Support for Technicolor TG799vac Xtream (VANT-W) from Etisalat in UAE

[fa1rid]

Product Vendor Technicolor
Product Name MediaAccess TG799vac Xtream
Software Version 17.1
Firmware Version 17.1.7854-0001005-20180216002644-BS
Firmware OID 5a861734835b67358c78212a
Bootloader Version 15.38.724-0000000-20150917132051-d85c65bd2e219aab5422ce7f3366cf1ebe170059
Bootloader OID unknown
Hardware Version VANT-W

I tried to do webui expolit but nothing works. There's even validation which says for example "Enter correct domain name or ip address.

I tried to send reboot using AFG and nothing happened (router didn't reboot), here's screenshot

I also tried to flash it using the telnor firmware and also nothing happened.
I tired ::::::;reboot inside webui and didn't work.

Here's tch-exploit screenshot connected to WAN port with static ip as shown here:https://github.com/BoLaMN/tch-exploit

So what should I do now please?
Thanks a lot for your help.

[LuKePicci]

Has your device ever received an automatic firmware update? If yes, we have some known viable options for getting root on this.

From your screenshot I see that firmware is handling an MGMT network, this means we have not enough info at this stage to determine if it could work (by prober vlan setup) or not, we need to sort this out differently to the goal, then we may go back discussing how to get tch-exploit working, whenever possibile.

I tried ::::::;reboot inside webui and didn't work.

Ok, did you try both Ping and DDNS forms?

[fa1rid]

Ok, did you try both Ping and DDNS forms?

It doesn't allow you in the ping form, it says hostname is invalid. In DDNS in the domain field it says the same error also, username and password fields has no errors, but has no effect (command doesn't get executed)

Has your device ever received an automatic firmware update?

I don't know, I wasn't aware of that.

What can I send you to be able to know what do?

[LuKePicci]

The only way to understand which one of the two banks is being booted without attempting a blind firmware flash is to look at serial console bootlog.

If you go with Type 3 instructions you will actually get Telia firmware on your Etisalat device. However, in the unlucky case your device has never been updated, the Telia firmware will overwrite the only copy of Etisalat firmware you have in bank_1 as bank_2 is empty when no firmware update occurred. So you really need to check the actual active bank before using TFTP flash. Did you try that already?

[fa1rid]

It seems like I was able to flash the firmware using TFTP method.

However I still see the old interface of Etisalat. I will try now Bootfail Procedure to see if it will switch to bank_1

[LuKePicci]

Cool, that means we still have chances of getting a copy of the Etisalat fw. It is a good thing, because from the dump we will be able to understand if an how to root it too.

[fa1rid]

I'm trying with Bootfail Procedure but no luck. Can you please advise me? Which method is the best?

[fa1rid]

Any tutorial on how to monitor the serial? I have serial to usb board.

[LuKePicci]

This one https://hack-technicolor.readthedocs.io/en/latest/Recovery/#crazy-power-switching
Check the video.

Serial is really helpful , here is a good hint on how to get serial configured: https://www.crc.id.au/hacking-the-technicolor-tg799vac-and-unlocking-features/#mozTocId446885

[LuKePicci]

Be aware: there are smalle chances that after successful failboot you may encounter issues with Telia webui as it will run on top of old Etisalat bank_1 configs. In case, you need a factory reset and failboot again to get a clean Telia firmware running in bank_1.

[flywire]

https://whirlpool.net.au/wiki/hack_technicolor_advanced
...
Serial Console
A serial console can be added using a 3.3v USB to RS232 TTL adapter (very cheap on ebay). Physically open the TG799 by removing two screws hidden under the white pads nearest the ports. Pop the cover off from the same side with a bit of force by prying the white base out to release the plastic clips around the back and sides. Do not try to unclip from the lights-side.

The serial console at J5 on the board needs a connection soldered and the pads at R327 and R328 bridged with solder to pass the serial signals to the adaptor. See picture (shown zoomed – note strain relief tape), Black = Ground, Yellow = RX, and Green = TX. The soldering requires a fine tip, steady hands and 20/20 vision. Few tips for impossible soldering start here: get a mate, very fine wire over tip or Blue Tack. Try the Blue Tack, magnifying glass and $10 soldering iron.

