Zyxel WAC6103D-I
The Zyxel WAC6103D-I is a wall or ceiling mounted dual band 3×3 wireless AC access point with PoE and a per band pair of software switchable antennae.
OpenWrt support
Work in Progress
Hardware highlights
| CPU | Ram | Flash | Network | WLAN | Serial |
|---|---|---|---|---|---|
| Qualcomm Atheros QCA9558 | 256 MiB | 16 MiB NOR + 256 MiB NAND | 2x 10/100/1000 | 2.4GHz: QCA9558 3×3:3 b/g/n, 5GHz: QCA9880 a/n/ac 3×3:3 | 3.3V 115200 8N1 externally accessible |
Installing OpenWrt
The device uses a dual-image setup and OpenWrt can only be installed as image 0. When the currently running stock firmware is image 0, OpenWrt will be installed as image 1, fail to boot and the device returns to stock firmware. If this happens, install any version of stock firmware so that it runs as image 1, before installing OpenWrt. Alternatively, if there already is a valid stock firmware in image 1, the debug dual-image show and debug dual-image set boot-image image1 commands can be used in the stock CLI via Serial/SSH/Telnet/Web to switch to image 1.
Flashing with Stock Web Interface
- Go to Maintenance → File Manager → Firmware Package (or click the link next to Firmware Version under Device Information on the dashboard)
- Under Upload File browse to the OpenWrt factory image and click on Upload
Debricking / Install OpenWrt / Install Stock
- Disconnect the device from power
- Configure your machine to 192.168.1.103/24 and start a TFTP server
- Put the OpenWrt factory or stock firmware image into the TFTP server root and rename it to ZLD-current
- Establish a serial connection to the device through the console port
- Connect the device to power
- When prompted, press a key to abort automatic boot and enter debug mode
- Use the atnz command to flash the firmware image
- Use the atgo command to boot from the newly flashed image
Specific configuration
Network interfaces
The default network configuration is:
| Interface Name | Description | Default configuration |
|---|---|---|
| br-lan | Uplink, LAN1 & WiFi | DHCP |
Buttons / Switches
→ hardware.button on howto use and configure the hardware button(s). Here, we merely name the buttons, so we can use them in the above Howto.
The Zyxel WAC6103D-I has the following buttons:
| BUTTON | Event |
|---|---|
| Reset | reset |
| Wall/Ceiling mount switch | BTN_0 |
The physical antenna toggle switch on the device is implemented as an input switch mapped to button BTN_0 with the ceiling setting acting as the pressed and the wall setting acting as released action. See below for mapping it to a function.
Hardware
Info
| Architecture | MIPS 74Kc |
|---|---|
| Vendor | Qualcomm |
| Bootloader | Custom and restrictive, based on U-Boot |
| System-On-Chip | Qualcomm Atheros QCA9558 |
| CPU/Speed | 720 MHz |
| Flash-Chip | SPI-NOR, SPI-NAND MT29F2G08ABAEA |
| Flash size | 16 MiB NOR, 256 MiB NAND |
| RAM | 256 MiB 2x Nanya NT5TU64M16HG-AC |
| Wireless | 2.4GHz QCA9558 b/g/n 3×3, 5GHz QCA9880 a/n/ac 3×3:3 |
| Ethernet | 2x 10/100/1000 Mbit/s w/ vlan support |
| Switch | Qualcomm Atheros QCA8334 |
| USB | No |
| Serial | Yes externally accessible, 3.3V 115200 8N1 |
| JTAG | ? |
Flash Layout
The SPI-NOR flash layout is (not used by OpenWrt other than for bootconfig setting in mrd):
| Layer0 | raw flash | |||||||
|---|---|---|---|---|---|---|---|---|
| Layer1 | bootm | recovery | ker_reserved | fs_reserved | conf | mrd | disklog_reserved | art |
The SPI-NAND flash layout in the stock firmware is:
| Layer0 | raw flash | |||||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Layer1 | bootm_reserved | recovery_reserved | kernel1 | zldfs1 | kernel2 | zldfs2 | conf_reserved | mrd_reserved | disklog | ART_reserved |
Photos
Opening the case
There are 4 obvious phillips head screws and one smaller one hidden behind the MAC address label. There are some easy to detach plastic clips.
Serial
→ port.serial general information about the serial port, serial port cable, etc.
