Parker's Blog

Inseego FX2000

Sat, 28 Jun 2025 07:27:30 GMT

In my infinite hunt for a product to tinker with, I decided to give the Inseego FX2000 a run for its money. Less than $100 on eBay in fact! I was a little weary of working with this device because Novatel/Inseego is known for locking down their devices more heavily than their competitors.

This guide takes into account that you have knowledge of ADB/Fastboot tools, hex editing, and some Qualcomm tool knowledge. This is by no means a step-by-step tutorial.

Gaining ADB Access

Inseego devices hide their various ports behind an HID port, where you can send values to enable them. In newer devices, the value is encrypted, and can not be done unless you know the crypt. In my testing, the FX2000 worked fine, but my M2000 did not (I think my M2000 is haunted, it just refuses to connect to T-Mobile).

Connect a Windows computer to the USB-C port on the rear of the FX2000. Download the mifilink utility from here. In a terminal, execute mifilink.exe diag. There should now be a plethora of ports at our disposal, including ADB and DIAG.

Modifying TTL

Now that you have ADB access, we can access the shell and mangle the TTL and HL on our device. When booted, the runlevel of the device is 3, meaning we can place a file in /etc/rc3.d/ and it'll be executed on startup.

Contents of /etc/init.d/set-ttl.sh

#!/bin/sh
sleep 15
iptables -t mangle -I POSTROUTING -o rmnet+ ! -p icmp -j TTL --ttl-set 64
ip6tables -t mangle -I POSTROUTING -o rmnet+ ! -p icmpv6 -m hl ! --hl-eq 255 -j HL --hl-set 64

What these two commands do is modify the outgoing TTL/HL of any packet on an rmnet wildcard interface to 64, so it appears as on-device traffic. It excludes ICMP because pings and traceroutes won't function correctly. For IPv6, it also ignores packets with a HL of 255 as that is used for neighbor-discovery, and without the exclusion, downstream devices of the router won't receive an IPv6 address.

Once we create that file, we want to mark it as executable and link it to the rc3.d folder.

# chmod +x /etc/init.d/set-ttl.sh
# ln -s /etc/init.d/set-ttl.sh /etc/rc3.d/S98ttl
# chmod +x /etc/rc3.d/S98ttl

If you give the device a reboot and run iptables -vL -t mangle and ip6tables -vL -t mangle, our rules should be there!

SSH Access

Let's enable SSH access so we don't have to continually connect our laptop and use the ADB shell to execute commands.

First, execute passwd in the ADB shell and set a new root password. Then create /etc/init.d/dropbear.sh.

Contents of /etc/init.d/dropbear.sh:

#!/bin/sh
sleep 15
/etc/init.d/dropbear start

Then execute the following commands:

# chmod +x /etc/init.d/dropbear.sh
# ln -s /etc/init.d/dropbear.sh /etc/rc3.d/S98dropbear
# chmod +x /etc/rc3.d/S98dropbear

Now SSH will be enabled on boot! By default, your SSH clients probably won't like the ciphers dropbear uses, but you can ignore this on UNIX with the following command:

ssh -oKexAlgorithms=+diffie-hellman-group1-sha1 -oHostKeyAlgorithms=+ssh-rsa root@xxx.xxx.xxx.xxx

Repairing IMEI

This is not for the weary. It involves backing up and wiping a sensitive EFS partition, modifying the backup in a hex editor, and restoring it onto the device. As far as I am aware, you cannot repair the IMEI on this device without wiping the EFS partition. That is because the NV item 550 (where the IMEI is held) is read-only, and can only be written to once.

With QPST tools on your computer, launch QFIL and select the port of your router, then in the menu bar, head to Tools > QCN Backup Restore. Select Backup QCN to begin the backup.

I also took the liberty to make an xQCN backup here, using the Software Download tool in QPST, since this contains more data than a regular QCN. If we restore this after we restore the QCN we're about to modify, it will not repair the IMEI to the original since it is now read-only. Allegedly there are also some nv items that are used during a factory reset, which these processes may not backup, which could lead to bootlooping after a factory reset.

With the completed QCN backup, open it in your preferred hex editor, and search for hex 089A. (That is, if your IMEI begins with 9. If it is something else, search for 08xA, where x is that first digit.) For me, the offset of the IMEI value is 29560.

If your original IMEI is 358314360147956, then the hex value should be 08 3A 85 13 43 06 41 97 65. The first octet will always be 08, and the second will always be the first digit, followed by A. For every octet after that, it is the digits reversed. Save the file once done under a new filename.

There is a possibility of bricking your device after this. Know the risks. I might even recommend making a nanddump backup of the efs2 partition (/dev/mtd2).

On your laptop connected via USB to the router, execute the following commands in your shell:

adb reboot bootloader
fastboot erase efs2
fastboot reboot

The device should reboot, but it will not come up as normal. It is now in a persistent runlevel 2.

This is not required, but if you execute telinit 3 in an ADB shell, the device will come back up as normal, and you can verify that there is no IMEI in the device's settings.

With the device back up, launch QFIL and navigate to the same menu as before under Tools > QCN Backup Restore, and choose the modified hex file and restore it. Once the restore is completed, reboot the device. When the device comes back up, we need to tell the device to return to a persistent runlevel 3. In an ADB shell, execute:

# dsm_cli set_persistent_rl

When prompted Is runlevel persistent 0/1:, type 1 and hit enter, then when prompted Enter runlevel 2/3/4:, type 3 and hit enter. Reboot the device again. It should now come back up as normal, and you can check the device's settings to make sure your repaired IMEI is present.

Random device knowledge

General
Manufacturer: Inseego
Model: FX2000-3

Software Components
Modem Firmware Version: SDX55MOR-4.05.1.1 1 [2022-12-15 07:35:29]
Wi-Fi Firmware Version: 1.0.1.2.193.0
OS Version: 4.14
Cute Version: 3A

ati
Manufacturer: Inseego Corp.
Model: FX2000
Revision: 4.05.1.1  SVN 18 [2022-12-15 07:35:29] (Release Build - nvtl)
SVN: 18
IMEI: xx
+GCAP: +CLTE3, +MS, +ES, +DS

OK

# cat /proc/mtd 
dev:    size   erasesize  name
mtd0: 00280000 00040000 "sbl"
mtd1: 00280000 00040000 "mibib"
mtd2: 01500000 00040000 "efs2"
mtd3: 001c0000 00040000 "tz"
mtd4: 00100000 00040000 "tz_devcfg"
mtd5: 00180000 00040000 "ddr"
mtd6: 00100000 00040000 "apdp"
mtd7: 00100000 00040000 "xbl_config"
mtd8: 00100000 00040000 "multi_image"
mtd9: 00100000 00040000 "aop"
mtd10: 00100000 00040000 "qhee"
mtd11: 00100000 00040000 "abl"
mtd12: 00280000 00040000 "uefi"
mtd13: 00180000 00040000 "toolsfv"
mtd14: 00180000 00040000 "loader_sti"
mtd15: 00d00000 00040000 "boot"
mtd16: 00100000 00040000 "scrub"
mtd17: 06b40000 00040000 "modem"
mtd18: 001c0000 00040000 "misc"
mtd19: 00180000 00040000 "devinfo"
mtd20: 01900000 00040000 "recovery"
mtd21: 001c0000 00040000 "fota"
mtd22: 02940000 00040000 "recoveryfs"
mtd23: 000c0000 00040000 "ipa_fw"
mtd24: 00100000 00040000 "usb_qti"
mtd25: 00100000 00040000 "sec"
mtd26: 00100000 00040000 "fotacookie"
mtd27: 11200000 00040000 "system"

