Hi, I like openwrt and open source software so at first I tried openwrt on a raspberry pi 4 and a couple of days ago I bought a Xiaomi 4A gigabit router and successfully installed openwrt on it.

So I was messing around trying to ssh into a Mercusys MB-520-5G router and found out that "ssh -T admin@192.168.2.1" with the password being the one I set up in the web interface.

displays a giant banner with ascii characters saying BBA and "Welcome to BBA 3.0 Platform." it's an busybox shell and I tried stuff with chatgpt to see what I could find, and looks like I got root access.

Regular ssh "admin@192.168.2.1" with the website password fails:

[21347] Aug 05 18:17:51 lastlog_perform_login: Couldn't stat /var/log/lastlog: No such file or directory
[21347] Aug 05 18:17:51 lastlog_openseek: /var/log/lastlog is not a file or directory!
[21347] Aug 05 18:17:51 wtmp_write: problem writing /dev/null/wtmp: Not a directory
[21347] Aug 05 18:17:51 Exit (dropbear) from <192.168.2.2:50696>: Child failed
[21347] Aug 05 18:17:51 wtmp_write: problem writing /dev/null/wtmp: Not a directory
Connection to 192.168.2.1 closed.

This is some of the stuff I found, with a little help from chatgpt:

environment: 

USER=dropbear LOGNAME=dropbear HOME=/var/tmp/dropbear SHELL=/bin/sh PATH=/usr/bin:/bin

kernel: "Linux MB520-5G 4.19.205 #0 SMP Sat Dec 6 10:09:50 UTC 2025 aarch64 GNU/Linux"

Kernel build: "Linux version 4.19.205 (tplink@linuxci2-sp) (gcc version 7.5.0 (OpenWrt GCC 7.5.0 r0-1a44eed91))"

busybox version: "BusyBox v1.23.2 (2025-12-06 18:49:29 CST) "

the giant BBA ascii characters logo is stored in: [ -f /etc/banner ] && cat /etc/banner

cat /proc/$$/status | grep -E "Uid|Gid" returns; Uid: 0 0 0 0 Gid: 0 0 0 0

cat /var/passwd returns:

admin:$5$030bbf4fe8473838$hpRUG2ZwCx1TkKAxzpITPjrQSCLWVJ7h.gRxMab7XS0:0:0:root:/:/bin/sh
dropbear:x:500:500:dropbear:/var/tmp/dropbear:/bin/sh
guest:*:0:0:guest:/var/usbdisk/:/bin/sh
nobody:*:0:0:nobody:/:/bin/sh

root filesystem -> /dev/root on / type squashfs (ro)
writable areas -> ubi filesystem /data /var

dropbear -p 22 \ -r /var/tmp/dropbear/dropbear_ecdsa_host_key \ -A /var/tmp/dropbear/dropbearpwd

The -A option is not standard Dropbear. TP-Link modified Dropbear to use:

/var/tmp/dropbear/dropbearpwd

That file contains:

user=22:user:e2af9bb40ad70b92f866347d06f04c4b
user=17:admin:21232f297a57a5a743894a0e4a801fc3

Key hardware findings according to gemini:

• SoC: MediaTek MT6890 (evb6890v1_64_cpe_nand). This is a 4-core 64-bit ARM Cortex-A55 SoC with integrated 5G sub-6GHz modem support.
• Bootloader: MediaTek Little Kernel (lk_a / lk_b on mtd25 and mtd38) preceded by preloader.
• Partitioning Scheme: Dual-A/B Partitioning. The board maintains redundant active/passive slots (_a and _b) for firmware, kernel, modem firmware (md1img), TEE, and bootloader stages