Don't forget with a serial connection RX goes to TX and TX goes to RX.

[fa1rid]

Thanks a lot guys, you are really helpful:)

I opened my device as you told me.
However I see things differently.
Here are screenshots (names look different) which one they're supposed to be?

[flywire]

Look at JPA1 right in the middle of the second photo. Note the notch.

[flywire]

Note the notch - #79 (comment)

[fa1rid]

Note the notch - #79 (comment)

But which ones should I bridge together?

[flywire]

Who knows? Try RA11 and RA17 which go to RX and TX respectively.

[mephir]

@fa1rid you need oscilloscope, multimeter or logic analyzer to find pin out. Its quite easy if you have any of it. GND is steady 0V, tx will be transmiting and should be somewhere around 3V, RX will be floating so it will be a little bit above zero. you have 4th pin, it is possibly vcc which is not needed for your purpose, but to ensure you don't make mistake with finding tx, you can check it should have steady 3.3V. On oscilloscope is much easier to see it. I have also this modem from etisalat, i was making just quick research 'to take care' of it when im back in dubai on thursday. so if you won't gonna find anything, most likely I will have some results on friday. I have all tools needed for this task :)

[mephir]

@fa1rid it has possibly something to do with RA11, RA17 and RA50. I'm currently in europe so it is hard to guess. i'll check exactly when i'm back to dxb. Simple continuity test should answer this

[LuKePicci]

The pinout is almost always the same on tch devices, so it is almost 100% sure that the correct pinout and required bridges are these:

No need for multimeter, you can also avoid soldering if your goal is to simply read some logs, just stick the GND wire to the metal shield of an USB port with tape, pick another single wire connected to RX pin of your serial adapter and firmly touch the TX pin on the board with the other side of that wire. It will be more then enough if you are not planning to do failboot on a daily basis.

[fa1rid]

Hi Guys, I was able to get the log from the serial. I couldn't find where the Bank thingy is.
Please help. Thanks.
Serial log.txt

@LuKePicci
By the way, your TX and RX are inverted in the previous attached photos.

[LuKePicci]

I had to guess which naming convention the original picture taker was using. He only said the yellow cable was RX but he didn't say on which side of the link. I assumed he was indicating where to connect TX and RX terminals from the serial adapter rather then which function implemented the pin on the board side. BTW to avoid ambiguity:

adapter TX <--> board RX : yellow [not required for read-only operations]
adapter RX <--> board TX : green
adapter GND <> board GND : black

The log you captured is from the Quantenna Wireless SoC, you need to capture the output from the main OS SoC.

[fa1rid]

Oh, I didn't notice that, you are right.
Here's the correct one. I can see it says Booting: Bank 2.
Serial Log CPU.txt

[LuKePicci]

Awesome! Now, you should follow me carefully. As you may know we found that the Telia and Telenor VANT-W boards had different OSKeys, which means they didn't accept the firmware of the other. The Telenor one is a VANT-W Rev 1 board, the Telia one is a VANT-W Rev 2. I see yours is a Rev 3, I don't know if Telenor and Telia firmwares would work on your Rev 3, but we can redo what we did for Telenor and luckily get into Etisalat as well.

Trying to flash Telia and Telenor firmwares is a no go. Assuming they would work (I doubt) If you overwrite the old Etisalat firmware in Bank 1 you will loose the chance og grabbing a firmware image.

Keep trying the failboot approach. It is not easy but it WILL work for sure. Let me know when you manage to boot from bank_1, keep it powered on and keep it connected to serial console. Be ready to save all you get from the serial log.

[fa1rid]

Actually I tried now the method in this video and it worked: https://www.youtube.com/watch?v=BMT8AhA4qns
However Bank 1 Failed to boot 3 times:
Bank 1 failed booting 3 times; no suitable fall-back bank found.

21:17:38.720 -> Entering BOOT-P mode (reason: NO_SW )

[LuKePicci]

why bank_1 fails to boot? what it says?

[fa1rid]

It's currently active on Bank 2 and it boots fine to the original software of Etisalat. Now, using the method to switch the bank works, but it fails to boot from Bank 1. Please see attached log.
Bank 1 Failed.txt

[fa1rid]

If you remember, before I flashed the software listed in the Wiki, Telia or Telenor, I don't remember. Seems like it's not compatible. What do you think?