# cat /proc/cpuinfo 
processor	: 0
model name	: ARMv7 Processor rev 5 (v7l)
BogoMIPS	: 38.40
Features	: half thumb fastmult vfp edsp neon vfpv3 tls vfpv4 idiva idivt vfpd32 lpae evtstrm 
CPU implementer	: 0x41
CPU architecture: 7
CPU variant	: 0x0
CPU part	: 0xc07
CPU revision	: 5

Hardware	: Qualcomm Technologies, Inc SDXPRAIRIE
Revision	: 0000
Serial		: 0000000000000000

# cat /proc/mounts 
ubi0:rootfs / ubifs rw,relatime,bulk_read,ubi=0,vol=0 0 0
devtmpfs /dev devtmpfs rw,relatime,size=373084k,nr_inodes=93271,mode=755 0 0
proc /proc proc rw,relatime 0 0
none /tmp ramfs rw,relatime 0 0
none /sys sysfs rw,relatime 0 0
none /run ramfs rw,relatime 0 0
none /var/log ramfs rw,relatime 0 0
none /run ramfs rw,relatime 0 0
none /var/lock ramfs rw,relatime 0 0
none /sys/kernel/debug debugfs rw,relatime 0 0
ramfs /opt/nvtl/tmp ramfs rw,relatime 0 0
devpts /dev/pts devpts rw,relatime,gid=5,mode=620,ptmxmode=000 0 0
/dev/ubi1_0 /firmware ubifs ro,relatime,bulk_read,ubi=1,vol=0 0 0
none /sys/kernel/config configfs rw,relatime 0 0
adb /dev/usb-ffs/adb functionfs rw,relatime 0 0

# cat /proc/version 
Linux version 4.14.206-perf (builder@nvtlsdselbld06) (clang version 6.0.9 for Android NDK, GNU ld (GNU Binutils) 2.31.1.20181224) #1 PREEMPT Thu Apr 6 02:19:08 PDT 2023

# uname -a
Linux mifi 4.14.206-perf #1 PREEMPT Thu Apr 6 02:19:08 PDT 2023 armv7l GNU/Linux

Also, I may be crazy, but using the MBN profile ROW_Commercial instead of Commercial-TMO and a custom DNS server appears to solve my video throttling issue on T-Mobile.

Running a RIPE Atlas Probe on OpenWRT

Thu, 12 Jan 2023 06:28:17 GMT

The RIPE Atlas network is described as "a global network of probes that measure Internet connectivity and reachability, providing an unprecedented understanding of the state of the Internet in real time."

RIPE can either provide a hardware probe that you plug into an ethernet port if you apply and are accepted, or you can run a software probe, not needing any additional hardware, and apply online.

Prerequisites

Create an account here and make note of your username/email address

Installing the package

SSH into your OpenWRT device and enter the following commands:
opkg update
opkg install atlas-sw-probe

Configuring the package

This will install the appropriate package and its dependencies. It should print out something saying Missing probe_key. To init the key follow instruction in /etc/atlas/atlas.readme.

If we read the contents of that file, it reads:

# Atlas probe setup instruction

The atlas probe software requires a rsa 2048-4096 key for registration.

Follow these steps to register your probe on the ripe-atlas systems.
1. Insert your username in the atlas config file (/etc/config/atlas)
2. Use the command '/etc/init.d/atlas create_key' to create a priv/pub key.
3. The priv/pub key will be stored on the directory /etc/atlas/
4. Use the command '/etc/init.d/atlas get_key' to get the public key used for probe registration.
   Make sure to copy the entire key and that the last value is the correct username
5. Follow the instruction from the past command or go to 'https://atlas.ripe.net/apply/swprobe/'
   and register your probe.

So we'll follow those instructions. OpenWRT includes the vi editor by default. So we will execute:

vi /etc/config/atlas

Using the arrow keys on your keyboard, place the cursor in between the quotes following the option username line. Then, press I on your keyboard to enter insert mode, then enter your username, then press ESC to leave insert mode, followed by :wq to save and quit the editor and pressing the enter key. You should be returned to the command prompt.

Next, we will run /etc/init.d/atlas create_key to create our private and public key pairs. After it's done generating, run /etc/init.d/atlas get_key to print the key in the terminal. It will print the URL to register your software probe, or you can click here.

Registering your probe

The page will ask for your AS number, which is an identifying number for your ISP and can be found by going here and making note of the numbers following the "asn" array. Enter the city where your device is located, followed by the country. Finally, enter the public key that was returned by the get_key command earlier.

The approval process is a manual one, and someone will have to approve your software probe to be placed on the network.

Ensuring Atlas starts on boot

Finally, enter these last two commands in your terminal to enable and start the Atlas service.

/etc/init.d/atlas enable
/etc/init.d/atlas start

That's it! Once your probe is approved, you should be able to view the data on it and be able to use the credits generated by your probe to fully utilize the Atlas network.

Secure DNS On A Linux-Based Hotspot

Sun, 10 Jul 2022 06:05:54 GMT

In my previous posts, I talked about the Netgear MR1100 and T-Mobile TMOHS1 hotspots. In them, I briefly spoke about mods you can perform on those devices, including modifying the TTL and changing the DNS servers. But I wanted a little more security on the DNS side, especially because we know that carriers perform deep packet inspection and God knows what else on their networks.

Originally I planned to use cloudflared in its DNS mode, however, the binary file was much too big (~26MB) for the relatively small file systems on these devices and did not work half the time. I gave up, but then I remembered dnscrypt-proxy. And luckily for us, its binary file size is much more forgiving at only ~7.5MB.

I'm going to be using a custom Cloudflare Zero Trust DoH server for the upstream requests on my hotspot. dnscrypt-proxy has many built-in servers and a list can be found here. It also supports a vast amount of protocols, including but not limited to, DNScrypt, DNS over HTTPS, Oblivious DNS over HTTPS, and plain old DNS.

Overview

Downloading dnscrypt-proxy on the device
Modifying the config file
Adding CA Certs
Creating a script to make dnscrypt-proxy run on boot
Changing the hotspot settings to use the new DNS settings

Downloading dnscrypt-proxy On the Device

First, we need to get to a root shell on the device which I discussed how to do in my other posts. Then we'll navigate to the /tmp folder and grab the dnscrypt-proxy tar and untar it.

cd /tmp
wget https://github.com/DNSCrypt/dnscrypt-proxy/releases/download/2.1.1/dnscrypt-proxy-linux_arm-2.1.1.tar.gz
tar -xf dnscrypt-proxy-linux_arm-2.1.1.tar.gz

If we do a ls now, we should see a linux-arm folder.

