VONETS VAR11N-300

The VONETS VAR11N-300 is a miniature router, similar to VONETS Mini300, based on the MediaTek MT7620n with one wired ethernet plug, one ethernet port, and a 802.11n 2T/2R 2.4 GHz 300Mbps wireless interface.

Supported Versions

Experimental Versions

There are ongoing efforts to make 23.x builds usable and useful on 4/32 devices.

Hardware Highlights

Installation

Flash Layout

root@OpenWrt:~# cat /proc/mtd
dev:    size   erasesize  name
mtd0: 00030000 00001000 "u-boot"
mtd1: 00010000 00001000 "u-boot-env"
mtd2: 00010000 00001000 "factory"
mtd3: 003b0000 00001000 "firmware"
mtd4: 00160a01 00001000 "kernel"
mtd5: 0024f5ff 00001000 "rootfs"
mtd6: 0000b000 00001000 "rootfs_data"
root@OpenWrt:~#
[    0.575197] Creating 4 MTD partitions on "spi0.0":
[    0.584755] 0x000000000000-0x000000030000 : "u-boot"
[    0.595852] 0x000000030000-0x000000040000 : "u-boot-env"
[    0.607656] 0x000000040000-0x000000050000 : "factory"
[    0.618930] 0x000000050000-0x000000400000 : "firmware"
[    1.040041] 2 uimage-fw partitions found on MTD device firmware
[    1.051910] 0x000000050000-0x0000001b0a01 : "kernel"
[    1.062981] 0x0000001b0a01-0x000000400000 : "rootfs"
[    1.074003] mtd: device 5 (rootfs) set to be root filesystem
[    1.087702] 1 squashfs-split partitions found on MTD device rootfs
[    1.100138] 0x0000003f5000-0x000000400000 : "rootfs_data"

Layer0	raw flash, 4096 KiB
Layer1	mtd0 `u-boot` 192 KiB	mtd1 `u-boot-env` 64 KiB	mtd2 `factory` 64 KiB	mtd3 - `firmware` 3776 KiB _{^{(= FlashSize-(192+64+64))}}
Layer2				mtd4 `kernel` ~1410 KiB	mtd5 - `rootfs` ~2365 KiB
Layer3				mtd4 `kernel` ~1410 KiB	`/dev/root` ~2321 KiB	mtd6 `rootfs_data` 44 KiB

Initial installation

Current firmwares on retail VAR11N-300 no longer have an active exploit and need to be flashed directly with SPI and a SOIC 8 clip.

Using a RaspberryPi, Rasbian, a pomona 8-pin clip, and https://www.rototron.info/recover-bricked-bios-using-flashrom-on-a-raspberry-pi/ as a guide for both physical connection as well as walk-through
run `flashrom -p linux_spi:dev=/dev/spidev0.0,spispeed=2000 -r vonets-var11n-300.bin` to get the existing ROM
download the openwrt system image
use `dd if=vonets_var11n-300.bin of=var11n-300-base.bin bs=327680 count=1` to extract the base from the original firmware (50000 hex converted to decimal is 327680)
use `cat var11n-300-base.bin openwrt-18.06.5-ramips-mt7620-vonets_var11n-300-squashfs-sysupgrade.bin > testbuild.rom` to create the test ROM
flashrom won't work unless it's the same size as the flash chip, so use `ls -al` to determine the size difference between the original and the new test ROM
use `dd if=vonets_var11n-300.bin of=pad bs=1 skip=4145334` to get the last remaining bytes out of the original ROM (where 4145334 was the size of my new test ROM from ls -al command)
then `cat testbuild.rom pad > fulltestbuild.rom` to join them together
lastly `flashrom -p linux_spi:dev=/dev/spidev0.0,spispeed=2000 -w fulltestbuild.rom` to flash it back to the chip

Upgrading OpenWrt

Once OpenWrt is installed, the standard upgrade procedure applies. → generic.sysupgrade

LuCI Web Upgrade Process

Browse to http://192.168.1.1/cgi-bin/luci/mini/system/upgrade/ LuCI Upgrade URL
Upload image file for sysupgrade to LuCI
Wait for reboot

