Differences
This shows you the differences between two versions of the page.
| Both sides previous revision Previous revision Next revision | Previous revision | ||
| toh:zte:mf286r [2022/09/09 13:00] – [Debricking] pcislocked | toh:zte:mf286r [2024/11/04 10:22] (current) – [Basic configuration] andrewz | ||
|---|---|---|---|
| Line 5: | Line 5: | ||
| /* USE https:// | /* USE https:// | ||
| - | {{page> | + | ZTE MF286R is a wireless LTE router, capable of connecting to LTE networks at download speeds up to 300Mbps using carrier aggegation. It has 3x3 2.4GHz Wi-Fi 4 and 2x2 5GHz Wi-Fi 5 Wave 2 radios, four gigabit ethernet ports, one USB 2.0 port, two RJ-11 ports for connecting landline phones that lets you use the cellular network to make calls. It is commonly used by some European ISPs for FWA(Fixed Wireless Access) services, such as Windtre on Italy, Turkcell on Türkiye, and more. Some models of the MF286 family include battery or phone ports, as well as corresponding LEDs on the front. |
| - | ZTE MF286 is a wireless LTE router, capable of connecting to LTE networks at speeds up to 300Mbps using carrier aggegation. It has tri-band 2.4GHz Wi-Fi 4 and dual-band 5GHz Wi-Fi 5 Wave 2 radios, four gigabit ethernet ports, one USB 2.0 port, two RJ-11 ports for connecting landline phones that lets you use the cellular network to make calls, and a battery slot on the back for a 3Ah battery. It is commonly used by some european ISPs for FWA(Fixed Wireless Access) services, by Windtre on Italy, Turkcell on Turkey, and more. Some models do not include battery or phone ports, as well as corresponding LEDs on the front. | + | {{media:zte:mf286r: |
| - | + | ||
| - | {{media: | + | |
| ===== Supported Versions ===== | ===== Supported Versions ===== | ||
| - | ---- datatable ---- | + | <!-- ToH: { |
| - | cols | + | " |
| - | headers | + | " |
| - | align : c,c,c,c,c,c,c | + | " |
| - | filter | + | " |
| - | filter | + | " |
| - | ---- | + | |
| + | } --> | ||
| /* If no unsupported functions known, comment out the following datatable or delete it. */ | /* If no unsupported functions known, comment out the following datatable or delete it. */ | ||
| - | ---- datatable ---- | + | <!-- ToH: { |
| - | cols | + | " |
| - | filter | + | |
| - | filter | + | |
| - | ---- | + | " |
| + | " | ||
| + | } --> | ||
| ===== Experimental Versions ===== | ===== Experimental Versions ===== | ||
| Line 32: | Line 33: | ||
| ===== Hardware Highlights ===== | ===== Hardware Highlights ===== | ||
| - | ---- datatable ---- | + | <!-- ToH: { |
| - | cols | + | " |
| - | header | + | " |
| - | align : c,c, | + | " |
| - | filter | + | " |
| - | filter | + | |
| - | ---- | + | |
| + | } --> | ||
| ===== Installation ===== | ===== Installation ===== | ||
| - | ---- datatable ---- | + | <!-- ToH: { |
| - | cols | + | " |
| - | headers | + | " |
| - | align : c,c,c | + | " |
| - | filter | + | " |
| - | filter | + | " |
| - | ---- | + | |
| + | } --> | ||
| -> [[docs: | -> [[docs: | ||
| TL:DR; Get a serial adapter and connect to the serial(see [[: | TL:DR; Get a serial adapter and connect to the serial(see [[: | ||
| - | If you don't have a serial adapter, you can use the known exploiot | + | If you don't have a serial adapter, you can use the known exploit |
| Line 75: | Line 78: | ||
| - Set IP of your computer to 192.168.0.22/ | - Set IP of your computer to 192.168.0.22/ | ||
| - Have a TFTP server running at that address | - Have a TFTP server running at that address | ||
| - | - Download MIPS build of busybox including telnetd, for example from [[https:// | + | - Download MIPS build of busybox including telnetd, for example from [[https:// |
| - As previously, login to router' | - As previously, login to router' | ||
| - Using " | - Using " | ||
| Line 94: | Line 97: | ||
| ===Method 2 - using stock firmware=== | ===Method 2 - using stock firmware=== | ||
| - | - Connect an external USB drive formatted with FAT or ext4 to the USB port. | + | - After booting into the stock frimware and connecting to the console either via serial or telnet, |
