linux"
mtd2: 00281f40 00010000 "rootfs"
mtd3: 00060000 00010000 "resource"
mtd4: 00010000 00010000 "factory"
mtd5: 00010000 00002000 "nvram"
# lsmod
Module Size Used by
wl 560400 0 (unused)
et 21920 0 (unused)
So that looks like 32MB RAM.
(Most of the usual commands like df and uname don't work, hence the need to poke in /proc)
There's a bunch of hidden configuration webpages:
# cd /3w
# ls
en js index.asp res images css
# ls en/
wlan_status_adv.asp save_pin.asp fw_switch_h3g.asp
wlan_settings.asp route_cfg.asp fw_switch.asp
wlan_bridge.asp restorerouter.asp fw_remote_web.asp
wlan_basic_en.asp resetrouter.asp fw_port_forwards.asp
wlan_basic_cfg.asp pukcfg.asp fw_filter_mac.asp
wlan_adv_cfg.asp profile.asp fw_filter_ip.asp
wl_mac_filter.asp ppp_settings.asp fw_dmz_ipaddr.asp
wizard.asp pincfg.asp fw_app_special.asp
wan_status_adv.asp pin_message.asp footer.asp
w_hiden.asp pin_management.asp first.asp
upgrade.asp password.asp dialup.asp
umts.asp networklist.asp ddns_cfg.asp
u_version.asp networkcfg.asp content.asp
system.asp menu.asp connect_main.asp
syscfg_b220.asp mac_filter.asp conn.asp
syscfg1.asp logo.asp cardlock.asp
syscfg.asp log_error.asp basic_status.asp
sms_settings.asp lancfg.asp adv_settings_tim.asp
security_cfg_h3g.asp lan_status_adv.asp adv_settings.asp
security_cfg.asp fw_upnp_active.asp
(for example, http://192.168.1.1/en/cardlock.asp looks like an unlocking page, but requires an unlock code)
Some 'hidden' features:
ddyns_cfg.asp: dynamic DNS settings
sms_settings.asp: Voice Message Services number (?)
security_cfg_h3g.asp: The same as the security config page, but with no text (? I wondered if H3G was Hutchison 3G?)
syscfg.asp/syscfg1.asp/syscfg_b220.asp: Various mobile band options for different locales (GSM900/1800, GSM950/1900, etc)
fw_app_special.asp: Firewall punching. It looks like you configure an outbound 'trigger port', which causes a range of other ports to be opened when you connect. For example, I tried for the Twinkle SIP client (which refuses to work as it's behind symmetric NAT):
Name: SIP
Status: On
Trigger port: 5060
Trigger protocol: UDP
Open port: 5060,8000-8005
Open protocol: UDP
Common port:
But I can't make the Javascript accept the values (after clicking 'apply', all the buttons grey out and nothing else happens).
MTN DNS is quite slow, but I've yet to find a page to configure my own DNS servers (editing NVRAM might be an option).