Terminal Upgrade Process

If you don't have a GUI (LuCI) available, you can alternatively upgrade via the command line. There are two command line methods for upgrading:

sysupgrade
mtd

Note: It is important that you put the firmware image into the ramdisk (/tmp) before you start flashing.

sysupgrade

cd /tmp
wget http://downloads.openwrt.org/snapshots/trunk/XXX/xxx.abc
sysupgrade /tmp/xxx.abc

mtd

If sysupgrade does not support this router, use mtd.

cd /tmp
wget http://downloads.openwrt.org/snapshots/trunk/XXX/xxx.abc
mtd write /tmp/xxx.abc linux && reboot

Debricking

→ generic.debrick

Refer to initial installation method with direct SPI flash.

Failsafe mode

→ failsafe_and_factory_reset

Basic configuration

Set up your Internet connection, configure wireless, configure USB port, etc. → Basic configuration After flashing, proceed with this.

Specific Configuration

Network interfaces

The default network configuration is:

Interface Name	Description	Default configuration
br-lan	LAN & WiFi	192.168.1.1/24
vlan0 (eth0.1)	LAN port	None
vlan1 (eth0.2)	WAN port	DHCP
wlan0	WiFi	Disabled

Switch Ports (for VLANs)

Numbers 0-1 are Ports 1-2 as labeled on the unit, number 4 is the Internet (WAN) on the unit, 5 is the internal connection to the router itself. Don't be fooled: Port 1 on the unit is number 3 when configuring VLANs. vlan0 = eth0.0, vlan1 = eth0.1 and so on.

Port	Switch port
Internet (WAN)	2
LAN	1

Buttons

The VONETS VAR11N-300 has the following buttons:

BUTTON	Event
Reset	reset

→ hardware.button on howto use and configure the hardware button(s).

Hardware

Info

Photos

Surround View:

Opening the case

Note: This will void your warranty!

There are no screws or stickers to remove. The top case is held to the bottom case with 9 tiny plastic clips. 3 on each side, 2 on top, and 1 on bottom.

Main PCB:
Insert photo of PCB

Serial

→ port.serial general information about the serial port, serial port cable, etc.

How to connect to the Serial Port of this specific device:
Insert photo of PCB with markings for serial port

Bootloader mods

→ bootloader

Hardware mods

None so far.

