ZyXEL NWA50AX

Under Construction!
This page is currently under construction. You can edit the article to help completing it.

The ZyXEL NWA50AX is ZyXEL's entry level SOHO 802.11ax/WiFi 6 access point, like many business class APs, it is designed for wall/ceiling mount, and includes a 12v1.5A power supply, and also PoE support, along side an easily accessible console port, reset button and multi-color LED.

Generic Router

Work in progress.

Describe if there are any ongoing activities that might lead to OpenWrt support.

CPU Ram Flash Network WLAN USB Serial JTag
4x Mediatek MT7621 @ 880 MHz 256M DDR3 128MB NAND 1x 1GbE 2.4/5GHz 802.11ax 2×2 (MT7915) No Yes ?

This device has a A/B partition layout, and OpenWrt will panic on boot if it has been installed to slot B.

From factory WebUI

Upload the OpenWrt factory image to the factory's firmware

If OpenWrt is installed to slot B, it will fail installation, and reboot to the stock ZyXEL firmware, in this case, simply install a stock firmware from ZyXEL's site, and then attempt to reinstall OpenWrt.

From Serial

The ZyXEL modified U-Boot has a restricted set of commands available, however more can be accessed by abusing the 'atns' command.

  1. Host the OpenWrt initramfs image on a TFTP server as 'openwrt-initramfs.bin'
  2. Attach an Ethernet cable to your machine with the TFTP server, with the IP 192.168.1.66 & Netmask 255.255.255.0
  3. Attach the UART console to the device, and press keys while the device is booting to interrupt the boot process.
  4. Boot the OpenWRT initramfs image using the commands:
    atnf openwrt-initramfs.bin
    atna 192.168.1.1
    atns "192.168.1.66; tftpboot; bootm"
  5. Once OpenWrt has booted, set the correct image slot using the commands
    zyxel-bootconfig /dev/mtd10 get-status
    zyxel-bootconfig /dev/mtd10 set-image-status 0 valid
    zyxel-bootconfig /dev/mtd10 set-active-image 0
  6. Copy the ramboot-factory image to the device, using for example SCP or wget.
  7. Install the image to the NAND
    mtd write ramboot-factory.bin firmware
    reboot
  8. Congratulations! Your device is now running OpenWrt.

hardware.button on howto use and configure the hardware button(s). Here, we merely name the buttons, so we can use them in the above Howto.

The ZyXEL NWA50AX has the following button:

BUTTON Event
Reset reset
Architecture MIPS
Vendor Ralink
Bootloader Zyxel U-Boot
System-On-Chip Mediatek MT7621 - MIPS 1004Kc V2.15
CPU/Speed 880MHz Quad-core
Flash-Chip Macronix MX30LF1G28AD-TI NAND
Flash size 128 M
RAM 128MB Nanya NT5CC128M16JR-EK DDR3 933
Wireless Mediatek MT7975DAN/MT7975DN
Ethernet 1x 1GbE
Serial Yes

Insert photo of front of the casing

Insert photo of back of the casing

Insert photo of backside label

Insert photo of PCB

On the bottom side of the device, there are 4 PH1 screws, remove them, flip the device over and pry the top cover off from the ridge around the edge.

port.serial general information about the serial port, serial port cable, etc.

How to connect to the Serial Port of this specific device:
Turn the device over, so you are looking at the ports, with the ports at the bottom, The order of the pins is.

<12v> <LAN> GND, RX, TX, VCC (do not connect VCC!). There will also be an arrow pointing at the VCC pin.