| - The drive will be auto-mounted to / | - The drive will be auto-mounted to / | ||
| - Check the flash layout of the device: | - Check the flash layout of the device: | ||
| + | <WRAP BOX> | ||
| cat /proc/mtd | cat /proc/mtd | ||
| + | </ | ||
| It should show the following: | It should show the following: | ||
| + | |||
| mtd0: 000a0000 00010000 " | mtd0: 000a0000 00010000 " | ||
| mtd1: 00020000 00010000 " | mtd1: 00020000 00010000 " | ||
| Line 118: | Line 124: | ||
| mtd15: 03200000 00020000 " | mtd15: 03200000 00020000 " | ||
| mtd16: 01d00000 00020000 " | mtd16: 01d00000 00020000 " | ||
| + | |||
| // | // | ||
| Line 132: | Line 139: | ||
| umount / | umount / | ||
| | | ||
| - | - Store the files in safe place if you ever plan to return to stock firmware. This is especially important, because stock firmware for this device is not available officially, and is usually customized by the mobile providers. | + | - Store the files in safe place if you ever plan to return to stock firmware. |
| + | |||
| + | |||
| + | Alternatively, | ||
| + | |||
| + | tftp -l /dev/mtd0ro -r mtd0ro_uboot.img -p 192.168.1.144 | ||
| + | tftp -l /dev/mtd1ro -r mtd1ro_uenv.img -p 192.168.1.144 | ||
| + | tftp -l /dev/mtd2ro -r mtd2ro_reseved1.img -p 192.168.1.144 | ||
| + | tftp -l /dev/mtd3ro -r mtd3ro_foto-flag.img -p 192.168.1.144 | ||
| + | tftp -l /dev/mtd4ro -r mtd4ro_art.img -p 192.168.1.144 | ||
| + | tftp -l /dev/mtd5ro -r mtd5ro_mac.img -p 192.168.1.144 | ||
| + | tftp -l /dev/mtd6ro -r mtd6ro_reserved2.img -p 192.168.1.144 | ||
| + | tftp -l /dev/mtd7ro -r mtd7ro_cfg-param.img -p 192.168.1.144 | ||
| + | tftp -l /dev/mtd8ro -r mtd8ro_log.img -p 192.168.1.144 | ||
| + | tftp -l /dev/mtd9ro -r mtd9ro_oops.img -p 192.168.1.144 | ||
| + | tftp -l / | ||
| + | tftp -l / | ||
| + | tftp -l / | ||
| + | tftp -l / | ||
| + | tftp -l / | ||
| + | tftp -l / | ||
| + | tftp -l / | ||
| + | |||
| + | Change the IP accordingly, | ||
| ====STEP 3: Booting initramfs image==== | ====STEP 3: Booting initramfs image==== | ||
| ===Method 1: using serial console (RECOMMENDED): | ===Method 1: using serial console (RECOMMENDED): | ||
| - | - Have TFTP server running, exposing the OpenWrt initramfs image, and set your computer' | + | - Have TFTP server running, exposing the OpenWrt initramfs image, and set your computer' |
| - Connect the serial console if you haven' | - Connect the serial console if you haven' | ||
| - | - Interrupt boot sequence by pressing any key in U-boot when prompted "Hit any key to stop autoboot" | + | - Interrupt boot sequence by pressing any key in U-boot when prompted "Hit any key to stop autoboot" |
| - Use the following commands to boot OpenWrt initramfs through TFTP: | - Use the following commands to boot OpenWrt initramfs through TFTP: | ||
| setenv serverip 192.168.0.22 | setenv serverip 192.168.0.22 | ||
| setenv ipaddr 192.168.0.1 | setenv ipaddr 192.168.0.1 | ||
| - | tftpboot | + | tftpboot |
| - | bootm 0x81000000 | + | bootm 0x82000000 |
| (Replace server IP and router IP as needed). | (Replace server IP and router IP as needed). | ||
| Line 159: | Line 189: | ||
| / | / | ||
| - | - If write is OK, reboot the device, it will reboot to OpenWrt | + | - If the write fails with " |
| - | | + | |
| + | cat / | ||
| + | |||
| + | Retry the write afterwards. | ||
| + | |||
| + | - If write is OK, reboot the device, it will reboot to OpenWrt initramfs: | ||
| reboot -f | reboot -f | ||
| - | - After rebooting, SSH into the device and use sysupgrade to perform | + | - After rebooting, SSH into the device and use sysupgrade to perform proper installation. |
| - | | + | |
| ===Method 3: using built-in TFTP recovery (LAST RESORT)=== | ===Method 3: using built-in TFTP recovery (LAST RESORT)=== | ||
| Line 182: | Line 216: | ||
| | | ||
| flash_erase /dev/mtd12 | flash_erase /dev/mtd12 | ||
| + | | ||
| + | - If the erase fails with " | ||
| + | |||
| + | cat / | ||
| + | |||
| + | Retry erasing afterwards. | ||
| | | ||
| Replace mtd12 with kernel partition if differrent. **THIS IS POINT OF NO RETURN.** | Replace mtd12 with kernel partition if differrent. **THIS IS POINT OF NO RETURN.** | ||