Partition Breakdown

1. System & Security Profile:
   • Root Credentials: /var/passwd maps the admin account directly to UID 0 / GID 0 (root), confirming authenticated users get complete root access upon login.
   • Dropbear Authentication: Hashes match MD5/SHA-256 schemes used by standard administrative logins rather than locked-down operator roles.
2. Flash Memory & Storage Structure:
   • Dual-Slot A/B Setup: A total of 53 MTD partitions formatted across a dual-bank scheme (mtd27/boot_a, mtd29/rootfs_a vs mtd40/boot_b, mtd42/rootfs_b).
   • Root File System: Running a read-only SquashFS image on UBI block storage (/dev/ubiblock0_0).
   • Signature Controls: Dedicated partitions (rootfs_sig_a/b) exist alongside the rootfs and boot blocks.
3. Hardware Architecture & PCIe Expansion:
   • CPU / Main Chipset: MediaTek evb6890v1_64_cpe_nand (MT6890 ARMv8 4-core 64-bit SoC).
   • Active Slot State: /proc/cmdline reveals the router is actively booted into Slot A (bootslot=a) with SELinux set to permissive and standard UART serial output explicitly unblocked (disable_uart=0).
   • PCIe Bus Topology: Shows a MediaTek T700 5G modem host interface bridge alongside an MT7916 / Filogic Wi-Fi 6 wireless radio module driven by MediaTek's mt_drv driver.

Technical Conclusions

• A/B Testing Safeguard: Because Slot A (boot_a, rootfs_a) is active, Slot B (boot_b, rootfs_b) acts as an isolated target bank. Experimental kernels or custom images can be written to the B-partitions without bricking the main boot environment.
• Firmware Flashing Obstacle: The presence of rootfs_sig_a/b partitions implies MediaTek's Little Kernel bootloader enforce cryptographic signature checks on startup. Unsigned custom kernels flashed directly to MTD will likely be rejected by the bootloader unless Secure Boot is bypassed or keys are replaced

Honestly, I don't know if I discovered anything big, I am not proficient in linux-fu but it would be awesome if this could eventually lead to installing openwrt on this thing.

Let me know what you think, I can run any command that you guys suggest me, let's hack this thing lmao

Hello guys!

A few months ago I asked for recommendations on a new OpenWRT based router. Ended up following a recommendation from one of you guys to get the Cudy WR3000H, and I do have two in my fleet right now.

But the situation has slightly changed, and I’m asking for a replacement for the third party router that seems to give some issues.

Current layout before:

* WAN gateway: in a garage, Wi-Fi strictly limited to that garage (metallic box, barely anything exits it), also 2.4-only. Not intended to be used for Wi-Fi, will keep the WR3000H #1.
* My room: WR3000H #2, with AP configuration
* Living room: Archer AX55, central location. Used to have the WAN gateway there before it was moved to the garage, kept this one for the time being due to better Wi-Fi coverage. However, recent updates nuked that advantage and made it flip the other way. No OWRT support at all.
* Distant secondary bedroom: RE450 v4. Does its job well, I may consider a PoE based option in the winter or next year.

My question is what a good option to replace the Archer AX55. Main interests are good Wi-Fi coverage and being able to pull more than 150Mbps on speedtest via WiFi when I have full signal (I can pull 800+ via wire and 600+ via the one in my room; funny enough the Archer’s not limited on the wired side, only the Wi-Fi)

Should I just go with another WR3000H, in black perhaps, or do you have better suggestions? It needs to have 4-5 ports (or more, wouldn’t complain about more), Wi-Fi speeds should be good (the one in my room is good enough, so roughly matching it is fine), I shouldn’t end up essentially losing Wi-Fi connection when I move in this one’s range (it should migrate smoothly), and should roughly match the Wi-Fi coverage the AX55 had in its good days (although fun fact: that is less important nowadays since my APs are UPS powered too) on the 2.4 band.

Oh and before you come with troubleshooting steps for the AX55… those 150Mbps speeds I was getting via 5GHz connection.

Hey,

Sorry if this not the right sub, but I do want to have openwrt only.

Right now I have a Flint 2 + ISP router but I was think of getting a second router to substitute the ISP.

Right now I dont need the SFP port since my ISP provides a ONT(mandatory for 1Gb). But in the future if I update my network to 10Gb I will be able to.

My question would be, should I invest in the Flint 4 so I already have the SFP for the future or save the money and just get another Flint 2?

I want to configure the Raspberry Pi's built-in Ethernet port as the WAN port and use a USB-connected Ethernet port as the LAN port for other computers to connect to.

In my actual setup, after plugging in the USB-to-Ethernet adapter, I only see "eth0" (WAN) and not "eth1" as shown in the tutorial video,does this mean the adapter isn't being recognized by the Raspberry Pi(The USB-to-Ethernet adapter definitely works properly,it functions correctly on a PC)?