Now we will change the directory into that folder and move some files to their appropriate location.

cd linux-arm/
mv dnscrypt-proxy /bin
mv example-dnscrypt-proxy.toml /etc/dnscrypt-proxy.toml

Modifying the Config File

Now that we've moved all the needed files to their appropriate location we can edit the config file for dnscrypt-proxy. This will allow us to set our upstream servers and our binding address, because we cannot have dnscrypt-proxy and dnsmasq both listening on 127.0.0.1:53, so we'll assign dnscrypt-proxy 127.0.1.200:53, and then tell the system to forward to that address. I recommend you visit the wiki here and learn how the config file works.

cd /etc
vi dnscrypt-proxy.toml

Line 32 in this file is where you specify your servers. Make sure to uncomment the line if you want to use servers other than the default so it is parsed accordingly. Line 42 is where we change our binding address, so change this 127.0.1.200:53. At the very bottom of the config is where you can specify custom servers using what's called a DNS stamp. This is a good generator.

use custom servers with the line uncommented

new listen address

If you choose to leave the server_names lines commented out, dnscrypt-proxy will choose servers that follow the options in the lines farther down.

Adding CA Certs

Once you've edited your config, we need to add ca-certificates to the system so dnscrypt-proxy can verify that we are connecting to a server with a valid certificate. We are going to place the file in /etc/ssl/certs/ca-certificates.crt

mkdir ssl
mkdir ssl/certs
cd ssl/certs/
wget https://curl.se/ca/cacert.pem
mv cacert.pem ca-certificates.crt

Verify that everything is setup by running dnscrypt-proxy -config /etc/dnscrypt-proxy.toml

Making a Script to Run On Boot

We're going to change directory to /etc/init.d/ and create a script that will wait 15 seconds on boot, then start dnscrypt-proxy. This gives the system time to establish a network connection and generally is safer than running immediately when the system comes up.

cd /etc/init.d
vi dnscrypt-proxy.sh
chmod +x dnscrypt-proxy.sh
ln -s /etc/init.d/dnscrypt-proxy.sh /etc/rc5.d/S98dnscrypt-proxy

Contents of dnscrypt-proxy.sh:

#!/bin/sh
sleep 15 && \
/bin/dnscrypt-proxy -config /etc/dnscrypt-proxy.toml &

Reboot the hotspot, and dnscrypt-proxy should be running! You can verify by performing a nslookup on the device itself.

Changing the Hotspot Settings to Use the New Server

On the MR1100, in the webUI, enable manual DNS and set DNS 1 to 127.0.1.200 and DNS 2 to 0.0.0.0. On the TMOHS1, edit the /etc/init.d/customdns.sh script with the new IP. A reboot may be needed to apply the changes.

Helpful Links

DNSCrypt Documentation
DNSCrypt Server List
DNS Stamp Calculator
How to Use Vim

Netgear MR1100 Hotspot

Tue, 05 Apr 2022 17:42:52 GMT

After receiving a T-Mobile TMOHS1 hotspot, I was left craving a little more. I hopped on eBay, searched up for an MR1100 hotspot, and found an ATT model with a bad SIM reader for ~$50! Bought it, took a small knife to the gold contacts on the reader, and pushed them up a little, and we're up and running!

I've been using the T-Mobile $10 business unlimited tablet plan, and I have read online that T-Mobile specifically blocks the IMEIs of MR1100s unless they're on specific hotspot plans. So my first step in my plan was to modify/perform magic/change/alter/etc. the IMEI.

I have gone ahead and flashed my ATT hotspot to the generic software, as I don't need the LAA feature, and I trust Netgear's firmware a little more than ATT's.

Performing "Magic"

In online forums, modifying the IMEI is typically referred to as "performing magic" on a device. Modification of the IMEI is a legal gray area in the US as you're only supposed to change the IMEI to a device you already own, i.e. a tablet. I won't be delving into how to obtain a tablet IMEI in this guide, sorry!

Regardless, let's hop right into it!

First, connect the MR1100 to your computer via USB, and use your favorite telnet client to telnet to your hotspot's IP at port 5510. Nothing will automatically display, but you should be able to type ati and get a response.

PuTTY settings

ati
ati
Manufacturer: Netgear, Incorporated
Model: MR1100
Revision: NTG9X50C_12.06.11.00 r3831 ntgrbc-fwbuild4 2020/01/24 17:46:40
IMEI: xxx
IMEI SV: 13
FSN: xxx
+GCAP: +CGSM


OK

Unlocking the Advanced Settings

We need to clone this Replit repo, as this gives us the script needed to modify the IMEI all in one place. In the Shell tab, we need to run pip3 install -r requirements.txt

~/TreasuredTornRouter$ pip3 install -r requirements.txt 
Collecting pyserial
  Using cached pyserial-3.5-py2.py3-none-any.whl
Installing collected packages: pyserial
Successfully installed pyserial-3.5
WARNING: You are using pip version 21.2.dev0; however, version 22.0.4 is available.
You should consider upgrading via the '/opt/virtualenvs/python3/bin/python3 -m pip install --upgrade pip' command.

Back in PuTTY, we need to type AT!OPENLOCK? to get the string needed to get the unlock token. Copy the string to your clipboard.

AT!OPENLOCK?
1240396BFCEA38E7

OK

Now we need to enter the command ./sierrakeygen.py -l 'string' -d MDM9x50_v1, replacing 'string' with the string you copied and without quotes.

~/TreasuredTornRouter$ ./sierrakeygen.py -l 1240396BFCEA38E7 -d MDM9x50_V1
AT!OPENLOCK="BCC54829A0CBE8DE"

The output of that command is what we need to copy and paste into PuTTY to unlock the advanced settings on the device.

AT!OPENLOCK="BCC54829A0CBE8DE"
AT!OPENLOCK="BCC54829A0CBE8DE"
OK

Modifying IMEI

Next, enter AT!NVIMEIUNLOCK.

AT!NVIMEIUNLOCK
AT!NVIMEIUNLOCK
OK

Now here's where we put in our IMEI. For example, if the IMEI we want to change it to is 123456789012347, we type AT!NVENCRYPTIMEI=12,34,56,78,90,12,34,70.

AT!NVENCRYPTIMEI=12,34,56,78,90,12,34,70
AT!NVENCRYPTIMEI=12,34,56,78,90,12,34,70
OK

Type ATI to verify our changes applied, and then type AT!RESET.

ati
ati
Manufacturer: Netgear, Incorporated
Model: MR1100
Revision: NTG9X50C_12.06.11.00 r3831 ntgrbc-fwbuild4 2020/01/24 17:46:40
IMEI: 123456789012347
IMEI SV: 13
FSN: xxx
+GCAP: +CGSM

AT!RESET
AT!RESET
OK

Done!

Modifying TTL

I've read online a lot of places that claim that modifying the TTL on the MR1100 is not possible. This couldn't be further from the truth. We just need to enable the root telnet shell, and then create a script that runs on boot to masquerade the TTL.

First, we need to enable the advanced settings of the hotspot as we did above with the python script. After that, enter AT!TELEN=1, followed by AT!CUSTOM="RDENABLE", 1. Then reboot the device.