[LuKePicci]

When you send an incompatible firmware via TFTP it doesn't allow you to flash it. You see TFTP sending the firmware, then the router checks for firmware compatibility and refuses to flash an invalid firmware.

From the log, it appears like your bank_1 is either empty or contains corrupted firmware. An half successful flash via TFTP could be the cause. In that case, it means the firmware you was flashing (Telia I think), was indeed compatible. Redo TFTP flashing of Telia firmware, this time take a look at serial log in the meanwhile.

PS It's safe to use TFTP because you have a copy of the Etisalat firmware on bank_2

[fa1rid]

I have USB WiFi (TL-WN823N V2) and (TL-WN822N V2). How do I know the WiFi chip inside of them?
For example I found this https://github.com/masterzorag/RTL8192EU-linux which is for (TL-WN822N) , and these products have many versions like v1, v2, and v3. Do they use the same WiFi chip inside?

[LuKePicci]

For ARM Linux 4.1 firmwares, look here: https://github.com/Ansuel/GUI_ipk

[fa1rid]

For ARM Linux 4.1 firmwares, look here: https://github.com/Ansuel/GUI_ipk

Not all the packages are there.

[LuKePicci]

Those are tested ones, You can try compiling the others

[fa1rid]

I'm trying to bridge WiFi to WAN and only 2G worked so far, the 5G WiFi signal disappeared and not visible in the UI as well.
In "/etc/config/wireless", inside (config wifi-iface) for both wl0 & wl1, I changed "option network" from "lan" to "wan". But why 2G worked and 5G not?

Here's my /etc/config/wireless

config wifi 'global'
	option station_history_persistent '0'
	option station_history_save_delay '24'

config wifi-device 'radio_2G'
	option type 'broadcom'
	option country 'EU'
	option channelwidth 'auto'
	option standard 'bgn'
	option state '1'
	option rateset '1(b) 2(b) 5.5(b) 6 9 11(b) 12 18 24 36 48 54'
	option ht_security_restriction '1'
	option sgi '0'
	option cdd '0'
	option frame_bursting '0'
	option interference_mode 'fixed'
	option interference_channel_list '1 2 3 4 5 6 7 8 9 10 11 12 13'
	option acs_config_file '/etc/wireless_acs.conf'
	option acs_state 'selecting'
	option acs_rescan_period '0'
	option acs_trace_level '0'
	option acs_chanim_tracing '0'
	option acs_traffic_tracing '0'
	option acs_policy '6'
	option acs_rescan_delay '1800'
	option acs_rescan_delay_policy 'notraffic'
	option acs_rescan_delay_max_events '46'
	option acs_channel_fail_lockout_period '28800'
	option acs_monitor_action 'policy'
	option acs_tx_traffic_threshold '50'
	option acs_rx_traffic_threshold '50'
	option acs_traffic_sense_period '5'
	option acs_interference_span '2'
	option tx_power_adjust '0'
	option tx_power_overrule_reg '0'
	option channel '11'

config wifi-iface 'wl0'
	option device 'radio_2G'
	option mode 'ap'
	option state '1'
	option network 'wan'
	option reliable_multicast '0'
	option ssid 'TN_wifi_2G'

config wifi-ap 'ap0'
	option iface 'wl0'
	option state '1'
	option public '1'
	option ap_isolation '0'
	option station_history '1'
	option max_assoc '0'
	option pmf 'disabled'
	option pmksa_cache '1'
	option wps_w7pbc '1'
	option wsc_state 'configured'
	option wps_ap_setup_locked '0'
	option acl_mode 'unlock'
	option acl_registration_time '60'
	option trace_modules ' '
	option trace_level 'some'
	option wep_key '7D44605B9B'
	option wpa_psk_key '7D44605B9B'
	option wps_ap_pin '18245677'
	option bandsteer_id 'off'
	option wps_state '0'
	option security_mode 'wpa2-psk'

config wifi-radius-server 'ap0_auth0'
	option state '0'
	option port '1812'
	option priority '3'
	option secret '7D44605B9B'

config wifi-radius-server 'ap0_acct0'
	option state '0'
	option port '1813'
	option priority '3'