Serial connection parameters
for ZyXEL NWA50AX
115200, 8N1, 3.3V

U-Boot SPL 2018.09 (Jan 22 2021 - 07:42:43 +0000) Trying to boot from NAND Initializing NMBM ... Signature found at block 1023 [0x07fe0000] First info table with writecount 0 found in block 960 Second info table with writecount 0 found in block 963 NMBM has been successfully attached U-Boot 2018.09 (Jan 22 2021 - 07:42:43 +0000) CPU: MediaTek MT7621AT ver 1, eco 3 Clocks: CPU: 880MHz, DDR: 600MHz (1200MT/s), Bus: 220MHz, XTAL: 40MHz Model: MediaTek MT7621 reference board (NAND) DRAM: 256 MiB NAND: 128 MiB Initializing NMBM ... Signature found at block 1023 [0x07fe0000] First info table with writecount 0 found in block 960 Second info table with writecount 0 found in block 963 NMBM has been successfully attached Loading Environment from NMBM... *** Warning - bad CRC, using default environment In: uartlite0@1e000c00 Out: uartlite0@1e000c00 Err: uartlite0@1e000c00 Net: Warning: eth@1e100000 (eth0) using random MAC address - fa:26:d7:78:e2:6c eth0: eth@1e100000 Reading from 0x7700000, size 0x20000 Succeeded Zyxel version:V1.03 gpio: pin 6 (gpio 6) value is 1 gpio: pin 24 (gpio 24) value is 0 gpio: pin 24 (gpio 24) value is 1 Hit any key to stop autoboot: 0 => help Unknown command 'help' - try 'help' => help Unknown command 'help' - try 'help' => ? ? - alias for 'help' at - print OK atds - show dual image info atgo - boot athe - show available commands atna - set board IP for tftp atnf - set filename for tftp atns - set server IP for tftp atnz - do firmware update via tftp atsh - dump Manufacturer Related Data (MRD) atsr - reboot => atsh Vendor name : Zyxel Communications Corp. Product model : NWA50AX System type : 10 MAC address : b8eca3dcxxxx Default country code : ed Boot module debug flag: 0 Hardware version : Zyxel NWA50AX MT7621 Serial number : xxx SNMP MIB level & OID : xxx Main feature bit : 0 Other feature bits : e1 6b 00 00 00 00 00 00 00 00 88 00 00 00 00 00 03 00 00 00 00 00 00 00 00 00 00 00 00 00 MRD recovery flag : 0 => atds Image0 status :success Image1 status :success Boot Image :Image0 => athe ? - alias for 'help' at - print OK atds - show dual image info atgo - boot athe - show available commands atna - set board IP for tftp atnf - set filename for tftp atns - set server IP for tftp atnz - do firmware update via tftp atsh - dump Manufacturer Related Data (MRD) atsr - reboot => atna 192.168.1.3 => atnf 625ABYW10C0.bin => atns 192.168.3.1 => atnz Using eth@1e100000 device TFTP from server 192.168.3.1; our IP address is 192.168.1.3 Filename '625ABYW10C0.bin'. Load address: 0x83000000 Loading: ## Warning: gatewayip needed but not set ################################################################# ################################################################# ################################################################# ################################################################# ################################################################# ################################################################# ################################################################# ################################################################# ################################################################# ################################################################# ################################################################# ################################################################# ################################################################# ################################################################# ################################################################# ################################################################# ################################################################# ################################################################# ################################################################# ################################################################# ################################################################# ################################################################# ################################################################# ################################################################# ################################################################# ################################################################# ################################################################# ################################################################# ################################################################# ################################################################# ######## 8.5 MiB/s done Bytes transferred = 28734029 (1b6724d hex) ## Executing script at 83000000 sha256+ Flashing Bootloader: [ skipped! ] Flashing u-boot-env: [ skipped! ] Flashing firmware: [ done ] Flashing firmware_1: [ done ] Flashing rootfs_data: [ skipped! ] Flashing logs: [ skipped! ] Flashing myzyxel: [ skipped! ] Flashing bootconfig: [ skipped! ] Flashing mrd: [ skipped! ] => atgo Loading FIT image at offset 0x180000 to memory 0x83000000, size 0x388d90 ... Automatic boot of image at addr 0x83000000 ... ## Loading kernel from FIT Image at 83000000 ... Using 'config@1' configuration Trying 'kernel@1' kernel subimage Description: MIPS OpenWrt Linux-4.4.198 Type: Kernel Image Compression: lzma compressed Data Start: 0x830000e4 Data Size: 3692204 Bytes = 3.5 MiB Architecture: MIPS OS: Linux Load Address: 0x81001000 Entry Point: 0x81001000 Hash algo: crc32 Hash value: 17e52f98 Hash algo: sha1 Hash value: e5234a83798af59a0f3da667443a705ec30f7bba Verifying Hash Integrity ... crc32+ sha1+ OK ## Loading fdt from FIT Image at 83000000 ... Using 'config@1' configuration Trying 'fdt@1' fdt subimage Description: MIPS OpenWrt mt7621-rfb-ax-nmbm device tree blob Type: Flat Device Tree Compression: uncompressed Data Start: 0x833858d4 Data Size: 12690 Bytes = 12.4 KiB Architecture: MIPS Hash algo: crc32 Hash value: 22dfdc4b Hash algo: sha1 Hash value: 1d76e5da661e6d2a8eafb4175232705f43e4132c Verifying Hash Integrity ... crc32+ sha1+ OK Booting using the fdt blob at 0x833858d4 Uncompressing Kernel Image ... OK Loading Device Tree to 8fe67000, end 8fe6d191 ... OK [ 0.000000] Linux version 4.4.198 (jenkins@TWPCNT01055-95) (gcc version 5.4.0 (LEDE GCC 5.4.0 r48+2-a5857a0e) ) #0 SMP Thu Jun 16 17:53:32 UTC 2022 [ 0.000000] SoC Type: MediaTek MT7621 ver:1 eco:3 [ 0.000000] bootconsole [early0] enabled [ 0.000000] CPU0 revision is: 0001992f (MIPS 1004Kc) [ 0.000000] MIPS: machine is MediaTek MT7621 RFB (802.11ax, NAND with NMBM) [ 0.000000] Determined physical RAM map: [ 0.000000] memory: 10000000 @ 00000000 (usable) [ 0.000000] CPU Clock: 1000MHz Got LINK_CHANGE Port [0] Copper is up --> Group [0] is up Start EnterpriseWLAN system daemon.... ........................ Got LINK_CHANGE Port [0] Copper is down --> Group [0] is down .......................................Applying system configuration file, please wait... ................................................. Got LINK_CHANGE Port [0] Copper is up --> Group [0] is up ifanme=br0 ifanme=br0 ................................EnterpriseWLAN system is configured successfully with startup-config.conf netopeer-server start Welcome to NWA50AX Username: admin Password: Router> reboot % EnterpriseWLAN is going to reboot!


