A5-V11 3G/4G Router

This unbranded Ralink/MediaTek RT5350F-based router is sold on Aliexpress from Chinese sellers for around 6 USD (shipped) as of July 2016, often under the model number M1 SkyShare. It has a tiny black or white housing about the size of a lighter, with silkscreened print “3G/4G Router 150M”.

With its small size (62 mm x 24 mm x 14.5 mm) and its low price tag, it is certainly one of the smallest and cheapest router onto which you can install OpenWrt.

However, this router has some drawbacks: memory (both DRAM and Flash) is limited, and actual hardware and firmware can vary a lot, even when purchased from the same vendor.

Basically, a first device has been designed to fit into the given housing, based on the original Ralink RT5350F reference design, with the goal to make a 3G/4G 150M Wi-Fi router (don't be mistaken, 3G/4G is when you attach an external 3G/4G USB dongle to it!). The resulting PCB has been copied and is populated during “grey shifts” using whatever components are at hand, and sold unbranded on Aliexpress to make a small profit.

As of OpenWrt trunk r43793 it is supported by the Image Generator. Depending on the stock firmware, an OpenWrt image may successfully be flashed from the stock firmware GUI or from the limited stock command Shell without having to open the device or mess with uboot manually.

→ Install OpenWrt (generic explanation)

• A specific firmware mini_luci_web_wifi.bin from FPGA-Computer has a Wi-Fi router with luci web interface , opkg and USB mass storage support that fit into the 4MB Flash
• As of August 2015, one can also try an alternative prebuilt image from Modems and Mens (look for A5-V11). It is specialized for use with USB 3G modems.

Be aware that these unbranded routers come with very different stock firmwares:

• Some have an U-Boot bootloader that accept standard OpenWrt images
• Some have a crippled U-Boot bootloader that only accept vendor-supplied modified images
• Some have a very limited Busybox shell available by telnet (login/password admin/admin)
• Some have a more complete Busybox shell but without any simple mean to fetch files from outside (wget, curl, ftp or tftp)
• Some have at least one way to fetch files from the command Shell
• Some have a Chinese / English or English-only WebUI, that may be unbranded or featuring the Qualcomm logo, even if this is a Mediatek / Ralink-based device!

Based on this sad situation, the best way to install OpenWrt on this router may vary. Even if you have similar devices with same packaging from same vendor, you may have to try successively several methods to find out which one actually works.

First, make sure you really have this device and not some other one. The best way is to open it up (just pry it open with your fingernails or with a pry tool) and check for the A5-V11 marking on the bottom left corner of the PCB, close to the Ethernet connector. If you don't want to mess with the plastics you can also check for the actual version via telnet by following the procedure below.

With the factory firmware, just connect the router with an Ethernet cable to a network. The device will switch on the blue and red LEDs. Find out the device's IP address from your DHCP server, and log into the router via telnet:

BoC Login: admin
Password: admin
 
BusyBox v1.12.1 (2013-06-20 00:48:37 HKT) built-in shell (msh)
Enter 'help' for a list of built-in commands.
 
BoC Router> 

The factory firmware is very limited; most commands are disabled (but see below for how to change this).

BoC Router> help
 
 ?                   ->Display help information.
 help                ->Display help information, same as '?' command.
 clear               ->Clear various talbes, type clear for help.
 ping                ->ping HOST, type ping for help.
 traceroute          ->route trace, type traceroute for help.
 ipmac               ->ip mac bind settings.
 quit                ->Close terminal session.
 show                ->Display various talbes information, type show for help.
 restart_httpd       ->Restart web server.
 restore_defaults    ->Restore the config to the default factory value.
 ated                ->run ated for MP test.
 
BoC Router> show system revision
 
  software version: 2.1.3.8
     product model: Mifi-Storage-3G
     serial number: ZJL2014XXXXX
  hardware version: 1.0
  f/w release date: Aug. 23, 2013 15:27:22

If you want to access a full shell, here's how (thanks Whiterat):

BoC Router> cat /proc/cmdline
Unknow command
BoC Router> runshellcmd
shell mode on
BoC Router> cat /proc/cmdline
console=ttyS1,57600n8 root=/dev/ram0

Using your browser, open the device's home page. I flashed OpenWrt Chaos Calmer 15.05 using the stock web interface of the device. Just connect the router with an Ethernet cable to a network, it will switch on the blue and red LEDs. Find the device's IP address from your DHCP server, and log into the device using your web browser.

Login: admin

Password: admin

Switch the language to English from the drop down menu. It redirects to a wrong IP address, so type the correct one again in the URL field of the browser. Using the Administrator → Firmware menu, flash openwrt-15.05-ramips-rt305x-a5-v11-squashfs-factory.bin.

Wait for a success message to appear.