config wifi-device 'radio_5G'
	option type 'quantenna'
	option country 'EU'
	option channelwidth 'auto'
	option standard 'anac'
	option state '1'
	option rateset '6(b) 9 12(b) 18 24(b) 36 48 54'
	option ht_security_restriction '1'
	option sgi '1'
	option cdd '1'
	option ldpc '1'
	option txbf '1'
	option mumimo '0'
	option channel '100'

config wifi-iface 'wl1'
	option device 'radio_5G'
	option mode 'ap'
	option state '1'
	option network 'wan'
	option reliable_multicast '0'
	option ssid 'TN_wifi_5G'

config wifi-ap 'ap1'
	option iface 'wl1'
	option state '1'
	option public '1'
	option ap_isolation '0'
	option station_history '1'
	option max_assoc '0'
	option pmf 'disabled'
	option pmksa_cache '1'
	option wps_w7pbc '1'
	option wsc_state 'configured'
	option wps_ap_setup_locked '0'
	option acl_mode 'unlock'
	option acl_registration_time '60'
	option trace_modules ' '
	option trace_level 'some'
	option supported_security_modes 'none wpa2-psk wpa-wpa2-psk'
	option wep_key '7D44605B9B'
	option wpa_psk_key '7D44605B9B'
	option wps_ap_pin '18245677'
	option bandsteer_id 'off'
	option wps_state '0'
	option security_mode 'wpa2-psk'

config wifi-bandsteer 'bs0'
	option rssi_threshold '-40'
	option rssi_5g_threshold '-80'
	option policy_mode '5'

config wifi-bandsteer 'bs1'
	option rssi_threshold '-40'
	option rssi_5g_threshold '-80'
	option policy_mode '5'

config wifi-iface 'wl0_1'
	option device 'radio_2G'
	option mode 'ap'
	option state '1'
	option network 'wlnet_b_24'
	option ssid 'Guest_24GHz_CFC479'
	option reliable_multicast '0'

config wifi-ap 'ap2'
	option iface 'wl0_1'
	option state '0'
	option public '1'
	option ap_isolation '1'
	option station_history '1'
	option max_assoc '0'
	option security_mode 'wpa2-psk'
	option supported_security_modes 'none wep wpa2-psk wpa-wpa2-psk wpa2 wpa-wpa2'
	option pmf 'disabled'
	option wep_key '7D44605B9B'
	option wpa_psk_key '7D44605B9B'
	option pmksa_cache '1'
	option wps_state '0'
	option wps_w7pbc '1'
	option wsc_state 'configured'
	option wps_ap_setup_locked '1'
	option acl_mode 'disabled'
	option acl_registration_time '60'
	option trace_level 'some'
	option display_connected_devices '1'
	option wps_ap_pin '18245677'

config wifi-iface 'wl1_1'
	option device 'radio_5G'
	option mode 'ap'
	option state '1'
	option vlan_id '3'
	option network 'wlnet_b_5'
	option ssid 'Guest_5GHz_CFC479'
	option reliable_multicast '0'

config wifi-ap 'ap3'
	option iface 'wl1_1'
	option state '0'
	option public '1'
	option ap_isolation '1'
	option station_history '1'
	option max_assoc '0'
	option security_mode 'wpa2-psk'
	option supported_security_modes 'none wpa2-psk wpa-wpa2-psk wpa2 wpa-wpa2'
	option pmf 'disabled'
	option wep_key '7D44605B9B'
	option wpa_psk_key '7D44605B9B'
	option pmksa_cache '1'
	option wps_state '0'
	option wps_w7pbc '1'
	option wsc_state 'configured'
	option wps_ap_setup_locked '1'
	option wps_ap_pin 'SET_BY_SCRIPT'
	option acl_mode 'disabled'
	option acl_registration_time '60'
	option trace_level 'some'
	option display_connected_devices '1'