How to connect to the Serial Port of this specific device:
| Serial connection parameters for Zyxel WAC6103D-I | 115200, 8N1, 3.3V |
|---|
JTAG
→ port.jtag general information about the JTAG port, JTAG cable, etc.
Bootlogs
OEM bootlog
Loading... *** Warning *** : PCIe1 WLAN Module not found !!! BootModule Version: V2.2 | 2016-03-16 15:46:32 Kernel Version: 2.6.31 | 2024-08-08 03:35:25 ZLD Version: 6.28(AAXH.3) | 2024-08-08 04:19:13 CAPWAP Version: V1.00.04 DRAM Size : 256 Mbytes FLASH Size : 16 Mbytes NAND Size : 256 Mbytes Ethernet MAC Address : b8:ec:a3:0f:c8:30 Press any key to enter debug mode within 1 seconds. ..................... WAC6103D-I> athe ======= Debug Command Listing ======= AT just answer OK ATHE print help ATSR system reboot ATNAx board ip for tftp upload ATNSx server ip for tftp upload ATNK(x) tftp upload kernel image to flash ATNR(x) tftp upload file system to flash ATNZ(x) tftp upload and extract ZLD-current to flash ATKZ(x) show init switch or set to x ATSH dump manufacturer related data in ROM ATGO boot router ATDS Dualimage information show. OK WAC6103D-I> atds Image0 Kernel Version :2.6.31 | 2022-06-22 05:05:30 Image0 ZLD Version :6.28(AAXH.0) | 2022-06-22 05:24:17 Image0 status :Success Image1 Kernel Version :2.6.31 | 2024-08-08 03:35:25 Image1 ZLD Version :6.28(AAXH.3) | 2024-08-08 04:19:13 Image1 status :Success Boot Image :Image1 OK WAC6103D-I> atsh BootModule Version :V2.2 | 2016-03-16 15:46:32 Vendor Name :ZyXEL Communications Corp. Product Model :WAC6103D-I System Type :10 MAC Address :b8eca30fc830 Default Country Code :e1 Boot Module Debug Flag :0 Hardware Version :ZyXEL WAC6103D-I QCA955x Serial Number :S162L42140321 SNMP MIB level & OID :060102030405060708091011121314151617181920 Main Feature Bit :0 Other Feature Bits : e1 25 00 00 00 00 00 00-00 00 88 01 00 00 00 00 04 00 00 00 00 00 00 00-00 00 00 00 00 00 HW Test Flag :0 MFG Flag :0 OK WAC6103D-I> atgo Booting... Going to booting Kernel... BM cmd line: console=ttyS0,115200 root=31:13 init=/sbin/zyinit rootfstype=jffs2 mtdparts=ath-nor0:192k(bootm),1408k(recovery),1152k(ker_reserved),128k(fs_reserved),13184k(conf),64k(mrd),192k(disklog_reserved),64k(ART);ath-nand:1024k(bootm_reserved),1024k(recovery_reserved),25m(backup_ker),85m(backup_fs),25m(kernel),85m(zldfs),1024k(conf_reserved),1024k(mrd_reserved),31m(disklog),1024k(ART_reserved); bootImage=1 Loading from device 0: ath-nand (offset 0x70a0000) Created: 2024-08-07 20:18:21 UTC Created: 2024-08-07 20:18:21 UTC Starting kernel ... Booting QCA955x INIT: version 2.86 booting INIT: Entering runlevel: 3 Starting zylog daemon: zylogd zylog starts. Starting syslog-ng. Starting ZLD Wrapper Daemon.... Starting uam daemon. Starting periodic command scheduler: cron. Start EnterpriseWLAN system daemon.... Got LINK_CHANGE Port [0] Copper is up --> Group [0] is up ...................................Applying system configuration file, please wait... .........................................EnterpriseWLAN system is configured successfully with startup-config.conf netopeer-server start Welcome to WAC6103D-I Username:
OpenWrt bootlog
