ZyXEL NWA50AX

Under Construction!
This page is currently under construction. You can edit the article to help completing it.

The ZyXEL NWA50AX is ZyXEL's entry level SOHO 802.11ax/WiFi 6 access point, like many business class APs, it is designed for wall/ceiling mount, and includes a 12v1.5A power supply, and also PoE support, along side an easily accessible console port, reset button and multi-color LED.

ZyXEL NWA50AX

This device has a A/B partition layout, and OpenWrt will panic on boot if it has been installed to slot B.

From factory WebUI

Upload the OpenWrt factory image to the factory's firmware. Normally, this should work right away.

However, if your NWA50AX has had a firmware update since unpacking, then OpenWrt is installed to slot B and will fail installation. The NWA50AX will then reboot to the stock ZyXEL firmware. In this case, simply install another stock firmware image from ZyXEL's site, and then attempt to reinstall OpenWrt.

From Serial

The modified ZyXEL U-Boot has a restricted set of commands available, however, more can be accessed by abusing the 'atns' command.

Requirements

  1. Local area network with 192.168.1.0/24 subnet
  2. A TFTP server hosting the openwrt-initramfs.bin image running on the arbitrary IP address: e.g. 192.168.1.20
  3. ramboot-factory.bin image (you'll download this image later via wget from the console)

Go through the following steps

  1. Connect the serial cable to the console port
  2. Connect the router to your LAN using ethernet cable
  3. Start the terminal emulator and connect to the serial port
  4. Connect the power cable which starts the router and you see the following
    U-Boot SPL 2018.09 (Jan 22 2021 - 07:42:43 +0000)
    Trying to boot from NAND
    
    Initializing NMBM ...
    Signature found at block 1023 [0x07fe0000]
    First info table with writecount 0 found in block 960
    Second info table with writecount 0 found in block 963
    NMBM has been successfully attached
  5. Interrupt the boot sequence with the keyboard to enter the UART console
    gpio: pin 24 (gpio 24) value is 1
    Hit any key to stop autoboot:  0
    =>
  6. Check the active slot:
    atds
  7. Read the output to find the active slot
    Image0 status           :success [Slot A]
    Image1 status           :success [Slot B]
    Boot Image              :Image1  [Slot B is active]
  8. Boot the OpenWRT initramfs image using the commands:
    atnf openwrt-initramfs.bin
    atna 192.168.1.10
    atns "192.168.1.20; tftpboot; bootm"
  9. Wait until the text below appears and then press Enter
    Press the [f] key and hit [enter] to enter failsafe mode
    Press the [1], [2], [3] or [4] key and hit [enter] to select the debug level
    Please press Enter to activate this console.
  10. You have successfully booted OpenWrt
    BusyBox v1.35.0 (2023-01-03 00:24:21 UTC) built-in shell (ash)
    
      _______                     ________        __
     |       |.-----.-----.-----.|  |  |  |.----.|  |_
     |   -   ||  _  |  -__|     ||  |  |  ||   _||   _|
     |_______||   __|_____|__|__||________||__|  |____|
              |__| W I R E L E S S   F R E E D O M
     -----------------------------------------------------
     OpenWrt 22.03.3, r20028-43d71ad93e
     -----------------------------------------------------
    === WARNING! =====================================
    There is no root password defined on this device!
    Use the "passwd" command to set up a new password
    in order to prevent unauthorized SSH logins.
    --------------------------------------------------
    root@OpenWrt:/#
  11. Once OpenWrt has booted, you'll have to configure the network to get Internet access
  12. Edit the file /etc/config/network
    vim /etc/config/network
  13. Configure router's IP address, gateway, dns server
    (...)
    
    config interface 'lan'
            option device 'br-lan'
            option proto 'static'
            option ipaddr '192.168.1.10'
            option netmask '255.255.255.0'
            option ip6assign '60'
            option gateway '192.168.1.1'
            list dns '192.168.1.1'
    
  14. Apply the changes with
    /etc/init.d/network restart
  15. Verify the Internet connection
    ping www.google.com
  16. If slot B is active, you'll have to install zyxel-bootconfig package
    opkg update 
    opkg install zyxel-bootconfig
  17. ...and make slot A active (you don't have to do this is slot A is already active)
    zyxel-bootconfig /dev/mtd10 get-status
    zyxel-bootconfig /dev/mtd10 set-image-status 0 valid
    zyxel-bootconfig /dev/mtd10 set-active-image 0
  18. Download the ramboot-factory image to the device, using for example SCP or wget
    cd /tmp
    wget --no-check-certificate -O ramboot-factory.bin https://downloads.openwrt.org/releases/22.03.3/targets/ramips/mt7621/openwrt-22.03.3-ramips-mt7621-zyxel_nwa50ax-squashfs-ramboot-factory.bin
  19. Install the image to the NAND
    mtd write ramboot-factory.bin firmware
    reboot
  20. Congratulations! Your device is now running OpenWrt.

hardware.button on howto use and configure the hardware button(s). Here, we merely name the buttons, so we can use them in the above Howto.

