Sagemcom FAST5393LTE-AFull CLI for your Optus 5G Router
Bypass the locked DNS UI. Manage WiFi, firewall, NAT, and devices. Discover 50+ undocumented API endpoints. All from your terminal or a beautiful web dashboard.
Complete router control
Every API endpoint the router exposes, exposed through a clean CLI and a real-time web dashboard.
DNS Bypass
Circumvent the router's locked DNS provider dropdown. Set any DNS servers — Pi-hole, AdGuard Home, Cloudflare Gateway, or your own.
Real-time Dashboard
Beautiful web GUI with live Socket.io updates. Traffic bars, device tables, firewall controls, and system metrics — all real-time.
51+ API Endpoints
From DHCP to DDNS, firewall to port forwarding, VoIP to VPN. Discover every endpoint the router exposes with a single command.
Firewall & NAT Control
Set firewall levels (Off/Low/Medium/High), manage DMZ hosts, add and delete port forwarding rules. Full security control.
Device Management
List connected devices with IP, MAC, link type, and active time. Block devices, set nicknames, export as JSON.
System Control
Reboot, factory reset, backup config, view logs, run ping and traceroute diagnostics. Full system management.
Get started in 2 minutes
Node.js 16+ required. Clone, install, configure, and you're connected.
Clone & install
git clone https://github.com/ari/OptusCLI.git
cd OptusCLI
npm installConfigure credentials
Copy the sample config and fill in your router's admin password (found on the sticker on the bottom of the router).
{
"host": "http://192.168.0.1",
"username": "optus",
"password": "your-password-here"
}Test the connection
node optusctl.js statusYou should see your router's model, firmware version, WAN status, and connected devices.
Launch the Web GUI (optional)
npm run webA real-time dashboard at http://localhost:3000 with live updates, device table, traffic graphs, and full router controls.
The reason this project exists
The Optus Sagemcom router locks DNS to a dropdown of ~20 predefined providers. You cannot enter 192.168.0.100 for your Pi-hole. This CLI bypasses that entirely.
# Pi-hole on your LAN:
optusctl dns --set 192.168.0.100 1.1.1.1
# Cloudflare 1.1.1.1:
optusctl dns --set 1.1.1.1 1.0.0.1
# Google DNS:
optusctl dns --set 8.8.8.8 8.8.4.4
# Quad9:
optusctl dns --set 9.9.9.9 149.112.112.112
# View current configuration:
optusctl dnsThe CLI writes directly to the router's internal DHCP API — the same API the Angular web UI uses, but without the UI restrictions. Your custom DNS persists across reboots.
Why the UI is locked
Optus constrains the DNS dropdown to approved providers. The underlying API accepts any IP — the Angular frontend simply never exposes a free-text field. OptusCLI bypasses the UI layer completely.
Safe to use
The DNS change is the same API call the official UI makes when you select a provider. There is no risk of bricking the router. Revert anytime with --set 8.8.8.8 8.8.4.4.
19 commands, 80+ flags
Every feature of the router, accessible from your terminal.
