Ubiquiti UniFi 6 Plus

The Ubiquiti U6 Plus is a MediaTek Filogic 820 based PoE-powered 802.11ax WiFi 6 access point with 8 spacial streams. The design is a 6.3“ (160mm) disk designed for wall mounting or can be laid flat on a shelf. There are several devices released under their UniFi U6 line:

Ubiquiti U6

Support for U6+ was added in this commit ?p=openwrt/openwrt.git;a=commit;h=75ee5546e9b7cfa5bbfd6f844ab8c5fffd5bb594 and is available starting from the 23.05.3 release.

SoCMediaTek MT7981A dual-core ARM Cortex-A53 1.3 GHz
RAM256 MB DDR3-2133 RAM
Flash16 MB SPI NOR and 4 GB eMMC
LAN1x Gigabit Ethernet with 802.3af/at support
WLANMediaTek MT7976C 2×2 MIMO dual-band WiFi 6
LEDs1x blue and 1x white
Buttons1x reset button

Although U6+ has far more flash than even some high-end wireless routers, most of that space is not available without modifying the partition table. To minimize the possibility of bricking the device during the initial installation, OpenWrt keeps the partitions as-is. This means only about 120 MiB is available to OpenWrt, but this is more than enough for access point scenarios.

This procedure has been tested on stock UniFi firmware up to version 6.6.55, but likely also works on later versions. If it doesn't, you may try using the TFTP recovery procedure to downgrade to an earlier version.

Avoid connecting the AP to a functioning network. The AP will obtain a DHCP lease in this scenario instead of using, which complicates SSH access. Also, OpenWrt defaults to a static IP address of even on APs, so connecting the AP right after flashing to the rest of your network can cause problems! Connecting the AP directly to your PC as described below is the most reliable way to flash and configure the AP before deployment.

The eMMC contains the partitions “factory” and “EEPROM” which hold radio firmware and calibration data, as well as the MAC addresses. This data is device-specific and overwriting them with dd will brick your device's radio! Be sure that you are writing only to the partitions named “kernel0”, “kernel1”, and “bs”. The instructions below will help you double-check the correct partition numbers.

  1. Connect your PC to the device using PoE injector or a switch, separate from any network. Use static IP address on the PC.
  2. SSH into the device with password: ubnt
    $ ssh ubnt@
  3. Unlock kernel partitions for writing.
    $ echo 5edfacbf > /proc/ubnthal/.uf
  4. Confirm correct partition numbers. If the PARTNAMEs below do not match, stop and ask on the OpenWrt forum for assistance.
    $ grep PARTNAME /sys/block/mmcblk0/mmcblk0p6/uevent
    $ grep PARTNAME /sys/block/mmcblk0/mmcblk0p7/uevent
    $ grep PARTNAME /sys/block/mmcblk0/mmcblk0p8/uevent
  5. Set and confirm bootloader environment.
    $ fw_setenv boot_openwrt "fdt addr \$(fdtcontroladdr); fdt rm /signature; bootubnt"
    $ fw_setenv bootcmd_real "run boot_openwrt"
    $ fw_printenv
  6. Download the sysupgrade (not kernel) image to your PC and use scp to copy it to /tmp/openwrt.bin on the device.
  7. Copy kernel and rootfs to mmcblk0p6 and mmcblk0p7, respectively.
    $ tar xf /tmp/openwrt.bin sysupgrade-ubnt_unifi-6-plus/kernel -O | dd of=/dev/mmcblk0p6
    $ tar xf /tmp/openwrt.bin sysupgrade-ubnt_unifi-6-plus/root -O | dd of=/dev/mmcblk0p7
  8. Ensure device boots from mmcblk0p6.
    $ echo -ne "\x00\x00\x00\x00\x2b\xe8\x4d\xa3" > /dev/mmcblk0p8
  9. Reboot the device.
    $ reboot

You should now have OpenWrt running at static IP address Proceed to configuring the device as a "dumb" access point here. Ignore the steps that reference a WAN port or a LAN switch, since U6+ does not have either of those things.

All UniFi APs support TFTP recovery, which is described in Ubiquiti's documentation. You can recover to any firmware version, not just the latest stock version. All prior versions are available for download.

Interestingly, TFTP recovery does not touch the kernel1 partition at all, which is where OpenWrt stores the root file system. If you are simply trying to start over with OpenWrt, consider using OpenWrt's failsafe mode or factory reset instead.

This website uses cookies. By using the website, you agree with storing cookies on your computer. Also you acknowledge that you have read and understand our Privacy Policy. If you do not agree leave the website.More information about cookies
  • Last modified: 2024/04/06 18:07
  • by elbertmai