The ZyXEL NWA50AX has the following button:

BUTTON Event
Reset reset
Architecture MIPS
Vendor Ralink
Bootloader Zyxel U-Boot
System-On-Chip Mediatek MT7621 - MIPS 1004Kc V2.15
CPU/Speed 880MHz Quad-core
Flash-Chip Macronix MX30LF1G28AD-TI NAND
Flash size 128 M
RAM 128MB Nanya NT5CC128M16JR-EK DDR3 933
Wireless Mediatek MT7975DAN/MT7975DN
Ethernet 1x 1GbE
Serial Yes

Insert photo of front of the casing

Insert photo of back of the casing

Insert photo of backside label

Photo of the PCB:

On the bottom side of the device, there are 4 PH1 screws, remove them, flip the device over and pry the top cover off from the ridge around the edge. There are no plastic clips, the device should come apart without problems. You will see a large antenna ground plate that also serves as a heat sink, seemingly attached with 4 screws. However, it is also attached to the PCB with some sort of tape. See photo: Should you decide to rip off the heat sink, a photo of the resulting mess may be helpful.

The PCB is held down with 4 little plastic clamps on the corners, and is also attached to a heat sink with double sticking tape. Taking the PCB out should be easy.

port.serial general information about the serial port, serial port cable, etc.

How to connect to the Serial Port of this specific device:
Turn the device over, so you are looking at the ports, with the ports at the bottom, The order of the pins is:

<12v> <LAN> GND, RX, TX, VCC (do not connect VCC!). See picture: zyxel_nwa50ax_connections.jpg There will also be an arrow above the word CONSOLE pointing at the VCC pin.

Note RX needs to be connected to TX on the connecting device and TX to RX.

