Xiaomi AX3200 / Redmi AX6S

Under Construction!
This page is currently under construction. You can edit the article to help completing it.

Xiaomi Router AX3200 allows you to easily enjoy nearly twice the speed of a typical AC1200 router. The Wi-Fi 6 router significantly reduces latency and unresponsiveness in end devices, even when multiple users are using multiple devices at the same time.

Xiaomi AX3200 (model RB01, international version) and Redmi AX6S (model RB03, Chinese version) are exactly the same hardware. The only difference is the version of the stock firmware (which is region locked).

Xiaomi AX3200

ModelVersionSoCCPU MHzFlash MBRAM MBWLAN HardwareWLAN2.4WLAN5.0100M portsGbit portsModemUSB
AX3200MediaTek MT7622B1350128NAND256MediaTek MT7622B, MediaTek MT7915Eb/g/na/n/ac/ax-4--

Important: There are two versions of this device: Xiaomi AX3200 (model RB01, international version) and Redmi AX6S (model RB03, Chinese version). Both versions are exactly the same hardware, and the only difference is the version of the stock firmware (which is region locked).

The initial installation of OpenWrt on these devices requires telnet access. Some early production units were shipped with telnet enabled from factory, but later devices started shipping with telnet disabled, thus making impossible to install OpenWrt.

However, for the Chinese version Redmi AX6S (model RB03), even if it comes with telnet disabled, it is possible to enable telnet access by installing a beta version of the stock firmware (miwifi_rb03_firmware_stable_1.2.7_closedbeta.bin, more details below). This stock firmware does enable telnet on the Redmi AX6S (model RB03) and therefore it makes OpenWrt installation possible.

For the Xiaomi AX3200 (model RB01), if it does not have telnet enabled from factory, there is no simple way to install OpenWrt. At the present moment (September 2022), there are only 2 ways to install OpenWrt on the Xiaomi AX3200 (model RB01) with telnet disabled:

  • UART flash method: the method which requires opening the device, connecting a UART cable, and following a specific set of steps. This process is recommended only for advanced users, and may soft brick your device. The instructions for this process are available at https://github.com/mikeeq/xiaomi_ax3200_openwrt#uart-flash
  • “netmode: 4” method: the method which requires a second Xiaomi router (in addition to the Xiaomi AX3200 RB01, you will temporarily need any other Xiaomi router with Mesh support). If connect both routers via ethernet cable (LAN port on the RB01 and WAN port on the 2nd Xiaomi router) and perform a hard reset on the 2nd Xiaomi router, the AX3200 RB01 will obtain {“netmode”:4,“code”:0} with telnet enabled, thus unlocking the ability to install OpenWrt. The instructions for this process are available in this post: Link to owrt forum

Installation steps:

  1. If your device has telnet enabled from factory, you can skip to step 3 (click here to access your device and check if telnet is enabled).
  2. If your device does not have telnet enabled from factory and it is a Redmi AX6 (RB03 model), you can enable telnet by flashing stock “closed beta” firmware labelled miwifi_rb03_firmware_stable_1.2.7_closedbeta.bin. (MD5: 5eedf1632ac97bb5a6bb072c08603ed7). If your device is a Xiaomi AX3200 (RB01 model) and does not have telnet enabled from factory, stop here - unfortunately, there is no known way to enable telnet on this model other than the UART flash or “netmode: 4” methods.
  3. Download this Python program and save to your local disk with the name unlock_pwd.py. Then execute this program by running the command python3 unlock_pwd.py <S/N> by replacing <S/N> with the actual serial number from your device (you need to have Python pre-installed on your computer). You can locate the serial number in the label beneath your router.
  4. Open a telnet session to your device (using a telnet client such as Putty) and login with username “root” and the password from the previous step. The default IP address of the stock firmware is 192.168.31.1.
  5. Execute the following commands to prepare device for OpenWrt flashing:
    nvram set ssh_en=1
    nvram set uart_en=1
    nvram set boot_wait=on
    nvram set flag_boot_success=1
    nvram set flag_try_sys1_failed=0
    nvram set flag_try_sys2_failed=0
    nvram commit
  6. Rename the file openwrt-mediatek-mt7622-xiaomi_redmi-router-ax6s-squashfs-factory.bin you previously downloaded to your computer to factory.bin
  7. On your computer, in the same directory where the file factory.bin is located, run the following command (you need to have Python pre-installed on your computer):
    python -m http.server
  8. On the telnet session to your router, execute the following commands to flash OpenWrt:
    cd /tmp
    wget http://<IP address of your computer>:8000/factory.bin
    mtd -r write factory.bin firmware
  9. After flashing is complete, your device should reboot to OpenWrt. Notice that the device IP will change to the OpenWrt default IP address which is 192.168.1.1 after it reboots.
  10. If after previous step your device still boots into stock firmware, open a telnet session again, execute the following commands, go back to step 8 and flash again:
    nvram set ssh_en=1
    nvram set uart_en=1
    nvram set boot_wait=on
    nvram set flag_boot_success=1
    nvram set flag_try_sys1_failed=0
    nvram set flag_try_sys2_failed=0
    nvram set "boot_fw1=run boot_rd_img;bootm"
    nvram commit

