This whitelabel Ralink/MediaTek RT5350F-based router is sold on Aliexpress from Chinese sellers for around 8 USD (shipped) as of January 2015. It has a white housing with silver print "3G/4G Router 150M". As of OpenWrt trunk r43793 it is supported by the Image Generator. The factory image can successfully be flashed from the stock firmware GUI without having to open the device or mess with uboot manually.
PCB marking next to the Ethernet port may be "A5-V11" or "MIFI". On the PCB it has a W9825G6EH-75 or EM63A165TS-6G RAM (32 MB) RAM chip and 4 MB SPI ROM. Ethernet MAC address starts with 2C:67:FB:. One can log in to stock firmware with "admin"/"admin" via telnet.
Note that there are very similar devices, e.g. HAME-branded and unbranded black ones, that share almost identical PCBs; however the components (including RAM size) can be different.
|CPU||Ralink RT5350 MIPS 24KEc V4.12|
|CPU Speed||360 MHz|
|Flash size:||4 MB|
|RAM:||32 MB (W9825G6EH-75 or EM63A165TS-6G) / SDR-166|
|Wireless:||Ralink integrated in SOC|
|Ethernet:||1x100 Ralink integrated in SOC|
|USB:||Yes 1 x 2.0, EHCI|
swconfig dev switch0 port 1 set disable 1 swconfig dev switch0 port 2 set disable 1 swconfig dev switch0 port 3 set disable 1 swconfig dev switch0 port 4 set disable 1 swconfig dev switch0 set apply
config led option default '0' option name 'WIFI' option sysfs 'a5-v11:blue:system' option trigger 'netdev' option dev 'wlan0' option mode 'link tx rx'
15.05 is available for download here
The OpenWRT sysupgrade image has been successfully loaded over serial using U-Boot. You will need to setup a TFTP server for transfer of the image, dnsmasq has been successfully tested: create a folder and place the sysupgrade image in this folder (rename the image to a shorter name ie openwrt.bin), the following command will start a tftp server under dnsmasq:
root@localhost:~# dnsmasq --port=0 --enable-tftp eth0 --tftp-root=/your/folder
Boot the device with serial connected and at the U-Boot menu press 2. You will be asked for an ip to assign to the device, an ip for the server, and lastly the file name of the image.
As of August 2015, one can find a prebuilt image at http://ofmodemsandmen.com/downloadsm.html (look for A5-V11). It is specialized for use with USB 3G modems.
First, make sure you really have this device and not some other one. The best way is to open it up (just pry it open with your fingernails or with a pry tool) and check for the A5-V11 marking on the bottom left corner of the PCB, close to the Ethernet connector. If you don't want to mess with the plastics you can also check for the actual version via telnet by following the procedure below.
With the factory firmware, just connect the router with an Ethernet cable to a network. The device will switch on the blue and red LEDs. Find out the device's IP address from your DHCP server, and log into the router via telnet:
BoC Login: admin
BusyBox v1.12.1 (2013-06-20 00:48:37 HKT) built-in shell (msh)
Enter 'help' for a list of built-in commands.
The factory firmware is very limited; most commands are disabled (but see below for how to change this).
BoC Router> help
? →Display help information.
help →Display help information, same as '?' command.
clear →Clear various talbes, type clear for help.
ping →ping HOST, type ping for help.
traceroute →route trace, type traceroute for help.
ipmac →ip mac bind settings.
quit →Close terminal session.
show →Display various talbes information, type show for help.
restart_httpd →Restart web server.
restore_defaults →Restore the config to the default factory value.
ated →run ated for MP test.
BoC Router> show system revision
software version: 188.8.131.52
product model: Mifi-Storage-3G
serial number: ZJL2014XXXXX
hardware version: 1.0
f/w release date: Aug. 23, 2013 15:27:22
If you want to access a full shell, here's how (thanks Whiterat):
BoC Router> cat /proc/cmdline
BoC Router> runshellcmd
shell mode on
BoC Router> cat /proc/cmdline
Using your browser, open the device's home page. I flashed OpenWrt Chaos Calmer 15.05 using the stock web interface of the device. Just connect the router with an Ethernet cable to a network, it will switch on the blue and red LEDs. Find the device's IP address from your DHCP server, and log into the device using your web browser.
