| Both sides previous revision Previous revision Next revision | Previous revision |
| toh:zte:mf286r [2023/08/16 20:58] – oops pcislocked | toh:zte:mf286r [2024/11/04 10:22] (current) – [Basic configuration] andrewz |
|---|
| /* USE https://openwrt.org/meta/create_new_device_page */ | /* USE https://openwrt.org/meta/create_new_device_page */ |
| |
| ZTE MF286 is a wireless LTE router, capable of connecting to LTE networks at speeds up to 300Mbps using carrier aggegation. It has tri-band 2.4GHz Wi-Fi 4 and dual-band 5GHz Wi-Fi 5 Wave 2 radios, four gigabit ethernet ports, one USB 2.0 port, two RJ-11 ports for connecting landline phones that lets you use the cellular network to make calls, and a battery slot on the back for a 3Ah battery. It is commonly used by some european ISPs for FWA(Fixed Wireless Access) services, by Windtre on Italy, Turkcell on Turkey, and more. Some models do not include battery or phone ports, as well as corresponding LEDs on the front. | ZTE MF286R is a wireless LTE router, capable of connecting to LTE networks at download speeds up to 300Mbps using carrier aggegation. It has 3x3 2.4GHz Wi-Fi 4 and 2x2 5GHz Wi-Fi 5 Wave 2 radios, four gigabit ethernet ports, one USB 2.0 port, two RJ-11 ports for connecting landline phones that lets you use the cellular network to make calls. It is commonly used by some European ISPs for FWA(Fixed Wireless Access) services, such as Windtre on Italy, Turkcell on Türkiye, and more. Some models of the MF286 family include battery or phone ports, as well as corresponding LEDs on the front. |
| |
| {{media:zte:mf286r:mf286r-all-angles.jpg?512|ZTE MF286R from all angles.}} | {{media:zte:mf286r:mf286r-all-angles.jpg?512|ZTE MF286R from all angles.}} |
| |
| ===== Supported Versions ===== | ===== Supported Versions ===== |
| ---- datatable ---- | <!-- ToH: { |
| cols : Brand, Model, Versions, Supported Current Rel, OEM device homepage URL_url, Forum Search_search-forums, Device Techdata_pageid | "source": "json", |
| headers : Brand, Model, Version, Current Release, OEM Info, Forum Search, Technical Data | "dom": "t", |
| align : c,c,c,c,c,c,c | "paging": false, |
| filter : Brand=ZTE | "rotate": true, |
| filter : Model=MF286R | "shownColumns": ["brand", "model", "version", "supportedcurrentrel", "oemdevicehomepageurl", "forumsearch", "deviceid"], |
| ---- | "filterColumns": {"brand": "^ZTE$", "model": "^MF286R$"} |
| | } --> |
| |
| /* If no unsupported functions known, comment out the following datatable or delete it. */ | /* If no unsupported functions known, comment out the following datatable or delete it. */ |
| ---- datatable ---- | <!-- ToH: { |
| cols : Unsupported Functions_unsupporteds | "source": "json", |
| filter : Brand=ZTE | "dom": "t", |
| filter : Model=MF286R | "paging": false, |
| ---- | "shownColumns": ["unsupported_functions"], |
| | "filterColumns": {"brand": "^ZTE$", "model": "^MF286R$"} |
| | } --> |
| |
| ===== Experimental Versions ===== | ===== Experimental Versions ===== |
| |
| ===== Hardware Highlights ===== | ===== Hardware Highlights ===== |
| ---- datatable ---- | <!-- ToH: { |
| cols : Model, Versions, CPU, CPU MHz, CPU Cores_numcores, Flash MB_mbflashs, RAM MB_mbram, WLAN Hardware, WLAN 2.4GHz, WLAN 5.0GHz, Ethernet 100M ports_, Ethernet Gbit ports_, Modem, USB ports_ | "source": "json", |
| header : Model, Version,SoC,CPU MHz,CPU Cores,Flash MB,RAM MB,WLAN Hardware,WLAN2.4,WLAN5.0,100M ports,Gbit ports,Modem,USB | "dom": "t", |
| align : c,c,c,c,c,c,c,c,c,c,c,c,c | "paging": false, |
| filter : Brand=ZTE | "rotate": true, |
| filter : Model=MF286R | "shownColumns": ["model", "version", "cpu", "cpumhz", "cpucores", "flashmb", "rammb", "wlanhardware", "wlan24ghz", "wlan50ghz", "ethernet100mports", "ethernet1gports", "modem", "usbports"], |