Loading... *** Warning *** : PCIe1 WLAN Module not found !!! BootModule Version: V2.2 | 2016-03-16 15:46:32 Kernel Version: 6.12.63 | 2026-01-18 20:48:28 ZLD Version: OpenWrt r32562-f948f71300 | 2026-01-18 20:48:29 CAPWAP Version: Vundefined DRAM Size : 256 Mbytes FLASH Size : 16 Mbytes NAND Size : 256 Mbytes Ethernet MAC Address : b8:ec:a3:0f:c8:30 Press any key to enter debug mode within 1 seconds. .................... Going to booting Kernel... BM cmd line: console=ttyS0,115200 root=31:11 init=/sbin/zyinit rootfstype=jffs2 mtdparts=ath-nor0:192k(bootm),1408k(recovery),1152k(ker_reserved),128k(fs_reserved),13184k(conf),64k(mrd),192k(disklog_reserved),64k(ART);ath-nand:1024k(bootm_reserved),1024k(recovery_reserved),25m(kernel),85m(zldfs),25m(backup_ker),85m(backup_fs),1024k(conf_reserved),1024k(mrd_reserved),31m(disklog),1024k(ART_reserved); bootImage=0 Loading from device 0: ath-nand (offset 0x2a0000) Created: 2026-01-19 13:39:29 UTC Created: 2026-01-19 13:39:29 UTC Starting kernel ... [ 0.000000] Linux version 6.12.65 (build@834b9a072102) (mips-openwrt-linux-musl-gcc (OpenWrt GCC 14.3.0 r32350+1-41a1874c70) 14.3.0, GNU ld (GNU Binutils) 2.44) #0 Mon Jan 19 13:39:29 2026 [ 0.000000] printk: legacy bootconsole [early0] enabled [ 0.000000] CPU0 revision is: 00019750 (MIPS 74Kc) [ 0.000000] MIPS: machine is Zyxel WAC6103D-I [ 0.000000] SoC: Qualcomm Atheros QCA9558 ver 1 rev 0 [ 0.000000] Initrd not found or empty - disabling initrd [ 0.000000] OF: reserved mem: Reserved memory: No reserved-memory node in the DT [ 0.000000] Primary instruction cache 64kB, VIPT, 4-way, linesize 32 bytes. [ 0.000000] Primary data cache 32kB, 4-way, VIPT, cache aliases, linesize 32 bytes [ 0.000000] Zone ranges: [ 0.000000] Normal [mem 0x0000000000000000-0x000000000fffffff] [ 0.000000] Movable zone start for each node [ 0.000000] Early memory node ranges [ 0.000000] node 0: [mem 0x0000000000000000-0x000000000fffffff] [ 0.000000] Initmem setup node 0 [mem 0x0000000000000000-0x000000000fffffff] [ 0.000000] Kernel command line: console=ttyS0,115200n8 rootfstype=squashfs,jffs2 [ 0.000000] Dentry cache hash table entries: 32768 (order: 5, 131072 bytes, linear) [ 0.000000] Inode-cache hash table entries: 16384 (order: 4, 65536 bytes, linear) [ 0.000000] Writing ErrCtl register=00000000 [ 0.000000] Readback ErrCtl register=00000000 [ 0.000000] Built 1 zonelists, mobility grouping on. Total pages: 65536 [ 0.000000] mem auto-init: stack:off, heap alloc:off, heap free:off [ 0.000000] SLUB: HWalign=32, Order=0-3, MinObjects=0, CPUs=1, Nodes=1 [ 0.000000] RCU Tasks Trace: Setting shift to 0 and lim to 1 rcu_task_cb_adjust=1 rcu_task_cpu_ids=1. [ 0.000000] NR_IRQS: 51 [ 0.000000] CPU clock: 720.000 MHz [ 0.000000] clocksource: MIPS: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 5309056796 ns [ 0.000001] sched_clock: 32 bits at 360MHz, resolution 2ns, wraps every 5965232126ns [ 0.008356] Calibrating delay loop... 358.80 BogoMIPS (lpj=1794048) [ 0.075006] pid_max: default: 32768 minimum: 301 [ 0.089821] Mount-cache hash table entries: 1024 (order: 0, 4096 bytes, linear) [ 0.097630] Mountpoint-cache hash table entries: 1024 (order: 0, 4096 bytes, linear) [ 0.115283] Memory: 247272K/262144K available (7702K kernel code, 587K rwdata, 1684K rodata, 1220K init, 236K bss, 14040K reserved, 0K cma-reserved) [ 0.134107] clocksource: jiffies: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 19112604462750000 ns [ 0.144626] futex hash table entries: 256 (order: 0, 3072 bytes, linear) [ 0.158835] pinctrl core: initialized pinctrl subsystem [ 0.167770] NET: Registered PF_NETLINK/PF_ROUTE protocol family [ 0.190101] clocksource: Switched to clocksource MIPS [ 0.206504] NET: Registered PF_INET protocol family [ 0.211975] IP idents hash table entries: 