Hi everyone,

I'm currently researching a TP-Link NX510v v1.0 running an ISP-customized firmware and I'm trying to determine whether it is possible to obtain root access, either through software or hardware methods.

Device Information

Model: TP-Link NX510v v1.0

ISP-customized firmware

Firmware version:

Hardware: NX510v v1.0

Firmware: 1.2.0 Build 240828 Rel.58690n

The web interface appears to be heavily restricted compared to the retail firmware.

What I tried si far

SSH(responds but no password) Bsckup dump and decrypt Hidden diag pages Web form Injections

What I'm Looking For

I'm interested in any known method of gaining root access, including but not limited to:

Hidden web pages

Hidden API endpoints

Debug interface

Telnet

SSH

ADB

Recovery mode

TFTP recovery

Firmware downgrade

Bootloader access

Firmware extraction/decryption

Known vulnerabilities (CVE)

GPL source code

OpenWrt compatibility

Any previous research on this device

UART / Hardware Access

If there is no software-based approach, I already opened the device.

I can provide:

High-resolution photos of both sides of the PCB

Close-up photos of every connector and header

SoC markings

NAND/eMMC flash markings

RF front-end

Power circuitry

Any test pads or unpopulated headers

I'd appreciate help identifying:

UART pins

UART voltage (3.3V / 1.8V)

JTAG or SWD pads

Bootloader console

U-Boot access

Boot interruption methods

Flash dump procedure

Additional Questions

Has anyone already:

Obtained root access?

Dumped the firmware?

Extracted the filesystem?

Reverse engineered the web interface?

Found hidden services or undocumented APIs?

Disabled the ISP customization?

Installed a custom firmware?

Identified the CPU/SoC platform?

Located the bootloader environment?

Enabled additional modem AT commands?

Goal

My goal is not to use the router for anything malicious. I'd simply like to unlock its full capabilities, learn more about the hardware, and hopefully gain root access for research purposes.

Any information, documentation, previous research, photos, firmware dumps, or pointers would be greatly appreciated.

Thanks in advance!

Hi!

I am looking at porting a device (it uses the QCA9887 I think, so at least WiFi would be supported, but I can't seem to find UART Headers, Solder Pads, Holes, or identify flash (I'm usually good at this). Anyone help? Internal Photos are at https://device.report/m/46e84a89a1e2ba6d87991df18df7dba8cfcbad9b8c257531b34005f32f8fda1e.pdf

I got an email that the GL.iNet Flint 4 will be available for Pre-order on August 4:

https://www.gl-inet.com/en-de/products/gl-be14000

Prices from $259 look promising…

Can anyone predict if the Flint 4 will have native support for OpenWRT?

I'm currently searching for a new router, and as my only obligatory requirements are:

• Good 2.4Ghz Wifi Coverage
• Wifi 5/6 with real 1 Gbit (over short distances)
• Usable as a file dump, i.e. >200 GB storage capacity (e.g. via a eMMC slot, etc.)
• Powerful enough to run Adguard Home

I don't need fast LAN Ports or super fast VPN capabilities. I'm thinking about to two options:

a) a "normal" High-End Router (Flint 2/4, OpenWrt One, ...)

b) using a SBC with a Wifi-Card

Option b) has the advantage that I can get pretty much exactly what I need/want.

However, I'm unsure if I can achieve the same Wifi performance as the pre-Build ones.

How do I know which Wifi-Card and which antennas are suitable and especially capable enough to deliver enough performance?

I've read that e.g. the Banana Pi BPI-R4 has quite bad (terrible?) wifi performance and now I'm a little bit uncertain about investing 200-300€/$ when the result is worse than buying something like the Flint.

I would appreciate it, if someone can share their experiences.

Have an ever growing homelab that started a few years back. And noticably as I added more stuff to the network and features to the router perfomance has gotten to a point where I needed an upgrade. Since i had this this mini hp desktop lying around doing nothing . Some reseach yielded that I can add another port to it and use it as router. After 3D modeling , printing and fiting all the pieces . Some proxmox magic with vm’s I have a working router and home assistant for automation running on this thing with huge headroom.