System and Status| Command | Description |
|---|---|
optusctl status | Quick system overview — model, firmware, WAN, DHCP, device count |
optusctl system --info | Full device information |
optusctl system --features | Hardware features and capabilities |
optusctl system --time | NTP/time sync configuration |
optusctl system --discover | Probe all 50+ API endpoints to find available ones |
optusctl system --log | View system log |
Network| Command | Description |
|---|---|
optusctl dns | View current DNS configuration and available providers |
optusctl dns --set 1.1.1.1 1.0.0.1 | Bypass DNS lock — set any DNS servers |
optusctl wan | WAN/internet connection status |
optusctl wan --stats | WAN IP statistics |
optusctl lan | LAN interface statistics (RX/TX) |
optusctl upnp | UPnP IGD configuration |
Devices| Command | Description |
|---|---|
optusctl devices | List all network devices with IP, MAC, link type |
optusctl devices --active | Show only active (online) devices |
optusctl devices --json | Export as raw JSON |
optusctl devices --nickname aa:bb:cc:dd "Living Room" | Assign a nickname by MAC address |
optusctl devices --block aa:bb:cc:dd | Block a device from WiFi |
WiFi| Command | Description |
|---|---|
optusctl wifi --status | WiFi radio status (2.4G/5G/guest bands) |
optusctl wifi --scan | Scan for nearby wireless networks |
optusctl wifi --guest | Guest network settings |
optusctl wifi --wps | Activate WPS push button (2 min window) |
Security| Command | Description |
|---|---|
optusctl firewall | View firewall configuration |
optusctl firewall --rules | View firewall rules |
optusctl firewall --level high | Set firewall level (off/low/medium/high) |
optusctl parental --enable | Enable parental controls |
NAT and Port Forwarding| Command | Description |
|---|---|
optusctl nat | View NAT status and DMZ config |
optusctl nat --rules | View port forwarding rules |
optusctl nat --dmz 192.168.0.100 | Set DMZ host |
optusctl nat --add "Web" tcp 80 192.168.0.100 80 | Add port forward rule |
optusctl nat --delete "Web" | Delete a port forward rule |
System Control| Command | Description |
|---|---|
optusctl system --reboot | Reboot the router |
optusctl system --factory-reset | Factory reset (with confirmation prompt) |
optusctl system --backup | Backup router configuration |
optusctl diag --ping 8.8.8.8 | Ping test |
optusctl diag --traceroute 8.8.8.8 | Traceroute |
Advanced| Command | Description |
|---|---|
optusctl cellular | 4G/5G cellular modem status |
optusctl voice | VoIP telephony status |
optusctl usb | USB device list |
optusctl ddns | Dynamic DNS configuration |
optusctl vpn | VPN configuration |
optusctl raw /api/v1/dhcp | Raw API call — any endpoint, any method |
Real-time dashboard
Launch with npm run web and open http://localhost:3000.
Overview
System status, WAN, DHCP, traffic bars, WiFi radios, NTP, cellular signal — all in one place, updated every 3 seconds via WebSocket.
Devices Tab
Full device table with online/offline status, IP, MAC, link type, lease time. Block devices with one click.
Network Tab
DNS settings editor, WAN IPv4 info, LAN RX/TX statistics, ARP table viewer.
WiFi Tab
Radio status per band, band steering, guest network, WPS push button, network scanner.
Security Tab
Firewall level selector (off/low/medium/high), NAT/DMZ status, parental controls, UPnP config.
Advanced Tab
Port forwarding rule manager (add/delete), ping/traceroute diagnostics, system log viewer.
The router's hidden REST API
151 endpoints discovered in firmware SGKY10001970. At least 51 are accessible via simple GET requests.
How it works
The router runs a Sagemcom REST server that exposes its entire state through predictable REST endpoints. The Angular web UI is just a skin — OptusCLI talks directly to the API.
# POST credentials → receive session cookies
POST /api/v1/login
# Use cookies for every subsequent call
GET /api/v1/dhcp # DHCP config
GET /api/v1/hosts # Device list
PUT /api/v1/dhcp # Set DNS
POST /api/v1/device/reboot # RebootHow the router works
Sagemcom REST Architecture
The router runs a proprietary REST server (Server: Sagemcom Rest) that exposes all configuration and state via /api/v1/* endpoints. The Angular frontend (SPA) makes HTTP requests to this API — every button, toggle, and dropdown in the web UI is backed by a REST call.
Authentication
Firmware SGKY10001970+ uses simple cookie-based auth. POST username + password to /api/v1/login, receive salt, nonce, conid cookies. Send these with all subsequent requests. Sessions last 15 minutes. OptusCLI auto-reconnects on expiry.
Firmware Differences
Earlier firmware versions (SGKY10000893) used a challenge-response SHA-512 digest with custom PBKDF2. Newer firmware switched to direct password auth. The legacy crypto code is preserved in the repo but unused on current firmware.
Discovery
151 API endpoints were extracted from the Angular SPA's source bundle (main.*.js, ~4MB). Run optusctl system --discover to probe which ones respond on your router. Different firmware versions expose different endpoints.