Serial connection parameters
for ZyXEL NWA50AX
115200, 8N1, 3.3V

U-Boot SPL 2018.09 (Jan 22 2021 - 07:42:43 +0000) Trying to boot from NAND Initializing NMBM ... Signature found at block 1023 [0x07fe0000] First info table with writecount 0 found in block 960 Second info table with writecount 0 found in block 963 NMBM has been successfully attached U-Boot 2018.09 (Jan 22 2021 - 07:42:43 +0000) CPU: MediaTek MT7621AT ver 1, eco 3 Clocks: CPU: 880MHz, DDR: 600MHz (1200MT/s), Bus: 220MHz, XTAL: 40MHz Model: MediaTek MT7621 reference board (NAND) DRAM: 256 MiB NAND: 128 MiB Initializing NMBM ... Signature found at block 1023 [0x07fe0000] First info table with writecount 0 found in block 960 Second info table with writecount 0 found in block 963 NMBM has been successfully attached Loading Environment from NMBM... *** Warning - bad CRC, using default environment In: uartlite0@1e000c00 Out: uartlite0@1e000c00 Err: uartlite0@1e000c00 Net: Warning: eth@1e100000 (eth0) using random MAC address - fa:26:d7:78:e2:6c eth0: eth@1e100000 Reading from 0x7700000, size 0x20000 Succeeded Zyxel version:V1.03 gpio: pin 6 (gpio 6) value is 1 gpio: pin 24 (gpio 24) value is 0 gpio: pin 24 (gpio 24) value is 1 Hit any key to stop autoboot: 0 => help Unknown command 'help' - try 'help' => help Unknown command 'help' - try 'help' => ? ? - alias for 'help' at - print OK atds - show dual image info atgo - boot athe - show available commands atna - set board IP for tftp atnf - set filename for tftp atns - set server IP for tftp atnz - do firmware update via tftp atsh - dump Manufacturer Related Data (MRD) atsr - reboot => atsh Vendor name : Zyxel Communications Corp. Product model : NWA50AX System type : 10 MAC address : b8eca3dcxxxx Default country code : ed Boot module debug flag: 0 Hardware version : Zyxel NWA50AX MT7621 Serial number : xxx SNMP MIB level & OID : xxx Main feature bit : 0 Other feature bits : e1 6b 00 00 00 00 00 00 00 00 88 00 00 00 00 00 03 00 00 00 00 00 00 00 00 00 00 00 00 00 MRD recovery flag : 0 => atds Image0 status :success Image1 status :success Boot Image :Image0 => athe ? - alias for 'help' at - print OK atds - show dual image info atgo - boot athe - show available commands atna - set board IP for tftp atnf - set filename for tftp atns - set server IP for tftp atnz - do firmware update via tftp atsh - dump Manufacturer Related Data (MRD) atsr - reboot => atna 192.168.1.3 => atnf 625ABYW10C0.bin => atns 192.168.3.1 => atnz Using eth@1e100000 device TFTP from server 192.168.3.1; our IP address is 192.168.1.3 Filename '625ABYW10C0.bin'. Load address: 0x83000000 Loading: ## Warning: gatewayip needed but not set ################################################################# ################################################################# ################################################################# ################################################################# ################################################################# ################################################################# ################################################################# ################################################################# ################################################################# ################################################################# ################################################################# ################################################################# ################################################################# ################################################################# ################################################################# ################################################################# ################################################################# ################################################################# ################################################################# ################################################################# ################################################################# ################################################################# ################################################################# ################################################################# ################################################################# ################################################################# ################################################################# ################################################################# ################################################################# ################################################################# ######## 8.5 MiB/s done Bytes transferred = 28734029 (1b6724d hex) ## Executing script at 83000000 sha256+ Flashing Bootloader: [ skipped! ] Flashing u-boot-env: [ skipped! ] Flashing firmware: [ done ] Flashing firmware_1: [ done ] Flashing rootfs_data: [ skipped! ] Flashing logs: [ skipped! ] Flashing myzyxel: [ skipped! ] Flashing bootconfig: [ skipped! ] Flashing mrd: [ skipped! ] => atgo Loading FIT image at offset 0x180000 to memory 0x83000000, size 0x388d90 ... Automatic boot of image at addr 0x83000000 ... ## Loading kernel from FIT Image at 83000000 ... Using 'config@1' configuration Trying 'kernel@1' kernel subimage Description: MIPS OpenWrt Linux-4.4.198 Type: Kernel Image Compression: lzma compressed Data Start: 0x830000e4 Data Size: 3692204 Bytes = 3.5 MiB Architecture: MIPS OS: Linux Load Address: 0x81001000 Entry Point: 0x81001000 Hash algo: crc32 Hash value: 17e52f98 Hash algo: sha1 Hash value: e5234a83798af59a0f3da667443a705ec30f7bba Verifying Hash Integrity ... crc32+ sha1+ OK ## Loading fdt from FIT Image at 83000000 ... Using 'config@1' configuration Trying 'fdt@1' fdt subimage Description: MIPS OpenWrt mt7621-rfb-ax-nmbm device tree blob Type: Flat Device Tree Compression: uncompressed Data Start: 0x833858d4 Data Size: 12690 Bytes = 12.4 KiB Architecture: MIPS Hash algo: crc32 Hash value: 22dfdc4b Hash algo: sha1 Hash value: 1d76e5da661e6d2a8eafb4175232705f43e4132c Verifying Hash Integrity ... crc32+ sha1+ OK Booting using the fdt blob at 0x833858d4 Uncompressing Kernel Image ... OK Loading Device Tree to 8fe67000, end 8fe6d191 ... OK [ 0.000000] Linux version 4.4.198 (jenkins@TWPCNT01055-95) (gcc version 5.4.0 (LEDE GCC 5.4.0 r48+2-a5857a0e) ) #0 SMP Thu Jun 16 17:53:32 UTC 2022 [ 0.000000] SoC Type: MediaTek MT7621 ver:1 eco:3 [ 0.000000] bootconsole [early0] enabled [ 0.000000] CPU0 revision is: 0001992f (MIPS 1004Kc) [ 0.000000] MIPS: machine is MediaTek MT7621 RFB (802.11ax, NAND with NMBM) [ 0.000000] Determined physical RAM map: [ 0.000000] memory: 10000000 @ 00000000 (usable) [ 0.000000] CPU Clock: 1000MHz Got LINK_CHANGE Port [0] Copper is up --> Group [0] is up Start EnterpriseWLAN system daemon.... ........................ Got LINK_CHANGE Port [0] Copper is down --> Group [0] is down .......................................Applying system configuration file, please wait... ................................................. Got LINK_CHANGE Port [0] Copper is up --> Group [0] is up ifanme=br0 ifanme=br0 ................................EnterpriseWLAN system is configured successfully with startup-config.conf netopeer-server start Welcome to NWA50AX Username: admin Password: Router> reboot % EnterpriseWLAN is going to reboot!