Switch the language to English from the drop down menu. It redirects to a wrong IP address, so type the correct one again in the URL field of the browser. Using the Administrator → Firmware menu, flash openwrt-15.05-ramips-rt305x-a5-v11-squashfs-factory.bin.
Wait for a success message to appear.
Thereafter, the router is waiting for you to log in with telnet and no password via Ethernet on IP address 192.168.1.1. To access this, set your computer's IP address to 192.168.1.2 subnet 255.255.255.0. You can always enter OpenWrt failsafe mode, plug in power, wait until the red light disappears, then press the button a couple of times.
Instructions taken from here
Download Files and start Web Server:
cdto the directory where you downloaded openwrt-15.05-ramips-rt305x-a5-v11-squashfs-sysupgrade.bin.
thttpd -p 8080 -d ./
Connect your Linux laptop/PC to the mini router via Ethernet and power up the mini router
Connect the USB Flash drive to the mini router, mount it and flash the firmware
mount /dev/sda1 /mnt
mtd_write write /mnt/uboot256.img Bootloader
#Unlocking Bootloader …
#Writing from /mnt/uboot256.img to Bootloader … [w]
mtd_write write /mnt/mini.bin Kernel
#Unlocking Kernel …
#Writing from /mnt/mini.bin to Kernel … [w]
Upgrade to Chaos Calmer
/tmpdirectory and issue the following commands:
sysupgrade -vn /tmp/openwrt-15.05-ramips-rt305x-a5-v11-squashfs-sysupgrade.bin
-noption which deletes any Barrier Breaker configuration files
Once you have OpenWrt on your device, then you can use the OpenWrt sysupgrade mechanism to load sysupgrade images.
Since this device only has 4MB of Flash, you may want to attach a USB flash drive and configure extroot. Very small flash drives like the SanDisk Ultra Fit are well suited for this purpose. Once extroot is configured, you will have plenty of room to install MiniDLNA, NFS or any other package you like. You can even install gcc and build software natively.
Unfortunately, the Chaos Calmer sysupgrade image includes LuCI which does not leave enough room to install the kmod-fs-ext4, kmod-usb-storage and block-mount packages which are required for extroot. Therefore, you will need to build a custom image using the OpenWrt Image Generator. The OpenWrt Image Generator defaults will create a sysupgrade image which will leave enough room to install the kmod-fs-ext4, kmod-usb-storage and block-mount packages to configure extroot. Please see instructions below.
wget http://downloads.openwrt.org/chaos_calmer/15.05/ramips/rt305x/OpenWrt-ImageBuilder-15.05-ramips-rt305x.Linux-x86_64.tar.bz2 tar xfj OpenWrt-ImageBuilder-15.05-ramips-rt305x.Linux-x86_64.tar.bz2 cd OpenWrt-ImageBuilder-15.05-ramips-rt305x.Linux-x86_64 make image PROFILE="A5-V11"
Sysupgrade image is at
To switch the device to Ethernet DHCP client mode, do:
mount_root passwd /etc/init.d/dnsmasq stop /etc/init.d/firewall stop /etc/init.d/dnsmasq disable /etc/init.d/firewall disable cat > /etc/config/network <<\EOF config interface 'loopback' option ifname 'lo' option proto 'static' option ipaddr '127.0.0.1' option netmask '255.0.0.0' config interface 'lan0' option ifname 'eth0' config interface 'lan1' option ifname 'eth0.1' option proto 'dhcp' EOF sync /etc/init.d/network reload
| This device uses eth0.1 for the
Now connect the device to Ethernet and it will fetch an IP address with DHCP, and it should be possible to log in using ssh and the password just set.
If the serial boot console shows
procd: Instance odhcpd::instance1 s in a crash loop 6 crashes, 0 seconds since last crashthen you probably have extraneous network interfaces in /etc/configuration/network.
At least 6 GPIOs can be switched in software: numbers 8 and 22-26, as was tested with this method.
(15 and 16 are TX and RX; these are not exported as GPIOs) (these are connected to the TX and RX pads)
GPIOs can handle 4 mA max
There are 4 solder pads inside the device.