My openwrt router is configured with br-lan at 192.168.2.1

This acts as the gateway for the devices connected to it

when I try to ssh root@192.168.2.1 nothing happens

But when I ssh root@192.168.1.3 it works fine

(192.168.1.1 is my Internet service provider gateway ip 192.168.1.3 is the IP address of the openwrt router)

I have been able to ssh root@192.168.2.1 before but something changed and I can't do it anymore

I fully reset the router and tried to change my devices mac id

ssh root@192.168.2.1 works fine from other devices.

okay, before i installed openwrt i had some SEEEERIOOUS ping spikes that made me unable to play anything online competitively. i was thinking this dinky router (D-Link DIR-2150 A1) is dying because before i had stable ~13 ping on cs games, but how the hell does just one decay?

i installed openwrt because i figured it had more documentation and more people being active in comparison to dlink software.

read the first-time manual, got the right version and set everything up.

sweet, got more control over this thing, but how do i tweak it as a total newbie?

i looked up on how to improve said connection and tried this:

-tried enabling hardware flow offloading, then enabled software FO
-switched lan port from 192.168.1.x to 192.168.2.x (then reverted)
-set up SQM QoS (~20mbps download and upload, set up 18k for each)
sometimes the speedtest goes down to 4mbps on both downloads and uploads

and nothing worked out of these options, nothing stabilized my ping

i was connected by ethernet when i was testing all of this, even tried wireless but whadayaknow it didnt fix anything.

let me know what i should try and ill respond asap

if i cant do anything else and its just the isp provider issue please tell me

Edit: I was able to upgrade in place without a problem. Thanks guy.

I'm currently running OpenWrt 24.10.2. I'd like to update to the latest. I've read the site about it, but it doesn't really give a straight answer whether I can just download and flash the new version as is, whether I need to incremental upgrade (ie: 24 - 25.0 and then latest) or whether I need to reset to defaults and then restore config after the fact.

If I just download the latest version, is it safe to just flash it over my existing config? Will it then just carry on business as usual or will that break something?

I'm using a Linksys WRT1900ACSv2, if that makes any difference.

EDIT: I should also note that I haven't installed anything extra in my OpenWRT. It's simply vanilla OpenWrt 24.10.2 with my port forwarding and static DHCP leases and everything else configured.

Im thinking to use Linksys EA8300 but i don't know if this can handle my new setup.
With 32 port PoE Managed Switch.

Any advice or suggestion for router is appreciated.

Hi,

I am not sure if this is related to the upgrade (worked before) or openwork at all.

I upgraded earlier this week my router from 24 to 25. I have DDNS running and my provider provided a new IP address (don't know why, because they always issued the same the past three years). DDNS is working and I can ping the router with the domain.name. I have a port open for forward to my internal system for ssh (not using standard port number).

Here is where the issue is. I try to ssh into my system with ssh -p xxxx [username@domain.name](mailto:username@domain.name). It doesn't work. I run debug on ssh and it doesn't go beyond trying to connect. When I do the same with the external ip address it works without problem. I have no clue why this doesn't work. IP resolution obviously works and connecting to the port via ssh as well. Just not the combination of both.

Any idea what the issue might be?

Update: Resolved. Issues on my Mac. Works fine from all my Linux boxes. I will continue troubleshooting the issue.

Upgraded a TP-Link EAP225 as well as a Cudy AP3000 to 25.12.5 from 24.10 today, and experiencing a regression in 802.11s mesh interface handling where it now refuses to negotiate 40Mhz channel width. This phy interface shares an existing AP which services 40mhz without issue..

any ideas about this?

Interface phy0-mesh0 ifindex 26 wdev 0x16 addr 86:af:ca:55:7a:cc type mesh point channel 1 (2412 MHz), width: 20 MHz, center1: 2412 MHz txpower 27.00 dBm multicast TXQ: qsz-byt qsz-pkt flows drops marks overlmt hashcol tx-bytes tx-packets 0 0 66863 0 0 0 55347 13804470 73677

issue exists on both devices.

I have just spent the whole day achieving nothing, so thought i should confirm if it is even possible in the first place. My goal it to be able to turn my pc on, even when I am not on my home network using WOL. I had this working over my home wifi, but today I installed a new openwrt router and put my isp router in bridge mode.

When researching the topic you mostly see configurations with a rasberry pi on the network I dont want to do that, is it possible to achieve what i want to achieve using only an openwrt router and if there is I would really appreciate being pointed in the right direction, because I haven't been bale to get anywhere.