AT!TELEN=1
AT!TELEN=1
OK
AT!CUSTOM="RDENABLE", 1
AT!CUSTOM="RDENABLE", 1
OK

Now we need to open a new telnet session, this time at the standard telnet port. You should be dropped straight into a shell.

msm 202001241807 mdm9650

/ #

Now simply just enter the following commands and reboot the device!

echo "iptables -t mangle -I POSTROUTING -o rmnet_data+ -j TTL --ttl-set 64" > /etc/init.d/ttl.sh
echo "ip6tables -t mangle -I POSTROUTING -o rmnet_data+ -m hl ! --hl-eq 255 -j HL --hl-set 64" >> /etc/init.d/ttl.sh
chmod 755 /etc/init.d/ttl.sh
ln -s /etc/init.d/ttl.sh /etc/rc5.d/S98ttl

Note, I recommend after rebooting to disable the root shell telnet. This can be done by entering the advanced settings in the port 5510 telnet session and entering AT!TELEN=0andAT!CUSTOM="RDENABLE", 0, and rebooting once more.

AT!TELEN=0
AT!TELEN=0
OK
AT!CUSTOM="RDENABLE", 0
AT!CUSTOM="RDENABLE", 0
OK

Using IPv6 DNS Servers

A step up from the TMOHS1 hotspot, this one lets us specify the DNS servers for our clients. However, it will only let us use IPv4 servers...sigh. The resolv.conf file for this device is stored in /mnt/userrw/swietc/resolv.conf. So we simply create a script in /etc/init.d/customdns.sh with the contents:

#!/bin/sh

(while true
    do echo "nameserver 2606:4700:4700::1111" > /mnt/userrw/swietc/resolv.conf
    sleep 15
done) &

Make it executable:
chmod 755 /etc/init.d/customdns.sh
and finally:
ln -s /etc/init.d/customdns.sh /etc/rc5.d/S98customdns.

T-Mobile TMOHS1 Hotspot

Sat, 26 Mar 2022 08:43:05 GMT

GitHub - parker-stephens/TMOHS1-Root-Utility: An interactive python script that enables root access on the T-Mobile (Wingtech) TMOHS1, as well as providing several useful utilites to change the configuration of the device.

An interactive python script that enables root access on the T-Mobile (Wingtech) TMOHS1, as well as providing several useful utilites to change the configuration of the device. - GitHub - parker-st...

GitHubparker-stephens

Modifying All Outgoing TTL

Essentially masks all outgoing data as "on-device" rather than hotspot data. This will apply on each boot automatically.

echo "iptables -t mangle -I POSTROUTING -o rmnet_data+ -j TTL --ttl-set 64" > /etc/init.d/ttl.sh
echo "ip6tables -t mangle -I POSTROUTING -o rmnet_data+ -m hl ! --hl-eq 255 -j HL --hl-set 64" >> /etc/init.d/ttl.sh
chmod 755 /etc/init.d/ttl.sh
ln -s /etc/init.d/ttl.sh /etc/rc5.d/S98ttl

Using Custom DNS Server(s)

Editing /etc/resolv.conf provides a temporary fix, but this file will be overwritten again on reboot, and even randomly while it's on. So let's make a script to defeat that!
Create /etc/init.d/customdns.sh with the contents:

#!/bin/sh

(while true
    do echo "nameserver 1.1.1.1" > /etc/resolv.conf
    sleep 15
done) &

This will make the script repeat every 15 seconds, ensuring that our DNS change sticks. You can replace 1.1.1.1 with whatever IPv4/6 server you want.

chmod 755 /etc/init.d/customdns.sh
ln -s /etc/init.d/customdns.sh /etc/rc5.d/S98customdns

Allowing More Devices On WiFi

By default, the hotspot allows a maximum of 10 devices on a WiFi network, but we can change this to whatever we want. Edit the max_num_sta line in /data/configs/hostapd.conf for the 2.4GHz network or /data/configs/hostapd-wlan1.conf for the 5GHz network. There is also a file in /data/wlan_cfg/max_num, but this doesn't seem to do anything.

Changing USB Mode

At a shell:
ADB: /sbin/usb/compositions/9025
ADB + RNDIS + DIAG: /sbin/usb/compositions/902D
Default: /sbin/usb/compositions/9057

I've had trouble identifying whether or not this device has a MDM9207 or a MDM9607 (X5) modem, as the internal FCC photos show a MDM9207 modem and QPST also says MDM9207, but my hotspot's software references the MDM9607 several times, and considering I'm able to hit speeds of 75/15 (QCOM says the MDM9207 is only capable of 10/5), I'm just gonna assume it has the MDM9607 modem.

Considering that T-Mobile is literally handing these out for free with 30GB of data, I hope that eventually someone will figure out how to SIM unlock these devices. It appears as though there haven't been any software updates after ~January 2021 (device is on software version TMOHS1_0.04.18, and I'm able to find Google results about that version from around those times, but hell, it's possible it's even older than that).

Free 30-Day Trial with Test Drive® | App & Hotspot Device | T-Mobile

Try our network with a 30-day or 30GB free trial. Choose to Test Drive® with a mobile hotspot device or an iOS app and keep your phone, number, and apps.

Try T-Mobile free for 30 days or 30GB of data and experience our expanded network without leaving your current carrier or losing your phone number.

FCC ID 2APXW-TMOHS1 4G Mobile Broadband Router by Wingtech Group (Hong Kong) Limited

FCC ID application submitted by Wingtech Group (Hong Kong) Limited for 4G Mobile Broadband Router for FCC ID 2APXW-TMOHS1. Approved Frequencies, User Manuals, Photos, and Wireless Reports.

FCC IDFCC ID

ati: (what the hell? i guess it's a MDM9607??)

Manufacturer: QUALCOMM INCORPORATED
Model: 4108
Revision: MPSS.JO.2.0.2.c1.7-00052-9607_GENNS_PACK-1  1  [Jul 17 2020 11:00:00]
SVN: 04
IMEI: ###############
+GCAP: +CGSM

OK

at+cgdcont=?

+CGDCONT: (1-24),"IP",,,(0-2),(0-4),(0-1),(0-1)
+CGDCONT: (1-24),"PPP",,,(0-2),(0-4),(0-1),(0-1)
+CGDCONT: (1-24),"IPV6",,,(0-2),(0-4),(0-1),(0-1)
+CGDCONT: (1-24),"IPV4V6",,,(0-2),(0-4),(0-1),(0-1)

OK

Cloudflare for Teams Wireguard Config

Fri, 23 Jul 2021 19:01:39 GMT

Warning

I'm going to go ahead and say this isn't a task for the weak and feeble. This isn't a method supported by Cloudflare, and could be against their TOS for all I know, thus making this process not straightforward.

Summary

This process involved installing the Android SDK on Windows with the AVD manager, using some command line knowledge, and knowing how to setup a Wireguard tunnel.

We will make a device running Lollipop, as this allows us to extract the Wireguard configuration from the device, as in newer versions of Android this is locked down in hardware.