If you put the PCB on the table with the USB jack to the left and the Ethernet jack to the right (Ralink CPU is on the other side of the board), you see the 4 pads in the bottom-right corner of the PCB. They are (from left to right):
NOTE: When you a serial USB adapter to RX on the device and then power on the device, the device can hang and not continue booting. As a workaround, first power on the device and only thereafter connect the RX cable. Apparently this can be solved by using a 470 Ohm to 1k Ohm resistor between RX and the serial USB adapter.
Some models have disconnected antenna, which causes very poor wireless range (especially in STA MODE), fix method: https://forum.openwrt.org/viewtopic.php?id=57377
a5v11 routers have been proven to be a good solution for a cheap and easy deployable private secure telephone network. Wifi and USB won't be used. It is powerful enough to handle several simultaneously encrypted phone calls.
Just install an openvpn server somewhere and add a sip server of your choice (for example freeswitch or asterisk), make the sipserver only listen on the tun0 device (most likely 10.0.0.1). The nice thing with the following setup is, that you just don't use routing/nat at all. The vpn network doesn't have to be reachable from the individual lans or vice versa, siproxd will handle all the cross-network things.
Getting a workable image within that tiny 4mb space is kind of tricky, but works. The following is using openssl openvpn due to polar ssl behaving unstable with hardened openvpn settings.
nice -n 19 make image PROFILE=A5-V11 PACKAGES="openvpn-openssl -ip6tables -kmod-ip6tables -kmod-ipv6 -ppp -ppp-mod-pppoe -odhcp6c -luci-proto-ipv6 -luci-proto-ppp siproxd -dnsmasq -opkg"
generate a /etc/openvpn/openvpn.conf on the a5v11 (it will be started automatically)
client dev tun proto udp remote hostname 1194 resolv-retry infinite nobind user nobody group nogroup persist-key persist-tun mute-replay-warnings <ca> paste your ca certificate here </ca> <cert> paste your certificate here </cert> <key> paste your private key here </key> ns-cert-type server <tls-auth> paste your ta.key here </tls-auth> key-direction 1 cipher AES-256-CBC auth SHA256
adjust the hostname to your liking (for example a5v11) in /etc/config/system
enable dhcp in /etc/config/network:
config interface 'lan' option ifname 'eth0.1' option force_link '1' option macaddr 'aa:bb:cc:...' // whatever was in here before option type 'bridge' option proto 'dhcp' option hostname 'a5v11'
configure siproxd in /etc/config/siproxd
config siproxd general option if_inbound br-lan option if_outbound tun0
Now you can just plug the a5v11 to some network and configure all sipclients to use this proxy.
Basically you just need the following settings:
sip-registrar: 10.0.0.1 (the sip-server on the vpn, the network doesn't have to be reachable, no need for routing)
username/number: (whatever you created)
password: (whatever you generated)
This is really working great on several fritzboxes (you can use the usb port on the fritzbox to power the a5v11). Just hand out some of these sticks and tell the users the username and password. It's integrating very well with the existing telephones and you can prepare the a5v11 sticks in advance as they are only for connecting the vpn network. The actual credentials for the telephone server can be later generated on the fly. Just a hint: Make sure to use a dns name and not an IP as the openvpn client host entry, so you could later migrate the server to bigger hardware, if needed.
