Differences
This shows you the differences between two versions of the page.
| Both sides previous revision Previous revision Next revision | Previous revision | ||
| toh:zte:mf286r [2022/09/09 10:44] – oops pcislocked | toh:zte:mf286r [2024/11/04 10:22] (current) – [Basic configuration] andrewz | ||
|---|---|---|---|
| Line 5: | Line 5: | ||
| /* USE https:// | /* USE https:// | ||
| - | {{page> | + | ZTE MF286R is a wireless LTE router, capable of connecting to LTE networks at download speeds up to 300Mbps using carrier aggegation. It has 3x3 2.4GHz Wi-Fi 4 and 2x2 5GHz Wi-Fi 5 Wave 2 radios, four gigabit ethernet ports, one USB 2.0 port, two RJ-11 ports for connecting landline phones that lets you use the cellular network to make calls. It is commonly used by some European ISPs for FWA(Fixed Wireless Access) services, such as Windtre on Italy, Turkcell on Türkiye, and more. Some models of the MF286 family include battery or phone ports, as well as corresponding LEDs on the front. |
| - | ZTE MF286 is a wireless LTE router, capable of connecting to LTE networks at 300Mbps using carrier aggegation. It has tri-band 2.4GHz Wi-Fi 4 and dual-band 5GHz Wi-Fi 5 Wave 2 radios, four gigabit ethernet ports, one USB 2.0 port, two RJ-11 ports for connecting landline phones that lets you use the cellular network to make calls, and a battery slot on the back for a 3Ah battery. It is commonly used by some european ISPs for FWA(Fixed Wireless Access) services, by Windtre on Italy, Turkcell on Turkey, and more. Some models do not include battery or phone ports, as well as corresponding LEDs on the front. | + | {{media:zte:mf286r: |
| - | + | ||
| - | {{media: | + | |
| - | + | ||
| - | <WRAP BOX> | + | |
| - | FIXME | + | |
| - | ===== Getting started with a new Device Page ===== | + | |
| - | - This is an empty template that suggests the information that should be present on a well-constructed Device Page. This means, that **you have to fill it with life and information.** | + | |
| - | - There are several " | + | |
| - | - When there are no more " | + | |
| - | + | ||
| - | ===== Keep the articles modular ===== | + | |
| - | * Please include only model specific information, | + | |
| - | * If you have no time to write certain stuff, link to [[docs: | + | |
| - | * [[docs: | + | |
| - | * DO NOT provide a complete howto here! Instead //groom// the [[docs: | + | |
| - | </ | + | |
| ===== Supported Versions ===== | ===== Supported Versions ===== | ||
| - | + | <!-- ToH: { | |
| - | + | " | |
| - | ---- datatable ---- | + | " |
| - | cols | + | " |
| - | headers | + | " |
| - | align : c,c,c,c,c,c,c | + | " |
| - | filter | + | |
| - | filter | + | } --> |
| - | ---- | + | |
| /* If no unsupported functions known, comment out the following datatable or delete it. */ | /* If no unsupported functions known, comment out the following datatable or delete it. */ | ||
| - | ---- datatable ---- | + | <!-- ToH: { |
| - | cols | + | " |
| - | filter | + | |
| - | filter | + | |
| - | ---- | + | " |
| + | " | ||
| + | } --> | ||
| ===== Experimental Versions ===== | ===== Experimental Versions ===== | ||
| - | |||
| //None at this time.// | //None at this time.// | ||
| ===== Hardware Highlights ===== | ===== Hardware Highlights ===== | ||
| - | ---- datatable ---- | + | <!-- ToH: { |
| - | cols | + | " |
| - | header | + | " |