The Process

First, let's go ahead and install the latest Android SDK from here. In the install process, make sure AVD Manager is checked and will be installed on the hard drive. We also want Android platform-tools, as this includes ADB which we will need later on. Download that from here and just extract it into a folder.

Creating our Android Device

Go ahead and launch Android Studio, and select AVD manager under the configure dropdown.

A new windows will appear. Go ahead and select "Create Virtual Device."

Select Tablet in the Category pane, and Nexus 7 (not 2012!) in the Device pane.

In the "Select a system image" window, select Lollipop and select the download button next to it. Click accept on the terms, and wait for it to download. Select Lollipop and click next.

We don't need to change anything on this next window, so go ahead and select "Finish."

Select the play button inside the device you just created.

If all went well, you should now be greeted with the Android homescreen!

Installing 1.1.1.1 on the Android Device

Now on your computer, open your web browser and head to APKMirror here to download the latest APK of 1.1.1.1. Note that we want the APK, not a bundle. Once your apk is downloaded, place it in the folder you extracted platform-tools to. Your folder should look like something below.

Go ahead and shift+right-click in the folder, and select "Open Powershell window here" or "Open Command Prompt windows here," depending on what version on Windows you have, or whatever your preference is. Type adb.exe devices. This should list your emulator as a device.

Now we want to install 1.1.1.1 onto the Android device. Type adb.exe install "apk name here".

And like magic, 1.1.1.1 should show up in the app drawer now!

Logging into Cloudflare for Teams on the Device

If you have set up Cloudflare for Teams on any other mobile device, the process is the exact same here. Click the hamburger, "Account," "Login with Cloudflare for Teams."

Go ahead and enter your organization name, and proceed with whatever login method is set up.

And just like that Teams is set up on the device. Now it's time to extract the Wireguard configuration.

Pulling the Wireguard Configuration

Go back into Powershell/Command Prompt, and type adb pull /data/data/com.cloudflare.onedotonedotonedotone/shared_prefs/com.cloudflare.onedotonedotonedotone_preferences.xml. This will place the configuration in the platform-tools folder. Go ahead and open it with your favorite editor, VS Code in my case.

Tunnel Info

Within our XML file, we need to make note of a couple items.

Peer Public Key
Peer IP Address
Peer Port
Client IP/s
Client Private Key
Client Registration ID

You might have to dig around in the XML to find these, but in my case here are my values (don't worry, it won't work after).

Endpoint Public Key: bmXOC+F1FxEMF9dyiK2H5/1SUtzH0JuVo51h2wPfgyo=
Endpoint IP Address: 162.159.193.10 and [2606:4700:100::a29f:c10a]
Peer Port: 2408 (Note, if this is blocked by a firewall, port 500, 1701, and 4500 are also valid.)
Client IP: 172.16.0.2 and fd01:5ca1:ab1e:8f0c:9fb5:4cdd:ea7e:f0d3
Client Private Key: Q28IK1ygu1MT4wumEoBf3Gl6+awKgyS3X+ioEi2HGnE= (I have revoked this, it will not work for you.)
Client Registration ID: t.f634e942-ebe5-11eb-9b1d-a6b0c2bd8c0a (This is used to create Identity based-policies and other things in the Cloudflare for Teams dashboard. Note, the "t." part won't be present in the dashboard.)

All done!

That's it! Now you can use that in pfSense to treat your whole network as one device in the dashboard, use it on a device that doesn't support the 1.1.1.1 app but supports Wireguard, or anything else you put your mind to.

Keep in mind, some online service will recognize the Warp IP as a VPN. Specifically Hulu (but not Netflix?), Wikipedia, and others. You can try using split tunneling, but this will have to be configured on the local device, not the Cloudflare for Teams dashboard.

Joining the NTP Pool

Tue, 06 Apr 2021 02:30:46 GMT

What is NTP?

NTP, or Network Time Protocol is a UDP-based protocol on port 123 that allows computers to sync their time over the internet. NTP servers have different levels on a hierarchy based system, or stratums, with the highest at 0 being the reference clock sources that are not made public and are connected directly to stratum 1 servers, and so on and so forth. Endpoints such as your phone, computer, router, etc, can connect to any server at or below stratum 1.

What Is the NTP Pool?

The NTP pool is a large virtual cluster of timeservers that are used for millions of devices everyday. As of January 29, 2021, there are 4,392 active servers that take part in the NTP pool project. With all these servers, an accurate time can be kept, and load-balancing can be done amongst all servers to distribute a fair load upon all of them. Even with all these servers, however, more servers still need to be added to keep up with the growing demand of internet devices.

How Can I Join the Pool?

Now you may be asking yourself, "How do I join the pool?" All that you need to join the pool is a NTP server with a static IP address (IPv4 and/or IPv6!) and some good, manually selected upstream time servers (or your own clock source!). If you've got all that, you're eligible to join the NTP pool!

Choosing Good Upstream Time Servers

If you have a NTP server, but aren't sure of how to configure your upstream NTP servers, this can help. You want to use statically assigned NTP servers, and NOT pools (you can use servers that are in the pool, just make sure you save the specific IP address, NOT the pool hostname.) For example, if you want to use time.google.com, run a DNS lookup for time.google.com, like below, and choose one of those IP addresses instead of the hostname.

Also, you can configure servers found on the NTP website as well. Here is a list of stratum 1 time servers, and here is a list of stratum 2 time servers. You want to pick servers that are marked "OpenAccess" for their access policy, and ones that are generally closer to your location. The goal here is to pick several different servers, not only for failover, but because of how NTP works, it compares the different server's times, and will only sync if three or more servers agree on the time.

Joining the Pool

Now it's time to join the pool! Make sure you have a firewall rule to allow UDP traffic on port 123 on your timeserver, and use a website such as this one to check if your NTP server can be reached from the outside internet. Once you've made sure you've done that, head over here to login in to the NTP pool website.

Once you are logged in, you will be brought to your dashboard. On the right-hand side, you can see the spot to add your server. Type in the hostname or IP address of your server, IPv4 and/or IPv6, and click add. It will then be populated in the list in the middle. There is an option to change the net speed of the server. This is NOT the actual speed of what NTP clients will connect at, so if you select 1000 Mbps you will NOT receive a full gigabit of NTP traffic. The net speed is relative to all the other NTP servers, so a 500 Mbps server will receive double the amount of that of a 250 Mbps server. In my dashboard I have my servers set to 1000 Mbps, and see a max constant 5 Mbps. This may sound too good to be true, but 5 Mbps of traffic for me is over 120k states of connections in my firewall.

When Will My Server Start Being Used?

You will notice at first that your NTP server will not be used. This is because your NTP server on the pool has a score, with a max of 20 and a low of -100, and for your server to be used in the pool it must have a minimum score of 10. What affects your score? Server downtime and if your time offset is more than 100ms. You can monitor your score on the dashboard and once it reaches 10 you will start to see NTP traffic flow to your server.

Flashing OpenWRT to Luma Mesh Routers

Wed, 14 Oct 2020 10:18:36 GMT

Luma is one of those Mesh WiFi companies that didn't last very long. The last firmware pushed out for these access points was in January 2018. Over two years ago. Their website, https://lumahome.com, isn't even available anymore. However, the app still works, but don't expect to get any support.