U-Boot 1.1.7 (Dec 13 2011 - 13:49:42) Board: Ralink APSoC DRAM: 32 MB relocate_code Pointer at: 81fb4000 spi_wait_nsec: 42 spi device id: 7f 9d 46 7f 9d (9d467f9d) Warning: un-recognized chip ID, please update bootloader! raspi_read: from:30000 len:1000 .*** Warning - bad CRC, using default environment ============================================ Ralink UBoot Version: 184.108.40.206 -------------------------------------------- ASIC 5350_MP (Port5<->None) DRAM_CONF_FROM: Boot-Strapping DRAM_TYPE: SDRAM DRAM_SIZE: 256 Mbits DRAM_WIDTH: 16 bits DRAM_TOTAL_WIDTH: 16 bits TOTAL_MEMORY_SIZE: 32 MBytes Flash component: SPI Flash Date:Dec 13 2011 Time:13:49:42 ============================================ icache: sets:256, ways:4, linesz:32 ,total:32768 dcache: sets:128, ways:4, linesz:32 ,total:16384 ##### The CPU freq = 360 MHZ #### estimate memory size =32 Mbytes raspi_read: from:40028 len:6 . raspi_read: from:0 len:30004 ....*************Is_update = 0 plat = 1************** Please choose the operation: 1: Load system code to SDRAM via TFTP. 2: Load system code then write to Flash via TFTP. 3: Boot system code via Flash (default). 4: Entr boot command line interface. 7: Load Boot Loader code then write to Flash via Serial. 9: Load Boot Loader code then write to Flash via TFTP. 1 0 3: System Boot system code via Flash. ## Booting image at bc050000 ... raspi_read: from:50000 len:40 . Image Name: MIPS OpenWrt Linux-3.14.27 Created: 2015-01-10 14:26:49 UTC Image Type: MIPS Linux Kernel Image (lzma compressed) Data Size: 1110484 Bytes = 1.1 MB Load Address: 80000000 Entry Point: 80000000 raspi_read: from:50040 len:10f1d4 ................. Verifying Checksum ... OK Uncompressing Kernel Image ... OK No initrd ## Transferring control to Linux (at address 80000000) ... ## Giving linux memsize in MB, 32 Starting kernel ... [ 0.000000] Linux version 3.14.27 (openwrt@gb-10) (gcc version 4.8.3 (OpenWrt/Linaro GCC 4.8-2014.04 r43888) ) #1 Fri Jan 9 12:40:17 UTC 2015 [ 0.000000] SoC Type: Ralink RT5350 id:1 rev:3 [ 0.000000] bootconsole [early0] enabled [ 0.000000] CPU0 revision is: 0001964c (MIPS 24KEc) [ 0.000000] MIPS: machine is A5-V11 [ 0.000000] Determined physical RAM map: [ 0.000000] memory: 02000000 @ 00000000 (usable) [ 0.000000] Initrd not found or empty - disabling initrd [ 0.000000] Zone ranges: [ 0.000000] Normal [mem 0x00000000-0x01ffffff] [ 0.000000] Movable zone start for each node [ 0.000000] Early memory node ranges [ 0.000000] node 0: [mem 0x00000000-0x01ffffff] [ 0.000000] Primary instruction cache 32kB, VIPT, 4-way, linesize 32 bytes. [ 0.000000] Primary data cache 16kB, 4-way, VIPT, no aliases, linesize 32 bytes [ 0.000000] Built 1 zonelists in Zone order, mobility grouping on. Total pages: 8128 [ 0.000000] Kernel command line: console=ttyS0,57600 rootfstype=squashfs,jffs2 [ 0.000000] PID hash table entries: 128 (order: -3, 512 bytes) [ 0.000000] Dentry cache hash table entries: 4096 (order: 2, 16384 bytes) [ 0.000000] Inode-cache hash table entries: 2048 (order: 1, 8192 bytes) [ 0.000000] Writing ErrCtl register=0004f376 [ 0.000000] Readback ErrCtl register=0004f376 [ 0.000000] Memory: 29024K/32768K available (2437K kernel code, 122K rwdata, 472K rodata, 160K init, 183K bss, 3744K reserved) [ 0.000000] SLUB: HWalign=32, Order=0-3, MinObjects=0, CPUs=1, Nodes=1 [ 0.000000] NR_IRQS:256 [ 0.000000] CPU Clock: 360MHz [ 0.000000] systick: running - mult: 214748, shift: 32 [ 0.000000] genirq: Flags mismatch irq 7. 