Thereafter, the router is waiting for you to log in with telnet and no password via Ethernet on IP address 192.168.1.1. To access this, set your computer's IP address to 192.168.1.2 subnet 255.255.255.0. You can always enter OpenWrt failsafe mode, plug in power, wait until the red light disappears, then press the button a couple of times.

Instructions taken from here and here

Fastest and simples method when firmware update using web browser is unsuccessful.

You need:

• laptop/PC with Ethernet Port
• telnet client
• Ethernet Cable
• VFAT formatted USB flash drive (might not be empty)

1. Download
   1. u-boot 256 in file name means 32M RAM, 128 means 16M RAM. Act accordingly.
   2. newest OpenWrt release
2. Copy them to USB drive, rename OpenWrt image to firmware.bin
3. Connect your Linux laptop/PC to the mini router via Ethernet and power up the mini router
4. Connect the USB Flash drive to the mini router
5. Telnet to the mini router with the following command:
   • telnet 192.168.100.1
   • The username and password are admin
6. Mount the USB flash drive with the following command:
   • mount /dev/sda1 /mnt
7. Wait a few seconds and verify that you see files
   • ls /mnt
   • You should see your files. Do not go further if you do not see files !
8. Upgrade uboot - be careful, do not reset router during and after this operation !
   • mtd_write write /mnt/uboot_usb_256_03.img Bootloader
   • You should see on console
     • #Unlocking Bootloader ...
     • #Writing from /mnt/uboot256.img to Bootloader ... [w]
9. Upgrade firmware - do not reset router during this operation!
   • mtd_write write /mnt/firmware.bin Kernel
   • You should see on console
     • #Unlocking Kernel ...
     • #Writing from /mnt/firmware.bin to Kernel ... [w]
10. Reboot router with the following command.
    • reboot

Alternative images and u-boots:

uboot256.img from JiapengLi

* Note. 1.This uboot256.img does not support emergency firmware restore via tftp. 2. “Reset” pressed on boot don't work (GPIO incorrect).

mini_luci_web_wifi.bin from FPGA-Computer

* Note. mini_luci_web_wifi.bin does not have IP address in preinit failsafe mode (pressed reset when blink led on firmware boot)

* Note. You might want to update this image after flashing. In this case, run something like this on your router

• sysupgrade -v -n /mnt/openwrt-15.05.1-ramips-rt305x-a5-v11-squashfs-sysupgrade.bin

Once you have OpenWrt on your device, then you can use the OpenWrt sysupgrade mechanism to load sysupgrade images.

Since this device only has 4MB of Flash, you may want to attach a USB flash drive and configure extroot_configuration. Very small flash drives like the SanDisk Ultra Fit are well suited for this purpose. Once extroot is configured, you will have plenty of room to install MiniDLNA, NFS or any other package you like. You can even install gcc and build software natively.

Unfortunately, the Chaos Calmer sysupgrade image includes LuCI which does not leave enough room to install the kmod-fs-ext4, kmod-usb-storage and block-mount packages which are required for extroot. Therefore, you will need to build a custom image using the OpenWrt Image Generator. The OpenWrt Image Generator defaults will create a sysupgrade image which will leave enough room to install the kmod-fs-ext4, kmod-usb-storage and block-mount packages to configure extroot. Please see instructions below.

wget http://downloads.openwrt.org/chaos_calmer/15.05/ramips/rt305x/OpenWrt-ImageBuilder-15.05-ramips-rt305x.Linux-x86_64.tar.bz2
tar xfj OpenWrt-ImageBuilder-15.05-ramips-rt305x.Linux-x86_64.tar.bz2
cd OpenWrt-ImageBuilder-15.05-ramips-rt305x.Linux-x86_64
make image PROFILE="A5-V11"

The OpenWRT sysupgrade image has been successfully loaded over serial using U-Boot. You will need to setup a TFTP server for transfer of the image, dnsmasq has been successfully tested: create a folder and place the sysupgrade image in this folder (rename the image to a shorter name ie openwrt.bin), the following command will start a tftp server under dnsmasq:

root@localhost:~# dnsmasq --port=0 --enable-tftp eth0 --tftp-root=/your/folder

Boot the device with serial connected and at the U-Boot menu press 2. You will be asked for an ip to assign to the device, an ip for the server, and lastly the file name of the image.

NOTE: This procedure was performed with the modified bootloader (uboot256.img) already flashed; it's unclear if this will work with the stock bootloader.

1. Obtain a known working sysupgrade image and rename it to firmware.bin
2. Hold down the reset button while powering up the device, the blue LED should start flashing
3. Connect the ethernet cable and set your host IP to 192.168.1.2
4. tftp firmware.bin to 192.168.1.1 (ensure that binary mode is used!)
5. The device should automatically restart, running the provided firmware

$ tftp 192.168.1.1
tftp> mode binary
tftp> put firmware.bin
Sent 3670187 bytes in 10.9 seconds

PCB marking next to the Ethernet port may be “A5-V11” or “MIFI”. On the PCB it has a W9825G6EH-75 or EM63A165TS-6G RAM (32 MB) RAM chip and 4 MB SPI ROM. Ethernet MAC address starts with 2C:67:FB:. One can log in to stock firmware with “admin”/“admin” via telnet.