U-Boot SPL 2018.09 (Jan 22 2021 - 07:42:43 +0000) Trying to boot from NAND Initializing NMBM ... Signature found at block 1023 [0x07fe0000] First info table with writecount 0 found in block 960 Second info table with writecount 0 found in block 963 NMBM has been successfully attached U-Boot 2018.09 (Jan 22 2021 - 07:42:43 +0000) CPU: MediaTek MT7621AT ver 1, eco 3 Clocks: CPU: 880MHz, DDR: 600MHz (1200MT/s), Bus: 220MHz, XTAL: 40MHz Model: MediaTek MT7621 reference board (NAND) DRAM: 256 MiB NAND: 128 MiB Initializing NMBM ... Signature found at block 1023 [0x07fe0000] First info table with writecount 0 found in block 960 Second info table with writecount 0 found in block 963 NMBM has been successfully attached Loading Environment from NMBM... *** Warning - bad CRC, using default environment In: uartlite0@1e000c00 Out: uartlite0@1e000c00 Err: uartlite0@1e000c00 Net: Warning: eth@1e100000 (eth0) using random MAC address - fa:26:d7:78:e2:6c eth0: eth@1e100000 Reading from 0x7700000, size 0x20000 Succeeded Zyxel version:V1.03 gpio: pin 6 (gpio 6) value is 1 gpio: pin 24 (gpio 24) value is 0 gpio: pin 24 (gpio 24) value is 1 Hit any key to stop autoboot: 0 Loading FIT image at offset 0x180000 to memory 0x83000000, size 0x29c6b0 ... Automatic boot of image at addr 0x83000000 ... ## Loading kernel from FIT Image at 83000000 ... Using 'config-1' configuration Trying 'kernel-1' kernel subimage Description: MIPS OpenWrt Linux-5.10.127 Type: Kernel Image Compression: lzma compressed Data Start: 0x830000e4 Data Size: 2724936 Bytes = 2.6 MiB Architecture: MIPS OS: Linux Load Address: 0x80001000 Entry Point: 0x80001000 Hash algo: crc32 Hash value: 6b34883c Hash algo: sha1 Hash value: 089af61d77c1d4e7410d0d222607f7c4506c4ccb Verifying Hash Integrity ... crc32+ sha1+ OK ## Loading fdt from FIT Image at 83000000 ... Using 'config-1' configuration Trying 'fdt-1' fdt subimage Description: MIPS OpenWrt zyxel_nwa50ax device tree blob Type: Flat Device Tree Compression: uncompressed Data Start: 0x83299668 Data Size: 11010 Bytes = 10.8 KiB Architecture: MIPS Hash algo: crc32 Hash value: 938ea667 Hash algo: sha1 Hash value: af5b82e0f956d373beb4de43d65e21a686ebe474 Verifying Hash Integrity ... crc32+ sha1+ OK Booting using the fdt blob at 0x83299668 Uncompressing Kernel Image ... OK Loading Device Tree to 8fe67000, end 8fe6cb01 ... OK [ 0.000000] Linux version 5.10.127 (taylorfox@ubuntu-2204) (mipsel-openwrt-linux-musl-gcc (OpenWrt GCC 11.3.0 r20115-e37ba80633) 11.3.0, GNU ld (GNU Binutils) 2.37) #0 SMP Fri Jul 15 23:27:22 2022 [ 0.000000] SoC Type: MediaTek MT7621 ver:1 eco:3 [ 0.000000] printk: bootconsole [early0] enabled [ 0.000000] CPU0 revision is: 0001992f (MIPS 1004Kc) [ 0.000000] MIPS: machine is ZyXEL NWA50AX Press the [f] key and hit [enter] to enter failsafe mode Press the [1], [2], [3] or [4] key and hit [enter] to select the debug level Please press Enter to activate this console.


as of March 2024 there is no way to have mixed untagged and tagged vlan's on this device.

Example of a vlan configuration.

config device
  option name 'br-lan'
  option type 'bridge'
  list ports 'lan.22'

config device
  option name 'br-guest'
  option type 'bridge'
  list ports 'lan.40'

config device
  option name 'br-cctv'
  option type 'bridge'
  list ports 'lan.34'
This website uses cookies. By using the website, you agree with storing cookies on your computer. Also you acknowledge that you have read and understand our Privacy Policy. If you do not agree leave the website.More information about cookies
  • Last modified: 2024/03/25 20:53
  • by nokius