00014600 (timer) vs. 00014600 (systick) [ 0.010000] Calibrating delay loop... 479.23 BogoMIPS (lpj=2396160) [ 0.070000] pid_max: default: 32768 minimum: 301 [ 0.070000] Mount-cache hash table entries: 1024 (order: 0, 4096 bytes) [ 0.080000] Mountpoint-cache hash table entries: 1024 (order: 0, 4096 bytes) [ 0.090000] pinctrl core: initialized pinctrl subsystem [ 0.090000] NET: Registered protocol family 16 [ 0.120000] bio: create slab <bio-0> at 0 [ 0.120000] rt2880_gpio 10000600.gpio: registering 22 gpios [ 0.130000] rt2880_gpio 10000600.gpio: registering 22 irq handlers [ 0.130000] rt2880_gpio 10000660.gpio: registering 6 gpios [ 0.140000] rt2880_gpio 10000660.gpio: registering 6 irq handlers [ 0.150000] Switched to clocksource systick [ 0.150000] NET: Registered protocol family 2 [ 0.170000] TCP established hash table entries: 1024 (order: 0, 4096 bytes) [ 0.190000] TCP bind hash table entries: 1024 (order: 0, 4096 bytes) [ 0.190000] TCP: Hash tables configured (established 1024 bind 1024) [ 0.210000] TCP: reno registered [ 0.220000] UDP hash table entries: 256 (order: 0, 4096 bytes) [ 0.230000] UDP-Lite hash table entries: 256 (order: 0, 4096 bytes) [ 0.240000] NET: Registered protocol family 1 [ 0.250000] rt-timer 10000100.timer: maximum frequency is 7324Hz [ 0.270000] futex hash table entries: 256 (order: -1, 3072 bytes) [ 0.330000] squashfs: version 4.0 (2009/01/31) Phillip Lougher [ 0.330000] jffs2: version 2.2 (NAND) (SUMMARY) (LZMA) (RTIME) (CMODE_PRIORITY) (c) 2001-2006 Red Hat, Inc. [ 0.360000] msgmni has been set to 56 [ 0.370000] io scheduler noop registered [ 0.380000] io scheduler deadline registered (default) [ 0.390000] gpio-export gpio_export.6: 2 gpio(s) exported [ 0.400000] Serial: 8250/16550 driver, 16 ports, IRQ sharing enabled [ 0.430000] 10000c00.uartlite: ttyS0 at MMIO 0x10000c00 (irq = 20, base_baud = 2500000) is a 16550A [ 0.450000] console [ttyS0] enabled [ 0.450000] console [ttyS0] enabled [ 0.470000] bootconsole [early0] disabled [ 0.470000] bootconsole [early0] disabled [ 0.490000] m25p80 spi32766.0: pm25lq032 (4096 Kbytes) [ 0.510000] 4 ofpart partitions found on MTD device spi32766.0 [ 0.510000] Creating 4 MTD partitions on "spi32766.0": [ 0.530000] 0x000000000000-0x000000030000 : "u-boot" [ 0.530000] 0x000000030000-0x000000040000 : "u-boot-env" [ 0.550000] 0x000000040000-0x000000050000 : "factory" [ 0.570000] 0x000000050000-0x000000400000 : "firmware" [ 0.590000] 2 uimage-fw partitions found on MTD device firmware [ 0.610000] 0x000000050000-0x00000015f214 : "kernel" [ 0.620000] mtd: partition "kernel" must either start or end on erase block boundary or be smaller than an erase block -- forcing read-only [ 0.650000] 0x00000015f214-0x000000400000 : "rootfs" [ 0.650000] mtd: partition "rootfs" must either start or end on erase block boundary or be smaller than an erase block -- forcing read-only [ 0.690000] mtd: device 5 (rootfs) set to be root filesystem [ 0.690000] 1 squashfs-split partitions found on MTD device rootfs [ 0.710000] 0x000000330000-0x000000400000 : "rootfs_data" [ 0.730000] ralink_soc_eth 10100000.ethernet eth0: ralink at 0xb0100000, irq 5 [ 0.750000] rt3xxx-usbphy usbphy.3: loaded [ 0.760000] rt2880_wdt 10000120.watchdog: Initialized [ 0.780000] TCP: cubic registered [ 0.780000] NET: Registered protocol family 17 [ 0.780000] Bridge firewalling registered [ 0.800000] 8021q: 802.1Q VLAN Support v1.8 [ 0.820000] VFS: Mounted root (squashfs filesystem) readonly on device 31:5. [ 0.820000] Freeing unused kernel memory: 160K (802f8000 - 80320000) procd: Console is alive procd: - watchdog - [ 6.730000] usbcore: registered new interface driver