| - | align : c,c, | + | " |
| - | filter | + | " |
| - | filter | + | |
| - | ---- | + | |
| + | } --> | ||
| ===== Installation ===== | ===== Installation ===== | ||
| - | ---- datatable ---- | + | <!-- ToH: { |
| - | cols | + | " |
| - | headers | + | " |
| - | align : c,c,c | + | " |
| - | filter | + | " |
| - | filter | + | " |
| - | ---- | + | |
| + | } --> | ||
| -> [[docs: | -> [[docs: | ||
| - | FIXME Please add the installation procedure here. | + | TL:DR; Get a serial adapter and connect to the serial(see [[: |
| + | If you don't have a serial adapter, you can use the known exploit to gain a root shell and move from there. | ||
| - | ==== Flash Layout ==== | ||
| - | <WRAP BOX> | ||
| - | FIXME // | ||
| - | Please check out the article [[docs:techref: | + | ====STEP 1: Gaining root shell==== |
| - | </ | + | |
| + | ===Method 1=== | ||
| + | Use a serial cable. It might seem inconvenient to tear apart the device and get a serial adapter for one job but it is way easier to do the install with it. Otherwise, feel free to follow the other methods mentioned below, which takes advantage of an URL RCE exploit within the Web UI. Some up-to-date firmwares patched this bug(such as T-Mobile.pl firmware.). Physical connections for serial are shown [[: | ||
| - | ==== OEM installation using the TFTP method | + | ===Method 2=== |
| + | This works if busybox has telnetd compiled in the binary. If this does not work, try method | ||
| - | -> [[docs:guide-user:installation: | + | Using well-known exploit to start telnetd on your router - works only if Busybox on stock firmware has telnetd included: |
| + | - Open stock firmware web interface | ||
| + | - Navigate to "URL filtering" | ||
| + | - Add an entry ending with < | ||
| + | - telnetd will immediately listen on port 4719. | ||
| + | - After connecting to telnetd use " | ||
| - | === Specific values needed for tftp === | + | ===Method 3=== |
| + | This works if busybox does not have telnetd compiled in. Notably, this is the case in DNA.fi firmware. | ||
| - | <WRAP BOX> | + | - Set IP of your computer to 192.168.0.22/ |
| + | - Have a TFTP server running at that address | ||
| + | - Download MIPS build of busybox including telnetd, for example from [[https:// | ||
| + | - As previously, login to router' | ||
| + | - Using " | ||
| + | <nowiki> < | ||
| + | - Stay on the page - do not navigate anywhere | ||
| + | - Enter < | ||
| + | - Save the settings. This will download the telnetd binary over tftp and execute it. You should be able to log in at port 23, using " | ||
| - | FIXME Enter values for " | + | ====STEP 2: Backing up original software==== |
| + | As the stock firmware may be customized by the carrier and is not officially available in the Internet, **IT IS IMPERATIVE** to back up the stock firmware, if you ever plan to returning to stock firmware. It is highly recommended to perform backup using both methods, to avoid hassle of reassembling firmware images in future, if a restore is needed. | ||
| - | ^ Bootloader tftp server IPv4 address | + | ===Method 1 - After booting OpenWrt initramfs image via TFTP=== |
| - | ^ Bootloader MAC address (special) | + | PLEASE |
| - | ^ Firmware tftp image | [[: | + | - Dump stock firmware located |
| - | ^ TFTP transfer window | + | |
| - | ^ TFTP window start | approximately FILL-IN seconds after power on | | + | |
