VOIP etc > Voice Over IP - VOIP > VOIP Tech Chat > [General] DLink VTA-VR

reply to vmk

Re: DLink VTA-VR

deleted.
found my answer early in this long thread:)

reply to mazilo

d-link vta-vd

reply to mazilo

Re: [General] DLink VTA-VR

reply to chickenrob

Re: d-link vta-vd

Do you have any notes on hacking the VTA-VD

reply to spacez

Re: [General] DLink VTA-VR

Thanks for your reply! I tried your suggestion, but no luck. The device still cannot register.

You have to remember that FWD doesn't support for a Registrar Address server (as of this writing) and my response as shown in the link works just fine with GizmoProject because it does have a support for a Registrar Address server.

You certainly can build your own Registrar Address server running on your NAT/Firewall router for your ATA devices to use if your NAT/Firewall router is supported by any open-source firmware as shown here. I know this because I had my Linksys WRT54GS v3 NAT/Firewall router running a DDWRT open-source firmware with its VoIP package acting as my own Registrar Address server for my Linksys/Vonage WRTP54G WiFi VoIP router, Linksys PAP2v2, and DLink VTA-VR devices registered to VoSPs that don't support for a Registrar Address server, i.e. FWD, VoIPUSer, etc.

reply to mazilo

Need help with reducing the echo.

Thanks for the quick reply.

It is the other party can hear their own voice echo, not mine, just like their voice was bounced back to their end. I hear them just fine.

New firmware

reply to mazilo

Re: [General] DLink VTA-VR

reply to mazilo
Thanks! I switched to GizmoProject so I can get the VTA-VR work. I hope I can get Linksys PAP2 work with GizmoProject too so that I can build a hot line between my family members.

reply to mazilo
I too had problems with Dlink VTA connecting to FWD. Setup for my Linksys SPA3102 (using Voxilla Wizard) was no problem with FWD (I've notice that the SPA3102 had Gateway settings for FWD). I'm still going to try to figure things out (getting Dlink VTA to work with FWD), maybe there is a setting in the VTA for gateways...

I then tried Gizmoproject for the Dlink VTA, and it worked nicely. But my Linksys SPA3102 didn't want to register with Gizmo... I did some research, and found that regular SIP settings weren't enough for Gizmo... It was registering ok, but when I called the SPA3102 (via Gizmo/Dlink VTA) I only got a ring and a empty noise. I then set it up with STUN and still the same answer... I then dialled the whole 1-747 number and then it worked!

So I guess it had no real problems, with the setup in the first place, it was just the way I was dialling. Although I though there was no need for the 1-747 whenever your dialling Gizmo to Gizmo..

I still prefer FWD since it seems to be more stable than Gizmo... With Gizmo, I still had to fiddle with the SPA3102's DTMF settings, NAT settings, etc. since my DTMF sometimes aren't recognized, or has echoes, and I get disconnected after a few minutes...

has anyone been able to unlock the VTA-VR with the
VTA-11.4.1-r060815-1.00.09-r070401.img firmware?

After battling with my VTA-VR for 3 days, I want to fill everyone in on what happened, and what I managed to do - as well as give you some hints and tips if you're in the same spot I was.

I have a VTA-VR that was provisioned on Vonage for approx. 18 months. I recently canceled (Jan 5, 08) and the box was now out of commission. I previously switched to running Asterisk/FreePBX and now have my service through Les.Net with IAX trunks to my Asterisk server. I had one Grandstream ATA that i configured with one extension and have been using that. I wanted to break into my VTA-VR and clean it out and configure it for Asterisk SIP extensions as well.

My VTA-VR, having been "online and working with Vonage" had updated itself to Firmware VTA-11.4.1-r060815-1.00.09-r070401.img - this is a problem. In this version they have "fixed" the hole that was previously used by the CYT tools to break Admin, as well as it hides/removes the "encryption key" from the Admin interface. Several other problems - the "Support" login/password is neither blank nor the old "tivonpw" password so I couldn't get in to Support even. The CYT tools get a "Page outside the html tree" error provided by the now "upgraded"? webcm gatekeeper. So how was I going to break this thing?