usbfs [ 6.750000] usbcore: registered new interface driver hub [ 6.760000] usbcore: registered new device driver usb [ 6.780000] ehci_hcd: USB 2.0 'Enhanced' Host Controller (EHCI) Driver [ 6.800000] ehci-platform: EHCI generic platform driver [ 7.200000] rt3xxx-usbphy usbphy.3: remote usb device wakeup disabled [ 7.220000] rt3xxx-usbphy usbphy.3: UTMI 16bit 30MHz [ 7.230000] ehci-platform 101c0000.ehci: EHCI Host Controller [ 7.250000] ehci-platform 101c0000.ehci: new USB bus registered, assigned bus number 1 [ 7.250000] ehci-platform 101c0000.ehci: irq 26, io mem 0x101c0000 [ 7.290000] ehci-platform 101c0000.ehci: USB 2.0 started, EHCI 1.00 [ 7.310000] hub 1-0:1.0: USB hub found [ 7.310000] hub 1-0:1.0: 1 port detected [ 7.330000] ohci_hcd: USB 1.1 'Open' Host Controller (OHCI) Driver [ 7.350000] ohci-platform: OHCI generic platform driver [ 7.350000] ohci-platform 101c1000.ohci: Generic Platform OHCI controller [ 7.370000] ohci-platform 101c1000.ohci: new USB bus registered, assigned bus number 2 [ 7.370000] ohci-platform 101c1000.ohci: irq 26, io mem 0x101c1000 [ 7.700000] hub 2-0:1.0: USB hub found [ 7.700000] hub 2-0:1.0: 1 port detected procd: - preinit - [ 9.830000] rt305x-esw 10110000.esw: link changed 0x00 [ 9.990000] random: mktemp urandom read with 70 bits of entropy available Press the [f] key and hit [enter] to enter failsafe mode Press the , ,  or  key and hit [enter] to select the debug level [ 11.300000] rt305x-esw 10110000.esw: link changed 0x01 jffs2 is ready No jffs2 marker was found [ 13.810000] jffs2: notice: (313) jffs2_build_xattr_subsystem: complete building xattr subsystem, 15 of xdatum (1 unchecked, 14 orphan) and 23 of xref (0 dead, 16 orphan) found. switching to overlay procd: - early - procd: - watchdog - procd: - ubus - procd: - init - [ 17.300000] NET: Registered protocol family 10 [ 17.320000] ip6_tables: (C) 2000-2006 Netfilter Core Team [ 17.350000] Loading modules backported from Linux version master-2014-11-04-0-gf3660a2 [ 17.370000] Backport generated by backports.git backports-20141023-2-g4ff890b [ 17.390000] ip_tables: (C) 2000-2006 Netfilter Core Team [ 17.430000] nf_conntrack version 0.5.0 (456 buckets, 1824 max) [ 17.510000] xt_time: kernel timezone is -0000 [ 17.560000] cfg80211: Calling CRDA to update world regulatory domain [ 17.590000] cfg80211: World regulatory domain updated: [ 17.600000] cfg80211: DFS Master region: unset [ 17.610000] cfg80211: (start_freq - end_freq @ bandwidth), (max_antenna_gain, max_eirp), (dfs_cac_time) [ 17.630000] cfg80211: (2402000 KHz - 2472000 KHz @ 40000 KHz), (N/A, 2000 mBm), (N/A) [ 17.650000] cfg80211: (2457000 KHz - 2482000 KHz @ 40000 KHz), (N/A, 2000 mBm), (N/A) [ 17.660000] cfg80211: (2474000 KHz - 2494000 KHz @ 20000 KHz), (N/A, 2000 mBm), (N/A) [ 17.680000] cfg80211: (5170000 KHz - 5250000 KHz @ 80000 KHz), (N/A, 2000 mBm), (N/A) [ 17.700000] cfg80211: (5250000 KHz - 5330000 KHz @ 80000 KHz, 160000 KHz AUTO), (N/A, 2000 mBm), (0 s) [ 17.710000] cfg80211: (5490000 KHz - 5730000 KHz @ 160000 KHz), (N/A, 2000 mBm), (0 s) [ 17.730000] cfg80211: (5735000 KHz - 5835000 KHz @ 80000 KHz), (N/A, 2000 mBm), (N/A) [ 17.750000] cfg80211: (57240000 KHz - 63720000 KHz @ 2160000 KHz), (N/A, 0 mBm), (N/A) [ 17.850000] PPP generic driver version 2.4.2 [ 17.850000] NET: Registered protocol family 24 [ 17.870000] ieee80211 phy0: rt2x00_set_rt: Info - RT chipset 5350, rev 0500 detected [ 17.870000] ieee80211 phy0: rt2x00_set_rf: Info - RF chipset 5350 detected procd: - init complete - [ 29.380000] random: nonblocking pool is initialized