| - | ^ TFTP client required IP address | + | |
| + | ssh root@192.168.1.1: | ||
| + | ssh root@192.168.1.1: | ||
| + | |||
| + | ===Method 2 - using stock firmware=== | ||
| + | - After booting into the stock frimware and connecting to the console either via serial or telnet, Connect an external USB drive formatted with FAT or ext4 to the USB port. | ||
| + | - The drive will be auto-mounted to / | ||
| + | - Check the flash layout of the device: | ||
| + | |||
| + | <WRAP BOX> | ||
| + | cat /proc/mtd | ||
| </ | </ | ||
| - | ===== Upgrading OpenWrt ===== | + | It should show the following: |
| - | -> [[docs:guide-user: | + | |
| + | mtd0: 000a0000 00010000 " | ||
| + | mtd1: 00020000 00010000 " | ||
| + | mtd2: 00140000 00010000 " | ||
| + | mtd3: 000a0000 00020000 " | ||
| + | mtd4: 00080000 00020000 " | ||
| + | mtd5: 00080000 00020000 " | ||
| + | mtd6: 000c0000 00020000 " | ||
| + | mtd7: 00400000 00020000 " | ||
| + | mtd8: 00400000 00020000 " | ||
| + | mtd9: 000a0000 00020000 " | ||
| + | mtd10: 00500000 00020000 " | ||
| + | mtd11: 00800000 00020000 " | ||
| + | mtd12: 00300000 00020000 " | ||
| + | mtd13: 01a00000 00020000 " | ||
| + | mtd14: 01900000 00020000 " | ||
| + | mtd15: 03200000 00020000 " | ||
| + | mtd16: 01d00000 00020000 " | ||
| + | |||
| + | |||
| + | // | ||
| + | - Copy over all MTD partitions, for example by executing the following: | ||
| + | |||
| + | for i in 0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15; do cat /dev/mtd$i > \ | ||
| + | / | ||
| + | |||
| + | " | ||
| + | |||
| + | - If the count of MTD partitions is different, this might indicate that this is not a MF286R device, but one of its other variants. | ||
| + | - Unmount the filesystem | ||
| + | |||
| + | umount / | ||
| + | | ||
| + | - Store the files in safe place if you ever plan to return to stock firmware. **This is especially important, because stock firmware for this device is not available officially, and is usually customized by the mobile providers.** | ||
| + | |||
| + | |||
| + | Alternatively, | ||
| + | |||
| + | tftp -l /dev/mtd0ro -r mtd0ro_uboot.img -p 192.168.1.144 | ||
| + | tftp -l /dev/mtd1ro -r mtd1ro_uenv.img -p 192.168.1.144 | ||
| + | tftp -l /dev/mtd2ro -r mtd2ro_reseved1.img -p 192.168.1.144 | ||
| + | tftp -l /dev/mtd3ro -r mtd3ro_foto-flag.img -p 192.168.1.144 | ||
| + | tftp -l /dev/mtd4ro -r mtd4ro_art.img -p 192.168.1.144 | ||
| + | tftp -l /dev/mtd5ro -r mtd5ro_mac.img -p 192.168.1.144 | ||
| + | tftp -l /dev/mtd6ro -r mtd6ro_reserved2.img -p 192.168.1.144 | ||
| + | tftp -l /dev/mtd7ro -r mtd7ro_cfg-param.img -p 192.168.1.144 | ||
| + | tftp -l /dev/mtd8ro -r mtd8ro_log.img -p 192.168.1.144 | ||
| + | tftp -l /dev/mtd9ro -r mtd9ro_oops.img -p 192.168.1.144 | ||
| + | tftp -l / | ||
| + | tftp -l / | ||
| + | tftp -l / | ||
| + | tftp -l / | ||
| + | tftp -l / | ||
| + | tftp -l / | ||
| + | tftp -l / | ||
| + | |||
| + | Change the IP accordingly, | ||
| + | |||
| + | ====STEP 3: Booting initramfs image==== | ||
| + | |||
| + | ===Method 1: using serial console (RECOMMENDED): | ||
| + | - Have TFTP server running, exposing the OpenWrt initramfs image, and set your computer' | ||
| + | - Connect the serial console if you haven' | ||
| + | - Interrupt boot sequence by pressing any key in U-boot when prompted "Hit any key to stop autoboot" | ||