Also trying to go to the user/user page when you check the box to "Reset Provisioned Parameters" it doesn't let you - it prompts for an admin password. I decided to work on breaking this first. Running Wireshark packet capture, and setting the PC up with its own DHCP server setting itself as default gateway (but no way to get to the internet of course), and connecting the VTA-VR with a switch to the LAN port I was able to reset the VTA-VR and convince it to use my PC for "all traffic" thus ensuring I caught everything on Wireshark (including DNS requests, etc). A look at what happens when you try to fake the admin PW for the "Provisioned Parameters" leads me to a URL it was POST submitting. A little edit of that URL and pasting it in my browser and I was able to get the page to come back with the boxes already checked, with no request for password. Here's that URL:
192.168.0.2/cgi-bin/webcm?getpage=/usr/www_safe/html/home/home_system.htm&var:OldProvisioned=on&=&var:OldUnProvisioned=on&=&var:isFirstTime=no

You may have to try a few times or tweak the "OldProvisioned" to yes/no - it's all a javascript program in the page source for home_system.html. In any case I got it to come up with both boxes checked and I hit reset. The box reset and I saw it trying to download an image by http now rather than by tftp (trying to connect to "httpconfig.vonage.net" and retrieve /CodeHere/tiMAC.xml ) - so I knew it was fully "reset" to blank.

Well I'll be darned.. logging in as Support with no password now gave me the extra tab to do firmware. A little searching on Google leads me to the page on httpconfig.vonage.net that has the firmware (if you have trouble here - the firmware image I was looking for was the older 1.00.07 one - the firmware file name is VTA-11.4.0-r060331-1.00.07-r060418.img - there's nothing other than "/" in the http path between the host name and file name.)

With a copy of 1.00.07 now in hand and the firmware page up, I was able to reload the system with the old firmware. It then rebooted and I saw it trying to connect back to vonage again on my Wireshark (but of course it couldn't get there).

I loaded up CYT46 with the DLINK command line option, pointed it to the IP of the VTA-VR, and bingo, it reset the password for Admin and I was in. Now I was able to play with the configuration etc. and get my decrypt key from that version of the Admin pages.

Now I got brave and decided to re-flash it with the newest firmware again, let it connect to Vonage, get all its XML files, and log in with the password I got by using RC4 decrypt on the XML file from ti.tftp.vonage.net. Well that worked beautifully - except for one thing - the new version of the firmware *requires* the .xml files to be encrypted - and for some reason when I encrypted them with the RC4 key I got before out of the old version of firmware, it wouldn't use them or accept them. It certainly wouldn't accept unencrypted XML's. Also there are a few changes in the Admin pages that restrict what you can do. On the other hand it brings all the "SIP" options up easy to check out.

But, now I was in as Admin with Vonage's Admin Password for the device, I was able to simply re-flash to the 11.4.0/1.00.07 firmware, pointed the device to my Asterisk server (and I set up tftp server on it to hand out the tiMAC.XML file) - edited the XML file based on the template one included with CYT - and a little help from several of the XML files here on the forum, rebooted the VTA-VR, watched it TFTP the file from my asterisk box, and then connect both extensions by SIP. Tried with both handsets plugged into both ports and all my calls are working, and incoming calls to those extensions ring them.

So the short answer after the long explanation is - the newest firmware - 11.4.1/1.00.09 - is relatively useless for those of us who want to use our box on another carrier. So, break into the reset page using the URL above, force it to reset both Provisioned and NonProvisioned, login as Support/(blank), grab the 11.4.0/1.00.07 firmware off Vonage's httpconfig server while it's available (I've got a copy and if they ever remove it I'll make sure it ends up somewhere you can get your hands on it). Then, break in using CYT46 (I don't know if 35 or 39 will work - 46 was flawless for me) - set yourself up your TFTP provisioning server, edit your XML file, and you're good to go.

Good luck to anyone out there working on breaking the 11.4.1/1.00.09 firmware - let us know if you get it to work for you. The inability to turn off the requirement for an RC4 encrypted XML file was the killer for me. I could have forced it to retrieve any XML file from my PC directly by "faking myself as Vonage" on the LAN - but it wouldn't do any good and wouldn't read the configs from the files. Also my RC4 decrypted XML files didn't decrypt nicely - about half of the file was garbage - but luckily the first half was clean enough to get the Admin PW.

Good job and well done! Another way to hack Vonage!