Adding support for ZTE MF287+ aka DreiNeo

I've got yet another very, very cheap ISP branded LTE router: ZTE MF287+. Features:

  • IPQ4018 SoC
  • 256MiB RAM
  • 128MiB NAND (SPI)
  • 2.4G and 5G WiFi (SoC Internal)
  • SPI ZigBee module
  • Cat12 (or 13?) LTE module
  • Battery and charge controller (managed by LTE module)
  • 4 GBit ports
  • 1 RJ11 phone port (managed by LTE module)
  • 1x USB (doesn't work on stock firmware, only for OEM debug)
  • Apart from the blue debug LED on the board, all LEDs are controlled by the LTE module.

I have basic support finished and I'm currently working out the rough edges.

Regarding USB: No power is provided to the port. It seems to be controlled by the LTE module, it is powered for a short period while the LTE module is booting (independently of the IPQ SoC).

Installation without opening the device is possible using an exploit, for now it's only explained on my personal website at The information will be added to the device wiki page once the PR is accepted.



Do you have any additional information about the modem, like band and CA support?

Unfortunately not. There is no datasheet that I could find, the information is scattered in some forums. Do you know if I can get this information via AT commands from the modem?

Not sure. Do you have any response to AT+CLAC? command? Potentially you may see a command with bnd or band in its name.

I'll try that on the weekend, when I have access to my spare device.

OK, so AT+CLAC? produces an error, but AT+ZNLOCKBAND? works:

+ZNLOCKBAND: 20080800c5,2000004c00000

NB: This response is from a ZTE DreiNeo Pro aka MF287Pro. I won't have access to the MF287+ for another few weeks.

is B1 B3 B7 B8 B20 B28 B38

Thanks for decoding :slight_smile:

According to Wikipedia, that's every European band currently deployed...

To be sure, try AT+ZNLOCKBAND=? then see the max allowed value for the 1st parameter and if it consists of multiple F's write it like this:
then read again AT+ZNLOCKBAND?

The command

just returns OK.

Well... it is a proprietary command and they are free to ignore the common syntax )
According to polish forum this is the "maximum" for MF286D:
AT+ZNLOCKBAND=1,0,20080800C5,0 - All
In fact, that is not 100% correct , at least for the latest Telia B12 modem firmware, as B32 is missing from the list.

So if we want to verify that then we need to write something like this:
and then re-read with AT+ZNLOCKBAND?

The LTE module looks very interesting.
In the original documents from "Drei" shows that the device also should support NFC.
Unfortunately, I did not test this function before flashing openwrt. It is maby connected over the LTE module.

No, that's a different model: The DreiNeo Pro (or MF287Pro) supports NFC but lacks ZigBee while the DreiNeo (or MF287+) lacks NFC but supports ZigBee (and it has a rechargeable battery that's not present on the Pro). The can be easily distinguished by the NFC logo on the top (or lack thereof).

The Pro has different GPIO assignments, PR for the Pro is here.

1 Like

I tried the Exploit through the backup option, but on my CR_H3GATMF287PLUSSTV1.0.0B27 it does not make a request to the tftp Server, requesting on another laptop to GET from works and delivers the file and creates a log entry. But the router also doesnt restart, so it alteast has to do something.

Really stupid error on my part, i checked the network panel and chrome blocked the upload due to some reason

Did anyone ever get the USB to work? It doesn't seem to get power after boot. I'd like to use USB for overlay.

You can't. USB is only working on the MF287 Pro.

I'm still pretty sure that USB power is controlled by the LTE module, but I haven't found any way to enable it. I've stopped trying to get it working a while ago when I switched to the MF287 Pro.

1 Like

Okay, thank you - what a bummer. Would be a decent yet very affordable device, but the standard overlay partition is just too small to install packages.

Hm, I bought my last MF287 Pro for €10,- so I'd say that's affordable, too :slight_smile:
Depending on the choice of packages, you might fit everything if you create a custom image using the image selector. I usually do this and I still have 11MB of free space that I don't need.

10 EUR is a steal! The ones I saw traded around 40-50 EUR, still a not so bad price regarding the hardware one gets.

Thank you, I'll think about the custom image whilst also keeping my eyes peeled for a good MF287 Pro offer.