Note that there are very similar devices, e.g. HAME-branded and unbranded black ones, that share almost identical PCBs; however the components (including RAM size) can be different.

• snapshot images are not built by default (fixed)
• According to this forum entry, there are 5 Ethernet PHYs in this SoC, and even if they are not physical connected they consume power - really (Wi-Fi off, all ethernet on: 203mA vs. Wi-Fi off, one ethernet on: 128mA). These commands turn off port 1-4:

  • swconfig dev switch0 port 1 set disable 1
    swconfig dev switch0 port 2 set disable 1
    swconfig dev switch0 port 3 set disable 1
    swconfig dev switch0 port 4 set disable 1
    swconfig dev switch0 set apply 

    • After a power cycle they will be active again, to make these settings default on startup add the commands to /etc/rc.local

• Only the red LED is enabled by default. In order to enable the blue LED and associate it with the wireless interface, add the following to /etc/config/system:

  • config led
            option default '0'
            option name 'WIFI'
            option sysfs 'a5-v11:blue:system'
            option trigger 'netdev'
            option dev 'wlan0'
            option mode 'link tx rx'

• Some models have disconnected antenna, which causes very poor wireless range (especially in STA MODE), fix method: https://forum.openwrt.org/viewtopic.php?id=57377

• Some models get very hot during long time run (24/7) maybe a heatsink is good choice

To switch the device to Ethernet DHCP client mode, do:

mount_root
 
passwd
 
/etc/init.d/dnsmasq stop
/etc/init.d/firewall stop
/etc/init.d/dnsmasq disable
/etc/init.d/firewall disable
 
cat > /etc/config/network <<\EOF
config interface 'loopback'
        option ifname 'lo'
        option proto 'static'
        option ipaddr '127.0.0.1'
        option netmask '255.0.0.0'

config interface 'lan0'
        option ifname 'eth0'

config interface 'lan1'
        option ifname 'eth0.1'
        option proto 'dhcp' 
EOF
 
sync
 
/etc/init.d/network reload

This device uses eth0.1 for the lan1 interface, rather than eth0 or eth1, so be aware of that in order for the wired Ethernet to work. You need to change /etc/configuration/network accordingly or the device will not be accessible after flashing without using a serial adapter to unbrick (or possibly OpenWrt Failsafe). edit: doesn't seem to be the case with DD trunk anymore, had to set proto 'dhcp' on lan0 for my A5-V11... initially set it on lan1 like the configuration above, and lost access.

Now connect the device to Ethernet and it will fetch an IP address with DHCP, and it should be possible to log in using ssh and the password just set.

If the serial boot console shows

procd: Instance odhcpd::instance1 s in a crash loop 6 crashes, 0 seconds since last crash

then you probably have extraneous network interfaces in /etc/configuration/network.

At least 6 GPIOs can be switched in software: numbers 8 and 22-26, as was tested with this method.

• gpio1 - I2C_SD - LOOKS N/C
• gpio2 - I2C_SCLK - LOOKS N/C

• gpio17 - red power LED
• gpio20 - blue system LED

• gpio7 - USB power
• gpio12 - USB Root hub power

• gpio8 - TXD - see picture above; CPU-side of resistor
• gpio9 - CTS_N - LOOKS N/C
• gpio10 - RXD - LOOKS N/C
• gpio11 - DTR_N - LOOKS N/C
• gpio13 - DSR_N - LOOKS N/C
• gpio14 - RIN - LOOKS N/C

(15 and 16 are TX and RX; these are not exported as GPIOs) (these are connected to the TX and RX pads)

• gpio18 - JTAG_TDI - LOOKS N/C
• gpio19 - JTAG_TMS - LOOKS N/C
• gpio21 - JTAG_TRST_N - goes to via
• gpio22 - EPHY_LED0_N - see picture above; CPU-side of resistor
• gpio23 - EPHY_LED1_N - see picture above; CPU-side of resistor
• gpio24 - EPHY_LED2_N - see picture above; CPU-side of absent resistor
• gpio25 - EPHY_LED3_N - see picture above; CPU-side of absent resistor
• gpio26 - EPHY_LED4_N - see picture above; CPU-side of resistor

GPIOs can handle 4 mA max

There are 4 solder pads inside the device.