3-pack of Luma Mesh System

So you may be asking yourself, what can I do to these access points to give them more customizability, make them more secure, or just have more control over them? These routers ran a customized version of OpenWRT out of the box, but recently OpenWRT has been ported over, and as of October 13, 2020, builds are in the snapshot state.

What do you need?

A Luma Router (M/N WRTQ-329ACN)
The install/initram image of OpenWRT (Can be found here)
A USB to TTL adapter (Can be found on eBay for literally less than $5 with free shipping)
Some Solderless Breadboard Jumper Wires
A Computer
A TFTP Server (for Windows you can use PumpKIN and macOS you can use TFTPServer)
A little patience

Getting Started

First, let's pop open the Luma. You can do this by placing a flathead screwdriver in the bottom slot of the Luma. A lot of force is required to pop it open, and you will most likely damage the plastic a little.

Now we can get a good look at the mainboard and the back plate, which even has a heatsink with heat pads on it!

Here's the area we need to focus on, the serial connector.

Whatever you do, DO NOT CONNECT THE VCC CONNECTOR. YOU WILL MOST LIKELY FRY YOUR LUMA OR YOUR USB TTL ADAPTER. YOU HAVE BEEN WARNED.

On my USB TTL Adapter, there are 4 pins. Red is VCC (REMEMBER, DO NOT CONNECT), black is ground, green is TX or transfer, and white is RX or receive.

Let's go ahead and connect the two together. The jumper wire colors can be whatever you want, as long as you know the colors on the USB TTL Adapter and what they correspond to on the Luma.

Here you can see I used totally different jumper wire cables, but as long as you remember what each USB TTL Adapter wire is and what pin it goes to on the Luma, you are fine. Arguably, the most tedious part is done.

Getting U-Boot Access

U-Boot is the bootloader on these devices, and we need to get access to it. However, Luma has disabled this out of the box, therefore, there are some extra steps needed to get access. For macOS, you can use the screen command with a baud rate of 115200 to get serial access to the device. In Windows, you can use a program such as Putty to get access, just be sure to specify the correct COM port Windows has assigned (can be checked in Device Manager) and use a baud rate of 115200. For example, in macOS I would use the command below. Note, sudo is not needed.

Let's go ahead and boot up the Luma. As you do, tons of messages should fill up the screen. If no characters appear, or garbled characters appear, check that your connections are good and that you have set the correct baud rate. We want to look for an option to enter failsafe mode.

Highlighted in red above is what you want to look out for. If you miss it, just reboot the Luma and try again. Once you see that, press "f" and then enter on your keyboard, and then you should see the splash screen. Once here we want to enter these commands:

mount_root

and:

fw_setenv bootdelay 3

This gives us a three second time delay to enter U-Boot on the device, which is plenty.

Booting the Install Image

Once you've gained U-Boot access, let's reboot the device. You should see a prompt like below to stop the autoboot process. Just press any key on your keyboard to stop this. Once done, we are given a prompt.

Now to boot the image, we use the tftpboot command. At this point, make sure your ethernet cable is connected to your computer and the other end is plugged into the left port of the Luma (labeled as "out" on the backplate). If you've done this right, type tftpboot and press enter.

It should start attempting to load a TFTP file. Just press ctrl + c to exit this. Now this tells us we need to set our computer's static IP address to 192.168.11.168, and the install image name to C0A80B0E.img. The file name can be different for each device, so copy the file name your Luma specifies.

Above shows the current directory I have selected for the TFTP server, with the proper install image renamed. Once you have your computer's static IP set and the proper directory set for your TFTP server, let's continue. At the prompt, enter:

tftpboot 0x84000000
then:

bootm 0x84000000
This will start loading the OpenWRT install image. Once it's done booting, you are now running a temporarily build of OpenWRT!

Flashing OpenWRT Permanently

Well now that you've got the awesome OpenWRT booted, you want it installed on your Luma! The first step we need to do is connect an ethernet cable connected to your existing network, with an active internet connection and DHCP to the right ethernet port, or the "in" port according to the backplate. At the prompt type:

opkg update
then:

opkg install uboot-envtools

This will install the necessary package to modify the U-Boot bootloader from OpenWRT. If it successfully installed, let's continue. Type:

fw_setenv openwrt "setenv mtdids nand1=spi_nand; setenv mtdparts mtdparts=spi_nand:-(ubi); ubi part ubi; ubi read 0x84000000 kernel; bootm 0x84000000"

fw_setenv bootcmd "run openwrt"

ubirmvol /dev/ubi0 -N ubi_rootfs.

Now for the final steps. Navigate to the /tmp/ directory on your device.

cd /tmp/

Now we want to grab the latest sysupgrade file from OpenWRT.

wget https://downloads.openwrt.org/releases/21.02.2/targets/ipq40xx/generic/openwrt-21.02.2-ipq40xx-generic-luma_wrtq-329acn-squashfs-sysupgrade.bin

NOTE: This link may be subject to change and is just the example I have provided. Make sure you grab the correct latest link for the sysupgrade.

Now let's type:

sysupgrade -v -n openwrt-21.02.2-ipq40xx-generic-luma_wrtq-329acn-squashfs-sysupgrade.bin

Substituting the file name I used for the file name you used. OpenWRT will start flashing and the device will reboot with a fresh config.

Congrats!

You've just flashed OpenWRT on your Luma. You can go ahead and remove the jumper wires and place the backplate back on the Luma. The "out" port on the Luma is designated as the LAN and the "in" port is designated as the WAN. Note that with snapshot builds, the web GUI is not built in, and you will have to SSH in to install luci using opkg.

Also, the LED ring light will spin continuously as the custom Luma scripts are no longer present to control what they do. You can get around this as discussed at the bottom of the page here, and even do some fancy lighting changes.

Special thanks to everyone who made this possible, and especially the forum thread here. This would not be possible without them.

Sources:

Luma Home WiFi support

Is it possible to get support for Luma Home WiFi?? Since the company abandoned the product and I haven’t seen any firmware updates for nearly two years..... I have three of these units. Descent hardware specs http://en.techinfodepot.shoutwiki.com/wiki/Luma_WRTQ-329ACN Am willing to open one up a…

OpenWrt Forumjpstoppa

git.openwrt.org Git - openwrt/openwrt.git/commit

openwrt/openwrt.git/commit

Upgrading ntopng on pfSense To Latest Version

Sat, 16 May 2020 08:00:00 GMT

UPDATE: AUGUST 31, 2021.

ntop has a guide on installing the latest version of ntopng located here.

Adding An IPv6 Tunnel To pfSense

Sat, 09 May 2020 08:00:00 GMT

IPv6, the newest Internet Protocol. It’s meant to replace IPv4, and was even made in the 90s. However, not all ISPs have adopted it. Whether it be because of outdated equipment, a large investment is needed, or the ISP just isn’t ready, not everyone has native IPv6. Luckily this was thought of, and free services exist to remedy this issue.