Similarly:
# ls /3w/js/
wlansec.js u_connec.js networklist.js err_info.js
wlanadv.js puk.js networkcfg.js content.js
wlan_cfg.js pub_valid.js lancfg.js connection.js
wlan_bridge_cfg.js pub_ctl.js help.js band_cfg_b220.js
wizard.js pin.js global.js band_cfg1.js
u_version.js password.js frame_h3c.js band_cfg.js
Setting up is just like a normal router, nothing too special. The configuration interface is a bit clunky, but OK. Oddly it says it's doing 384kbps up/down when I'm actually getting about 3x that down, so the software must be confused between WCDMA (which it mentions) and HSDPA (which it doesn't, but is obviously using). (Later, it does show as using 7.2Mbps HSDPA)
Programs available:
# ls /sbin /bin /usr/bin /usr/sbin
/usr/sbin:
wlconf udhcpc ses ntpclient iptables epi_ttcp brctl
wl testmode sendpack nas4not ip drvtest ats
vconfig tc pppoecd nas httpd dnsmasq at
upnp syswatch pppd modload factory diagd
udhcpd ses_cl nvram looptest et ddns
/usr/bin:
wget telnetd nc free
traceroute route killall find
/bin:
umount rm mv mknod ln dd cat
sleep pwd msh mkdir kill date busybox
sh ps mount ls grep cp
rmdir ping more login echo chmod
/sbin:
write stats reboot lsmod insmod ifconfig erase
syslogd rmmod rc klogd init hotplug
# ps
PID Uid Stat Command
1 0 S init noinitrd
2 0 S [keventd]
3 0 R [ksoftirqd_CPU0]
4 0 S [kswapd]
5 0 S [bdflush]
6 0 S [kupdated]
7 0 S [mtdblockd]
8 0 S [khubd]
21 0 S httpd
91 0 S ats
92 0 S ats
169 0 S syslogd
179 0 S telnetd
182 0 S /usr/sbin/dnsmasq -H /tmp/hosts -n -i br0 -r /tmp/resolv.c
185 0 S nas /tmp/nas.lan.conf /tmp/nas.lan.pid lan
187 0 S diagd
189 0 S udhcpd /tmp/udhcpd0.conf
190 0 S syswatch
191 0 S diagd
196 0 S ses -f
197 0 S ses_cl -f
201 0 S pppd /dev/usb/tts/0 -g -i 0 -t 1500 -U 0
208 0 S -sh
262 0 R ps
Nothing terribly exciting there, except a notable lack of anything VOIP related. Which puzzles me as to why an RJ11 connector has been provided.
Aha, found the dmesg output (there's no dmesg tool):
# more /proc/kmsg
<4>Kernel addr reboot flag = 0xa1fff000, reboot_number = 0xa1fff004
<4>Kernel physical_mem =0x2000000 reboot flag = 0x12345678, reboot_number = 0x0
<4>CPU revision is: 00029029
<4>Primary instruction cache 16kb, linesize 16 bytes (4 ways)
<4>Primary data cache 16kb, linesize 16 bytes (2 ways)
<4>Linux version 2.4.20 (x127667@old_server.com) (gcc version 3.2.3 with Broadcom modifications) #2 �� 9�� 2 11:08:05 CST 2008
<4>Setting the PFC to its default value
<4>Determined physical RAM map:
<4> memory: 01fff000 @ 00000000 (usable)
<4>On node 0 totalpages: 8191
<4>zone(0): 8191 pages.
<4>zone(1): 0 pages.
<4>zone(2): 0 pages.
<4>Kernel command line: root=/dev/mtdblock2 noinitrd console=ttyS0,115200
<4>CPU: BCM5354 rev 3 at 240 MHz
<4>Calibrating delay loop... 237.56 BogoMIPS
<6>Memory: 30408k/32764k available (1565k kernel code, 2356k reserved, 112k data, 68k init, 0k highmem)
<6>Dentry cache hash table entries: 4096 (order: 3, 32768 bytes)
<6>Inode cache hash table entries: 2048 (order: 2, 16384 bytes)
<4>Mount-cache hash table entries: 512 (order: 0, 4096 bytes)
<4>Buffer-cache hash table entries: 1024 (order: 0, 4096 bytes)
<4>Page-cache hash table entries: 8192 (order: 3, 32768 bytes)
<4>Checking for 'wait' instruction... unavailable.
<4>POSIX conformance testing by UNIFIX
<4>PCI: no core
<4>PCI: Fixing up bus 0
<6>Linux NET4.0 for Linux 2.4
<6>Based upon Swansea University Computer Society NET3.039
<4>Initializing RT netlink socket
<4>Starting kswapd
<6>devfs: v1.12c (20020818) Richard Gooch (rgooch@atnf.csiro.au)
<6>devfs: boot_options: 0x1
<5>JFFS2 version 2.1. (C) 2001 Red Hat, Inc., designed by Axis Communications AB.
