Closing external ports on HG659 (i.e. Port 80).

Forums › One New Zealand (including Vodafone, WxC, Farmside) › Closing external ports on HG659 (i.e. Port 80).

Estx

8 posts

Wannabe Geek

#165856 23-Feb-2015 02:12

Howdy.

I spent a fair amount of time working my way through Google in my attempt to free up port 80 on my HG659 (that's there for the tech support lol..).
Got a spare HG659 lying around (for a backup) and would love to free-up the one I'm using right now.

I've tried editing the IPTABLES, but in all honesty I'm not very familiar with customizing them.
After flushing some rules the external port would still bring me to the router's gateway page.
Edit: I realize that I may be looking at the wrong area now. :\

Can anyone shed some light on this topic? :)

Thanks.

1 | 2 | 3

4629 posts

Uber Geek

Trusted

Lifetime subscriber

#1244545 23-Feb-2015 06:54

I flashed the vodafone hg659 with Spark latest firmware. All ports are now stealth. 'vfremote' login is also gone (You can't see this ID login).

Edit: I'm using this on bigpipe

Batman

Mad Scientist
29761 posts

Uber Geek

Trusted

Lifetime subscriber

#1244553 23-Feb-2015 08:01

How do I do that?

Jase2985

13459 posts

Uber Geek

ID Verified

Lifetime subscriber

#1244554 23-Feb-2015 08:09

flash with the spark firmware?

nakedmolerat

4629 posts

Uber Geek

Trusted

Lifetime subscriber

#1244570 23-Feb-2015 08:56

Jase2985: flash with the spark firmware?

That's right - I downloaded it from here: http://help.spark.co.nz/app/answers/detail/a_id/35558/~/update-modem-firmware---huawei-hg659

I can confirm that all ports are now stealth, vfremote ID is gone, the gateway is now inaccesible from the internet once you disable the remote management (in the vodafone firmware, the gateway is accesible via the net despite disabling remote management).

Batman

Mad Scientist
29761 posts

Uber Geek

Trusted

Lifetime subscriber

#1244650 23-Feb-2015 10:56

Wow ... Just as I thought I'd settled on a good Setup ...

Any improvement in performance in general? Wifi drops out a lot on mine

nakedmolerat

4629 posts

Uber Geek

Trusted

Lifetime subscriber

#1244664 23-Feb-2015 11:19

can't comment on wifi yet - i was having trouble with it as well before.

will see what happen in the next few weeks... i was also thinking of getting a new setup, might just wait and see now.

i don't know whether this is related to the new version or spark firmware, there are a few more options now present. some of it is useless - IPTV etc.

lxsw20

3552 posts

Uber Geek

Subscriber

#1244666 23-Feb-2015 11:26

I've got the Spark HG695b and it's solid as a rock. I'm convinced the VF versions have buggy firmware rather than it being a hardware issue.

Lenovo

Shop now for Lenovo laptops and other devices (affiliate link).

Andib

1363 posts

Uber Geek

ID Verified

Trusted

#1244682 23-Feb-2015 11:43

Other than flashing your device, Port 80 will stay open on VF hg659's

Be happy the VFremote password is the last 8digits of your serial and also locked down to VF Internal IP iirc rather than the HG556a's (Adsl Model) which username and password is support/support and is open to anyone.

<#
.DISCLAIMER
Anything I post is my own and not the views of my past/present/future employer.
#>

Estx

8 posts

Wannabe Geek

#1245181 23-Feb-2015 21:04

@nakedmolerat:
Thank you, this will serve my purpose.

But I'm still interested.. There's no way to remove this external port using root permissions via ssh (amongst the other open ports)?

Nil Einne

469 posts

Ultimate Geek

#1247529 27-Feb-2015 08:04

For clarity, do you want to be able to use port 80 for port forwarding for something else? Or do you simply want it to be unexposed? If you mean the former, I can't help since I never tried.