Bootlogs

OEM bootlog

COPY HERE THE BOOTLOG WITH THE ORIGINAL FIRMWARE

OpenWrt bootlog

[ 0.000000] Linux version 4.14.206 (buildbot@d6b0edf6d597) (gcc version 7.3.0 (OpenWrt GCC 7.3.0 r8077-7cbbab7246)) #0 Wed Nov 11 20:09:58 2020 [ 0.000000] Board has SDRAM [ 0.000000] Analog PMU set to hw control [ 0.000000] Digital PMU set to hw control [ 0.000000] SoC Type: MediaTek MT7620N ver:2 eco:3 [ 0.000000] bootconsole [early0] enabled [ 0.000000] CPU0 revision is: 00019650 (MIPS 24KEc) [ 0.000000] MIPS: machine is Vonets VAR11N-300 [ 0.000000] Determined physical RAM map: [ 0.000000] memory: 02000000 @ 00000000 (usable) [ 0.000000] Initrd not found or empty - disabling initrd [ 0.000000] Primary instruction cache 64kB, VIPT, 4-way, linesize 32 bytes. [ 0.000000] Primary data cache 32kB, 4-way, PIPT, no aliases, linesize 32 bytes [ 0.000000] Zone ranges: [ 0.000000] Normal [mem 0x0000000000000000-0x0000000001ffffff] [ 0.000000] Movable zone start for each node [ 0.000000] Early memory node ranges [ 0.000000] node 0: [mem 0x0000000000000000-0x0000000001ffffff] [ 0.000000] Initmem setup node 0 [mem 0x0000000000000000-0x0000000001ffffff] [ 0.000000] On node 0 totalpages: 8192 [ 0.000000] free_area_init_node: node 0, pgdat 80427620, node_mem_map 81000040 [ 0.000000] Normal zone: 64 pages used for memmap [ 0.000000] Normal zone: 0 pages reserved [ 0.000000] Normal zone: 8192 pages, LIFO batch:0 [ 0.000000] random: get_random_bytes called from 0x8042a730 with crng_init=0 [ 0.000000] pcpu-alloc: s0 r0 d32768 u32768 alloc=1*32768 [ 0.000000] pcpu-alloc: [0] 0 [ 0.000000] Built 1 zonelists, mobility grouping on. Total pages: 8128 [ 0.000000] Kernel command line: console=ttyS0,57600 rootfstype=squashfs,jffs2 [ 0.000000] PID hash table entries: 128 (order: -3, 512 bytes) [ 0.000000] Dentry cache hash table entries: 4096 (order: 2, 16384 bytes) [ 0.000000] Inode-cache hash table entries: 2048 (order: 1, 8192 bytes) [ 0.000000] Writing ErrCtl register=000121a4 [ 0.000000] Readback ErrCtl register=000121a4 [ 0.000000] Memory: 27680K/32768K available (3609K kernel code, 182K rwdata, 464K rodata, 216K init, 215K bss, 5088K reserved, 0K cma-reserved) [ 0.000000] SLUB: HWalign=32, Order=0-3, MinObjects=0, CPUs=1, Nodes=1 [ 0.000000] NR_IRQS: 256 [ 0.000000] CPU Clock: 600MHz [ 0.000000] clocksource: systick: mask: 0xffff max_cycles: 0xffff, max_idle_ns: 583261500 ns [ 0.000000] systick: enable autosleep mode [ 0.000000] systick: running - mult: 214748, shift: 32 [ 0.000000] clocksource: MIPS: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 6370868154 ns [ 0.000011] sched_clock: 32 bits at 300MHz, resolution 3ns, wraps every 7158278654ns [ 0.015557] Calibrating delay loop... 398.13 BogoMIPS (lpj=1990656) [ 0.087785] pid_max: default: 32768 minimum: 301 [ 0.097240] Mount-cache hash table entries: 1024 (order: 0, 4096 bytes) [ 0.110274] Mountpoint-cache hash table entries: 1024 (order: 0, 4096 bytes) [ 0.129860] clocksource: jiffies: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 19112604462750000 ns [ 0.149388] futex hash table entries: 256 (order: -1, 3072 bytes) [ 0.161574] pinctrl core: initialized pinctrl subsystem [ 0.173772] NET: Registered protocol family 16 [ 0.212301] rt2880_gpio 10000600.gpio: registering 24 gpios [ 0.223400] rt2880_gpio 10000600.gpio: registering 24 irq handlers [ 0.241462] clocksource: Switched to clocksource systick [ 0.253531] NET: Registered protocol family 2 [ 0.263432] TCP established hash table entries: 1024 (order: 0, 4096 bytes) [ 0.277264] TCP bind hash table entries: 1024 (order: 0, 4096 bytes) [ 0.289814] TCP: Hash tables configured (established 1024 bind 1024) [ 0.302697] UDP hash table entries: 256 (order: 0, 4096 bytes) [ 0.314259] UDP-Lite hash table entries: 256 (order: 0, 4096 bytes) [ 0.327063] NET: Registered protocol