I wanted to try and lock it to 1800Mhz, but there's no option for that exposed in the GUI that I can find.
Generally few devices allow for that. I do know the Zyxel devices we use allow for that in the engineering version we have for lab purposes. I'm not sure what is available in the commercial version. I do know however that we completely lock down the local interfaces of the Telenor branded version of the Zyxel device.
I had not, I didn't scan higher ports. It *is* open though, so I was able to connect to it. It only yells at me if I try to run any of the few AT commands I know (except at), not sure if that's because of the datalock code. If that's what I'm missing, how does one go about getting a hold of one of those? When I looked it up I only found some sites I have concern about the legitimacy of.