Note: Using a public IPv6 tunnel may break certain websites such as Netflix, as the tunnel is considered a “proxy.” Hurricane Electric also does not allow Cloudflare inbound connections (unless you want to pay $500/month), and you will be greeted with a 522 Error on any proxied DNS entry pointing towards a HE tunnel.

Hurricane Electric

Creating Tunnel

To get started, first create an account at tunnelbroker.net. Once you have your account created, select “Create Regular Tunnel” in the “User Functions” box in the left-side.

You will be greeted with a new page asking you to fill in your current IP address and the endpoint location of your tunnel. It will display your current IP as well.

IP cannot be pinged from HE.

If you get the above message, your endpoint will need to allow pings from HE’s IP. You can do this by adding a firewall rule like the one below.

Allowing ping from HE.

Successful ping from HE.

If you get the message above, continue. Make sure to pick the fastest server. You can do this by pinging the IPv4 addresses and seeing which one has the lowest latency. Think of it this way, all your IPv6 traffic will leave your pfSense box, as IPv4 packets, to a HE server, which will receive those packets and convert them to IPv6, and then route them at that server. Once you have created your tunnel, a new page will appear.

Newly created tunnel details page.

Adding Tunnel To pfSense

Once your new tunnel is created, login to pfSense and navigate to Interfaces>Assignments>GIFs. Select Add+. In the parent interface, select your WAN. In the GIF Remote Address, insert the Server IPv4 Address from above. In the GIF tunnel local address, insert the Client IPv6 address. In the GIF tunnel remote address, insert the Server IPv6 address. In the GIF Tunnel Subnet, select /64. Feel free to add a description and save the interface.

Configuring the tunnel on pfSense.

Once the GIF interface is made, navigate to Interfaces>Interface Assignments and add the new interface. Enable it and save it.

Assigning Subnet to LAN Interface

After you’ve enabled the GIF interface, you now need to assign an IPv6 address to your LAN interface or whichever one needs IPv6. Navigate to the interface settings page. Under IPv6 Configuration Type, select Static IPv6. A new section will appear below. In IPv6 address, insert the HE Routed /64 address here, with the /64 removed. Select /64 in the dropdown menu. Now save the interface and apply the changes.

Configuring the LAN interface for IPv6.

Allow IPv6 Firewall Rule

Now that IPv6 is enabled on the interface, you must create a new firewall rule to allow IPv6 on the interface. This is as simple as creating a new rule, selecting IPv6, selecting any protocol, and saving the new rule.

Creating the IPv6 firewall rule.

Done!

That’s it! You’ve now enabled IPv6 on your LAN network. Now your client will not receive an IPv6 address yet. You must configure a DHCPv6 server and/or SLAAC for this. The guide listed below will show you how to do that.

Sources:

pfSense Configuration Recipes — Configuring IPv6 Through A Tunnel Broker Service | pfSense Documentation

pfSense Documentation

Solving the Parasitic Battery Drain On My 2012 Volvo XC90

Sat, 18 Jan 2020 08:00:00 GMT

Recently, I got a 2012 Volvo XC90. Within the first few weeks of driving it, I came out to it and the battery was dead. A quick jump start later, and I was fine. The battery didn’t die for several more weeks. Note that this was also with me driving almost every day.

When it happened the second time, I figured something was up. I started Googling and read about the RDAR module (Remote Digital Audio Receiver, provides Sirius XM for the car) would constantly look for a signal when the car was off if you did not have a Sirius subscription. Since I did not have a subscription, and it did not work on the radio either, I looked into ways to fix the issue.

Ways to Fix the Issue

Some ways that included fixing it were to take it to a dealer and pay ~$150 to have Volvo do a software update and reload on the module. Another solution was to unplug the XM receiver and install a MOST loop on the receiver.

I chose to disconnect the receiver and install the MOST loop. In this car, MOST stands for the Media Oriented Systems Transport. It carries all the signals for the infotainment over plastic fiber optic cables, to various parts of the car. This includes a subwoofer in the back if equipped, the amplifier under the passenger seat, the RDAR module, the radio module in the roof headliner, and more. If you do not install the MOST loop and only disconnect the receiver, you will no longer have a working radio.

MOST Loop (P/N 8688083): https://www.volvopartswebstore.com/products/Volvo/Brace/1162068/8688083.html

Locating the Module

After finding the internal Volvo repair software online, I located everything I needed to replace and how to remove the parts.

RDAR Module Removal
Side Panel Removal

Removing the Side Panel

In the side panel, there are a total of 4 screws to remove. There are two behind the two metal hooks. Remove those screws by prying on the plastic and jamming a socket wrench on the screw with an extension. The next screw is under a little plastic cover by the window vent. The last one is under a little plastic cover on the C pillar.

After removing the 4 screws, remove the upper trim pieces on the C and D pillar. These can be somewhat difficult to remove, but the clips are sturdy and will not likely break.

After these trim pieces are out, lift up and out on the side panel. It should loosen up. Wiggle it out, making sure it is not getting caught on anything like the seatbelt, trunk, etc.

Disconnecting the RDAR (Sirius) Module

After the side trim is removed, the RDAR module is exposed. I found that it was easier to remove the module and to take out the wires/fiber optics then. When removing it, be careful not to bend the fiber optic cables to an extreme. Disconnect the power cable and the fiber optic cable. Connect the MOST loop to the end of the fiber optic cable. Do not reconnect the power cable, otherwise, you’ve wasted your entire time to connect back the faulty module.

Using VLANs on OpenWRT

Sat, 23 Nov 2019 08:00:00 GMT

If you have ever used prosumer or enterprise networking equipment, you have probably run across a switch with “smart” capabilities or VLAN capabilities. VLANs by definition is “a virtual LAN is any broadcast domain that is partitioned and isolated in a computer network at the data link layer.” VLANs allow for multiple networks and subnets to be carried across one physical network link.

Things You Will Need:

An OpenWRT Device supporting VLANs (see here for more info) set as a DHCP client on the uplink interface
A VLAN capable switch (buzzwords like “managed” or “smart” switch)
A router or other device supporting 802.1q VLANs

Getting Started

Let’s say that I have a 192.168.1.0/24 network on VLAN 1 and a 10.0.1.0/24 network on VLAN 5. To make it easier, VLAN 1 will be the untagged internal network, while VLAN 5 will be the tagged public network. The public network will be able to access the internet but not be able to access VLAN 1, but VLAN 1 can access VLAN 5 and the internet.

On the switch, VLAN 1 will be untagged to the port and VLAN 5 will be tagged on the port. This will allow for the default traffic to go on the management network while allowing the public network stays on the public network.

Creating Your Interfaces

Log in to the LuCi interface on OpenWRT and navigate to Network>Interfaces. The only item right now should be the LAN network configured as a DHCP client. The OpenWRT device should have an IP address in the management network.

To create the tagged public network, click on “Add new interface” and give it a name. For the protocol, select “Unmanaged” a keep “Bridge interfaces” unselected. For the interface, specify the uplink port, i.e. eth0, and the VLAN tag. I.e. if you have VLAN 5 on eth0, the interface would be eth0.5.

Click “Create interface” and apply the changes.