<6>Serial driver version 5.05c (2001-07-08) with MANY_PORTS SHARE_IRQ SERIAL_PCI enabled
<6>ttyS00 at 0xb8000300 (irq = 3) is a 16550A
<6>ttyS01 at 0xb8000400 (irq = 0) is a 16550A
<6>PPP generic driver version 2.4.2
<7>Physically mapped flash: Found an alias at 0x400000 for the chip at 0x0
<7>Physically mapped flash: Found an alias at 0x800000 for the chip at 0x0
<7>Physically mapped flash: Found an alias at 0xc00000 for the chip at 0x0
<7>Physically mapped flash: Found an alias at 0x1000000 for the chip at 0x0
<7>Physically mapped flash: Found an alias at 0x1400000 for the chip at 0x0
<7>Physically mapped flash: Found an alias at 0x1800000 for the chip at 0x0
<7>Physically mapped flash: Found an alias at 0x1c00000 for the chip at 0x0
<5> Amd/Fujitsu Extended Query Table v1.3 at 0x0040
<4>Physically mapped flash: Swapping erase regions for broken CFI table.
<5>number of CFI chips: 1
<5>Flash device: 0x400000 at 0x1c000000
<5>Physically mapped flash: cramfs filesystem found at block 1016
<5>Creating 6 MTD partitions on "Physically mapped flash":
<5>0x00000000-0x00040000 : "cfe"
<5>0x00040000-0x00380000 : "linux"
<5>0x000fe0c0-0x00380000 : "rootfs"
<5>0x00380000-0x003e0000 : "resource"
<5>0x003e0000-0x003f0000 : "factory"
<5>0x003f0000-0x00400000 : "nvram"
<3>sflash: found no supported devices
<6>usb.c: registered new driver usbdevfs
<6>usb.c: registered new driver hub
<4>USB20H fcr: 0x64
<4>USB20H shim cr: 0x8f7
<4>USB20H syn01 register : 0xfe00fe
<4>USB20H syn03 register : 0x1
<6>usb-ohci.c: USB OHCI at membase 0xb8003000, IRQ 6
<6>usb-ohci.c: usb-00:03.0, PCI device 14e4:471a
<6>usb.c: new USB bus registered, assigned bus number 1
<6>hub.c: USB hub found
<6>hub.c: 2 ports detected
<6>usb.c: registered new driver acm
<6>acm.c: v0.21:USB Abstract Control Model driver for USB modems and ISDN adapters
<6>usb.c: registered new driver serial
<6>usbserial.c: USB Serial support registered for Generic
<6>usbserial.c: USB Serial Driver core v1.4
<6>NET4: Linux TCP/IP 1.0 for NET4.0
<6>IP Protocols: ICMP, UDP, TCP
<6>IP: routing cache hash table of 512 buckets, 4Kbytes
<6>TCP: Hash tables configured (established 2048 bind 4096)
<6>IPv4 over IPv4 tunneling driver
<6>GRE over IPv4 tunneling driver
<4>ip_nat_pptp version 1.5 loaded
<4>ip_tables: (C) 2000-2002 Netfilter core team
<4>ipt_time loading
<6>NET4: Unix domain sockets 1.0/SMP for Linux NET4.0.
<6>NET4: Ethernet Bridge 008 for NET4.0
<1>802.1Q VLAN Support v1.7 Ben Greear
<1>All bugs added by David S. Miller
<4>msm gpio 0xc3
<3>devfs_register(gpio): could not append to parent, err: -17
<4>VFS: Mounted root (cramfs filesystem) readonly.