| + | - Use the following commands to boot OpenWrt initramfs through TFTP: | ||
| + | setenv serverip 192.168.0.22 | ||
| + | setenv ipaddr 192.168.0.1 | ||
| + | tftpboot 0x82000000 openwrt-ath79-nand-zte_mf286a-initramfs-kernel.bin | ||
| + | bootm 0x82000000 | ||
| + | |||
| + | (Replace server IP and router IP as needed). | ||
| + | |||
| + | There is no emergency TFTP boot sequence triggered by buttons, contrary to MF283+. | ||
| + | - When OpenWrt initramfs finishes booting, proceed to actual installation. | ||
| + | |||
| + | ===Method 2: using initramfs image as temporary boot kernel=== | ||
| + | This exploits the fact, that kernel and rootfs MTD devices are consecutive on NAND flash, so from within stock image, an initramfs can be written to this area and booted by U-boot on next reboot, because it uses " | ||
| + | - Download the initramfs-kernel.bin image | ||
| + | - After backing up the previous MTD contents, write the images to the " | ||
| + | |||
| + | nandwrite -p / | ||
| + | / | ||
| + | |||
| + | - If the write fails with " | ||
| + | |||
| + | cat / | ||
| + | | ||
| + | Retry the write afterwards. | ||
| + | |||
| + | - If write is OK, reboot the device, it will reboot to OpenWrt initramfs: | ||
| + | |||
| + | reboot -f | ||
| + | |||
| + | - After rebooting, SSH into the device and use sysupgrade to perform proper installation. | ||
| + | |||
| + | ===Method 3: using built-in TFTP recovery (LAST RESORT)=== | ||
| + | - With that method, ensure you have complete backup of system' | ||
| + | - Download " | ||
| + | - Prepare the recovery image by prepending 8MB of zeroes to the image, and name it root_uImage: | ||
| + | |||
| + | dd if=/ | ||
| + | |||
| + | cat padding.bin openwrt-ath79-nand-zte_mf286a-initramfs-kernel.bin > | ||
| + | root_uImage | ||
| + | |||
| + | - Set up a TFTP server at 192.0.0.1/ | ||
| + | - Put the previously generated " | ||
| + | - Deliberately erase " | ||
| + | | ||
| + | flash_erase /dev/mtd12 | ||
| + | | ||
| + | - If the erase fails with " | ||
| + | |||
| + | cat / | ||
| + | |||
| + | Retry erasing afterwards. | ||
| + | | ||
| + | Replace mtd12 with kernel partition if differrent. **THIS IS POINT OF NO RETURN.** | ||
| + | |||
| + | - Restart the device. U-boot will attempt flashing the recovery initramfs image, which will let you perform actual installation using sysupgrade. This might take a considerable time, sometimes the router doesn' | ||
| + | - After U-boot finishes flashing, the LEDs of switch ports will all light up. At this moment, perform power-on reset, and wait for OpenWrt initramfs to finish booting. Then proceed to actual installation. | ||
| + | |||
| + | ====STEP 4: Actual installation==== | ||
| + | - Set your computer IP to 192.168.1.22/ | ||
| + | - scp the sysupgrade image to the device: | ||
| + | |||
| + | scp openwrt-ath79-nand-zte_mf286a-squashfs-sysupgrade.bin \ | ||
| + | root@192.168.1.1:/ | ||
| + | |||
| + | - ssh into the device and execute sysupgrade: | ||
| + | |||
| + | sysupgrade -n / | ||
| + | |||
| + | - Wait for router to reboot to full OpenWrt. | ||
| + | |||
| + | ==== Flash Layout ==== | ||
| <WRAP BOX> | <WRAP BOX> | ||
| + | mtd0: 000a0000 00010000 " | ||
| + | mtd1: 00020000 00010000 " | ||
| + | mtd2: 00140000 00010000 " | ||
| + | mtd3: 000a0000 00020000 " | ||
| + | mtd4: 00080000 00020000 " | ||
| + | mtd5: 00080000 00020000 " | ||