4096 (order: 3, 32768 bytes, linear) [ 0.220732] tcp_listen_portaddr_hash hash table entries: 1024 (order: 0, 4096 bytes, linear) [ 0.229750] Table-perturb hash table entries: 65536 (order: 6, 262144 bytes, linear) [ 0.239051] TCP established hash table entries: 2048 (order: 1, 8192 bytes, linear) [ 0.247258] TCP bind hash table entries: 2048 (order: 2, 16384 bytes, linear) [ 0.254918] TCP: Hash tables configured (established 2048 bind 2048) [ 0.262353] MPTCP token hash table entries: 512 (order: 1, 6144 bytes, linear) [ 0.270338] UDP hash table entries: 256 (order: 0, 4096 bytes, linear) [ 0.277319] UDP-Lite hash table entries: 256 (order: 0, 4096 bytes, linear) [ 0.285529] NET: Registered PF_UNIX/PF_LOCAL protocol family [ 0.291671] PCI: CLS 0 bytes, default 32 [ 0.299394] workingset: timestamp_bits=14 max_order=16 bucket_order=2 [ 0.307832] squashfs: version 4.0 (2009/01/31) Phillip Lougher [ 0.314088] jffs2: version 2.2 (NAND) (SUMMARY) (LZMA) (RTIME) (CMODE_PRIORITY) (c) 2001-2006 Red Hat, Inc. [ 0.331231] pinctrl-single 1804002c.pinmux: 544 pins, size 68 [ 0.338200] gpio-export gpio-export: 2 gpio(s) exported [ 0.345884] Serial: 8250/16550 driver, 1 ports, IRQ sharing disabled [ 0.353721] printk: legacy console [ttyS0] disabled [ 0.359498] 18020000.uart: ttyS0 at MMIO 0x18020000 (irq = 11, base_baud = 2500000) is a 16550A [ 0.368844] printk: legacy console [ttyS0] enabled [ 0.368844] printk: legacy console [ttyS0] enabled [ 0.379057] printk: legacy bootconsole [early0] disabled [ 0.379057] printk: legacy bootconsole [early0] disabled [ 0.402841] nand: device found, Manufacturer ID: 0x2c, Chip ID: 0xda [ 0.409312] nand: Micron NAND 256MiB 3,3V 8-bit [ 0.413936] nand: 256 MiB, SLC, erase size: 128 KiB, page size: 2048, OOB size: 64 [ 0.421721] Scanning device for bad blocks [ 0.619692] 11 fixed-partitions partitions found on MTD device ar934x-nand [ 0.626706] Creating 11 MTD partitions on "ar934x-nand": [ 0.632109] 0x000000000000-0x000000100000 : "bootm_reserved" [ 0.639721] 0x000000100000-0x000000200000 : "recovery_reserved" [ 0.647074] 0x000000200000-0x0000002a0000 : "header" [ 0.653426] 0x0000002a0000-0x000001b00000 : "kernel" [ 0.659887] 0x000001b00000-0x000007000000 : "ubi" [ 0.666324] 0x000007000000-0x000008900000 : "alt_kernel" [ 0.673179] 0x000008900000-0x00000de00000 : "alt_rootfs" [ 0.680219] 0x00000de00000-0x00000df00000 : "conf_reserved" [ 0.687215] 0x00000df00000-0x00000e000000 : "mrd_reserved" [ 0.694115] 0x00000e000000-0x00000ff00000 : "disklog" [ 0.701243] 0x00000ff00000-0x000010000000 : "ART_reserved" [ 0.720664] 8 fixed-partitions partitions found on MTD device spi0.0 [ 0.727140] Creating 8 MTD partitions on "spi0.0": [ 0.732045] 0x000000000000-0x000000030000 : "bootm" [ 0.738432] 0x000000030000-0x000000190000 : "recovery" [ 0.745045] 0x000000190000-0x0000002b0000 : "ker_reserved" [ 0.751956] 0x0000002b0000-0x0000002d0000 : "fs_reserved" [ 0.758752] 0x0000002d0000-0x000000fb0000 : "conf" [ 0.765016] 0x000000fb0000-0x000000fc0000 : "mrd" [ 0.771573] 0x000000fc0000-0x000000ff0000 : "disklog_reserved" [ 0.778306] 0x000000ff0000-0x000001000000 : "art" [ 1.115125] ag71xx-legacy 19000000.eth: Could not find valid phy node [ 1.442060] ag71xx-legacy 1a000000.eth: connected to PHY at fixed-0:00 [uid=00000000, driver=Generic PHY] [ 1.452492] eth0: Atheros AG71xx at 0xba000000, irq 5, mode: sgmii [ 1.461246] NET: Registered PF_INET6 protocol family [ 1.471779] Segment Routing