If you put the PCB on the table with the USB jack to the left and the Ethernet jack to the right (Ralink CPU is on the other side of the board), you see the 4 pads in the bottom-right corner of the PCB. They are (from left to right):

1. VCC (3.3V; do not connect)
2. TX (connect to RXI on a 3.3V serial USB adapter)
3. RX (connect to TXO on a 3.3V serial USB adapter using a 470 Ohm to 1k Ohm resistor)
4. GND (connect to GND on a 3.3V serial USB adapter)

NOTE: When you use a serial USB adapter to RX on the device and then power on the device, the device may hang and not continue booting. As a workaround, first power on the device and only thereafter connect the RX cable. Apparently this can be solved by using a 470 Ohm to 1k Ohm resistor between RX and the serial USB adapter.

a5v11 routers have been proven to be a good solution for a cheap and easy deployable private secure telephone network. Wifi and USB won't be used. It is powerful enough to handle several simultaneously encrypted phone calls.

Just install an openvpn server somewhere and add a sip server of your choice (for example freeswitch or asterisk), make the sipserver only listen on the tun0 device (most likely 10.0.0.1). The nice thing with the following setup is, that you just don't use routing/nat at all. The vpn network doesn't have to be reachable from the individual lans or vice versa, siproxd will handle all the cross-network things.

Getting a workable image within that tiny 4mb space is kind of tricky, but works. The following is using openssl openvpn due to polar ssl behaving unstable with hardened openvpn settings.

nice -n 19 make image PROFILE=A5-V11 PACKAGES="openvpn-openssl  -ip6tables -kmod-ip6tables -kmod-ipv6 -ppp -ppp-mod-pppoe -odhcp6c -luci-proto-ipv6 -luci-proto-ppp siproxd -dnsmasq -opkg"

Setup steps:

generate a /etc/openvpn/openvpn.conf on the a5v11 (it will be started automatically)

client
dev tun
proto udp
remote hostname 1194
resolv-retry infinite
nobind
user nobody
group nogroup
persist-key
persist-tun
mute-replay-warnings
<ca>
paste your ca certificate here
</ca>
<cert>
paste your certificate here
</cert>
<key>
paste your private key here
</key>
ns-cert-type server
<tls-auth>
paste your ta.key here
</tls-auth>
key-direction 1
cipher AES-256-CBC
auth SHA256

adjust the hostname to your liking (for example a5v11) in /etc/config/system
enable dhcp in /etc/config/network:

config interface 'lan'                         
        option ifname 'eth0.1'                 
        option force_link '1'                  
        option macaddr 'aa:bb:cc:...' // whatever was in here before      
        option type 'bridge'                   
        option proto 'dhcp'               
        option hostname 'a5v11'           

configure siproxd in /etc/config/siproxd

config siproxd general
	option if_inbound	br-lan
	option if_outbound	tun0

Now you can just plug the a5v11 to some network and configure all sipclients to use this proxy.
Basically you just need the following settings:
sip-registrar: 10.0.0.1 (the sip-server on the vpn, the network doesn't have to be reachable, no need for routing)
username/number: (whatever you created)
password: (whatever you generated)
proxy: a5v11

This is really working great on several fritzboxes (you can use the usb port on the fritzbox to power the a5v11). Just hand out some of these sticks and tell the users the username and password. It's integrating very well with the existing telephones and you can prepare the a5v11 sticks in advance as they are only for connecting the vpn network. The actual credentials for the telephone server can be later generated on the fly. Just a hint: Make sure to use a dns name and not an IP as the openvpn client host entry, so you could later migrate the server to bigger hardware, if needed.

Do to the very short of free Memory , many features not possible but Ser2Net is possible with usb serial adapter

follow modules have to install

opkg update
opkg install kmod-usb-core
opkg install kmod-usb-uhci
opkg install kmod-usb-serial
opkg install kmod-usb-serial-cp210x
#example cp2101

now you have to choose wich usb serial adapter you are use only 1 is possible do to missing free memory !

• kmod-usb-serial-cp210x
• kmod-usb-serial-ch341
• kmod-usb-serial-cypress-m8
• kmod-usb-serial-ftdi
• kmod-usb-serial-pl2303

opkg install ser2net

please look it is you usb adapter recognize

dmesg | grep usb

please look at FEHM for config and autostart of Ser2net FEHM ser2net in OpenWRT

• http://www.digitalinferno.com/wiki/Wiki.jsp?page=Mini3G4GUSBRouterOpenWrtExternalUSB
• https://forum.openwrt.org/viewtopic.php?pid=251675#p251675 - Information about hardcoded passwords and keys
• http://www.cnx-software.com/2015/03/29/a5-v11-mini-router-runs-openwrt-linux-for-just-8/
• ftp://ftp.ff3l.net/A5-V11/Mifi-Storage-3G-2.1.3.8.bin - Stock Firmware Image

A similar device with the same “Qualcomm” firmware GUI but with more commands available via telnet showed up. Furthermore, it has a built-in battery.

How to add tags