Anyone working on TP-Link EAP225?

Yeah, my patches are bad currently. The makefile base device is wrong, but I'll push a fix in a minute.

Edit: pushed and build-tested.

1 Like

Just started compiling. Looks like I'm going to get an EAP225-Outdoor v1 model.

Edit: Build successful. I'm going to get my hands on one of these bad boys and flash the build I got.

@svanheule EAP225-Outdoor AP just arrived. Shell can't seem to find and execute cliclientd. Here are the executables under /bin:

/bin $ ls -al
total 393
drwxrwxrwx    2 0        root           473 Apr  4  2019 .
drwxrwxrwx   15 0        root           197 Apr  4  2019 ..
-rwxrwxrwx    1 0        root             0 Apr  4  2019 .gitignore
lrwxrwxrwx    1 0        root             7 Apr  4  2019 ash -> busybox
-rwxrwxrwx    1 0        root        381648 Apr  4  2019 busybox
lrwxrwxrwx    1 0        root             7 Apr  4  2019 cat -> busybox
lrwxrwxrwx    1 0        root             7 Apr  4  2019 chmod -> busybox
lrwxrwxrwx    1 0        root             7 Apr  4  2019 cp -> busybox
lrwxrwxrwx    1 0        root             7 Apr  4  2019 date -> busybox
lrwxrwxrwx    1 0        root             7 Apr  4  2019 dd -> busybox
lrwxrwxrwx    1 0        root             7 Apr  4  2019 df -> busybox
lrwxrwxrwx    1 0        root             7 Apr  4  2019 dmesg -> busybox
lrwxrwxrwx    1 0        root             7 Apr  4  2019 echo -> busybox
lrwxrwxrwx    1 0        root             7 Apr  4  2019 false -> busybox
lrwxrwxrwx    1 0        root             7 Apr  4  2019 grep -> busybox
lrwxrwxrwx    1 0        root             7 Apr  4  2019 gunzip -> busybox
lrwxrwxrwx    1 0        root             7 Apr  4  2019 gzip -> busybox
lrwxrwxrwx    1 0        root            22 Apr  4  2019 iptables-xml -> ../sbin/iptables-multi
lrwxrwxrwx    1 0        root             7 Apr  4  2019 kill -> busybox
lrwxrwxrwx    1 0        root             7 Apr  4  2019 ln -> busybox
lrwxrwxrwx    1 0        root             7 Apr  4  2019 login -> busybox
lrwxrwxrwx    1 0        root             7 Apr  4  2019 ls -> busybox
lrwxrwxrwx    1 0        root             7 Apr  4  2019 mkdir -> busybox
lrwxrwxrwx    1 0        root             7 Apr  4  2019 mount -> busybox
lrwxrwxrwx    1 0        root             7 Apr  4  2019 mv -> busybox
lrwxrwxrwx    1 0        root             7 Apr  4  2019 netstat -> busybox
lrwxrwxrwx    1 0        root             7 Apr  4  2019 ping -> busybox
lrwxrwxrwx    1 0        root             7 Apr  4  2019 ps -> busybox
lrwxrwxrwx    1 0        root             7 Apr  4  2019 rm -> busybox
lrwxrwxrwx    1 0        root             7 Apr  4  2019 sh -> busybox
lrwxrwxrwx    1 0        root             7 Apr  4  2019 sleep -> busybox
lrwxrwxrwx    1 0        root             7 Apr  4  2019 sync -> busybox
lrwxrwxrwx    1 0        root             7 Apr  4  2019 tar -> busybox
lrwxrwxrwx    1 0        root             7 Apr  4  2019 touch -> busybox
lrwxrwxrwx    1 0        root             7 Apr  4  2019 true -> busybox
lrwxrwxrwx    1 0        root             7 Apr  4  2019 umount -> busybox
lrwxrwxrwx    1 0        root             7 Apr  4  2019 uname -> busybox
lrwxrwxrwx    1 0        root             7 Apr  4  2019 usleep -> busybox
lrwxrwxrwx    1 0        root             7 Apr  4  2019 zcat -> busybox

/etc/sbin:

/usr/sbin $ ls -al
total 1634
drwxrwxrwx    2 0        root           140 Apr  4  2019 .
drwxrwxrwx    5 0        root            51 Apr  4  2019 ..
-rwxrwxrwx    1 0        root             0 Apr  4  2019 .gitignore
-rwxrwxrwx    1 0        root         26392 Apr  4  2019 arp
lrwxrwxrwx    1 0        root            17 Apr  4  2019 brctl -> ../../bin/busybox
-rwxrwxrwx    1 0        root          4896 Apr  4  2019 ebtables
-rwxrwxrwx    1 0        root          8564 Apr  4  2019 ebtables-restore
-rwxrwxrwx    1 0        root        644980 Apr  4  2019 snmpd
-rwxrwxrwx    1 0        root        982472 Apr  4  2019 tcpdump
lrwxrwxrwx    1 0        root            17 Apr  4  2019 telnetd -> ../../bin/busybox

