TalkTalk Wi-Fi Hub 2, firmware version SG4K100174 - DMZ and port forwarding rejecting LAN IP address

[ezequielv]

Hello. Long-time TalkTalk customer here, and experienced in networking and security.

I've had my TalkTalk router replaced today as part of the "free uprade" to "full fibre" in my local area. This Sagecom router is running the firmware version SG4K100174, and I've configured it as follows:

• LAN network: 192.168.11.0/24
• Router IP address on the LAN: 192.168.11.1
• DHCP server address range: 192.168.11.64-192.168.1.254
• Host IP in LAN for a router handling my "internal" LAN: 192.168.11.3 (and, of course, the internal LAN IP address is *not* using 192.168.11.0/24 for its nodes)

So this is a simple "I don't want TalkTalk looking at my LAN traffic" setup, and it has worked perfectly well for years. On my former router, I disabled "auto updates" (manually) to avoid issues with dodgy firmware updates, and all was good.

However, after the visit from the engineer today, and the subsequent change in the configuration to be as described above, I cannot do any of the following:

• I can't set *any* IP address in the TalkTalk router LAN network, that is, 192.168.11.3, for example. It gets rejected with "invalid IP address" (it's not).
• Same rejection on "port forwarding" rules, too.

Needless to say, I've checked that the IP addresses entered everywhere, including netmask values, etc., are all valid, and matching what I had previously set on my former TalkTalk router.

There *is* connectivity from the "internal LAN" to the internet, and everything that you'd want to do as part of normal streaming/web browsing works (with TeamViewer being blocked and not being able to connect to TeamViewer's servers, even with the "HomeSafe" feature disabled on my account, but that's for another post).

I have spent a couple of hours going through everything in the web interface (although it's always possible to miss something -- we're all human after all), and I can't see anything that would need changing to make this work at all, and so I'm inclined to think that the router firmware has a bug that is biting me hard.

I *need* DMZ primarily, as I don't want TalkTalk to look at my LAN traffic at all, and I'm running OpenWRT firmware on my internal routers. I can't be bothered to create several firewall rules and be on top of that every time I want to add a service/port forwarding, as I'm already doing that where it matters: on my "internal LAN" router/gateway. I just want TalkTalk to provide the modem/phone capabilities, and that's that. I don't want any other feature. A dumb gateway that forwards everything to my designated node (.11.3) will do.

Is there anything that TalkTalk can do to allow me to use the internet and my network as I deem fit? Or is TalkTalk only interested in consumers with no need to connect back to the homebase when on the road, like I do?

I'd greatly appreciate it if TalkTalk can solve this issue in the simplest of forms: give me a firmware that works for these features, and stop "upgrading" my firmware. I'll be happy staying with TalkTalk then. If not, I'll take my money and business elsewhere. Thank you.

[Michelle-TalkTalk]

Hi Alexander,

We ask everyone to create a separate topic to avoid confusion. Please can you create your own topic and we can look into this for you.

Thanks

Michelle

[AlexanderBelyaev]

Hi Michelle,

we need an urgent SG4K100174 software update.

I have lost my patience. 

It is already two months since it was discussed with you that the software is buggy and does not allow to connect to my home computer from outside via ssh. This is just crazy nonsense. And after the report two motnh ago nothing happened. 

Why talktalk has ignored this crucial problem and did not update  SG4K100174 software?

I am not going to create the new ticket. Everything was quite clear from the first report that SG4K100174 has crucial bugs!

Alexander

[Michelle-TalkTalk]

Hi Alexander,

I'm sorry to hear this. Please can you create your own topic and we can look into this further for you.

Thanks

Michelle

[AlexanderBelyaev]

Hello Debbie, the firmaware is still buggy -- my external ssh connection does not work. So, when the update will happen? I am really thinking now on chanching the provider!

[AlexanderBelyaev]

Thanks for detailed answer.

I have the same problem.

And talktalk still did not update the firmware for their HUB.

I can not login from my work anymore to my home desktop because of this problem.

Thinking about leaving TalkTalk and get better service from other provider.

[Debbie-TalkTalk]

Hi ezequielv

Apologies for the delay.

Our Products Team have advised the below, but just to add we would advise on having the firmware updates as this will provide bug fixes and security updates.

Customer can disable TR-069 management (hence FW updates) from within the UI. I think it is in the advanced UI. 

FW update should keep their port forwarding settings regardless.
 

[KeithFrench]

I have not had any issues with the Hub 2 with port forwarding on either the default subnet or others including network 10. I did get someone else working by doing a factory default.

[ezequielv]

I wanted to provide a quick update regarding the DMZ and port forwarding issue.

I managed to get things to work this morning. For everyone's benefit, I'll describe the steps I followed:

1. factory reset on the TT router;
2. configured the TT router's IP address to be 192.168.11.1 (as I had done previously), disabled DHCP server, clicked "apply";
3. waited for the router to reboot itself;
4. rebooted the TT router again;
5. connected to the TT router's new IP address (192.168.11.1);
6. enabled DHCP server, changed DHCP server settings as described in my original post (range: 192.168.11.64-192.168.11.254), clicked "apply";
7. rebooted the TT router;
8. Note: as my "internal LAN" router has been configured to have a static (or "fixed") IP address (192.168.11.3), there was no need to do "reserve IP" for it;
9. from the networking page on the TT router's web interface (where you see the wi-fi networks, LAN, and the devices connected to each of them), I clicked on the device's HW addr item (which also showed its IP address (192.168.11.3));
10. from here, I clicked on the DMZ tab, and enabled it -- the IP address was filled automatically, and it was in fact (IIRC) grayed out, so there was no possibility to enter its address, clicked "apply";
11. then, just to test whether the "port forwarding" would be accepted (as it was also consistently rejected previously, as described in my original post), I also added a "port forwarding" entry to this device for a port of my choice -- again, this was accepted without issues;

In short, it looks as if this issue is (as I suspected in my original post) a firmware issue. It had nothing to do with my setup, the IP addresses and networks I've used, or anything else I was doing. It looks as if it was either the web interface or the backend to which that was connecting that was rejecting configuration changes, even though they were exactly the same (from a user's perspective) to what I ended up configuring.

I'm now concerned that TalkTalk will, at some point and without asking for my permission, update my router's firmware and thus throw me into a new pit full of bugs, annoyances and forced reconfiguration, ultimately resulting in time wasted, a fresh chance for the router not ending up configured as I'd need it to be (for example, by having my workaround not working anymore on the new firmware, or having new issues resulting from a faulty implementation of the few features I'd be using), and ultimately proving to me that I should never have anything to do with this company for the rest of my days.

[KeithFrench]

Which hardware revision is your 5464 running?

[Debbie-TalkTalk]

Hi ezequielv

Thanks for your post.

We have to update the router firmware, this allows updates for fixes and also for security.

I will ask our Products Team to take a look at the points you have raised and I will post back as soon as I have further information.

Thanks