| + | mtd6: 000c0000 00020000 " | ||
| + | mtd7: 00400000 00020000 " | ||
| + | mtd8: 00400000 00020000 " | ||
| + | mtd9: 000a0000 00020000 " | ||
| + | mtd10: 00500000 00020000 " | ||
| + | mtd11: 00800000 00020000 " | ||
| + | mtd12: 00300000 00020000 " | ||
| + | mtd13: 01a00000 00020000 " | ||
| + | mtd14: 01900000 00020000 " | ||
| + | mtd15: 03200000 00020000 " | ||
| + | mtd16: 01d00000 00020000 " | ||
| + | </ | ||
| - | FIXME These are generic | + | |
| + | ===== Upgrading OpenWrt ===== | ||
| + | -> [[docs: | ||
| ==== LuCI Web Upgrade Process ==== | ==== LuCI Web Upgrade Process ==== | ||
| Line 114: | Line 275: | ||
| If you don't have a GUI (LuCI) available, you can alternatively upgrade via the command line. | If you don't have a GUI (LuCI) available, you can alternatively upgrade via the command line. | ||
| - | There are two command line methods for upgrading: | + | Login as root via SSH on 192.168.1.1, or connect via serial, then enter the following commands, replacing the URL and filename with the latest sysupgrade image link. |
| - | + | ||
| - | * '' | + | |
| - | * '' | + | |
| - | + | ||
| - | Note: It is important that you put the firmware image into the ramdisk (/tmp) before you start flashing. | + | |
| - | + | ||
| - | === sysupgrade === | + | |
| - | + | ||
| - | * Login as root via SSH on 192.168.1.1, | + | |
| < | < | ||
| Line 129: | Line 281: | ||
| wget http:// | wget http:// | ||
| sysupgrade / | sysupgrade / | ||
| - | </ | ||
| - | |||
| - | === mtd === | ||
| - | |||
| - | If '' | ||
| - | |||
| - | * Login as root via SSH on 192.168.1.1, | ||
| - | |||
| - | < | ||
| - | cd /tmp | ||
| - | wget http:// | ||
| - | mtd write / | ||
| </ | </ | ||
| Line 146: | Line 286: | ||
| ===== Debricking ===== | ===== Debricking ===== | ||
| - | -> [[docs: | + | See [[docs: |
| ===== Failsafe mode ===== | ===== Failsafe mode ===== | ||
| - | -> [[docs: | + | See [[docs: |
| ===== Basic configuration ===== | ===== Basic configuration ===== | ||
| - | -> [[docs: | + | Since the router is equipped with LTE modem as its main WAN interface, it might be useful to connect to the Internet right away after installation. To do so over Luci, you'd need to connect to Internet via other means (Ethernet or Wi-Fi STA) and then install '' |
| - | Set up your Internet connection, configure wireless, configure USB port, etc. | + | |
| - | ===== Specific Configuration ===== | + | You can also add the necessary packages when building a new image with [[https:// |
| + | As of this writing, the package and its dependencies can be found from the following page (check and update the version accordingly): | ||
| + | * https:// | ||
| + | * https:// | ||
| + | * https:// | ||
| - | <WRAP BOX> | + | If you can't access the Internet via other means or you want to set it up via console or SSH, you can put the following entries |
| - | FIXME Please fill in real values for this device, then remove | + | |
| - | ==== Network interfaces ==== | + | < |
| - | The default network configuration is: | + | config interface ' |
| - | ^ Interface Name ^ Description | + | |
| - | | br-lan | + | |
| - | | vlan0 (eth0.0) | + | |
| - | | vlan1 (eth0.1) | + | |
| - | | wl0 | EXAMPLE WiFi | EXAMPLE Disabled | + | </ |
| - | </WRAP> | + | Please refer to [[: |
| + | |||
| + | After configuring your LTE modem, you can follow [[docs: | ||