My Network file:

config interface 'loopback'
	option ifname 'lo'
	option proto 'static'
	option ipaddr '127.0.0.1'
	option netmask '255.0.0.0'

config globals 'globals'
	option ula_prefix 'fdd1:36c9:5967::/48'
	option default_ps '0'

config interface 'lan'
	option type 'bridge'
	option proto 'static'
	option netmask '255.255.255.0'
	option ip6assign '64'
	option force_link '0'
	option neighlocktime '-1'
	option stp '0'
	option priority '0x0001'
	option ipaddr '192.168.10.1'
	list pppoerelay ''
	list ifname 'vlan_eth2'
	list ifname 'vlan_eth3'
	list ifname 'vlan_eth5'
	list ifname 'vlan_eth0'

config switch 'bcmsw'
	option reset '1'
	option qosimppauseenable '0'
	option jumbo '0'
	option enable_vlan '1'
	option unit '1'

config device 'vlan_eth0'
	option type '8021q'
	option ifname 'eth0'
	option name 'vlan_eth0'
	option vid '1'

config device 'vlan_eth1'
	option type '8021q'
	option ifname 'eth1'
	option name 'vlan_eth1'
	option vid '1'

config device 'vlan_eth2'
	option type '8021q'
	option ifname 'eth2'
	option name 'vlan_eth2'
	option vid '1'

config device 'vlan_eth3'
	option type '8021q'
	option ifname 'eth3'
	option name 'vlan_eth3'
	option vid '1'

config device 'vlan_eth5'
	option type '8021q'
	option ifname 'eth5'
	option name 'vlan_eth5'
	option vid '1'

config switch_vlan 'lansw'
	option device 'bcmsw'
	option vlan '1'
	option ports '2* 3* 5* 8t 0*'

config device 'eth0_databr'
	option type '8021q'
	option ifname 'eth0'
	option name 'eth0_databr'
	option vid '2040'

config device 'eth1_databr'
	option type '8021q'
	option ifname 'eth1'
	option name 'eth1_databr'
	option vid '2040'

config device 'eth2_databr'
	option type '8021q'
	option ifname 'eth2'
	option name 'eth2_databr'
	option vid '2040'

config device 'eth3_databr'
	option type '8021q'
	option ifname 'eth3'
	option name 'eth3_databr'
	option vid '2040'

config switch_vlan 'datasw'
	option device 'bcmsw'
	option vlan '2040'
	option ports '8t 1*'

config device 'eth0_iptvbr'
	option type '8021q'
	option ifname 'eth0'
	option name 'eth0_iptvbr'
	option vid '2042'

config device 'eth1_iptvbr'
	option type '8021q'
	option ifname 'eth1'
	option name 'eth1_iptvbr'
	option vid '2042'

config device 'eth2_iptvbr'
	option type '8021q'
	option ifname 'eth2'
	option name 'eth2_iptvbr'
	option vid '2042'

config device 'eth3_iptvbr'
	option type '8021q'
	option ifname 'eth3'
	option name 'eth3_iptvbr'
	option vid '2042'

config switch_vlan 'iptvsw'
	option device 'bcmsw'
	option vlan '2042'
	option ports '8t'

config interface 'wlnet_b_24'
	option proto 'static'
	option ip6assign '64'
	option ipv6 '0'
	option ip6hint '1'
	option netmask '255.255.255.128'
	option ipaddr '192.168.168.1'
	option ifname 'wl0_1'
	option force_link '0'

config interface 'wlnet_b_5'
	option proto 'static'
	option ip6assign '64'
	option ipv6 '0'
	option ip6hint '2'
	option netmask '255.255.255.128'
	option ipaddr '192.168.168.129'
	option ifname 'wl1_1'
	option force_link '0'

config device 'wlnet_b_5eth5'
	option type '8021q'
	option name 'wl1_1'
	option enable '1'
	option ifname 'eth5'
	option vid '3'
	option ipv6 '0'

config interface 'wan'
	option auto '1'
	option proto 'dhcp'
	option reqopts '1 3 6 15 33 42 51 121 249'
	option vendorid 'Telenor_TG799_NATBISP '
	option hostname 'TG799vacXTREAM'
	option iface6rd '6rd'
	option mtu6rd '1480'
	option initboot '1'
	option release '1'
	option macaddr '10:13:31:CF:C4:78'
	option noforcerenew '1'
	option type 'bridge'
	list ifname 'eth4'
	list ifname 'eth1_databr'

config interface 'wwan'
	option auto '0'
	option proto 'mobiled'
	option session_id '0'
	option profile '1'
	option iface_464xlat '0'