U-Boot SPL 2018.09 (Jan 22 2021 - 07:42:43 +0000) Trying to boot from NAND Initializing NMBM ... Signature found at block 1023 [0x07fe0000] First info table with writecount 0 found in block 960 Second info table with writecount 0 found in block 963 NMBM has been successfully attached U-Boot 2018.09 (Jan 22 2021 - 07:42:43 +0000) CPU: MediaTek MT7621AT ver 1, eco 3 Clocks: CPU: 880MHz, DDR: 600MHz (1200MT/s), Bus: 220MHz, XTAL: 40MHz Model: MediaTek MT7621 reference board (NAND) DRAM: 256 MiB NAND: 128 MiB Initializing NMBM ... Signature found at block 1023 [0x07fe0000] First info table with writecount 0 found in block 960 Second info table with writecount 0 found in block 963 NMBM has been successfully attached Loading Environment from NMBM... *** Warning - bad CRC, using default environment In: uartlite0@1e000c00 Out: uartlite0@1e000c00 Err: uartlite0@1e000c00 Net: Warning: eth@1e100000 (eth0) using random MAC address - fa:26:d7:78:e2:6c eth0: eth@1e100000 Reading from 0x7700000, size 0x20000 Succeeded Zyxel version:V1.03 gpio: pin 6 (gpio 6) value is 1 gpio: pin 24 (gpio 24) value is 0 gpio: pin 24 (gpio 24) value is 1 Hit any key to stop autoboot: 0 Loading FIT image at offset 0x180000 to memory 0x83000000, size 0x29c6b0 ... Automatic boot of image at addr 0x83000000 ... ## Loading kernel from FIT Image at 83000000 ... Using 'config-1' configuration Trying 'kernel-1' kernel subimage Description: MIPS OpenWrt Linux-5.10.127 Type: Kernel Image Compression: lzma compressed Data Start: 0x830000e4 Data Size: 2724936 Bytes = 2.6 MiB Architecture: MIPS OS: Linux Load Address: 0x80001000 Entry Point: 0x80001000 Hash algo: crc32 Hash value: 6b34883c Hash algo: sha1 Hash value: 089af61d77c1d4e7410d0d222607f7c4506c4ccb Verifying Hash Integrity ... crc32+ sha1+ OK ## Loading fdt from FIT Image at 83000000 ... Using 'config-1' configuration Trying 'fdt-1' fdt subimage Description: MIPS OpenWrt zyxel_nwa50ax device tree blob Type: Flat Device Tree Compression: uncompressed Data Start: 0x83299668 Data Size: 11010 Bytes = 10.8 KiB Architecture: MIPS Hash algo: crc32 Hash value: 938ea667 Hash algo: sha1 Hash value: af5b82e0f956d373beb4de43d65e21a686ebe474 Verifying Hash Integrity ... crc32+ sha1+ OK Booting using the fdt blob at 0x83299668 Uncompressing Kernel Image ... OK Loading Device Tree to 8fe67000, end 8fe6cb01 ... OK [ 0.000000] Linux version 5.10.127 (taylorfox@ubuntu-2204) (mipsel-openwrt-linux-musl-gcc (OpenWrt GCC 11.3.0 r20115-e37ba80633) 11.3.0, GNU ld (GNU Binutils) 2.37) #0 SMP Fri Jul 15 23:27:22 2022 [ 0.000000] SoC Type: MediaTek MT7621 ver:1 eco:3 [ 0.000000] printk: bootconsole [early0] enabled [ 0.000000] CPU0 revision is: 0001992f (MIPS 1004Kc) [ 0.000000] MIPS: machine is ZyXEL NWA50AX Press the [f] key and hit [enter] to enter failsafe mode Press the [1], [2], [3] or [4] key and hit [enter] to select the debug level Please press Enter to activate this console.


This website uses cookies. By using the website, you agree with storing cookies on your computer. Also you acknowledge that you have read and understand our Privacy Policy. If you do not agree leave the website.More information about cookies
  • Last modified: 2022/07/16 12:10
  • by foxt