If you mean the later, you can do so at least on my version V100R001C206B013 and on a non Vodafone connection. No need to use SSH or anything, just the webinterface. Login with the admin username and password (User: Admin. Password: VF-NZhg659 hopefully this is okay to provide since I've seen Vodafone staff provide it elsewhere). Then deactive TR069 from whatever WAN connection. At least it works with ADSL and VDSL, never tried on the ethernet port (e.g. fibre). For good measure go to maintain and deactive remote management. I can't guarantee this will work on Vodafone but I suspect it will. You will obviously lose remote management features, but I suspect you will if you flash Spark firmware anyway.

Edit: Notice someone found the gateway was still accessible from internet even with TR069 disabled. Not sure why this happened for you, perhaps different firmware? In my case it was accessible when TR069 was enabled, but not once it was disabled. Well I presume they meant TR069 was deactivated rather than just remote management in Maintain. I don't think I ever tried just disabling Remote Management in Maintain if that's what was meant.

Edit2: Ah, further testing shows that you need to actually disable TR069 on the WAN interface. Simply turning off remote Management in Maintain doesn't seem to make a difference, at least with regards to port 80. It may or may not affect whether port 7547 (or whatever port you set) is enabled. I'm not sure since it doesn't seem to work whatever I do, it's possible BigPipe are blocking port 7547 for security reasons.

BTW, in case there is any confusion, I do have a public IP on my BigPipe connection. (I had same port 80 behaviour on a Slingshot ADSL connection.) I may or may not have noticed this behaviour before (I definitely tested 7547), I planned to document it but tend to never actually do it :-P

Anyway I suspect that's the reason some people still had port 80 open. Remote management was disabled but not TR069 on the WAN interface. Although I would still disable both just in case.

eXDee

4032 posts

Uber Geek

Trusted

#1247589 27-Feb-2015 09:42

As i understand it theres a minor hardware difference between HG659 and HG659B. I heard the B version with spark firmware is largely stable, and the HG659 non-B with vodafone firmware i wouldn't wish on anyone. Anecdotal of course, curious to hear other peoples experiences.

ashtonaut

614 posts

Ultimate Geek

#1248476 28-Feb-2015 14:45

I have a HG659B from Spark and it's been solid. Apart from the inability to get VOIP working on an xDSL connection (there's a thread somewhere on GZ) it has been trouble free.

Batman

Mad Scientist
29761 posts

Uber Geek

Trusted

Lifetime subscriber

#1248869 1-Mar-2015 14:52

nakedmolerat:
Jase2985: flash with the spark firmware?

That's right - I downloaded it from here: http://help.spark.co.nz/app/answers/detail/a_id/35558/~/update-modem-firmware---huawei-hg659

I can confirm that all ports are now stealth, vfremote ID is gone, the gateway is now inaccesible from the internet once you disable the remote management (in the vodafone firmware, the gateway is accesible via the net despite disabling remote management).

ok after needing a reboot twice a day, i am going to try a flash. if mine is a hg659, can i flash the firmware for b or must i flash the one without the b on the above page

Estx

8 posts

Wannabe Geek

#1248874 1-Mar-2015 15:13

joker97:
nakedmolerat:
Jase2985: flash with the spark firmware?

That's right - I downloaded it from here: http://help.spark.co.nz/app/answers/detail/a_id/35558/~/update-modem-firmware---huawei-hg659

I can confirm that all ports are now stealth, vfremote ID is gone, the gateway is now inaccesible from the internet once you disable the remote management (in the vodafone firmware, the gateway is accesible via the net despite disabling remote management).

ok after needing a reboot twice a day, i am going to try a flash. if mine is a hg659, can i flash the firmware for b or must i flash the one without the b on the above page

I flashed the one without the 'b' and have had no issues other than the loss of SSH. But that could have been due to me restoring the config file I backed up from the VF firmware.

Batman

Mad Scientist
29761 posts

Uber Geek

Trusted

Lifetime subscriber

#1248875 1-Mar-2015 15:19

Ok thanks

1 | 2 | 3