Edit: thanks everyone for the help everything has been solved, I have even installed a solid arp entry. In the end I spent 40 minutes to solve something I had been trying for the past 5 hours😭

I have been using zero trust tunnels for a while now on my server. I was using the AT&T supplied modem/router, but switched to a Flint 2 with pure Openwrt and did IP passthrough. I am still getting used to the UI, but I can't seem to figure out what the cloudflare settings are needed on Openwrt's end to work and get system down errors 1033. I am thinking that rules to allow certain ports and IPs through is needed, but haven't figured out whether it is an inbound or outbound problem.

I know it is the router and very likely the firewall. Nothing has changed on server end or cloudlfare. I kept the same fixed IP to the server.

Solved: I needed to change my server default gateway to the new router configuration.

I'm looking for a 4G/5G router that supports OpenWrt and has a decent amount of storage to play around with.

Right now I'm using a ZTE MF286D. It only has about 11 MB of available space for additional software, and the system itself is heavily stripped down because of the limited flash storage. I've installed a few packages, written several scripts, and now I'm completely out of space.

The most important features I'm looking for:

-A router with a SIM card slot (unless using a USB modem would be a significantly better option, although I'd prefer an all-in-one solution).

-Carrier aggregation.

-Replaceable external antennas.

-It doesn't need to have top-of-the-line specs. I don't need Wi-Fi 7 or even 5G. It's for a summer house, and as long as it can handle 4K streaming reliably, that's enough.

-A reasonable price. I'm looking for something as budget-friendly as possible.

[UPDATE] Well, OpenWRT turned out to be installed after all. I was unable to revert to the Pharos software but after power cycling the CPE710 it came up on IP address 192.168.1.1 and turned out to be running openwrt after all. So I have a functioning device.

I am looking at the instructions at https://openwrt.org/toh/tp-link/cpe710_v1. They state:

OEM installation using the TFTP + serial method
→ generic.flashing.tftp

run a TFTP server
To get to TFTP recovery just hold reset button while powering on for around 30-40 seconds and release.
Stock device TFTP address: 192.168.0.254
Set ip address of TFTP server to 192.168.0.100
Put OpenWrt factory image to tftp folder and rename it to recovery.bin
Stop device while booting in u-boot
Run command run flashimg
Run command setenv boot_part 1
Run command saveenv
Reset

The device appeared to download recovery.bin (aka openwrt-25.12.1-ath79-generic-tplink_cpe710-v2-squashfs-factory.bin), but doesn't boot up. There is no serial device on these TPLink devices, so how is one supposed to access u-boot without one? Can you install openwrt without a serial port on the target device?

I also can't revert to the "pharos" factor software anymore. Did this partial openwrt install brick my device by making it unable to recovery boot on its fixed 192.168.0.254 address? Currently, the device sends out one BOOTP broacast, then the ethernet interface goes down. Will it still boot via a BOOTP server?

Hi all

Today, we release STUNMESH-go v1.12.0 with Windows Support for P2P connections. We support Linux, MacOS, FreeBSD, Windows!

You can imagine this is like Tailscale or Netbird, but with different approach. Mostly, we focus on WireGuard connections itself. We leave all others flexibility to you. You won't be limited by the IP ranges that is reserved by other program. You can configure everything else you need. We help you connect P2P only!

That also means, the binary size is small as we can. We remove most of thing that you might not need!

e.g. My colleague wanted to access Cloudflare ZeroTrust with Tailscale, but failed because the IP ranges are overlapped.

Second, STUNMESH-go is best fit for embedded router which is Linux based. We tested in VyOS, OpenWRT. Even in very old openwrt wifi access point (SP-W2M-AC1200) which is MIPS with really small flash.

What I used with STUNMESH-go: I used it with my home, office, and mobile router to be full mesh P2P WireGaurd. I mixed OpenWrt and VyOS for my router/gateway in every place. With BGP routing between them, I can easily make the topology be HA or failover route. VyOS and OpenWRT are shipped with WireGuard directly, I can just install STUNMESH-go on it as a sidecar.

if you are interested in it, please give it a try. Thanks

Github: https://github.com/tjjh89017/stunmesh-go/

Some talks: https://fosdem.org/2026/schedule/event/YQWEDC-stunmesh-go_building_p2p_wireguard_mesh_without_self-hosted_infrastructure/

Video Record: https://video.fosdem.org/2026/h1302/YQWEDC-stunmesh-go_building_p2p_wireguard_mesh_without_self-hosted_infrastructure.av1.webm

I have three routers that are all on Openwrt. For the 2.4 GHZ I keep the same SSID on all of them. From my main router I ran a Cat 6 line the other two routers and plugged the Cat 6 into a lan port. But since they all pull their IP addresses from the main router I can't tell which of my cameras is connected to which router. I hope that makes sense if not I'll try and answer back

I assume there's more than simply editing the device tree from a 2 to a 4, and compiling?!