<6>Mounted devfs on /dev
<6>Freeing unused kernel memory: 68k freed
<3>cramfs: wrong magic
<4>eth0: Broadcom BCM47xx 10/100 Mbps Ethernet Controller
<4>eth1: Broadcom BCM4318 802.11 Wireless Controller 4.130.32.0
<4>Algorithmics/MIPS FPU Emulator v1.5
<6>vlan0: dev_set_promiscuity(master, 1)
<6>device eth0 entered promiscuous mode
<6>device vlan0 entered promiscuous mode
<6>device eth1 entered promiscuous mode
<6>br0: port 2(eth1) entering listening state
<6>br0: port 1(vlan0) entering listening state
<6>br0: port 2(eth1) entering learning state
<6>br0: port 1(vlan0) entering learning state
<6>br0: port 2(eth1) entering forwarding state
<6>br0: topology change detected, propagating
<6>br0: port 1(vlan0) entering forwarding state
<6>br0: topology change detected, propagating
<6>hub.c: new USB device 00:03.0-1, assigned address 2
<6>usbserial.c: Generic converter detected
<6>usbserial.c: Generic converter now attached to ttyUSB0 (or usb/tts/0 for devfs)
<6>usbserial.c: Generic converter detected
<6>usbserial.c: Generic converter now attached to ttyUSB1 (or usb/tts/1 for devfs)
<6>usbserial.c: Generic converter detected
<6>usbserial.c: Generic converter now attached to ttyUSB2 (or usb/tts/2 for devfs)
<4> RX status -2 RX status -2 RX status -2 RX status -2 RX status -2 RX status -2 RX status -2 RX status -2 RX status -2 RX status -2 RX status -2<6>br0: port 2(eth1) entering disabled state
<6>br0: port 1(vlan0) entering disabled state
<6>br0: port 1(vlan0) entering disabled state
<6>device vlan0 left promiscuous mode
<6>br0: port 2(eth1) entering disabled state
<6>device eth1 left promiscuous mode
<6>device eth1 entered promiscuous mode
<6>br0: port 2(eth1) entering listening state
<6>br0: port 1(vlan0) entering listening state
<6>br0: port 2(eth1) entering learning state
<6>br0: port 1(vlan0) entering learning state
<6>br0: port 2(eth1) entering forwarding state
<6>br0: topology change detected, propagating
<6>br0: port 1(vlan0) entering forwarding state
<6>br0: topology change detected, propagating
<4> RX status -2 RX status -2
usbfs is missing, so I had to mount it:
# mount usbfs /proc/bus/usb
# cat /proc/bus/usb/devices
T: Bus=01 Lev=00 Prnt=00 Port=00 Cnt=00 Dev#= 1 Spd=12 MxCh= 2
B: Alloc= 23/900 us ( 3%), #Int= 1, #Iso= 0
D: Ver= 1.10 Cls=09(hub ) Sub=00 Prot=00 MxPS= 8 #Cfgs= 1
P: Vendor=0000 ProdID=0000 Rev= 0.00
S: Product=USB OHCI Root Hub
S: SerialNumber=b8003000
C:* #Ifs= 1 Cfg#= 1 Atr=40 MxPwr= 0mA
I: If#= 0 Alt= 0 #EPs= 1 Cls=09(hub ) Sub=00 Prot=00 Driver=hub
E: Ad=81(I) Atr=03(Int.) MxPS= 2 Ivl=255ms
T: Bus=01 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 2 Spd=12 MxCh= 0
D: Ver= 1.10 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1
P: Vendor=12d1 ProdID=1001 Rev= 0.00
S: Manufacturer=HUAWEI Technologies
