Adding OpenWrt support for Xiaomi "Redmi Router AX6S"/"Xiaomi Router AX3200"

Although I'm confident that the script moves the routers from netmode:0 to netmode:4, I've got a problem here when it comes to testing any further steps towards enabling Telnet. The problem is that at this point both my routers permanently have telnet enabled. This persists over a factory reset, and using bdata set telnet_en=0; bdata commit also makes no difference. The factory reset does take me back to netmode:0, and that's how I'm proving the script's ability to go to netmode:4.
Can anyone advise me how to get back to the original state where telnet was disabled?

Thank you, works great.

1 Like

That's great to hear. Did you find that Telnet was instantly available after the script had enabled netmode:4, or did you have to take any additional steps?

I had to follow these instructions to enable telnet

1 Like

In the anger, i deleted all of file in root directory of router ax6s after failure in install openwrt, how can i do right now, pls help me

Hey, guys...
I had owrt RC4 working on ax6s but after trying to update to 22.03.3 I now have u-boot in serial console.

I was able to load the 22.03.3 initramfs via tftpboot, but I still have u-boot after rebooting with sysupgrade -F factory.bin.

Using initramfs 22.03.3 I get "0000000 0dd0 edfe 3900 ..." in the hexdump output /dev/mtd8 | head

Should I do sysupgrade -F from stock xiaomi firmware?

Just move to 22.03-SNAPSHOTs until the 22.03.4 comes out.

Thanks for the answer...@xabolcs but it didn't work.
Any information help?

Sorry for the noise. :sweat_smile:
I thought you have the BMT problem which fix was backported to openwrt-22.03.

After booting initramfs please use sysupgrade.bin instead of factory.bin! And not just now, but always!

factory.bin is for the initial flashing from the original stock fw.
sysupgrade.bin is to use with the sysupgrade utility!

1 Like

I tried your script on my rb01 telnet disabled router and it gave me the following error:

‘C:\Users\hazzr\Desktop\unlock>python -p 12345678 -H
Serial Number: 35756/J1UD45539
netmode is 0. Attempting to set netmode to 4
Traceback (most recent call last):
  File "C:\Users\hazzr\Desktop\unlock\", line 154, in <module>
    response = miwifi.enable_telnet()
  File "C:\Users\hazzr\Desktop\unlock\", line 88, in enable_telnet
    ssl_sock.connect((self.router_ip, self.mesh_port))
  File "C:\Users\hazzr\AppData\Local\Programs\Python\Python311\Lib\", line 1379, in connect
    self._real_connect(addr, False)
  File "C:\Users\hazzr\AppData\Local\Programs\Python\Python311\Lib\", line 1370, in _real_connect
  File "C:\Users\hazzr\AppData\Local\Programs\Python\Python311\Lib\", line 1346, in do_handshake
ssl.SSLError: [SSL: SSLV3_ALERT_HANDSHAKE_FAILURE] sslv3 alert handshake failure (_ssl.c:992)

Please advise how to resolve this issue

Could you please give some details about your experience in using the script to enable telnet?

My device is macbook air and I was connected to network from wifi.

Steps I followed to enable telnet:
1: pip3 install requests
2: python3 -p 12345678
3: instructions

Although I've not seen this message before, googling it, I found this:

Based on that, can you try finding the line ssl_context.verify_mode = ssl.CERT_NONE and adding this line below it:

If that works for you I'll update the script.


Thank you very much it worked:

C:\Users\hazzr\Desktop\unlock>python -p 12345678
Serial Number: 35756/J1UD45539
netmode is 0. Attempting to set netmode to 4
Waiting to check result
Netmode is 4
telnet password:

Great. I've updated the script accordingly.
What steps did you take after getting to Netmode4 before you could telnet to the router?

just conducted man in middle attack and everyone is saying thanksal and talking about installation instructions??? what ????

The "man in the middle" is my own laptop. The two device it sits between (in the middle of) are the two AX3200 routers that I paid for and I own, sitting on the same bench.
I'm "attacking" my own equipment so that it gives up its secrets, so that I can ultimately dispose of that unwanted and restrictive software.


I did everything according to the instructions including 3 steps described with changing tokens in mentioned urls

Hi, i have bought ax3200 just 2 days before. and its prod. Date is 11/2021 which means its Telnet is disabled. Can you please guide me on how to get Telnet enabled and SSH access so that i can install Openwrt onto my AX3200 pls ?
I dont have a 2nd AX3200 Router and i just want to install Openwrt and use it as an AccessPoint for better WiFi Coverage. In the above Discussion i didnt understand properly how to go step by step. Please help me.
Thanks in advance.

Hi guys,

I had OpenWRT running on my router, but a power outage kind of killed my Image yesterday.

I recovered into Stock Xiaomi image using TFTP and used the 2 python scripts above to enable network mode:4 and SSH to install openWRT using TFTP.

So far so good.

Everytime I do a sysupdate from the OpenWRT Recovery Image to the latest version (or the 22.03.2 version), I get the following error:

[    1.634713] UBI: auto-attach mtd10
[    1.644608] ubi0: attaching mtd10
[    1.648635] ubi0: scanning is finished
[    1.652380] ubi0 error: 0xffffffc010527930: the layout volume was not found
[    1.659346] ubi0 error: 0xffffffc01052b12c: failed to attach mtd10, error -22
[    1.666485] UBI error: cannot attach mtd10
[    1.671360] /dev/root: Can't open blockdev
[    1.675449] VFS: Cannot open root device "(null)" or unknown-block(0,0): error -6
[    1.682927] Please append a correct "root=" boot option; here are the available partitions:
[    1.691281] 1f00             512 mtdblock0
[    1.691283]  (driver?)
[    1.697811] 1f04             256 mtdblock1
[    1.697812]  (driver?)
[    1.704334] 1f08             512 mtdblock2
[    1.704336]  (driver?)
[    1.710862] 1f0c             256 mtdblock3
[    1.710863]  (driver?)
[    1.717397] 1f10             256 mtdblock4
[    1.717398]  (driver?)
[    1.723921] 1f14             512 mtdblock5
[    1.723923]  (driver?)
[    1.730450] 1f18             256 mtdblock6
[    1.730451]  (driver?)
[    1.736977] 1f1c             256 mtdblock7
[    1.736979]  (driver?)
[    1.743502] 1f20            4096 mtdblock8
[    1.743503]  (driver?)
[    1.750029] 1f24            3712 mtdblock9
[    1.750031]  (driver?)
[    1.756556] 1f28             128 mtdblock10
[    1.756558]  (driver?)
[    1.763168] 1f2c          113664 mtdblock11
[    1.763170]  (driver?)
[    1.769781] Kernel panic - not syncing: VFS: Unable to mount root fs on unknown-block(0,0)
[    1.778036] SMP: stopping secondary CPUs
[    1.781952] Kernel Offset: disabled
[    1.785431] CPU features: 0x00000002,04002004
[    1.789777] Memory Limit: none
[    1.795896] Rebooting in 1 seconds..

Can someone tell me, how to fix this?