config interface 'iptv'
	option proto 'dhcp'
	option reqopts '1 3 6 15 33 42 51 121 249'
	option vendorid 'Telenor_TG799_IPTV '
	option hostname 'TG799vacXTREAM'
	option ip4table 'iptv'
	option dnsset 'iptv'
	option initboot '1'
	option release '1'
	option noforcerenew '1'
	option macaddr '12:13:31:CF:C4:79'
	option auto '0'

config interface 'voip'
	option proto 'dhcp'
	option ip4table 'voip'
	option reqopts '1 3 6 15 33 42 51 121 249'
	option vendorid 'Telenor_TG799_VOIP '
	option hostname 'TG799vacXTREAM'
	option initboot '1'
	option dnsset 'voip'
	option release '1'
	option noforcerenew '1'
	option macaddr '10:13:31:CF:C4:79'
	option auto '0'

config device 'vlan698'
	option type '8021q'
	option ifname 'ptm0'
	option name 'vlan698'
	option vid '698'
	option macaddr '10:13:31:CF:C4:78'

config device 'vlan695'
	option type '8021q'
	option ifname 'ptm0'
	option name 'vlan695'
	option vid '695'
	option macaddr '12:13:31:CF:C4:79'

config device 'vlan697'
	option type '8021q'
	option ifname 'ptm0'
	option name 'vlan697'
	option vid '697'
	option macaddr '10:13:31:CF:C4:79'

config config 'config'

Note: Bridging Ethernet to WAN works fine.
However another question is why there are many "vlan_ethX" & "ethX_databr" devices?
Thanks!

[fa1rid]

I'm reading this: https://openwrt.org/docs/guide-user/network/wifi/relay_configuration.
and this https://openwrt.org/docs/guide-user/network/wifi/atheroswds
As I understood there are multiple methods to do WiFi-to-WiFi bridge. "WDS" or "mesh networking" if the drivers support, or instead, "relayd" to do it using routing. Is that correct?

I'm confused because they say:

In some cases, the wireless drivers used in OpenWrt do not support “Layer 2” bridging in client mode with a specific “upstream” wireless system.

Does this apply to relayd? And does this happen in "Layer 3" or "Layer 2"?
Also I'm wondering what methods do Range Extenders usually use like the "TP-link RE305" for this?

[LuKePicci]

Broadcom drivers can do wireless bridging at L2, other drivers cannot so the only alternative to L3 routing is relayd which is an application that forwards L2 to L2 like if it was a bridge Wireless repeaters are a different story, usually the only have a single wifi interface with a special driver being capable of working as client and ap concurrently without any bridging required at OS level. Otherwise, creating two interfaces (a client and an AP) on the same radio would also allow you to join them together (either bridged, relayd' or routed) and achieve a similar result. In general it's way better to use different radios for upstream and downstream links, so such cheap repeaters you mentioned having only a single interface in repeater mode are quire poor in performance. WDS and mesh are other two different special driver modes, similar to wireless repeater.

…

________________________________ From: Farid <notifications@github.com> Sent: Monday, April 20, 2020 4:07:47 AM To: kevdagoat/hack-technicolor <hack-technicolor@noreply.github.com> Cc: Luca Piccirillo <luca.piccirillo@gmail.com>; State change <state_change@noreply.github.com> Subject: Re: [kevdagoat/hack-technicolor] Support for Technicolor TG799vac Xtream (VANT-W) from Etisalat in UAE (#79) I'm reading this: https://openwrt.org/docs/guide-user/network/wifi/relay_configuration. and this https://openwrt.org/docs/guide-user/network/wifi/atheroswds As I understood there are multiple methods to do WiFi-to-WiFi bridge. "WDS" or "mesh networking" if the drivers support, or instead, "relayd" to do it using routing. Is that correct? I'm confused because they say: In some cases, the wireless drivers used in OpenWrt do not support “Layer 2” bridging in client mode with a specific “upstream” wireless system. Does this apply to relayd? And does this happen in "Layer 3" or "Layer 2"? Also I'm wondering what methods do Range Extenders usually use like the "TP-link RE305" for this? — You are receiving this because you modified the open/close state. Reply to this email directly, view it on GitHub<#79 (comment)>, or unsubscribe<https://github.com/notifications/unsubscribe-auth/ACCRPNQKZSFQPUACDOO7C3DRNOU7HANCNFSM4KRPDP3Q>.