Currently defined Busybox functions:

Currently defined functions:
        [, [[, arp, arping, ash, basename, brctl, cat, chmod, cp, cut, date, dd, devmem, df, dmesg, echo, expr, false,
        free, getty, grep, gunzip, gzip, halt, head, ifconfig, init, insmod, kill, killall, klogd, ln, logger, login,
        logread, ls, lsmod, lsof, md5sum, mkdir, mount, mv, netstat, ping, poweroff, ps, reboot, rm, rmmod, route, sh,
        sleep, sync, sysctl, syslogd, tail, tar, telnetd, test, tftp, top, touch, true, udhcpc, umount, uname, uptime,
        usleep, vconfig, xargs, zcat

AP came with 1.5.0 Build 20190404 Rel. 58086(4555) firmware. Do I need root access?

@PolynomialDivision had the same issue with FWv1.4.x. I think the required cliclientd is only available starting from FWv1.6.0.

Your options are:

  1. Upgrade to FW >= 1.6.0 (easy)
  2. Obtain a root shell, patch uclited to make uclited -u work; like for the EAP245 v1 (hard)

Got it. Updating to the latest firmware 1.7.0, then.

Edit: Turns out latest firmware is V1_1.20.0 Build 20200422 for EAP225-Outdoor.

I'm taking this (and post #110) as my guide:


Anything else I should know about?

@svanheule I was able to run cliclientd stopcs after upgrading to firmware v1.6.1. I've successfully flashed squashfs-factory image I had compiled to the AP. I can't seem to access the device locally though. No Wi-Fi signal either.

openwrt-ath79-generic-tplink_eap225-outdoor-v1-squashfs-factory

Edit: Looks like it's soft-bricked.

I was afraid this might happen at some point :frowning_face:
OpenWrt by default only enables the ethernet interface, so if that doesn't work you're in for trouble.

The problem is that PolynomialDivision hasn't found the serial port yet, nor found time to take hi-res PCB pictures so I can help look for it. Would you be able to open your device and take some pictures?

I just figured out that OpenWRT set 192.168.1.1, as its IP. I couldn’t see it because my router also got the same IP address set. After directly connecting to the PoE switch from my PC I figured by looking at arp -a I can reach it under 192.168.1.1 fine haha.

Cannot access Luci but SSH root access works fine.

Edit: Going to change IP from command line first.

1 Like

Ah, yes. That's typically the recommended way to set-up a new OpenWrt install if you have more than one device in your network.

You startled me by thinking it was bricked! :wink:

If you just selected the EAP225-Outdoor in make menuconfig, then you won't have LuCI installed. You'll need to add that to your build yourself. Also check that the ath10k-ct kernel module and the correct firmware are added. Otherwise you won't be able to use 5GHz Wi-Fi.

1 Like

Will do. Thanks for letting me know.

Looks like it was auto-selected.


5GHz wireless works fine but WikiDevi says 5GHz radio chip is a Qualcomm Atheros QCA9886
http://en.techinfodepot.shoutwiki.com/wiki/TP-LINK_EAP225-Outdoor

That is entirely correct. I would suggest you have a second look at the package description too :wink:

Ah, just realized that :smile:. While I have your attention, I'd like to ask around a few questions I have on a router. Is this thread OK or would you rather talk somewhere else?

Maybe use a DM if you don't want to de-rail this topic :slight_smile:

Welp I actually soft-bricked it this time. Tried to flash squashfs-factory under initramfs flashed system. Green light just lits up and stays there. Let's sacrifice this piece to research. I'm going to try to kindly open the chasis and see what's inside.

@svanheule take a look at these pictures while I tear this down.

Edit: Almost impossible to tear it down if I want to put this thing back together. I'm going somewhere with professional tools to safely dismantle it tomorrow.

I've seen the FCC pictures before, but the overview ones are so low-res it's hard to make things out. What you can make out, is that they appear to have gone at the housing with a pair of pliers to get the thing open :grimacing:

@PolynomialDivision did you ever manage to open the EAP225-Outdoor cleanly?

I have closely examined the housing, I think what it needs is heat, so I can take down plastic parts smoothly without damaging it. This AP supposedly have got IP65 protection as well, I think pair of pliers would pretty much damage the housing.

My man near the beach helped me out how to tear it down. He says he’s got a third eye when he looks at objects :smiley:

Edit: Will send high res images of the board when I’m home.

1 Like