with IPv6 [ 1.475614] In-situ OAM (IOAM) with IPv6 [ 1.479748] NET: Registered PF_PACKET protocol family [ 1.484960] 8021q: 802.1Q VLAN Support v1.8 [ 1.515319] PCI host bridge to bus 0000:00 [ 1.519500] pci_bus 0000:00: root bus resource [mem 0x12000000-0x13ffffff] [ 1.526525] pci_bus 0000:00: root bus resource [io 0x0001] [ 1.532197] pci_bus 0000:00: No busn resource found for root bus, will use [bus 00-ff] [ 1.540315] pci 0000:00:00.0: [168c:003c] type 00 class 0x028000 PCIe Endpoint [ 1.547686] pci 0000:00:00.0: BAR 0 [mem 0x00000000-0x001fffff 64bit] [ 1.554299] pci 0000:00:00.0: ROM [mem 0x00000000-0x0000ffff pref] [ 1.560662] pci 0000:00:00.0: supports D1 D2 [ 1.566615] pci_bus 0000:00: busn_res: [bus 00-ff] end is updated to 00 [ 1.573394] pci 0000:00:00.0: BAR 0 [mem 0x12000000-0x121fffff 64bit]: assigned [ 1.580855] pci 0000:00:00.0: ROM [mem 0x12200000-0x1220ffff pref]: assigned [ 1.597018] UBI: auto-attach mtd4 [ 1.600451] ubi0: attaching mtd4 [ 2.415278] ubi0: scanning is finished [ 2.430743] ubi0: attached mtd4 (name "ubi", size 85 MiB) [ 2.436253] ubi0: PEB size: 131072 bytes (128 KiB), LEB size: 126976 bytes [ 2.443268] ubi0: min./max. I/O unit sizes: 2048/2048, sub-page size 2048 [ 2.450167] ubi0: VID header offset: 2048 (aligned 2048), data offset: 4096 [ 2.457228] ubi0: good PEBs: 680, bad PEBs: 0, corrupted PEBs: 0 [ 2.463341] ubi0: user volume: 2, internal volumes: 1, max. volumes count: 128 [ 2.470675] ubi0: max/mean erase counter: 2/1, WL threshold: 4096, image sequence number: 1767780320 [ 2.479942] ubi0: available PEBs: 0, total reserved PEBs: 680, PEBs reserved for bad PEB handling: 40 [ 2.489346] ubi0: background thread "ubi_bgt0d" started, PID 332 [ 2.496426] block ubiblock0_0: created from ubi0:0(rootfs) [ 2.502056] ubiblock: device ubiblock0_0 (rootfs) set to be root filesystem [ 2.509354] clk: Disabling unused clocks [ 2.519601] VFS: Mounted root (squashfs filesystem) readonly on device 254:0. [ 2.531043] Freeing unused kernel image (initmem) memory: 1220K [ 2.537064] This architecture does not have kernel memory protection. [ 2.543628] Run /sbin/init as init process [ 3.021027] init: Console is alive [ 3.024810] init: - watchdog - [ 4.053317] kmodloader: loading kernel modules from /etc/modules-boot.d/* [ 4.113923] gpio_button_hotplug: loading out-of-tree module taints kernel. [ 12.442959] qca8k mdio.0:10: configuring for fixed/sgmii link mode [ 12.457040] qca8k mdio.0:10: Link is Up - 1Gbps/Full - flow control off [ 12.530937] qca8k mdio.0:10 uplink (uninitialized): PHY [mdio.0:01] driver [Qualcomm Atheros 8337 internal PHY] (irq=POLL) [ 12.610926] qca8k mdio.0:10 lan1 (uninitialized): PHY [mdio.0:02] driver [Qualcomm Atheros 8337 internal PHY] (irq=POLL) [ 12.636412] ag71xx-legacy 1a000000.eth eth0: entered promiscuous mode [ 12.643090] DSA: tree 0 setup [ 12.647510] kmodloader: done loading kernel modules from /etc/modules-boot.d/* [ 12.657429] init: - preinit - [ 13.710138] random: crng init done [ 14.380728] eth0: link up (1000Mbps/Full duplex) [ 14.385911] qca8k mdio.0:10 uplink: configuring for phy/internal link mode Press the [f] key and hit [enter] to enter failsafe mode Press the [1], [2], [3] or [4] key and hit [enter] to select the debug level [ 17.550854] qca8k mdio.0:10 uplink: Link is Up - 1Gbps/Full - flow control off [ 18.583542] UBIFS (ubi0:1): Mounting in unauthenticated mode [ 18.589509] UBIFS (ubi0:1): background thread "ubifs_bgt0_1" started, PID 484 [ 18.686995] UBIFS (ubi0:1): recovery needed [ 18.868354] UBIFS (ubi0:1): recovery completed [ 18.873000] UBIFS (ubi0:1): UBIFS: mounted UBI device 0, volume 1, name "rootfs_data" [ 18.880979] UBIFS (ubi0:1): LEB size: 126976 bytes (124 KiB), min./max. I/O unit sizes: 2048 bytes/2048 bytes [ 18.891061] UBIFS (ubi0:1): FS size: 75296768 bytes (71 MiB, 593 LEBs), max 603 LEBs, journal size 3809280 bytes (3 MiB, 30 LEBs) [ 18.902898] UBIFS (ubi0:1): reserved for root: 3556452 bytes (3473 KiB) [ 18.909612] UBIFS (ubi0:1): media format: w5/r0 (latest is w5/r0), UUID CCC60601-19FA-432D-8905-C349C9130D49, small LPT model [ 18.929922] mount_root: switching to ubifs overlay [ 18.950735] urandom-seed: Seeding with /etc/urandom.seed [ 19.287767] qca8k mdio.0:10 uplink: Link is Down [ 19.310547] procd: - early - [ 19.313756] procd: - watchdog - [ 19.967590] procd: - watchdog - [ 19.971664] procd: - ubus - [ 20.065376] procd: - init - Please press Enter to activate this console. [ 21.282494] kmodloader: loading kernel modules from /etc/modules.d/* [ 22.570313] Loading modules backported from Linux version v6.18-0-g7d0a66e4b [ 22.577481] Backport generated by backports.git 4d44cef [ 23.174802] urngd: v1.0.2 started. [ 23.454252] PPP generic driver version 2.4.2 [ 23.459902] NET: Registered PF_PPPOX protocol family [ 23.571130] ath10k_pci 0000:00:00.0: enabling device (0000 -> 0002) [ 23.577687] ath10k_pci 0000:00:00.0: pci irq legacy oper_irq_mode 1 irq_mode 0 reset_mode 0 [ 25.181631] ath10k_pci 0000:00:00.0: qca988x hw2.0 target 0x4100016c chip_id 0x043202ff sub 0000:0000 [ 25.191043] ath10k_pci 0000:00:00.0: kconfig debug 0 debugfs 1 tracing 0 dfs 1 testmode 0 [ 25.201794] ath10k_pci 0000:00:00.0: firmware ver 10.2.4-1.0-00047 api 5 features no-p2p,raw-mode,mfp,allows-mesh-bcast crc32 35bd9258 [ 25.651765] ath10k_pci 0000:00:00.0: board_file api 1 bmi_id N/A crc32 bebc7c08 [ 26.776233] ath10k_pci 0000:00:00.0: htt-ver 2.1 wmi-op 5 htt-op 2 cal nvmem max-sta 128 raw 0 hwcrypto 1 [ 26.986262] ieee80211 phy1: Atheros AR9550 Rev:0 mem=0x42909539, irq=14 [ 27.030539] kmodloader: done loading kernel modules from /etc/modules.d/* [ 40.073941] eth0: link down [ 40.106054] eth0: link up (1000Mbps/Full duplex) [ 40.140172] qca8k mdio.0:10 uplink: configuring for phy/internal link mode [ 40.205011] br-lan: port 1(uplink) entered blocking state [ 40.210577] br-lan: port 1(uplink) entered disabled state [ 40.216094] qca8k mdio.0:10 uplink: entered allmulticast mode [ 40.221970] ag71xx-legacy 1a000000.eth eth0: entered allmulticast mode [ 40.266986] qca8k mdio.0:10 uplink: entered promiscuous mode [ 40.359317] qca8k mdio.0:10 lan1: configuring for phy/internal link mode [ 40.399712] br-lan: port 2(lan1) entered blocking state [ 40.405093] br-lan: port 2(lan1) entered disabled state [ 40.410462] qca8k mdio.0:10 lan1: entered allmulticast mode [ 40.500374] qca8k mdio.0:10 lan1: entered promiscuous mode [ 43.390973] qca8k mdio.0:10 uplink: Link is Up - 1Gbps/Full - flow control off [ 43.398367] br-lan: port 1(uplink) entered blocking state [ 43.403901] br-lan: port 1(uplink) entered forwarding state BusyBox v1.37.0 (2026-01-19 13:39:29 UTC) built-in shell (ash) _______ ________ __ | |.-----.-----.-----.| | | |.----.