family 1 [ 0.335663] PCI: CLS 0 bytes, default 32 [ 0.339726] rt-timer 10000100.timer: maximum frequency is 1220Hz [ 0.352837] Crashlog allocated RAM at address 0x1f00000 [ 0.365818] workingset: timestamp_bits=30 max_order=13 bucket_order=0 [ 0.385500] squashfs: version 4.0 (2009/01/31) Phillip Lougher [ 0.397030] jffs2: version 2.2 (NAND) (SUMMARY) (LZMA) (RTIME) (CMODE_PRIORITY) (c) 2001-2006 Red Hat, Inc. [ 0.432331] io scheduler noop registered [ 0.439983] io scheduler deadline registered (default) [ 0.451627] Serial: 8250/16550 driver, 16 ports, IRQ sharing enabled [ 0.467737] console [ttyS0] disabled [ 0.474855] 10000c00.uartlite: ttyS0 at MMIO 0x10000c00 (irq = 20, base_baud = 2500000) is a Palmchip BK-3103 [ 0.494495] console [ttyS0] enabled [ 0.508292] bootconsole [early0] disabled [ 0.535826] spi spi0.0: force spi mode3 [ 0.553419] m25p80 spi0.0: w25q32 (4096 Kbytes) [ 0.562536] 4 fixed-partitions partitions found on MTD device spi0.0 [ 0.575197] Creating 4 MTD partitions on "spi0.0": [ 0.584755] 0x000000000000-0x000000030000 : "u-boot" [ 0.595852] 0x000000030000-0x000000040000 : "u-boot-env" [ 0.607656] 0x000000040000-0x000000050000 : "factory" [ 0.618930] 0x000000050000-0x000000400000 : "firmware" [ 1.040041] 2 uimage-fw partitions found on MTD device firmware [ 1.051910] 0x000000050000-0x0000001b0a01 : "kernel" [ 1.062981] 0x0000001b0a01-0x000000400000 : "rootfs" [ 1.074003] mtd: device 5 (rootfs) set to be root filesystem [ 1.087702] 1 squashfs-split partitions found on MTD device rootfs [ 1.100138] 0x0000003f5000-0x000000400000 : "rootfs_data" [ 1.113159] libphy: Fixed MDIO Bus: probed [ 1.128032] gsw: setting port4 to ephy mode [ 1.136500] mtk_soc_eth 10100000.ethernet eth0 (uninitialized): port 0 link up (100Mbps/Full duplex) [ 1.155058] mtk_soc_eth 10100000.ethernet: loaded mt7620 driver [ 1.167740] mtk_soc_eth 10100000.ethernet eth0: mediatek frame engine at 0xb0100000, irq 5 [ 1.185002] rt2880_wdt 10000120.watchdog: Initialized [ 1.196764] NET: Registered protocol family 10 [ 1.211654] Segment Routing with IPv6 [ 1.219084] NET: Registered protocol family 17 [ 1.228065] bridge: filtering via arp/ip/ip6tables is no longer available by default. Update your scripts to load br_netfilter if you need this. [ 1.253908] 8021q: 802.1Q VLAN Support v1.8 [ 1.279192] VFS: Mounted root (squashfs filesystem) readonly on device 31:5. [ 1.295796] Freeing unused kernel memory: 216K [ 1.304701] This architecture does not have kernel memory protection. [ 2.661417] random: fast init done [ 2.707157] init: Console is alive [ 2.714449] init: - watchdog - [ 4.192887] kmodloader: loading kernel modules from /etc/modules-boot.d/* [ 4.490308] kmodloader: done loading kernel modules from /etc/modules-boot.d/* [ 4.509268] init: - preinit - [ 6.135818] 8021q: adding VLAN 0 to HW filter on device eth0 [ 6.315548] random: procd: uninitialized urandom read (4 bytes read) [ 7.603653] jffs2: notice: (351) jffs2_build_xattr_subsystem: complete building xattr subsystem, 20 of xdatum (2 unchecked, 18 orphan) and 36 of xref (32 dead, 0 orphan) found. [ 7.637633] mount_root: switching to jffs2 overlay [ 7.695986] overlayfs: upper fs does not support tmpfile. [ 7.717206] urandom-seed: Seeding with /etc/urandom.seed [ 7.996585] procd: - early - [ 8.002493] procd: - watchdog - [ 8.353335] procd: - watchdog - [ 8.360215] procd: - ubus - [ 8.578917] random: ubusd: uninitialized urandom read (4 bytes read) [ 8.597121] random: ubusd: uninitialized urandom read (4 bytes read) [ 8.610786] random: ubusd: uninitialized urandom read (4 bytes read) [ 8.624811] procd: - init - [ 9.203763] kmodloader: loading kernel modules from /etc/modules.d/* [ 9.324268] ip6_tables: (C) 2000-2006 Netfilter Core Team [ 9.351960] Loading modules backported from Linux version wt-2017-11-01-0-gfe248fc2c180 [ 9.368043] Backport generated by backports.git v4.14-rc2-1-31-g86cf0e5d [ 9.387453] ip_tables: (C) 2000-2006 Netfilter Core Team [ 9.410866] nf_conntrack version 0.5.0 (1024 buckets, 4096 max) [ 9.529898] xt_time: kernel timezone is -0000 [ 9.645631] PPP generic driver version 2.4.2 [ 9.657955] NET: Registered protocol family 24 [ 9.716474] rt2800_wmac 10180000.wmac: loaded eeprom from mtd device "factory" [ 9.731020] ieee80211 phy0: rt2x00_set_rt: Info - RT chipset 6352, rev 0500 detected [ 9.746471] ieee80211 phy0: rt2x00_set_rf: Info - RF chipset 7620 detected [ 9.761145] ieee80211 phy0: Selected rate control algorithm 'minstrel_ht' [ 9.835685] kmodloader: done loading kernel modules from /etc/modules.d/* [ 11.158473] urandom_read: 5 callbacks suppressed [ 11.158485] random: jshn: uninitialized urandom read (4 bytes read) [ 21.172869] 8021q: adding VLAN 0 to HW filter on device eth0 [ 21.254078] br-lan: port 1(eth0.1) entered blocking state [ 21.264994] br-lan: port 1(eth0.1) entered disabled state [ 21.276298] device eth0.1 entered promiscuous mode [ 21.285926] device eth0 entered promiscuous mode [ 21.439886] br-lan: port 1(eth0.1) entered blocking state [ 21.450760] br-lan: port 1(eth0.1) entered forwarding state [ 21.462191] IPv6: ADDRCONF(NETDEV_UP): br-lan: link is not ready [ 22.228096] IPv6: ADDRCONF(NETDEV_CHANGE): br-lan: link becomes ready [ 25.622308] ieee80211 phy0: rt2800_config_channel: Warning - Using incomplete support for external PA [ 25.649426] IPv6: ADDRCONF(NETDEV_UP): wlan0: link is not ready [ 26.443422] ieee80211 phy0: rt2800_config_channel: Warning - Using incomplete support for external PA [ 26.528346] ieee80211 phy0: rt2800_config_channel: Warning - Using incomplete support for external PA [ 26.574570] ieee80211 phy0: rt2800_config_channel: Warning - Using incomplete support for external PA [ 26.620829] ieee80211 phy0: rt2800_config_channel: Warning - Using incomplete support for external PA [ 26.668716] ieee80211 phy0: rt2800_config_channel: Warning - Using incomplete support for external PA [ 26.714918] ieee80211 phy0: rt2800_config_channel: Warning - Using incomplete support for external PA [ 26.761416] ieee80211 phy0: rt2800_config_channel: Warning - Using incomplete support for external PA [ 26.808077] ieee80211 phy0: rt2800_config_channel: Warning - Using incomplete support for external PA [ 26.855527] ieee80211 phy0: rt2800_config_channel: Warning - Using incomplete support for external PA [ 26.901980] ieee80211 phy0: rt2800_config_channel: Warning - Using incomplete support for external PA [ 26.948463] ieee80211 phy0: rt2800_config_channel: Warning - Using incomplete support for external PA [ 26.995068] ieee80211 phy0: rt2800_config_channel: Warning - Using incomplete support for external PA [ 27.055172] ieee80211 phy0: rt2800_config_channel: Warning - Using incomplete support for external PA [ 27.114538] ieee80211 phy0: rt2800_config_channel: Warning - Using incomplete support for external PA [ 27.175798] ieee80211 phy0: rt2800_config_channel: Warning - Using incomplete support for external PA [ 27.198969] wlan0: authenticate with 6c:70:9f:e9:88:84 [ 27.212730] ieee80211 phy0: rt2800_config_channel: Warning - Using incomplete support for external PA [ 27.234193] wlan0: send auth to 6c:70:9f:e9:88:84 (try 1/3) [ 27.249182] wlan0: authenticated [ 27.267297] wlan0: associate with 6c:70:9f:e9:88:84 (try 1/3) [ 27.357689] wlan0: RX AssocResp from 6c:70:9f:e9:88:84 (capab=0x1401 status=0 aid=4) [ 27.373532] wlan0: associated [ 27.379813] wlan0: Limiting TX power to 30 (30 - 0) dBm as advertised by 6c:70:9f:e9:88:84 [ 27.382132] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 36.801679] random: crng init done

Notes

Space for additional notes, links to forum threads or other resources.

Table of Contents