| + | |||
| + | ===== Specific Configuration ===== | ||
| + | |||
| + | Other than LTE modem configuration mentioned above, no specific configuration is required. You might want to install < | ||
| ==== Switch Ports (for VLANs) ==== | ==== Switch Ports (for VLANs) ==== | ||
| Line 202: | Line 350: | ||
| ===== Hardware ===== | ===== Hardware ===== | ||
| ==== Info ==== | ==== Info ==== | ||
| - | ---- datatemplatelist dttpllist ---- | + | <!-- ToH: { |
| - | template: meta:template_datatemplatelist | + | " |
| - | cols | + | " |
| - | filter | + | " |
| - | filter | + | " |
| - | ---- | + | " |
| + | | ||
| + | } --> | ||
| ==== Photos ==== | ==== Photos ==== | ||
| - | /* =====>>>>> | ||
| - | /* When uploading photos, **name them** intelligently. Nobody knows what 20100930_000602.jpg is! */ | ||
| - | /* e.g. {{: | ||
| - | /* Thanks, your wiki administration - Oct. 2015 */ | ||
| // | // | ||
| - | **Insert photo of front of the casing** | + | {{media: |
| + | {{: | ||
| //Back://\\ | //Back://\\ | ||
| - | **Insert photo of back of the casing** | + | {{media: |
| + | {{: | ||
| - | //Backside label://\\ | + | //Top://\\ |
| - | **Insert photo of backside | + | {{: |
| + | |||
| + | // | ||
| + | {{: | ||
| + | |||
| + | //Under device | ||
| + | {{: | ||
| + | |||
| + | // | ||
| + | {{: | ||
| + | {{: | ||
| + | {{: | ||
| + | {{: | ||
| ==== Opening the case ==== | ==== Opening the case ==== | ||
| Line 228: | Line 388: | ||
| **Note:** This will void your warranty! | **Note:** This will void your warranty! | ||
| - | <WRAP BOX> | + | - Take of battery lid (no battery support for this model, battery cage is dummy). |
| - | FIXME //Describe what needs to be done to open the device, e.g. remove rubber feet, adhesive labels, | + | - Unscrew screw placed behind battery lid. |
| - | | + | - Take off back cover. It attached with multiple plastic clamps. |
| - | </ | + | - Unscrew four more screws |
| + | - Remove front panel from blue chassis. There are more plastic | ||
| + | | ||
| + | | ||
| + | - Extract board from blue chassis. | ||
| //Main PCB://\\ | //Main PCB://\\ | ||
| - | **Insert photo of PCB** | + | {{: |
| + | {{: | ||
| + | |||
| + | //PCB Board Details and modem photo:// | ||
| + | {{: | ||
| + | {{: | ||
| + | {{: | ||
| + | {{: | ||
| + | {{: | ||
| + | {{: | ||
| + | {{: | ||
| + | {{: | ||
| + | {{: | ||
| + | {{: | ||
| + | {{: | ||
| ==== Serial ==== | ==== Serial ==== | ||
| Line 1607: | Line 1785: | ||
| </ | </ | ||
| - | ===== Notes ===== | ||
| - | //Space for additional notes, links to forum threads or other resources.// | ||
| - | |||
| - | * ... | ||
| ===== Quirks and known issues ===== | ===== Quirks and known issues ===== | ||
| - It was observed, that CH340-based USB-UART converters output garbage during U-boot phase of system boot. At least CP2102 is known to work properly. | - It was observed, that CH340-based USB-UART converters output garbage during U-boot phase of system boot. At least CP2102 is known to work properly. | ||
| Line 1629: | Line 1803: | ||
| ===== Tags ===== | ===== Tags ===== | ||
| <WRAP BOX> | <WRAP BOX> | ||
| - | FIXME //Add tags below, then remove this fixme.// | + | FIXME //Add tags below, then remove this fixme. I don't know which tags are applicable, so pls help thx.// |
| </ | </ | ||
| [[meta: | [[meta: | ||
| {{tag> | {{tag> | ||