Ubiquiti Nanostation M5 / Loco M5

Warning! There are two versions of NanoStation: xm and xw.

Downgrade procedure fails for devices with HW revision higher than 1847G. Work in progress in this openwrt forum thread

The old xm version has limited RAM (32 MB) and thus is not recommended.

Version/Model Launch Date OpenWrt Version Supported Chip Bugs in Hardware
xm - 14.07 ar724x
xw 2014 14.07 - for Nanostation M5 ar9342
14.07 - for Nanostation Loco M5 A hardware bug causing loss of eth0 connectivity was fixed in OpenWrt 17.01.

In 2014 Ubiquiti released a new model of Nanostation M5 devices (old boards use ar724x chip while new ones are using ar934x chip).

New Ubiquiti Nanostation M5 firmware page devices use xw firmware image, while older use xm image.

  • For newer Nanostation Loco M5 (XW) (models since 2014) there is a new image (openwrt-ar71xx-generic-ubnt-loco-m-xw-squashfs-factory.bin).
  • For old Nanostation Loco M5 (XM) the image name is openwrt-ar71xx-generic-ubnt-nano-m-squashfs-factory.bin.

If you have installed OpenWrt and issue cat /proc/cpuinfo or look trough boot messages XW based hardware should come back as Atheros AR93xx, XM = Atheros AR72xx

Observed for a NanoStationlocoM2 (model SWX-M2L, XM firmware). Recent OpenWrt compilations, on basis of kernel v5 , enumerate the ethernet interfaces differently. In /etc/config/network the iface name of the LAN port is eth1, not eth0 ! When using the standard network setting the LAN port will appear active from a serial console but it relates to the passthrough port that is not present as a connector. So make sure that eth1 is used in the configuration files to reference the LAN connector.

There is (as of 2023/05) a unresolved problem with builds for Ubnt units with ONE ethernet port. Flashing a OpenWRT ath79 version after 19.07.10 will brick the unit. The last working version is 19.07.10 AR71xx. As mentioned in Ubiquiti Airmax M install the latest working buld and check your CPU with:

cat /proc/cpuinfo

if its AR7240 or Ar7241 and then flash the corresponding Ubiquiti BULLET M image! This is a one eth port only unit and is tested to be working on locos XM and rocket M.

Install OpenWrt (generic explanation)

Image name: openwrt-ar71xx-generic-ubnt-nano-m-...

You can install the *-factory image over the webinterface or via tftp rescue. Webinterface default address is

You may need to downgrade the original AirOS firmware to v5.5 in order to allow a firmware upload via the web interface. Upload via TFTP should work even for new AirOS versions.

To enter tftp rescue mode power cycle the device while keep the reset button pushed (for ~10 sec). Leds will start to blink red and yellow.

# pick an address in the range for your network device
# tftp
tftp> bin
tftp> trace
# depending on your version **xm** or **xw**
tftp> put openwrt-ar71xx-generic-ubnt-nano-m-squashfs-factory.bin
tftp> put openwrt-ar71xx-generic-ubnt-nano-m-xw-squashfs-factory.bin

Installing OpenWrt via TFTP

It is possible to supply power to another device via the secondary ethernet port. POE passthrough is disabled by default.

Device Model GPIO pin
xm 8
xw 2

The POE passthrough GPIO pin is configurable via UCI:

uci show system.poe_passthrough

Permanent configuration changes can be specified via command line:

uci set system.poe_passthrough.value=1
uci commit system

Run the following commands to change the state of the POE passthrough switch:

# nanostation xm
echo 8 > /sys/class/gpio/export
echo out > /sys/class/gpio/gpio8/direction
echo 1 > /sys/class/gpio/gpio8/value
# disable with echo 0 > /sys/class/gpio/gpio8/value
# nanostation xw
echo 2 > /sys/class/gpio/export
echo out > /sys/class/gpio/gpio2/direction
echo 1 > /sys/class/gpio/gpio2/value
# disable with echo 0 > /sys/class/gpio/gpio2/value

This state does not survive a reboot. See the UCI based setting above for permanent configuration changes.

Boot messages from Nanostation M5 Loco:

U-Boot (Jul 19 2012 - 10:41:56)

Board: Ubiquiti Networks XM board (rev 1.0 e0a5)
DRAM:  32 MB
Flash:  8 MB
PCIe WLAN Module found (#1).
Net:   eth0, eth1
Hit any key to stop autoboot:  0 
## Booting image at 9f050000 ...
   Image Name:   MIPS OpenWrt Linux-3.3.8
   Created:      2014-01-15  15:39:31 UTC
   Image Type:   MIPS Linux Kernel Image (lzma compressed)
   Data Size:    929404 Bytes = 907.6 kB
   Load Address: 80060000
   Entry Point:  80060000
   Verifying Checksum ... OK
   Uncompressing Kernel Image ... OK

Starting kernel ...


A pin header can be soldered to the board to use the serial port. The board is mounted to a sled which can be pulled out after the protective cover for the RJ-45 port is removed.

This website uses cookies. By using the website, you agree with storing cookies on your computer. Also you acknowledge that you have read and understand our Privacy Policy. If you do not agree leave the website.More information about cookies
  • Last modified: 2024/02/12 08:58
  • by