| Line 203: | Line 243: | ||
| ==== Flash Layout ==== | ==== Flash Layout ==== | ||
| <WRAP BOX> | <WRAP BOX> | ||
| - | FIXME // | ||
| - | |||
| - | Please check out the article [[docs: | ||
| mtd0: 000a0000 00010000 " | mtd0: 000a0000 00010000 " | ||
| mtd1: 00020000 00010000 " | mtd1: 00020000 00010000 " | ||
| Line 252: | Line 289: | ||
| ===== Failsafe mode ===== | ===== Failsafe mode ===== | ||
| - | -> [[docs: | + | See [[docs: |
| ===== Basic configuration ===== | ===== Basic configuration ===== | ||
| - | Since the router is equipped with LTE modem as its main WAN interface, it might be useful to connect to the Internet right away after installation. To do so, you first need to install NCM protocol. To do that, you need to connect | + | Since the router is equipped with LTE modem as its main WAN interface, it might be useful to connect to the Internet right away after installation. To do so over Luci, you' |
| - | /* Offine | + | You can also add the necessary packages when building a new image with [[https:// |
| + | As of this writing, | ||
| + | * https:// | ||
| + | * https:// | ||
| + | | ||
| - | After installing NCM, you can either | + | If you can't access the Internet via other means or you want to set it up via console or SSH, you can put the following entries in '' |
| < | < | ||
| - | config interface 'lte' | + | config interface 'wwan' |
| option proto ' | option proto ' | ||
| option device '/ | option device '/ | ||
| - | option pdptype 'IPV4V6' | + | option pdptype 'IP' |
| option apn ' | option apn ' | ||
| - | option ipv6 ' | ||
| - | option pincode ' | ||
| </ | </ | ||
| - | * If you don't know your APN, you can either consult with your operator, or delete the line " | + | Please refer to [[: |
| - | * If your SIM card doesn' | + | |
| - | * If your operator doesn' | + | |
| After configuring your LTE modem, you can follow [[docs: | After configuring your LTE modem, you can follow [[docs: | ||
| Line 313: | Line 350: | ||
| ===== Hardware ===== | ===== Hardware ===== | ||
| ==== Info ==== | ==== Info ==== | ||
| - | ---- datatemplatelist dttpllist ---- | + | <!-- ToH: { |
| - | template: meta:template_datatemplatelist | + | " |
| - | cols | + | " |
| - | filter | + | " |
| - | filter | + | " |
| - | ---- | + | " |
| + | | ||
| + | } --> | ||
| ==== Photos ==== | ==== Photos ==== | ||
| - | /* =====>>>>> | ||
| - | /* When uploading photos, **name them** intelligently. Nobody knows what 20100930_000602.jpg is! */ | ||
| - | /* e.g. {{: | ||
| - | /* Thanks, your wiki administration - Oct. 2015 */ | ||
| // | // | ||
| - | **Insert photo of front of the casing** | + | {{media: |
| + | {{: | ||
| //Back://\\ | //Back://\\ | ||
| - | **Insert photo of back of the casing** | + | {{media: |
| + | {{: | ||
| - | //Backside label://\\ | + | //Top://\\ |
| - | **Insert photo of backside | + | {{: |
| + | |||
| + | // | ||
| + | {{: | ||
| + | |||
| + | //Under device | ||
| + | {{: | ||
| + | |||
| + | // | ||
| + | {{: | ||
| + | {{: | ||
| + | {{: | ||
| + | {{: | ||
| ==== Opening the case ==== | ==== Opening the case ==== | ||
| Line 339: | Line 388: | ||
| **Note:** This will void your warranty! | **Note:** This will void your warranty! | ||
| - | <WRAP BOX> | + | - Take of battery lid (no battery support for this model, battery cage is dummy). |
| - | FIXME //Describe what needs to be done to open the device, e.g. remove rubber feet, adhesive labels, | + | - Unscrew screw placed behind battery lid. |
| - | | + | - Take off back cover. It attached with multiple plastic clamps. |
| - | </ | + | - Unscrew four more screws |
| + | - Remove front panel from blue chassis. There are more plastic | ||
| + | | ||
| + | | ||
| + | - Extract board from blue chassis. | ||
| //Main PCB://\\ | //Main PCB://\\ | ||
| - | **Insert photo of PCB** | + | {{: |
| + | {{: | ||
| + | |||
| + | //PCB Board Details and modem photo:// | ||
| + | {{: | ||
| + | {{: | ||
| + | {{: | ||
| + | {{: | ||
| + | {{: | ||
| + | {{: | ||
| + | {{: | ||
| + | {{: | ||
| + | {{: | ||
| + | {{: | ||
| + | {{: | ||
| ==== Serial ==== | ==== Serial ==== | ||