User Tools

Site Tools


Ubiquiti NanoStation 5

NanoStation 5, NanoStation Loco 5, LiteStation 5 and PicoStation 5

The following devices are not NanoStations but these devices use the same image as well. They most probably require snapshot builds.

  • LiteStation 5 - uses openwrt-atheros-ubnt5-squashfs.bin . Steps for flashing are the same as NanoStation 5

Flash like most ubiquiti devices:

Download this image: Push the reset button and then plug the power to the device keeping the button pushed. The leds will start blinking red and yellow, you can now release the reset button. Now you can tftp the image to

Models of the Ubiquiti NanoStation family are quite similar to each other so the same images and instructions can be used for the listed devices.

Datasheets for all models are available from Ubiquiti.


Bootloader: RedBoot
CPU: Atheros AR2313A
CPU Speed: 180 Mhz
Flash: 4 MB (PicoStation 5 - 8 MB)
RAM: 16 MB (PicoStation 5 - 32 MB)
Wireless: Atheros 802.11a (in AR5112A)
Ethernet: 1 port connected to the CPU
Power: passive POE (pairs 4,5+; 7,8 return) 12 to 24 VDC (POE injector included in the package)
Serial: internal (HE-10 connector, 3.3V)
JTAG: yes, internal (solder pads, 3.3V)

This device is an integrated wifi spot designed to be used outdoor. With Ubiquiti Firmware (AirOS 3) it can act as station, station WDS, client, or client WDS. There are on-PCB antennas supporting vertical or horizontal polarity with the option to send RF to an external antenna via an on-board connector. RF output selection available in AirOS.

Model On-board RF connector
PicoStation5: RP-SMA or SMA female (manufacture date dependent)
NanoStation5: RP-SMA or SMA female
LiteStation5: MMCX Straight PCB jack, female, socket

  • The Nanostation5 and Nanostation5 Loco come with 12V power supply, the internal DC-Converter is realized with a AP1509-33 PWM Control 2A Step-Down Converter. This can handle up to 24V but it is recommended to keep it below 20V, so if you have short cable use 12V and for longer cables 24V. (tested)

Hardware is very similar to D-Link DWL-2100AP

Opening the case

There are two screws under the label on the back. The newer M2 and M5 versions have just one screw under the label and two plastic pins that can be lifted out of their holes by pushing a plastic cable tie end next to them. After removing these, the board can be removed.


pin 1 - vcc
pin 3 - RX
pin 7 - TX
pin 9 - gnd

(9600 8n1)

RedBoot> fconfig
Local IP address:
Local IP address mask:

$ echo -e "\0377\0364\0377\0375\0006" > break
$ nc -vvv 9000 < break ; telnet 9000

NanoStation 5:
Nanostation 5 serial

NanoStation Loco 5:
Nanostation Loco 5 serial

NanoStation Loco M5:
Nanostation Loco M5 serial


pin 1 - TRST  pin 2 - GND
pin 3 - TDI   pin 4 - GND 
pin 5 - TDO   pin 6 - GND
pin 7 - TMS   pin 8 - 3V3
pin 9 - TCK   pin 10 - COLD_RST

The JTAG features should conform to MIPS EJTAG v2.6

JTAG and Serial Headers

Header center-to-center hole/pin spacing:

Model Function Pins Spacing
picostation Serial 10 2.00 mm
nanostation Serial 10 2.00 mm
litestation Serial 12 2.54 mm (common 0.100")
picostation JTAG 10 2.00 mm
nanostation JTAG 10 2.00 mm
litestation JTAG 14 2.54 mm (common 0.100")


NanoStation5 are supported by the OpenWrt AtherosPort. It is available as a pre-built image and can be built through buildroot.


The OpenWrt buildroot generates images that can be directly flashed to the NanoStation, usually with a name like atheros-ubnt5-squashfs.bin (for the NS5 or Loco5).

When flashing those images, the Ubiquiti web interface will show a warning about unsupported third-party firmware. This warning can be ignored.


In order to upgrade from OpenWrt to a newer version, both the kernel mtd and filesystem mtd must be reflashed. The kernel is likely lzma compressed. If either mtd block isn't big enough, reflashing can not be completed through OpenWrt, but must be done through the RedBoot bootloader.

Recent versions of OpenWrt (8.09.2 and newer) support sysupgrade on this platform. To upgrade, put a combined firmware image into /tmp on the device and flash it using the sysupgrade command as outlined below.

cd /tmp
sysupgrade openwrt-atheros-combined.img

Loading via tftp (bootloader contains server)

This can also be used to upgrade a device if you don't mind losing your old config.

NOTE: the method described here does not seem to work with NanoStation5, because RedBoot contains an tftp client, not a server. see Loading via tftp (bootloader contains client) below.

RedBoot does contain a tftp server, it can be started with the urescue command! see Restore Original AirOS firmware on Nanostation below.


  • Ethernet cable connection between PC and NanoStation. A switched connection or a bridged connection seems to work fine.
  • Network settings of PC:
  • TFTP client on PC
  • NanoStation firmware file from Ubiquiti (not an OpenWrt image)


  1. Turn (power) off the device
  2. Press and hold the reset button
  3. Turn (power) on the device
  4. Release the reset button ~10 seconds (but not longer) after turning the device on. You will know it's ready when the LEDs change.
  5. Ping If it works, you're ready to upload an image, if not, go back to step 1.
  6. tftp the image in binary mode to as 'flash_update'.

tftp> bin
tftp> put openwrt-atheros-ubnt5-squashfs.bin flash_update
Sent 1965199 bytes in 28.8 seconds
tftp> quit

or at a Windows CLI prompt

tftp -i put openwrt-atheros-ubnt5-squashfs.bin flash_update

7. Signal LEDs might be blinking during the upgrade. On a Nano5L, the power lights go back and forth. 7. Wait ~7 minutes before restarting or until the power lights stop their back and forth blinking. 7. Restart. The device should be back to its old configuration (OpenWrt doesn't overwrite or modify the NVRAM settings).