| |_ | - || _ | -__| || | | || _|| _| |_______|| __|_____|__|__||________||__| |____| |__| W I R E L E S S F R E E D O M ----------------------------------------------------- OpenWrt SNAPSHOT, r32688+2-687a2535d5 ----------------------------------------------------- === WARNING! ===================================== There is no root password defined on this device! Use the "passwd" command to set up a new password in order to prevent unauthorized SSH logins. -------------------------------------------------- OpenWrt recently switched to the "apk" package manager! OPKG Command APK Equivalent Description ------------------------------------------------------------------ opkg install <pkg> apk add <pkg> Install a package opkg remove <pkg> apk del <pkg> Remove a package opkg upgrade apk upgrade Upgrade all packages opkg files <pkg> apk info -L <pkg> List package contents opkg list-installed apk info List installed packages opkg update apk update Update package lists opkg search <pkg> apk search <pkg> Search for packages ------------------------------------------------------------------ For more information visit: https://openwrt.org/docs/guide-user/additional-software/opkg-to-apk-cheatsheet root@OpenWrt:~#
Notes
Antenna Switching
The device internally has 4 antennae for each frequency band of which always only 3 are in use. GPIOs are used to switch between the active set, where the ceiling configuration uses 3 antennae of the same type and the wall configuration uses the first 2 regular and one dipole antenna. The switching can be done individually for each band. The GPIOs are exposed as gpio_switch and can be set with uci:
uci set system.radio[0|1]_ceiling.value=[0|1]
Where radio0 is 5 GHz and radio1 is 2.4 GHz. Setting the value to 1 means the ceiling mount option is selected. This will make the WiFi LEDs be green, whereas they are amber in the wall mount configuration. Note that the gpio_switch service has to be restarted to apply the change.
The physical antenna toggle switch on the device is implemented as an input switch mapped to button BTN_0 with the ceiling setting acting as the pressed and the wall setting acting as released action. By default, it does nothing, but can be mapped through the regular button mapping methods. A straight forward way to tie the switch to its function in the stock firmware is to add a rc.button script like this:
#!/bin/sh
if [ "$ACTION" = "released" ]
then
state=0
else
state=1
fi
uci set system.radio0_ceiling.value=$state
uci set system.radio1_ceiling.value=$state
service gpio_switch restart
return 0
Put the above script into /etc/rc.button/BTN_0 and mark it executable.
The initial button state is sent when the gpio_button_hotplug kernel module is loaded. This way happen too early for the rc.button script to be triggered. This means that the initial switch setting may not be applied on boot. As a workaround, the module can be reloaded in /etc/rc.local to have it applied:
rmmod gpio_button_hotplug && modprobe gpio_button_hotplug
Gaining Root Access on Stock Firmware
The web interface allows for command injection through the System Location field. Using that, the shell and UID of the admin user can be changed so that root access is possible via SSH/telnet/console.
- Log in at the stock web interface
- Go to Configuration (Cogwheel) → System → Host Name
- Inject the following commands by pasting them into System Location and pressing Apply
$(sed -i 's/zysh/bash/' /var/zyxel/passwd) $(sed -i 's/x:10001/x:0/' /var/zyxel/passwd)
This modification is temporary and will be reverted after a reboot as the passwd file is regenerated.