S: Product=HUAWEI Mobile
C:* #Ifs= 3 Cfg#= 1 Atr=a0 MxPwr=500mA
I: If#= 0 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=ff Driver=serial
E: Ad=81(I) Atr=03(Int.) MxPS= 16 Ivl=128ms
E: Ad=82(I) Atr=02(Bulk) MxPS= 64 Ivl=0ms
E: Ad=02(O) Atr=02(Bulk) MxPS= 64 Ivl=0ms
I: If#= 1 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=serial
E: Ad=84(I) Atr=02(Bulk) MxPS= 64 Ivl=0ms
E: Ad=04(O) Atr=02(Bulk) MxPS= 64 Ivl=0ms
I: If#= 2 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=serial
E: Ad=85(I) Atr=02(Bulk) MxPS= 64 Ivl=0ms
E: Ad=05(O) Atr=02(Bulk) MxPS= 64 Ivl=0ms
Lots of exciting stuff in the NVRAM (private stuff altered):
# nvram show
wl_leddc=0x640000
sdram_config=0x0062
wl_radius_port=1812
wl0_disable=1
filter_maclist=
wl0_wme_sta_be=15 1023 3 0 0 off off
ntp_server=192.5.41.40 192.5.41.41 133.100.9.2
wl_lazywds=0
sdram_refresh=0
wl0_mrate=0
wan_ppp_service=
wl0_wme_sta_bk=15 1023 7 0 0 off off
wl0_antdiv=3
lan_proto=dhcp
lan_hwnames=
wl_mrate=0
wl_antdiv=3
vlan0ports=0 1 2 3 5*
wan_hwname=
wan_ppp_demand=0
wl_wme=off
wl_wme_no_ack=off
wl0_crypto=tkip
wan0_hostname=
dmz_ipaddr=192.168.1.103
wan_ping_disable=1
lan_dhcp=0
wl_akm=psk
wl_corerev=
wl0_nmcsidx=-1
wl_crypto=tkip
wan_desc=
wl_wme_sta_vi=7 15 2 6016 3008 off off
wl0_wpa_psk=secret
wan_route=
wl0_macmode=disabled
wan_unit=0
wl_wme_sta_vo=3 7 2 3264 1504 off off
wl_maclist=
lan_ifnames=vlan0 eth1
wl0_maxassoc=32
wan0_route=
ezc_version=2
wl_rateset=default
curprofile=p_MTN�High-Speed�Internet
wan0_ipaddr=10.201.1.30
et0mdcport=0
bxa2g=1
wan0_web_enable=0
wan0_ppp_ac=
wl_net_reauth=36000
vlan1hwname=et0
wl_reg_mode=off
os_date=
wl0_bcn=100
wan0_ppp_auth=2
wan0_wins=
ag0=2
LastConnectedIP=1728161984
wl0_radius_port=1812
need_relogin=0
wl0_wme_ap_be=15 63 3 0 0 off off
ure_disable=1
wl0_wme_ap_bk=15 1023 7 0 0 off off
wl0_nreqd=0
serno=DQ6RAB19B1500068
et0phyaddr=30
wl0_dfs_preism=60
wan0_ppp_service=
wan0_dns=212.0.138.13 212.0.138.12
pa0maxpwr=72
wl0_gmode=1
app_version=
wl_nreqd=0
pa0b0=0x125d
wl_sta_retry_time=5
pa0b1=0xfb6e
time_zone=PST8PDT
wl_afterburner=off
pa0b2=0xfec1
wl0_channel=11
wl_gmode=1
wl_phytype=b
dhcp_domain=wan
ezc_enable=1
wl0_wds_timeout=1
wan_telnet_ipaddr=
os_server=
wan_ppp_auth=2
il0macaddr=00:25:68:xx:xx:xx
wan_ifname=ppp0
no_sim_card_alert=1
filter_ip_enable=1
wl0_radio=1
wan0_ifnames=ppp0
wl_wme_ap_vi=7 15 1 6016 3008 off off
ses_wds_mode=1
wl_wme_apsd=on
wl_dfs_postism=60
p_MTN�High-Speed�Internet=MTN�High-Speed�Internet *99# 0 internet1 1 0
wl0_lazywds=0
wl_wme_ap_vo=3 7 1 3264 1504 off off
wl_radio=1
wandevs=et0
wl0_vlan_prio_mode=off
wl0_key1=
wl0_radius_key=
wl0_key2=
console_loglevel=1
wl0_key3=
wl0_key4=
clkfreq=240
wl0_wme=off
wl_key1=
wan0_telnet_enable=0
wan0_ppp_demand=1
wl_key2=
wl_wds_timeout=1
wl_key3=
wan_domain=
wan_lease=86400