| ---- | "filterColumns": {"brand": "^ZTE$", "model": "^MF286R$"} |
| | } --> |
| |
| ===== Installation ===== | ===== Installation ===== |
| ---- datatable ---- | <!-- ToH: { |
| cols : Model, Versions, Supported Current Rel, Firmware OpenWrt Install URL_url, Firmware OpenWrt Upgrade URL_url, Firmware OEM Stock URL_url | "source": "json", |
| headers : Model, Version, Current Release, Firmware OpenWrt Install, Firmware OpenWrt Upgrade, Firmware OEM Stock | "dom": "t", |
| align : c,c,c | "paging": false, |
| filter : Brand=ZTE | "rotate": true, |
| filter : Model=MF286R | "shownColumns": ["model", "version", "supportedcurrentrel", "firmwareopenwrtinstallurl", "firmwareopenwrtupgradeurl", "firmwareoemstockurl"], |
| ---- | "filterColumns": {"brand": "^ZTE$", "model": "^MF286R$"} |
| | } --> |
| |
| -> [[docs:guide-user:installation:generic.flashing|Install OpenWrt (generic explanation)]] | -> [[docs:guide-user:installation:generic.flashing|Install OpenWrt (generic explanation)]] |
| |
| TL:DR; Get a serial adapter and connect to the serial(see [[:toh:zte:mf286r#serial|Serial]]), boot the initramfs image, then apply the sysupgrade image. | TL:DR; Get a serial adapter and connect to the serial(see [[:toh:zte:mf286r#serial|Serial]]), boot the initramfs image, then apply the sysupgrade image. |
| If you don't have a serial adapter, you can use the known exploiot to gain a root shell and move from there. | If you don't have a serial adapter, you can use the known exploit to gain a root shell and move from there. |
| |
| |
| - Check the flash layout of the device: | - Check the flash layout of the device: |
| |
| | <WRAP BOX> |
| cat /proc/mtd | cat /proc/mtd |
| | </WRAP> |
| |
| <WRAP BOX> | |
| It should show the following: | It should show the following: |
| | |
| mtd0: 000a0000 00010000 "u-boot" | mtd0: 000a0000 00010000 "u-boot" |
| mtd1: 00020000 00010000 "u-boot-env" | mtd1: 00020000 00010000 "u-boot-env" |
| mtd15: 03200000 00020000 "fota" | mtd15: 03200000 00020000 "fota" |
| mtd16: 01d00000 00020000 "firmware" | mtd16: 01d00000 00020000 "firmware" |
| </WRAP> | |
| |
| //Differences might indicate that this is NOT a MF286A device but one of other variants.// | //Differences might indicate that this is NOT a MF286A device but one of other variants.// |
| umount /var/usb_disk; sync | umount /var/usb_disk; sync |
| | |
| - Store the files in safe place if you ever plan to return to stock firmware. This is especially important, because stock firmware for this device is not available officially, and is usually customized by the mobile providers. | - Store the files in safe place if you ever plan to return to stock firmware. **This is especially important, because stock firmware for this device is not available officially, and is usually customized by the mobile providers.** |
| |
| - Alternatively, you can use the TFTP server you are already going to use for the openwrt initramfs image, as a storage for the MTD dumps, by using something similar to: (Thanks to cicibird at discord for this tip) | |
| |
| <WRAP BOX> | Alternatively, you can use the TFTP server you are already going to use for the openwrt initramfs image, as a storage for the MTD dumps, by using something similar to: (Thanks to cicibird at discord for this tip) |
| tftp -l /dev/mtd0ro -r mtd0ro_uboot.img -p 192.168.1.144 | |
| tftp -l /dev/mtd1ro -r mtd1ro_uenv.img -p 192.168.1.144 | tftp -l /dev/mtd0ro -r mtd0ro_uboot.img -p 192.168.1.144 |
| tftp -l /dev/mtd2ro -r mtd2ro_reseved1.img -p 192.168.1.144 | tftp -l /dev/mtd1ro -r mtd1ro_uenv.img -p 192.168.1.144 |
| tftp -l /dev/mtd3ro -r mtd3ro_foto-flag.img -p 192.168.1.144 | tftp -l /dev/mtd2ro -r mtd2ro_reseved1.img -p 192.168.1.144 |