[fa1rid]

Any help please regarding my WiFi bridging problem?

[LuKePicci]

I think the Quantenna 5GHz wireless interface is on eth5, so that's the interface name you need to include in bridge. I'm not sure about this as I have no Quantenna equipped devices here to test.

[fa1rid]

Please check, you can ssh directly to the router through:
ssh root@xxxxxx -p xxx
pass: xxx

[LuKePicci]

Try now. Please note vlan_eth5 has now vid 2 for eth5 (switch port 5) and is no more part of vlan 'lansw' (vid 1), but moved to a new vlan 'wansw' (vid 2)

[fa1rid]

Yes it worked. Thanks a lot. Yes I see that. I don't understand what is the eth5 can you please explain, why it's not wl0 or wla1? Why there are many devices and interfaces? Like why there's vlan_ethX and also ethX_databr at the same time?. Are these settings special to broadcom devices? And moreover why the "eth1_databr" is not on vid 2?

[LuKePicci]

the quantenna wireless chip is connected to an internal switch port, so you have switch port 0 1 2 3 and 5, ports 0 to 3 are lan rj45 sockets. As in every switch everything is bridged, unless you divide ports 0 1 2 3 into a separate vlan from port 5. Then, once lan ports and eth5 are from different vlan, you can bridge it like you did with wl0. It would have appeared as wl1 if it was a broadcom interface like the 2.4 GHz one. Still, it is called wl1 in /etc/config/wireless despite its real ifname is eth5, that's why it won't bridge it like it did with wl0 when you set network 'wan' in /etc/config/wireless, so I did it manually adding eth5 in interface wan from /etc/config/network (where you don't see wl0, because it manages to bridge it automatically because of network 'wan' from /etc/config/wireless).

eth0 to eth3 are lan sockets, eth4 is the wan ethernet socket, eth5 is the quantenna 5GHz chip
vlan_ethX are the untagging interfaces for vlans as configured in the switch vlans, so the first four have vid 1, vlan_eth5 has vid 2. They are needed because in switch vlan configs you have "8t" which means the switch sends packets belonging to that vlan to the internal CPU as tagged, and that is needed when you want to send differently tagged stuff to the CPU, eg lan stuff from vlan 1 and wan stuff from vlan 2.

You also have some wl0_x and wl1_x , they are wireless guest interfaces

Then there are a lot of interfaces like "databr", that Is Telenor stuff, they use all these interfaces to allow people using their routers in some kinf of bridged mod. You can also remove them all.

[fa1rid]

After I rebooted the router, the 5G WiFi disappeared. What happened?
You did install these packages, right?

# opkg list-installed
libncurses - 6.1-1
nano - 4.4-1
terminfo - 6.1-1
wget - 1.19.5-2

[LuKePicci]

Yes, I used nano to edit config

Can't say why it disappeared. Probably a bit more work is needed to let it stick in the wan bridge.

[fa1rid]

How do I know for which linux kernel version is this archive: https://archive.openwrt.org/snapshots/trunk/brcm63xx/generic/packages/base/ ?

[fa1rid]

I think it has to do with (option ports) in (config switch_vlan 'lansw') and (config switch_vlan 'wansw') settings that you changed because I wasn't able to recover it back until I brought these settings back.

Also I noticed this

config switch_vlan 'lansw'
	option device 'bcmsw'
	option vlan '1'
	option ports '0* 1* 2* 3* 5* 8t '

I assume these refers to ethX, knowing that I bridged eth1 to wan but you added it there and maybe didn't notice.
What's the difference between 0* 1*... and 8t?

[LuKePicci]

How do I know for which linux kernel version is this archive: https://archive.openwrt.org/snapshots/trunk/brcm63xx/generic/packages/base/ ?

They are for mips, you need arm packages

[LuKePicci]

What's the difference between 0* 1*... and 8t?