Flash layout running OpenWRT (22.03-SNAPSHOT)

dev start end size erasesize name size
mtd0 00000000 00080000 00080000 00020000 Preloader 512KiB
mtd1 00080000 000c0000 00040000 00020000 ATF 256KiB
mtd2 000c0000 00140000 00080000 00020000 u-boot 512KiB
mtd3 00140000 00180000 00040000 00020000 u-boot-env 256KiB
mtd4 00180000 001c0000 00040000 00020000 bdata 256KiB
mtd5 001c0000 00240000 00080000 00020000 factory 512KiB
mtd6 00240000 00280000 00040000 00020000 crash 256KiB
mtd7 00280000 002c0000 00040000 00020000 crash_log 256KiB
mtd8 002c0000 006c0000 00400000 00020000 kernel 4MiB
mtd9 006c0000 075c0000 06f00000 00020000 ubi 111MiB

Flash layout running OEM 1.0.35 firmware on a BR01/international model

dev start end size erasesize name size
mtd0 00000000 00020000 00020000 00020000 PL_Header 128KiB
mtd1 00020000 00080000 00060000 00020000 Preloader 384KiB
mtd2 00080000 000c0000 00040000 00020000 ATF 256KiB
mtd3 000c0000 00140000 00080000 00020000 uboot 512KiB
mtd4 00140000 00180000 00040000 00020000 Nvram 256KiB
mtd5 00180000 001c0000 00040000 00020000 Bdata 256KiB
mtd6 001c0000 00240000 00080000 00020000 Factory 512KiB
mtd7 00240000 00280000 00040000 00020000 crash 256KiB
mtd8 00280000 002c0000 00040000 00020000 crash_syslog 256KiB
mtd9 002c0000 020c0000 01e00000 00020000 firmware 30720KiB
mtd10 002c0000 00560000 002a0000 00020000 kernel 2688KiB
mtd11 00560000 020c0000 01b60000 00020000 rootfs 28032KiB
mtd12 020c0000 03ec0000 01e00000 00020000 firmware1 30720KiB
mtd13 03ec0000 070c0000 03200000 00020000 overlay 51200KiB
mtd14 070c0000 08000000 00f40000 00020000 obr 15616KiB

Known Issue: It is reported that some newer AX6S can only flash factory image and is impossible to use a sysupgrade image. Personal investigation shows that the mtd partitions are offset with -0x20000. So kernel/root partition and ubi volume and written into the wrong position, thus bricks the device.

Reported cases(in Chinese, google-translate required):

generic.sysupgrade

FIXME These are generic instructions. Update with your router's specifics.

  • Browse to http://192.168.1.1/cgi-bin/luci/mini/system/upgrade/ LuCI Upgrade URL
  • Upload image file for sysupgrade to LuCI
  • Wait for reboot

If you don't have a GUI (LuCI) available, you can alternatively upgrade via the command line. There are two command line methods for upgrading:

  • sysupgrade
  • mtd

Note: It is important that you put the firmware image into the ramdisk (/tmp) before you start flashing.

sysupgrade

  • Login as root via SSH on 192.168.1.1, then enter the following commands:
cd /tmp
wget http://downloads.openwrt.org/snapshots/trunk/XXX/xxx.abc
sysupgrade /tmp/xxx.abc

mtd

If sysupgrade does not support this router, use mtd.

  • Login as root via SSH on 192.168.1.1, then enter the following commands:
cd /tmp
wget http://downloads.openwrt.org/snapshots/trunk/XXX/xxx.abc
mtd write /tmp/xxx.abc linux && reboot

The following assumes that the u-boot partition is not damaged.

  • Power on with the reset button held. About 10s later, the orange led will blink quickly for some seconds then back to always on
  • Release the reset button
  • Connect any LAN port to another computer with DHCP+TFTP enabled
  • The AX6S will download from {XX}{XX}{XX}{XX}.img (XX is the uppercase hex-encoded of its assigned IP address), like C0A81F02.img for 192.168.31.2
  • When device LED turns blue and blinks quickly, reboot the device

Basic configuration After flashing, proceed with this.
Set up your Internet connection, configure wireless, configure USB port, etc.

