The NWA55AXE is a Wifi6 outdoor router with PoE support and a single LAN port.

Currently only a single version of the device exists.

1. Connect to the device via lan
2. Set your IP to `192.168.1.20`
3. Open Web UI at `192.168.1.2`
4. Login with username “admin” and the password from the sticker on the back of the device, select standalone mode
5. At maintenance/firmware-package upload the factory image (see Techdata: ZyXEL NWA55AXE)
6. The device should reboot into openwrt an be accessible via `192.168.1.1`

This installation routine is especially useful in case

• unknown device password (NWA55AXE lacks reset button)
• bricked device

Attach to the UART console header of the device. Interrupt the boot procedure by pressing Enter.

The bootloader has a reduced command-set available from CLI, but more commands can be executed by abusing the atns command.

The modified ZyXEL U-Boot has a restricted set of commands available, however, more can be accessed by abusing the 'atns' command.

Requirements

1. Local area network with 192.168.1.0/24 subnet
2. A TFTP server hosting the openwrt-initramfs.bin image running on the arbitrary IP address: e.g. 192.168.1.20
3. ramboot-factory.bin image (you'll download this image later via wget from the console)

Go through the following steps

1. Connect the serial cable to the console port
2. Connect the router to your LAN using ethernet cable
3. Start the terminal emulator and connect to the serial port
4. Connect the power cable which starts the router and you see the following
   

   U-Boot SPL 2018.09 (Jan 22 2021 - 07:42:43 +0000)
   Trying to boot from NAND
   
   Initializing NMBM ...
   Signature found at block 1023 [0x07fe0000]
   First info table with writecount 0 found in block 960
   Second info table with writecount 0 found in block 963
   NMBM has been successfully attached

5. Interrupt the boot sequence with the keyboard to enter the UART console
   

   gpio: pin 24 (gpio 24) value is 1
   Hit any key to stop autoboot:  0
   =>

6. Check the active slot:
   

   atds

7. Read the output to find the active slot
   

   Image0 status           :success [Slot A]
   Image1 status           :success [Slot B]
   Boot Image              :Image1  [Slot B is active]

8. Boot the OpenWRT initramfs image using the commands:
   

   atnf openwrt-initramfs.bin
   atna 192.168.1.10
   atns "192.168.1.20; tftpboot; bootm"

9. Wait until the text below appears and then press Enter
   

   Press the [f] key and hit [enter] to enter failsafe mode
   Press the [1], [2], [3] or [4] key and hit [enter] to select the debug level
   Please press Enter to activate this console.

10. You have successfully booted OpenWrt
    

    BusyBox v1.36.1 (2024-03-22 22:09:42 UTC) built-in shell (ash)
    
      _______                     ________        __
     |       |.-----.-----.-----.|  |  |  |.----.|  |_
     |   -   ||  _  |  -__|     ||  |  |  ||   _||   _|
     |_______||   __|_____|__|__||________||__|  |____|
              |__| W I R E L E S S   F R E E D O M
     -----------------------------------------------------
     OpenWrt 23.05.3, r23809-234f1a2efa
     -----------------------------------------------------
    === WARNING! =====================================
    There is no root password defined on this device!
    Use the "passwd" command to set up a new password
    in order to prevent unauthorized SSH logins.
    --------------------------------------------------
    root@(none):/#

11. Once OpenWrt has booted, you'll have to configure the network to get Internet access
12. Edit the file /etc/config/network
    

    vim /etc/config/network

13. Configure router's IP address, gateway, dns server
    

    (...)
    
    config interface 'lan'
            option device 'br-lan'
            option proto 'static'
            option ipaddr '192.168.1.10'
            option netmask '255.255.255.0'
            option ip6assign '60'
            option gateway '192.168.1.1'
            list dns '192.168.1.1'
    

14. Apply the changes with
    

    /etc/init.d/network restart

15. Verify the Internet connection
    

    ping www.google.com

16. If slot B is active, you'll have to install zyxel-bootconfig package
    

    opkg update 
    opkg install zyxel-bootconfig

17. ...and make slot A active (you don't have to do this is slot A is already active)
    

    zyxel-bootconfig /dev/mtd10 get-status
    zyxel-bootconfig /dev/mtd10 set-image-status 0 valid
    zyxel-bootconfig /dev/mtd10 set-active-image 0

18. Download the ramboot-factory image to the device, using for example SCP or wget
    

    cd /tmp
    wget --no-check-certificate -O ramboot-factory.bin https://downloads.openwrt.org/releases/23.05.3/targets/ramips/mt7621/openwrt-23.05.3-ramips-mt7621-zyxel_nwa55axe-squashfs-ramboot-factory.bin