| tftp -l /dev/mtd4ro -r mtd4ro_art.img -p 192.168.1.144 | tftp -l /dev/mtd3ro -r mtd3ro_foto-flag.img -p 192.168.1.144 |
| tftp -l /dev/mtd5ro -r mtd5ro_mac.img -p 192.168.1.144 | tftp -l /dev/mtd4ro -r mtd4ro_art.img -p 192.168.1.144 |
| tftp -l /dev/mtd6ro -r mtd6ro_reserved2.img -p 192.168.1.144 | tftp -l /dev/mtd5ro -r mtd5ro_mac.img -p 192.168.1.144 |
| tftp -l /dev/mtd7ro -r mtd7ro_cfg-param.img -p 192.168.1.144 | tftp -l /dev/mtd6ro -r mtd6ro_reserved2.img -p 192.168.1.144 |
| tftp -l /dev/mtd8ro -r mtd8ro_log.img -p 192.168.1.144 | tftp -l /dev/mtd7ro -r mtd7ro_cfg-param.img -p 192.168.1.144 |
| tftp -l /dev/mtd9ro -r mtd9ro_oops.img -p 192.168.1.144 | tftp -l /dev/mtd8ro -r mtd8ro_log.img -p 192.168.1.144 |
| tftp -l /dev/mtd10ro -r mtd10ro_reserved3.img -p 192.168.1.144 | tftp -l /dev/mtd9ro -r mtd9ro_oops.img -p 192.168.1.144 |
| tftp -l /dev/mtd11ro -r mtd11ro_web.img -p 192.168.1.144 | tftp -l /dev/mtd10ro -r mtd10ro_reserved3.img -p 192.168.1.144 |
| tftp -l /dev/mtd12ro -r mtd12ro_kernel.img -p 192.168.1.144 | tftp -l /dev/mtd11ro -r mtd11ro_web.img -p 192.168.1.144 |
| tftp -l /dev/mtd13ro -r mtd13ro_rootfs.img -p 192.168.1.144 | tftp -l /dev/mtd12ro -r mtd12ro_kernel.img -p 192.168.1.144 |
| tftp -l /dev/mtd14ro -r mtd14ro_data.img -p 192.168.1.144 | tftp -l /dev/mtd13ro -r mtd13ro_rootfs.img -p 192.168.1.144 |
| tftp -l /dev/mtd15ro -r mtd15ro_foto.img -p 192.168.1.144 | tftp -l /dev/mtd14ro -r mtd14ro_data.img -p 192.168.1.144 |
| tftp -l /dev/mtd16ro -r mtd16ro_frimware.img -p 192.168.1.144 | tftp -l /dev/mtd15ro -r mtd15ro_foto.img -p 192.168.1.144 |
| </WRAP> | tftp -l /dev/mtd16ro -r mtd16ro_frimware.img -p 192.168.1.144 |
| |
| Change the IP accordingly, of course. | Change the IP accordingly, of course. |
| setenv serverip 192.168.0.22 | setenv serverip 192.168.0.22 |
| setenv ipaddr 192.168.0.1 | setenv ipaddr 192.168.0.1 |
| tftpboot 0x81000000 openwrt-ath79-nand-zte_mf286a-initramfs-kernel.bin | tftpboot 0x82000000 openwrt-ath79-nand-zte_mf286a-initramfs-kernel.bin |
| bootm 0x81000000 | bootm 0x82000000 |
| |
| (Replace server IP and router IP as needed). | (Replace server IP and router IP as needed). |
| |
| ===== Basic configuration ===== | ===== Basic configuration ===== |
| Since the router is equipped with LTE modem as its main WAN interface, it might be useful to connect to the Internet right away after installation. To do so, you first need to install NCM protocol. To do that, you need to connect the router to the internet via Wi-Fi or Ethernet, configure the IP, gateway and DNS settings, then use the System > Software section in LuCI to install the **luci-proto-ncm** package. For more info about installing [[:packages:start|packages]], see [[:docs:guide-user:additional-software:managing_packages]] | Since the router is equipped with LTE modem as its main WAN interface, it might be useful to connect to the Internet right away after installation. To do so over Luci, you'd need to connect to Internet via other means (Ethernet or Wi-Fi STA) and then install ''luci-proto-ncm'' package. |
| |
| /* Offine install is possible but I couldn't find a way to get a link to the luci-proto-ncm. */ | You can also add the necessary packages when building a new image with [[https://firmware-selector.openwrt.org/|Firmware Selector]] or download the package as well as its missing dependencies after installation via OpenWrt's website, upload them to the router and install them manually, which doesn't require the router to be connected to Internet. |
| | As of this writing, the package and its dependencies can be found from the following page (check and update the version accordingly): |