Those numbers are internal switch port numbers. 0 to 3 are Lan rj45 ports matching eth0 to eth3 interfaces, 5 is the 5G wifi matching the eth5 interface. 8 is the CPU. 8t means packets get tagged towards the CPU. There was something wrong in the bridging so I reverted most to defaults before moving 5 from vlan 1 to vlan 2

[fa1rid]

How do I know for which linux kernel version is this archive: https://archive.openwrt.org/snapshots/trunk/brcm63xx/generic/packages/base/ ?

They are for mips, you need arm packages

How do you know?

[LuKePicci]

https://openwrt.org/docs/techref/targets/brcm63xx

As long as you look at official openwrt builds, the brcm63xx target is MIPS arch only. There is no upstream support into openwrt for broadcom 63xx ARM-based SoC's

In Homeware, the brcm63xx-tch target might be for ARM or MIPS based SoC's depending on the board. In future, openwrt builds for ARM-based broadcom SoC's would probably go under a differently named target, such that brcm63xx would be only MIPS, and brcm63xx-arm would be only ARM.

PS: brcm63xx openwrt target has been recently (finally! 🍾🎉) renamed to bcm63xx

[fa1rid]

Thanks man for the excellent explanation .
I found the driver for the USB WiFi adapter I told you about but couldn't know how to download the source code of it so I can compile it: https://wireless.wiki.kernel.org/en/users/drivers/ath9k_htc
How to download it?

I'm learning now how to build and compile programs for the device using this:
https://github.com/Ansuel/GUI_ipk

I have downloaded the toolchain-arm_cortex-a9+neon_gcc-4.8-linaro_glibc_eabi.tar
and openwrt_18.x_tch_buildroot_based_custom.tar.xz from there.
I will be trying to use them as discussed in this issue : Ansuel/GUI_ipk#7
The guys mentioned to use Ubuntu 12 as OS for that, which debian version I can use?

[LuKePicci]

Try the latest one

[fa1rid]

I have an issue and I don't know if this is normal behavior or not. The "br-wan" interface on my device gets stuck with same DCHP address assigned even when you unplug the cable or connect to different source, where instead it should get new DHCP address or show not connected if unplugged.

I found the solution is to run "ifconfig br-wan down && ifconfig br-wan up".

Is this normal and how can I make it automatically detect change in the status.

[LuKePicci]

It is normal. It would automatically refresh its DHCP address when the entire bridge goes down, not only the single interface in there.

You should ask openwrt guys about how to manage that situation as you want.

[fa1rid]

Thanks man!

[BoLaMN]

Could u not use hotplug and watch for iface events on br-wan and run the up/down?

https://openwrt.org/docs/guide-user/base-system/hotplug

[LuKePicci]

He should watch for events on the port and act on the bridge, atm no events are triggered for the bridge when a single if of the bridge gets disconnected, that's why the if reup doesn't occur.

[fa1rid]

I have very strange problem and it's driving me crazy in this device, please your opinion on that.

The problem is in the WiFi connectivity. When I go to another room, I can see the signal is about -60dB however when I add any light barrier (like laptop screen or my hand) in-front of the phone which is connected to the to the WiFi I lose the ability to communicate with the gateway knowing that the signal is always ranging between -60to-70dB.
So I have strong signal which is good enough but I lose the complete communication with the gateway.
I have tested 2 iPhones and one Samsung phone and all produced the same problem.
It seems like it's only happening with 5Ghz band.
I have another dlink router and it doesn't have this problem knowing that its signal is weaker and giving me about -80dB on both 2.4Ghz and 5Ghz.
Weird technology!!

[Emiluren]

This thread was great help when experimenting with my own router. I now have Telenor v17.1.7937 running in my bank_1 (confirmed via serial). However, I have not managed to get tch-exploit to work. My IP address is set to 58.162.0.1 and I am connected to the WAN port. I get the DHCP request and the router seems to get an assigned address but I never get to the stage with the green text (cwmp request?). Does cwmp really work with just a random port? EDIT: I am stupid...

Should I try another rooting method (though #C is the only one listed in the docs) or another firmware version (could one for Telia work even though mine is Telenor?)?

Sorry for necroposting but I am stuck :(. I would have created an issue in the tch-exploit repo but those seem to be disabled?

EDIT: I just got it to work. I must have pressed reboot instead of factory reset when I was testing last night or something... Sorry