Ubiquiti UniFi 6 Plus

The Ubiquiti U6 Plus is a MediaTek Filogic 820 based PoE-powered 802.11ax WiFi 6 access point with 8 spacial streams. The design is a 6.3“ (160mm) disk designed for wall mounting or can be laid flat on a shelf. There are several devices released under their UniFi U6 line:

• U6-Lite
• U6+
• U6-LR

Support for U6+ was added in this commit ?p=openwrt/openwrt.git;a=commit;h=75ee5546e9b7cfa5bbfd6f844ab8c5fffd5bb594 and is available starting from the 23.05.3 release.

Although U6+ has far more flash than even some high-end wireless routers, most of that space is not available without modifying the partition table. To minimize the possibility of bricking the device during the initial installation, OpenWrt keeps the partitions as-is. This means only about 120 MiB is available to OpenWrt, but this is more than enough for access point scenarios.

This procedure has been tested on stock UniFi firmware up to version 6.6.55, but likely also works on later versions. If it doesn't, you may try using the TFTP recovery procedure to downgrade to an earlier version.

1. Connect your PC to the device using PoE injector or a switch, separate from any network. Use static IP address 192.168.1.2 on the PC.
2. SSH into the device with password: ubnt

   $ ssh ubnt@192.168.1.20

3. Unlock kernel partitions for writing.

   $ echo 5edfacbf > /proc/ubnthal/.uf

4. Confirm correct partition numbers. If the PARTNAMEs below do not match, stop and ask on the OpenWrt forum for assistance.

   $ grep PARTNAME /sys/block/mmcblk0/mmcblk0p6/uevent
   PARTNAME=kernel0
   $ grep PARTNAME /sys/block/mmcblk0/mmcblk0p7/uevent
   PARTNAME=kernel1
   $ grep PARTNAME /sys/block/mmcblk0/mmcblk0p8/uevent
   PARTNAME=bs

5. Set and confirm bootloader environment.

   $ fw_setenv boot_openwrt "fdt addr \$(fdtcontroladdr); fdt rm /signature; bootubnt"
   $ fw_setenv bootcmd_real "run boot_openwrt"
   $ fw_printenv

6. Download the sysupgrade (not kernel) image to your PC and use scp to copy it to /tmp/openwrt.bin on the device.
7. Copy kernel and rootfs to mmcblk0p6 and mmcblk0p7, respectively.

   $ tar xf /tmp/openwrt.bin sysupgrade-ubnt_unifi-6-plus/kernel -O | dd of=/dev/mmcblk0p6
   $ tar xf /tmp/openwrt.bin sysupgrade-ubnt_unifi-6-plus/root -O | dd of=/dev/mmcblk0p7

8. Ensure device boots from mmcblk0p6.

   $ echo -ne "\x00\x00\x00\x00\x2b\xe8\x4d\xa3" > /dev/mmcblk0p8

9. Reboot the device.

   $ reboot

You should now have OpenWrt running at static IP address 192.168.1.1. Proceed to configuring the device as a "dumb" access point here. Ignore the steps that reference a WAN port or a LAN switch, since U6+ does not have either of those things.

All UniFi APs support TFTP recovery, which is described in Ubiquiti's documentation. You can recover to any firmware version, not just the latest stock version. All prior versions are available for download.

Interestingly, TFTP recovery does not touch the kernel1 partition at all, which is where OpenWrt stores the root file system. If you are simply trying to start over with OpenWrt, consider using OpenWrt's failsafe mode or factory reset instead.