| | * https://downloads.openwrt.org/releases/23.05.5/packages/mips_24kc/luci/ |
| | * https://downloads.openwrt.org/releases/23.05.5/targets/ath79/nand/packages/ |
| | * https://downloads.openwrt.org/releases/23.05.5/packages/mips_24kc/base/ |
| |
| After installing NCM, you can either put the following entries in /etc/config/network, replacing the specific configuration entries with one needed for your ISP, or add the interface through LuCı. | If you can't access the Internet via other means or you want to set it up via console or SSH, you can put the following entries in ''/etc/config/network'', replacing the specific APN with one needed for your ISP. |
| |
| <code> | <code> |
| config interface 'lte' | config interface 'wwan' |
| option proto 'ncm' | option proto 'ncm' |
| option device '/dev/ttyACM0' | option device '/dev/ttyACM0' |
| option pdptype 'IPV4V6' | option pdptype 'IP' |
| option apn 'internet' | option apn 'internet' |
| option ipv6 'auto' | |
| option pincode '1234' | |
| </code> | </code> |
| |
| * If you don't know your APN, you can either consult with your operator, or delete the line "option apn ...", in which case the modem will use the last known APN(not recommended). | Please refer to [[:docs:guide-user:network:wan:wwan:ethernetoverusb_ncm#network_configuration|NCM modem configuration]] for further details. |
| * If your SIM card doesn't have a PIN code, remove the line containing "option pincode ....". | |
| * If your operator doesn't support IPv6, replace IPV4V6 with IPV4. | |
| | |
| After configuring your LTE modem, you can follow [[docs:guide-user:base-system:start|Basic configuration]] to proceed with other configuration steps, such as [[:docs:guide-user:network:wifi:start|setting up your Wi-Fi]]. | After configuring your LTE modem, you can follow [[docs:guide-user:base-system:start|Basic configuration]] to proceed with other configuration steps, such as [[:docs:guide-user:network:wifi:start|setting up your Wi-Fi]]. |
| ===== Hardware ===== | ===== Hardware ===== |
| ==== Info ==== | ==== Info ==== |
| ---- datatemplatelist dttpllist ---- | <!-- ToH: { |
| template: meta:template_datatemplatelist | "source": "json", |
| cols : Brand, Model, Versions, Device Type, Availability, Supported Since Commit_git, Supported since Rel, Supported current Rel, Unsupported, Bootloader, CPU, Target, CPU MHz, Flash MBs, RAM MB, Switch, Ethernet 100M ports_, Ethernet Gbit ports_, Comments network ports_, Modem, VLAN, WLAN 2.4GHz, WLAN 5.0GHz, WLAN Hardwares, WLAN Comments_, Detachable Antennas_, USB ports_, SATA ports_, Comments USB SATA ports_, Serial, JTAG, LED count, Button count, Power supply, Device Techdata_pageid, Forum topic URL_url, wikidevi URL_url, OEM Device Homepage URL_url, Firmware OEM Stock URL_url, Firmware OpenWrt Install URL_url, Firmware OpenWrt Upgrade URL_url, Comments_ | "dom": "t", |
| filter : Brand=ZTE | "paging": false, |
| filter : Model=MF286R | "rotate": true, |
| ---- | "shownColumns": ["brand", "model", "version", "devicetype", "availability", "supportedsincecommit", "supportedsincerel", "supportedcurrentrel", "unsupported_functions", "bootloader", "cpu", "target", "cpumhz", "flashmb", "rammb", "switch", "ethernet100mports", "ethernet1gports", "commentsnetworkports", "modem", "vlan", "wlan24ghz", "wlan50ghz", "wlanhardware", "wlancomments", "detachableantennas", "usbports", "sataports", "commentsusbsataports", "serial", "jtag", "ledcount", "buttoncount", "powersupply", "deviceid", "owrt_forum_topic_url", "wikideviurl", "oemdevicehomepageurl", "firmwareoemstockurl", "firmwareopenwrtinstallurl", "firmwareopenwrtupgradeurl", "comments"], |
| | "filterColumns": {"brand": "^ZTE$", "model": "^MF286R$"} |
| | } --> |
| |
| ==== Photos ==== | ==== Photos ==== |