wl_key4=
wl0_akm=psk
wl0_corerev=13
autofw_port0=
wl0_afterburner=off
os_name=linux
wan0_lease=86400
cctl=0
wl0_guest_ssid_1=
wl0_maclist=
wl0_guest_ssid_2=
wl0_guest_ssid_3=
wan_hwaddr=
wl0_guest_ssid_4=
wl_wds=
lan_wins=
wl0_rateset=default
sdram_ncdl=0xffe0a
ccode=0
boardnum=0x5347
wan_wins=
is_need_watch=enable
lan_ifname=br0
wan_hostname=
timer_interval=3600
wl0_dfs_postism=60
router_disable=0
wl_plcphdr=long
wan0_web_ipaddr=
wl0_frag=2346
wl_wep=disabled
build_app_version=248.11.00.03.102
product_name=B220
wl_frag=2346
fw_app0=
dhcp_end=192.168.1.230
http_wanport=
wl_nctrlsb=none
wl0_closed=0
restore_defaults=no_need
upnp_enable=0
wl_ap_isolate=0
rssisav2g=2
wl_closed=0
wl0_frameburst=off
lan_domain=
wl0_tpc_db=
wl_wme_sta_be=15 1023 3 0 0 off off
wan0_hwname=
wan_proto=dhcp
filter_client0=
gateway_domain=e.home
wl_wme_sta_bk=15 1023 7 0 0 off off
wl0_reg_mode=off
curr_username=admin
wan0_proto=dhcp
lan_hwaddr=00:25:68:xx:xx:xx
wan_ppp_mru=1492
boardno=020RPY6R9B000158
wan_primary=0
wl_radioids=
wl_wpa_psk=secret
wl0_phytype=l
wl0_wme_no_ack=off
wl_auth_mode=none
wan0_ppp_idletime=600
dhcp_start=192.168.1.1
wl0_wme_sta_vi=7 15 2 6016 3008 off off
rssismc2g=2
wan_web_enable=0
wl_wpa_gtk_rekey=0
tl_timeout=600
cfe_version=
wl0_phytypes=l
wl0_wme_sta_vo=3 7 2 3264 1504 off off
wan_netmask=0.0.0.0
wan0_ppp_dialtime=120
stats_server=
lan_route=
wl_rts=2347
log_level=0
wl_nbw=20
rxpo2g=0xfff8
wl0_country_code=US
opo=12
wl_country_code=US
wl0_wpa_gtk_rekey=0
wl0_net_reauth=36000
wan_ppp_ifname=
wan_ipaddr=0.0.0.0
wl_key=1
build_os_date=Sep 1 2008 16:27:46
wl0_unit=0
ses_cl_enable=1
wan_ppp_ac=
first_used=1
wan0_ppp_mru=1492
wl_unit=0
wan0_primary=1
wl0_ssid=MTN_High_Speed_Internet
aa0=3
ses_enable=1
wan0_telnet_ipaddr=
lang_custom=en
wl0_wds=
wan_ppp_mtu=1500
wl0_wme_apsd=on
pa0itssit=62
wl_ssid=MTN_High_Speed_Internet
sromrev=3
wl_dfs_preism=60
wl_gmode_protection=auto
wl_vlan_prio_mode=off
filter_macmode=deny
wl_maxassoc=32
wl_disable=1
is_modified=1
wl0_nband=2
wl0_wme_ap_vi=7 15 1 6016 3008 off off
boardtype=0x048e
boardflags=0x750
dmz_enable=0
http_lanport=80
wl0_wme_ap_vo=3 7 1 3264 1504 off off
wl_nband=2
wl_wme_ap_be=15 63 3 0 0 off off
wl0_plcphdr=long
wan0_ifname=ppp0
is_default=0
wl0_auth=0
wl0_infra=1
watchdog=3000
wl0_wep=disabled
profile_number=1
wl_wme_ap_bk=15 1023 7 0 0 off off
fw_config=1
ses_status=Unknown
wl_auth=0
lan_netmask=255.255.255.0
wl_nmcsidx=-1
wl0_nctrlsb=none
dhcp_wins=wan
wl0id=0x4318
wl_infra=1
wl_macmode=disabled
rssismf2g=0
wan_ppp_idletime=600
boardrev=0x11
lan_ipaddr=192.168.1.241
et0macaddr=00:25:68:xx:xx:xx
et1phyaddr=0x1f
wan0_desc=Default Connection
wl0_rate=0
forward_port0=
wan0_unit=0
wan0_domain=
landevs=vlan0 wl0
wan_ppp_dialtime=120
wl0_mode=ap
wan_gateway=0.0.0.0
build_cfe_version=248.11.00.03.102
