Hacking the alcatel speedtouch home modem

What this document is about

In this document i'll try to describe how you can alter the configuration of an Alcatel Speed Touch Home ADSL modem to get the following features:

No more PPTP, no dial-in software needed. With this configuration you'll set up your connection simply with DHCP, which is the default setup of most freshly installed Operation Systems.
You get a real ip-address. this means that you can run servers behind your ADSL-connection. (It also means people from outside can connect to your computer!) This document is different from most documents on the internet describing how to alter a Speed Touch Home ADSL modem. This document is made with the idea in mind to put a router with NAT capabilities behind your modem. If you don't want this you probably need to go here: http://www.sateh.com/hacks/alcatel.php

Disclaimer & Warning

Modifying your modem-configuration is at your own risk. By performing this hack, you will lose all waranty on your modem. I only describe how i altered the configuration of my modem and it worked for me, so don't blame me if you did something wrong.

Get the password of your modem

To put the modem in EXPERT mode, you will need to get the password first.

Log in as any user and type 'td prompt' (or 'expert' if that doesn't work). The modem will show a string like 'SpeedTouch (00-00-00-00-00-00)' before asking the password.

With this string, the password can be retrieved here: http://security.sdsc.edu/self-help/alcatel/challenge.cgi Write this down! (I wrote it on the modem just to be sure), because there is no easy way to get this code back without that web script.

Enable the Pro features

Login to the modem using telnet. You can login as any user with any password (if you haven't changed it of course). Now do the following:

User : guest
=>td prompt (in version older than 2.70 the command was 'expert')
'SpeedTouch (00-00-00-00-00-00)'
Password : 1234567890

Switch to expert mode.

Return to Normal mode by typing: NORMAL

You are now in Expert mode. There are some other interesting commands available here. Ok, next step is to upgrade the modem:

>rip
rip> drv_read 2 1 b
the data in hex is :  8604

Now change the last digit to 6 and write it back. It's possible that you get another number back, but changing the last digit to 6 always seems to do the trick. (I'm not sure why my modem gave back 8604, others have reported to get 8600 for PSTN or 9600 for ISDN)

rip> drv_write 2 1 b 8606

And then reboot the modem:

rip>exit
>system
system> reboot

That's it! Your modem now has the Pro features!

Configure your PC

use the following settings on your PC/Mac/UNIX computer:

IP Address: 10.0.0.150 (or any other value between 0 and 255, excluding 138)
Netmask: 255.255.255.0
Default Gateway: 10.0.0.138
Primary DNS: Use your provider's DNS

Change your modem's configuration

Start a webbrowser and surf to the webinterface of the modem (http://10.0.0.138/). Make the following changes:

DNS menu:

Disable 'Server Active'
remove all entries from the 'DNS hostname table'
Apply

Bridge menu:

Delete all ports
Apply

PPTP menu:

Delete everything
Apply

CIP menu:

Delete all interfaces
Delete all connections
Apply

PPP menu:

Delete everything
Apply

Routing menu:

Remove the '10.0.0.0/8 any 10.0.0.138 eth0' entry if it's there.
Apply

Dialin menu:

Delete all entries (can already be empty)
Apply

Phonebook menu:

Delete all entries
Apply

Click on 'save all'

Phonebook menu:

Add the following entry:

Name: DHCP_MXSTREAM (Warning: the name *MUST* begin with DHCP_)
VPI : 8
VCI : 48
Type: ppp

Click 'add'.

Apply

PPP menu:

Add a PPP configuration:

Name : DHCP_MXSTREAM
Encap: vc-mux
Click 'add'.

Click on 'config' for the new configuration

Enter the following:

User                : mxstream username (bv blah@xs4all-fast-adsl)
Password            : you mxstream password
Connection sharing  : Only me
Destination networks: Remote host only
Address translation : Disable
Primary DNS         : none
Secondary DNS       : none
Local IP            : none
Remote IP           : none
Mode                : always-on
Idle time limit     : leave empty
LCP Echo            : enable
PAP                 : disable
ACCOMP              : enable

Apply

DHCP menu:

Enable DHCP server
Apply
Click on Advanced

Enter the following DHCP info:

Addresses    : IP address you got from your provider
through      : Same IP address
Subnetmask   : 255.255.255.0
Lease time   : 7200
Def. Gateway : auto
DNS server   : auto
DHCP Spoofing: enable

Clear the DHCP Lease table if something is in there
Apply

Click on 'save all'

On the PPP screen you can now turn the Status to On and Save the changes. it can take a while before the modem connects and changes to the 'on' status.

Change your PC's configuration

Switch your TCP/IP settings on your pc to DHCP. My interfaces file looks like this:

# /etc/network/interfaces -- configuration file for ifup(8), ifdown(8)
# The loopback interface
auto lo
iface lo inet loopback
auto eth0
iface eth0 inet dhcp
  up ifconfig eth0 up
  up route add 10.0.0.138 dev eth0
  up route add -net 0.0.0.0 netmask 0.0.0.0 gw 10.0.0.138

Now you should be ready to use your connection again.