8. telnet to and set a password with


Loading via tftp (bootloader contains client)

General procedure as described in

TFTP method uses the failsafe mode of the RedBoot bootloader of the hardware, which starts BEFORE OpenWRT. If you can't trigger it via reset button, you need to open your device and connect via Serial interface, then press Ctrl-C when RedBoot loads to get a RedBoot prompt.

Set your IP using ip_address, then get an image via tftp using load.

Restore Original AirOS firmware on Nanostation

To restore the original firmware, you cannot use mtd or sysupgrade - you must use the tftp method.

This is because the AirOS images are not sysupgrade-compatible. Uploading in luci does nothing and give you OpenWRT again after power cycle (so you can still try it without bricking your device if you don't believe me).

TFTP method uses the failsafe mode of the RedBoot bootloader of the hardware, which starts BEFORE OpenWRT. If you can't trigger it via reset button, you need to open your device and connect via Serial interface, then press Ctrl-C when RedBoot loads to get a RedBoot prompt. From this you can set an IP address (test pinging it afterwards) and then use TFTP.

On the redboot promt, help gives you a list of commands and syntax for the commands.

Serial console output:

Ethernet eth1: MAC address xx:xx:xx:xx:xx:xx
IP:, Gateway:
Default server:

RedBoot(tm) bootstrap and debug environment [ROM]
Ubiquiti Networks certified release, version 0.8.2395 - built 14:33:10, Dec 22 2007

Copyright (C) 2000, 2001, 2002, 2003, 2004 Red Hat, Inc.

Board: Ubiquiti NanoStation5
RAM: 0x80000400-0x80ff0400, [0x80000400-0x80fd1400] available
FLASH: 0xbe000000 - 0xbe3f0000, 64 blocks of 0x00010000 bytes each.
== Executing boot script in 1.000 seconds - enter ^C to abort

== Executing boot script in 1.000 seconds - enter ^C to abort
RedBoot> ^C

Perform the "Loading via tftp" procedure detailed above.

wifi failure, 632nd bit

If wireless does not work with eg. backfire 10.03.1 prebuilt firmware, and you get (in dmesg) "wifi%d: ath_attach failed: -22", then you may need to run the following script by Bill Moffitt. This script attempts to read the/a Flash configuration partition, set the regulatory domain (regdomain) to 0 if it is not already, erase the Flash partition, then write the old data with regdomain zero'd back to the Flash. WARNING: This script might brick your router (but it worked for me, User:green, on a NanoStation Loco2).

# By Bill Moffitt - this script puts a zero in the 632nd byte of the appropriate device
date >>/etc/firstbootlog
echo "Starting" >>/etc/firstbootlog
partn=`grep boardconfig /proc/mtd |awk '{print $1}' |cut -d: -f1`
byte=$(hexdump -b /dev/$partn |grep 0000270 |awk '{print $9}')
echo "Going to work on partition $partn where regdomain is $byte"
if [ $byte == "000" ]; then
   echo "success" >/tmp/regdomain_success
if [ $partn -a ! $byte == "000" ]; then
   echo "Setting up regdomain on partition /dev/$partn" >>/etc/firstbootlog
   dd if=/dev/$partn of=/tmp/mtdfile bs=1 count=631 && echo "got the first 631 bytes" >>/etc/firstbootlog
   dd if=/dev/zero bs=1 count=1 >>/tmp/mtdfile && echo "put in the zero" >>/etc/firstbootlog
   dd if=/dev/$partn bs=1 skip=632 >>/tmp/mtdfile && echo "got the rest of the file" >>/etc/firstbootlog
   mtd erase $partn && echo "erased the partition" >>/etc/firstbootlog
   dd if=/tmp/mtdfile of=/dev/$partn 2>>/etc/firstbootlog && echo "Finished flashing partition $partn" >>/etc/firstbootlog
   sync && echo "Sync succeeded" >>/etc/firstbootlog
   byte=$(hexdump -b /dev/$partn |grep 0000270 |awk '{print $9}')
   if [ $byte -eq "000" ]; then
      echo "regdomain is zero" >>/etc/firstbootlog
      sync &&
      rm /tmp/mtdfile
      date >>/etc/firstbootlog
      echo "done with regdomain" >>/etc/firstbootlog
      echo "success" >/tmp/regdomain_success
      echo "FAIL writing the file back to /dev/$partn - regdomain remains $byte"
   echo "Could not find partition" >>/etc/firstbootlog

Switching antenna

The two internal antennas work more or less automatically, using the driver's "diversity" setting to choose the correct one. Using an external antenna requires manually setting a few things:

sysctl set dev.wifi0.softled 0
gpioctl 7 0

These can be added to an init file in /etc/rc.d and /etc/init.d

In recent OpenWrt versions (8.09.1+) the antenna setting is covered by the wireless configuration. The corresponding option is called antenna and should be set within the wifi-iface section.

uci set wireless.@wifi-iface[0].antenna=mode
uci commit wireless

Value (mode) Description
vertical Use internal antenna with vertical polarization
horizontal Use internal antenna with horizontal polarization
external Use external antenna port

Some photos on this page © Matt Westervelt and available for use under a Creative Commons license for non-commercial works.


toh/ubiquiti/picostation5.txt · Last modified: 2016/06/27 21:06 by registrar