wl_rate=0
wan0_ppp_mtu=1500
wl_radius_key=
wl0_ifname=eth1
wl_mode=ap
wl0_nmode=-1
wan0_ping_disable=1
wl0_ampdu=
boot_wait=on
sdram_init=0x000b
user_passwd=secret
wl_ifname=
wan0_hwaddr=
wl_bcn=100
wl_nmode=-1
wl0_sta_retry_time=5
profile=p_MTN�High-Speed�Internet
auto_validate_times=3
admin_passwd=secret
log_ipaddr=
lan_lease=86400
auto_validate=on
lan_stp=1
fw_disable=0
wl_radius_ipaddr=
ses_event=0
br0_ifnames=vlan0 eth1
wl0_rts=2347
wan_dns=
wan_web_ipaddr=
wl0_nbw=20
tri2g=78
wan_ifnames=ppp0
filter_ipaddr0=
wl0_radioids=BCM2062
vlan1ports=4 5u
wl0_hwaddr=00:25:68:xx:xx:xx
wl0_ure=
wan_telnet_enable=0
vlan0hwname=et0
wl0_dtim=3
wl_channel=11
wan0_ppp_ifname=
wl_hwaddr=
wl0_key=1
wl_dtim=3
xtalfreq=25000
wan0_gateway=10.64.64.64
wl0_radius_ipaddr=
ses_cl_event=0
wl_phytypes=
wl0_gmode_protection=auto
wl0gpio0=11
wl0_leddc=0x640000
wl0_auth_mode=none
wan0_netmask=255.255.255.255
wl0gpio1=11
wl0gpio2=11
first_power_on=0
wl0gpio3=11
restore_ipaddr=192.168.1.1
jffs2_enable=disable
wl_frameburst=off
lan_gateway=192.168.1.241
wl0_ap_isolate=0
size: 6004 bytes (26764 left)
When I plug the router into my Ubuntu machine using the USB port, dmesg on the laptop says:
[93414.400168] usb 3-1: new full speed USB device using uhci_hcd and address 2
[93414.560144] usb 3-1: configuration #1 chosen from 1 choice
[93414.575380] usb-storage: probe of 3-1:1.0 failed with error -1
[93414.585197] usb 3-1: USB disconnect, address 2
[93415.312175] usb 3-1: new full speed USB device using uhci_hcd and address 3
[93415.486174] usb 3-1: configuration #1 chosen from 1 choice
[93415.507149] usb-storage: probe of 3-1:1.0 failed with error -5
[93415.514507] usb-storage: probe of 3-1:1.1 failed with error -5
[93415.539658] usb-storage: probe of 3-1:1.2 failed with error -1
[93415.561257] usbcore: registered new interface driver usbserial
[93415.561303] USB Serial support registered for generic
[93415.561486] usbcore: registered new interface driver usbserial_generic
[93415.561494] usbserial: USB Serial Driver core
[93415.572485] USB Serial support registered for GSM modem (1-port)
[93415.572754] option 3-1:1.0: GSM modem (1-port) converter detected
[93415.572977] usb 3-1: GSM modem (1-port) converter now attached to ttyUSB0
[93415.573011] option 3-1:1.1: GSM modem (1-port) converter detected
[93415.573199] usb 3-1: GSM modem (1-port) converter now attached to ttyUSB1
[93415.573252] usbcore: registered new interface driver option
[93415.573260] option: v0.7.2:USB Driver for GSM modems
[93524.695704] usb 1-1: USB disconnect, address 2
lsusb says I have a:
Bus 003 Device 003: ID 12d1:1003 Huawei Technologies Co., Ltd. E220 HSDPA Modem / E270 HSDPA/HSUPA Modem
Indeed, I can connect just fine to the 'internet1' APN with NetworkManager using that modem device.