FIXME Please fill in real values for this device, then remove the EXAMPLEs

The default network configuration is:

Interface Name Description Default configuration
br-lan EXAMPLE LAN & WiFi EXAMPLE 192.168.1.1/24
vlan0 (eth0.0) EXAMPLE LAN ports (1 to 4) EXAMPLE None
vlan1 (eth0.1) EXAMPLE WAN port EXAMPLE DHCP
wl0 EXAMPLE WiFi EXAMPLE Disabled

FIXME Please fill in real values for this device, then remove the EXAMPLEs

Numbers 0-3 are Ports 1-4 as labeled on the unit, number 4 is the Internet (WAN) on the unit, 5 is the internal connection to the router itself. Don't be fooled: Port 1 on the unit is number 3 when configuring VLANs. vlan0 = eth0.0, vlan1 = eth0.1 and so on.

Port Switch port
Internet (WAN) EXAMPLE 4
LAN 1 EXAMPLE 3
LAN 2 EXAMPLE 2
LAN 3 EXAMPLE 1
LAN 4 EXAMPLE 0

hardware.button on howto use and configure the hardware button(s). Here, we merely name the buttons, so we can use them in the above Howto.

The Xiaomi AX3200 has the following buttons:

BUTTON Event
Reset reset
Mesh BTN_9
General
Brand Xiaomi
Model AX3200
Versions
Device Type WiFi Router
Availability Available 2021
Comments - general
OpenWrt Support
Supported Since Commit https://git.openwrt.org/?p=openwrt/openwrt.git;a=commit;h=9f9477b2751231d57cdd8c227149b88c93491d93
Supported Since Release 22.03.0
Supported Current Release 22.03.2
Unsupported
Hardware
Bootloader U-Boot
Target mediatek
System-On-Chip MediaTek MT7622B
CPU MHz 1350
Flash MB 128NAND
RAM MB 256
Network
Ethernet 100M ports -
Ethernet Gbit ports 4
Switch MediaTek MT7531B
Modem -
VLAN ¿
Comments - network ports
Wireless
WLAN 2.4GHz b/g/n
WLAN 5.0GHz a/n/ac/ax
WLAN Hardware MediaTek MT7622B, MediaTek MT7915E
Detachable Antennas -
Comments - WLAN MU-MIMO, OFDMA, 802.11s
Interfaces
USB ports -
SATA ports -
Serial Yes
JTAG No
Comments - USB & SATA ports
Misc
LED count 2
Button count 2
Power supply 12 VDC, 1.5 A
Links
Forum Topic URL
WikiDevi URL https://wikidevi.wi-cat.ru/Xiaomi_Mi_Router_Redmi_AX6S_(AX3200)
OEM device homepage URL https://www.mi.com/global/product/xiaomi-router-ax3200/
Firmware OEM Stock URL https://openwrt.org/toh/xiaomi/ax3200#stock_firmware
Firmware OpenWrt Install URL http://downloads.openwrt.org/releases/22.03.2/targets/mediatek/mt7622/openwrt-22.03.2-mediatek-mt7622-xiaomi_redmi-router-ax6s-squashfs-factory.bin
Firmware OpenWrt Upgrade URL http://downloads.openwrt.org/releases/22.03.2/targets/mediatek/mt7622/openwrt-22.03.2-mediatek-mt7622-xiaomi_redmi-router-ax6s-squashfs-sysupgrade.bin
Edit the underlying data View/Edit data

Front:
Insert photo of front of the casing

Back:
Insert photo of back of the casing

Backside label:
Insert photo of backside label

port.serial general information about the serial port, serial port cable, etc.

How to connect to the Serial Port of this specific device:

Through-holes on top-right of board, next to reset button, labelled J1. Pins are VCC, RX, GND, TX from left to right, starting from the hole labelled 1 on the silkscreen. Terminal headers can be attached, but may be awkward to solder due to the antenna leads not allowing free movement of board from inside the case.

Serial connection parameters
for Xiaomi AX3200
3.3V, 115200, 8N1

Thanks to tgabor forum user for the hint, it's possible to reach the serial terminals without opening the case / voiding your warranty!

Note: This will void your warranty!

Remove the sticker/label on the bottom of the device to reveal two screws. Unscrew these and use a plastic spudger or pry-tool in order to remove the top cover. It may take some patience and luck in order not to break any of the plastic tabs holding the cover in place. You may now optionally remove the five screws fastening the heat-spreader if you require access to any of the components below it.

Main PCB:

port.jtag general information about the JTAG port, JTAG cable, etc.

How to connect to the JTAG Port of this specific device:
Insert photo of PCB with markings for JTAG port

None so far.

COPY HERE THE BOOTLOG WITH THE ORIGINAL FIRMWARE


COPY HERE THE BOOTLOG ONCE OPENWRT IS INSTALLED AND RUNNING


Space for additional notes, links to forum threads or other resources.

This website uses cookies. By using the website, you agree with storing cookies on your computer. Also you acknowledge that you have read and understand our Privacy Policy. If you do not agree leave the website.More information about cookies
  • Last modified: 2022/09/29 03:01
  • by alexq