19. Install the image to the NAND
    

    mtd write ramboot-factory.bin firmware
    reboot

20. Congratulations! Your device is now running OpenWrt.

~# cat /proc/mtd
dev:    size   erasesize  name
mtd0: 00080000 00020000 "u-boot"
mtd1: 00080000 00020000 "u-boot-env"
mtd2: 00080000 00020000 "factory"
mtd3: 02800000 00020000 "firmware"
mtd4: 00800000 00020000 "kernel"
mtd5: 02000000 00020000 "ubi"
mtd6: 02800000 00020000 "zy_firmware_1"
mtd7: 01400000 00020000 "zy_rootfs_data"
mtd8: 00d00000 00020000 "zy_logs"
mtd9: 00480000 00020000 "myzyxel"
mtd10: 00080000 00020000 "bootconfig"
mtd11: 00080000 00020000 "mrd"

Upload the Factory image using the devices web interface.

As the device uses a dual-image partition layout, OpenWrt can only installed on slot A. This requires the current active image prior flashing the device to be on slot B.

If the currently installed image is started from slot A, the device will flash OpenWrt to slot B. OpenWrt will panic upon first boot in this case and the device will return to the ZyXEL firmware upon next boot.

If this happens, first install a ZyXEL firmware upgrade of any version and install OpenWrt after that.

This installation routine is especially useful in case * unknown device password (NWA55AXE lacks reset button) * bricked device

Attach to the UART console header of the device. Interrupt the boot procedure by pressing Enter.

The bootloader has a reduced command-set available from CLI, but more commands can be executed by abusing the atns command.

Boot a OpenWrt initramfs image available on a TFTP server at 192.168.1.66. Rename the image to owrt.bin

  $ atnf owrt.bin
  $ atna 192.168.1.88
  $ atns "192.168.1.66; tftpboot; bootm"

Upon booting, set the booted image to the correct slot:

  $ zyxel-bootconfig /dev/mtd10 get-status
  $ zyxel-bootconfig /dev/mtd10 set-image-status 0 valid
  $ zyxel-bootconfig /dev/mtd10 set-active-image 0

Copy the OpenWrt ramboot-factory image to the device using scp. Write the factory image to NAND and reboot the device.

  $ mtd write ramboot-factory.bin firmware
  $ reboot

→ generic.sysupgrade

cd /tmp
wget http://downloads.openwrt.org/snapshots/trunk/XXX/xxx.abc
sysupgrade /tmp/xxx.abc

cd /tmp
wget http://downloads.openwrt.org/snapshots/trunk/XXX/xxx.abc
mtd write /tmp/xxx.abc linux && reboot

The device has a reduced uboot env:

=> athe
?       - alias for 'help'
at      - print OK
atds    - show dual image info
atgo    - boot
athe    - show available commands
atna    - set board IP for tftp
atnf    - set filename for tftp
atns    - set server IP for tftp
atnz    - do firmware update via tftp
atsh    - dump Manufacturer Related Data (MRD)
atsr    - reboot
=> atds

A problem which might occur is the customization of the uboot-env, which can be reset using:

=> atns "10.42.0.1; env default -a -f; saveenv; printenv"
baudrate=115200
bootargs=console=ttyS0,115200 loglevel=1
bootcmd=atgo   
bootdelay=1
bootfile=ZLD-current
ipaddr=192.168.1.2
netmask=255.255.255.0
serverip=192.168.1.103

In general, it helps to know that chaining commands in atns helps to execute other commands in the reduced bootloader.

To get back to the stock firmware, one can flash it from the bootloader using:

atna 10.42.0.2
atns 10.42.0.1
atnz 710ABZL1C0.bin

→ generic.debrick

→ failsafe_and_factory_reset

→ Basic configuration After flashing, proceed with this.
Set up your Internet connection, configure wireless, configure USB port, etc.

→ hardware.button on howto use and configure the hardware button(s). Here, we merely name the buttons, so we can use them in the above Howto.

The ZyXEL NWA55AXE has no buttons.

Front:

Back:

Backside label:
Insert photo of backside label

→ Warranty

Remove the two screws indicated:

Slide the PCB tray out from the outer housing as shown:

Main PCB:

→ port.serial general information about the serial port, serial port cable, etc.

The Serial Port of this specific device is indicated by the red ellipse:

The board may not come with header pins attached. In this case, remove the four screws indicated in blue. You may also want to either unplug the antenna cables, or remove the nuts holding the RP-SMA ports in place in the plastic housing. Remove the PCB to allow soldering the header pins from the back side of the board.

The pinout is pretty obvious, but just in case:

→ port.jtag general information about the JTAG port, JTAG cable, etc.

How to connect to the JTAG Port of this specific device:
Insert photo of PCB with markings for JTAG port

→ bootloader

None so far.

Space for additional notes, links to forum threads or other resources.

• ...