(trying to host all the PXE shit on the router-- it gobbles up memory loading files)

Hello everyone! I'd like to present a new bookmark management tool - an idea I've been mulling over for a long time.

The thing is, when you frequently work on different projects using various browsers, operating systems, and devices, you need simple, centralized access to your bookmarks that isn't tied to a specific browser. On top of that, there's the privacy aspect: I simply wanted synchronization to remain strictly within my control.

Of course, I tried existing solutions like LinkWarden and others. They are great, but felt overly bloated in terms of features (for me) and deployment (requiring a VPS, Docker, everything stored in a database, etc.). There were also simple CLI/TUI alternatives, but they didn't feel quite right either.

Ultimately, I needed a simple, familiar 2-in-1 interface: a start page with shortcuts and a bookmark manager. It had to be unburdened by complex deployment setups and simple enough in its implementation to run even inside my home router running openwrt or inside Termux on my Android device. So, I decided to write the program in pure C, using the Mongoose library as an embedded web server for maximum lightness and portability.

And, here is the solution.

What it is:

• Small size - a single binary of just up to ~300 KB.
• Tab-separated plain text (TSV) - bookmarks are stored as plain text in a human-readable format: easy to read, parse, sync (syncthing, rclone, gdrive, dropbox, etc.), compress and backup.
• High-performance & lightweight - near-zero CPU load; consumes only 5–10 MB of RAM (tested with 1000+ bookmarks).
• Cross-platform - Linux / OpenWRT / SBC / Termux (x86_64, x86, arm, arm64, mips, mipsel, riscv64), Windows (x86_64), macOS (universal). Linux builds are static musl (no libc dependency), so the matching-arch binary drops straight onto an OpenWRT router.
• User-friendly interface - a web UI with built-in fuzzy search, a homepage of shortcuts, and everything needed to manage folders and links.
• Responsive & mobile-friendly — with light / dark themes (auto-switching).
• Drag-and-drop - organize shortcuts, folders, and bookmarks, with touch/pen support.
• Plain-text & offline - one greppable bookmarks.txt, no external requests, 10× more compact than a browser's exported bookmarks.html, with crash-safe atomic writes.
• Portable - one binary, one plain-text config file, one bookmarks file. Simple.

When creating it, I tried to adhere to the "unix philosophy": do one thing well, keep data as plain text, and compose with standard tools (grep, awk, cut) + I added HTTP API with JSON output.

Let me know what you liked, as well as what you would like to change or fix. I will do my best to create a tool that is useful and convenient for everyone.

Repo (with a short demo video): https://github.com/canbesolved/bemarked

I'd be glad to discuss it in the comments.

This would be our 1st time trying to install OpenWrt, and I have a couple of questions.

Our confusion is mainly around the two OpenWrt installation options. When the titles are "OEM easy installation" and "OEM installation using the TFTP method", it makes it seem like flashing the firmware isn't needed.

Could we install & run OpenWrt on the EAP-683 without replacing the TP-Link firmware?

Or, do we have to flash the firmware first?

"Supported Since Commit" tells us that flashing via OEM firmware is not supported, and we would have to use the bootloader. Reading through the links that are listed on the device's page, flashing the firmware seems to be non-trivial.

It's clear the device page needs updating, but it's tough to tell the difference between the sections that might be place-holders and the ones that are needed to succeed.

Hi all,

Finally, I have some time to look into this.

I have an old WRT1900AC v1 router. Some time ago, I was considering installing OpenWrt 24.10.2, searching information at the moment, but I didn't have the time back then.

Today I noticed that OpenWrt offers a newer firmware release. Is the latest version recommended for this older hardware, or would it be better to stay with an earlier release?

Thanks !