On Windows, a USB mass storage device comes up and tries to install various drivers.
20/4/2010:
Right, I've now figured out how the the configuration interface operates. It's terrible... everything is done in Javascript on the user's browser (and Opera doesn't work, but Ubuntu Firefox does). The action happens in a script called http://192.168.1.1/en/apply.cgi (which I think is built into the /usr/sbin/httpd on the router). The parameters POSTed to the CGI are the NVRAM values to change. For example:
curl --user admin:password --basic -d "dmz_enable=1&dmz_ipaddr=192.168.1.123&page=fw_dmz_ipaddr.asp&action=Apply" http://192.168.1.1/en/apply.cgi
will turn on the DMZ and set its IP address by setting dmz_enable=1 and dmz_ipaddr=192.168.1.123
I think the page= parameter is just the page to redirect you back to afterwards. That means, while some of the hidden setup pages don't work (perhaps because they need to be actioned in the full frameset), you can configure them by looking in the page source, finding out the NVRAM values to set and setting them this way.
22/4/2010:
It seems this B220 is quite similar to the Huawei B970 and E960. Some resources on those:
https://dev.openwrt.org/ticket/2711
http://mybroadband.co.za/vb/archive/index.php/t-146724.html
Particularly interesting is the nvram key to enable the DDNS menu:
# nvram set ddns_cfg_enable=on
Which does work on my router. Possibly some of the other hidden pages can be activated in this way. So far I haven't been able to find the source for the B970 or E960 to poke around for other keys.
I tried setting the wan_dns and wan0_dns, but I couldn't override the PPP-supplied DNS servers. MTN uses Sudatel's, which are pretty poor:
$ java -jar browsermob-dns-perf.jar 212.0.138.12
BROWERMOB DNS PERFORMANCE TOOL v 1.0.1
This tool checks DNS lookup times (no caching) for the Alexa worldwide top 1000.
It checks runs three rounds of tests against Google, OpenDNS, and (optionally)
the DNS servers of your choice (we recommend you try your ISP's DNS servers).
At the end of the test, select the best score for each provider, and then send us
your results by adding a comment at http://browsermob.com/perf-dns.
Note: We see you are testing a custom set of DNS servers. Please make sure you are
are using DNS servers that aren't simple relays to another service, such as
your wireless router, which does caching and will give skewed results.
This service is brought to you by BrowserMob, which provides cloud-based website
monitoring and load testing service - all using real Firefox browsers. Check us
out at http://browsermob.com to try out our free services
Starting test...
Test 1: Google
772560 ms for 1000 records
Test 2: Google
514982 ms for 1000 records
Test 3: Google
696747 ms for 1000 records
Test 1: OpenDNS
682921 ms for 1000 records
Test 2: OpenDNS
706675 ms for 1000 records
Test 3: OpenDNS
544984 ms for 1000 records
Test 1: Your DNS
1021057 ms for 1000 records
Test 2: Your DNS
802216 ms for 1000 records
Test 3: Your DNS
991916 ms for 1000 records
The DNS servers are 212.0.138.12 and 212.0.138.13. The latter resolves to ns1.sudatel.sd - so I wouldn't be surprised if half the network infrastructure of the entire country is run off this pair of DNS servers. (Sudatel is the biggest telco). Currently they're just refusing to resolve some names (eg translate.google.com, but www.google.com is fine).