Assigning an SSID the Public Network

Let’s say that we want a public SSID titled “Public WiFi.” Navigate to Network>Wireless. Under the wireless radio for the SSID, it can be either 2.4 or 5GHz or both, select add. You will be asked to enter the SSID information.

As you can see, the SSID is on the “Public” network and not the “LAN” network. Configure SSID security, if needed, and save and apply the changes. If all went well you should be able to connect to the “Public WiFi” network and receive an IP in the public network subnet. If this did not work, check your switch to see if the VLAN is properly configured on that port, and make sure it is the right VLAN.

Enabling 802.11r (Fast Roaming/Transition) on OpenWRT

Sat, 16 Nov 2019 08:00:19 GMT

802.11r, also known as Fast Roaming/Transition on OpenWRT allows clients to seamlessly switch between several access points depending on which one is closer to the client. This is great for locations with more than one access point as a client does not have to drop a connection to rescan for APs, but can instead switch between, dropping minimal packets and remaining secure. In this guide, you will learn how to enable fast roaming on OpenWRT.

Installing WPAD

wpad is a full-featured IEEE 802.1x authenticator/supplicant for OpenWRT. Your access point may already have it installed but in another format such as wpad-mini or wpad-basic. For fast roaming, wpad, the full package, is required.

SSH Into The AP

SSH into your access point. I will be using Windows’ default ssh client. You may be asked to access the RSA key of the client, and select yes. Enter in the password of the AP.

Removing Other Forms of wpad

First in the terminal, enter in:

opkg update
This will update the repositories and lists of packages on the access points. Then enter:

opkg install wpad

If you receive the following message:

wpad is already installed and up-to-date

Then you do not need to do anything to continue. If you receive a message saying that the wpad package could not be installed due to another package, i.e. wpad-basic or wpad-mini, then type:
opkg remove interfering-package
This should remove the interfering wpad packages.

Installing wpad

If there are no conflicting dependencies and packages, type in:

opkg install wpad

If you want WPA3 support, install wpad-openssl instead of wpad

opkg install wpad-openssl

Configuring Fast Roaming

Now that wpad is installed we can configure fast roaming.

Login to the Luci web interface. Navigate to Network>Wireless. Then choose the SSID you want to enable fast roaming on. Note that if you have more than one SSID or radio, then you will have to repeat these steps.

Select the SSID you want to enable fast roaming on, and go to the Wireless Security tab under Interface Configuration. Select the checkbox to enable 802.11r.

You will be greeted with several fields.

For the mobility domain, enter in an 4-character hexadecimal ID. Here are examples

abcd
12ab
1234
1a2b
So on and so forth.

Once you have entered these settings, copy and paste the same mobility domain if you have multiple SSIDs. If you have multiple access points, you will keep the same mobility domain.

Congrats, you should now have fast roaming enabled on your access points!

Installing OpenWRT On a Meraki MR16

Sat, 09 Nov 2019 08:00:00 GMT

UPDATE 10/21. It appears that Cucumber WiFi (CT WiFi, etc.) was officially shut down September 3, 2021. I believe that leaves the only way to flash with Serial.

I recently picked up 11 Meraki MR16’s off of eBay for a good price. I decided to buy these because I knew that they would be reliable access points for the price.

Things you will need:

A computer (mine is running Windows)
A couple of ethernet cables
A Meraki MR16 Access Point
Something to push the reset button of the MR16 (i.e. a paperclip)
A TFTP server, in my case pumpkin
Cucumber firmware
OpenWRT Sysupgrade File Link (look for files starting with MR16)
Putty (or other SSH client)

Because you can not flash OpenWRT directly from the MR16 with the TFTP server, we will use Cucumber WiFi as an intermediary between the two, as it can be flashed simply.

Registering for a Cucumber Account

First, sign up for an account here.

Adding Device and Downloading Firmware

Then you want to log in to your dashboard. You will be asked to create a site and add a device. Once you’ve created your site, navigate to its page, and select “Devices” in the left-hand menu.

Once you are on the Devices page, you will then click the plus sign in the upper-right corner. It will ask you to either discover your device or to manually add it via its mac address. Select the mac address option.

When prompted to enter the mac address, you will enter the mac address found on the back of your MR16 access point, right above its serial number. You will enter it in the format of xx:xx:xx:xx:xx. Enter a device description to help find it later.

Now to download the Cucumber firmware. To download it, select your profile icon in the upper-right corner of the Cucumber WiFi dashboard, and select downloads. In the downloads list, choose Meraki MR16 and download the file. When downloaded, rename the file to “vmlinux.gz.uImage“. The name is case-sensitive and there must not be a trailing .bin at the end of the name.

Setting Up the TFTP Server

The first step to setting up the server is setting a static ip-address on your wired interface.

IP – 192.168.1.101
Subnet Mask – 255.255.255.0

From here, launch the pumpkin TFTP server. When it is launched, select the “Network” tab and input 192.168.1.101 in the ip-address field. Go back to the “Server” tab and for the “TFTP Filesystem Root” specify the location of the vmlinux.gz.uImage file.

Flashing the Cucumber Image

Connect an ethernet cable between your computer on the wired interface you set a static ip and the Meraki AP. Grab a paperclip and press and hold the reset button. Then connect power to the AP. While still holding the reset button, you should see the file being transferred in pumpkin, and after the file is transferred keep holding down the reset button until all the lights on the front of the AP start flashing, then you can let go. It will take approximately 5 minutes to flash, and if the device is still flashing after ~10 minutes, reboot and try again. After the AP reboots, connect the ethernet cable on the AP to an internet source. Also, connect your computer back to the internet.

Setting the MAC Address of the AP

By default, the MAC address of Meraki access points are not recognized by WRT-based operating systems. When the AP is fully booted and has an ip-address, navigate to its ip. If you do not know the location of the AP check the DHCP leases in your router. You will reach a login page. The username is cucumber and the password is stinky. Then navigate to http://ip-address/cgi-bin/meraki.html, substituting the IP of the AP in. You will be prompted to enter the MAC address of the AP. Note: Here the format is xx-xx-xx-xx-xx with hyphens. Save the changes and the AP will reboot.

SSHing into the AP

After the device reboots after setting the MAC address, it should appear in the Cucumber dashboard. Navigate to the device’s page in Cucumber expand the Network Details menu, and copy the SSH password. Open your SSH client and login to the AP with the username root and the password that you copied earlier. You will be prompted to connect to the host, select yes. You will be greeted with a Cucumber terminal.

Flashing OpenWRT

Copy the sysupgrade URL from earlier, and remove the (s) from https. Now, go back to the SSH terminal and type in the following commands. The wget command copies the file to the flash. When issueing the sysupgrade command, do not use the url.

cd /tmp
wget url-of-file
sysupgrade -v filename

The device should start flashing OpenWRT.

Getting Ready for OpenWRT

After the device reboots after issuing the sysupgrade command and the power light is a solid green, you will need to hold down the reset button on the AP until the power button starts flashing. The device will reboot.

Navigating to OpenWRT

Once the device reboots, it will act as a DHCP server. If you connect your computer to the AP’s ethernet cable it will obtain an IP address. OpenWRT will then be reachable at http://192.168.1.1