Configure and Launch DSL with FritzBox 3370

Hi everyone,
I live in France, so I have a french ISP (called SFR) with the modem-router NB6VAC.
I want to replace this modem with a FritzBox 3370 annex B (German version) using OpenWrt.

Knowing French ISPs use DSL Annex A, is it feasible ?

I've followed the 3370 instruction, and the commit

I've connected the FritzBox serial port to a PC via RS232toUSB. For me, the working serial config is 115200 8n1.
IMG_0100

I ended up in EVA boot loader. When I 'printenv' I got:

HWRevision            175
ProductID             Fritz_Box_3370
SerialNumber          0000000000000000
annex                 B
autoload              yes
bootloaderVersion     1.1186
bootserport           tty0
cpufrequency          500000000
firstfreeaddress      0x8110A514
flashsize             nor_size=0MB sflash_size=256KB nand_size=128MB
maca                  BC:05:43:E8:CB:EB
macb                  BC:05:43:E8:CB:EC
macwlan               BC:05:43:E8:CB:ED
macdsl                BC:05:43:E8:CB:EE
memsize               0x08000000
modetty0              38400,n,8,1,hw
modetty1              38400,n,8,1,hw
mtd0                  0x400000,0x3400000
mtd1                  0x0,0x400000
mtd2                  0x0,0x20000
mtd3                  0x20000,0x30000
mtd4                  0x30000,0x40000
mtd5                  0x0,0x200000
my_ipaddress          192.168.178.1
prompt                Eva_AVM
req_fullrate_freq     250000000
sysfrequency          250000000
urlader-version       2186
usb_board_mac         BC:05:43:E8:CB:EF
usb_rndis_mac         BC:05:43:E8:CB:F0
usb_device_id         0x0000
usb_revision_id       0x0000
usb_manufacturer_name  AVM

is this SerialNumber 0000000000000000 normal ? Is there anything else out of place ?

So I downloaded openwrt, checkout the commit, and build the 2 NAND versions (one for micron, one for hynix), because when I look at my NAND, I think I have another one called "ST Micro NAND04GW3B2DN6". Here is a picture of my NAND.
IMG_0099

So with the commit, I get for each NAND, a kernel image and a filesystem image.

But by curiosity, I decided to compile OpenWrt without this commit. As a result I got a sysupgrade image and 2 u-boot files:

  1. u-boot-fb3370_eva/u-boot.bin
  2. u-boot-fb3370_ram/u-boot.asc

Am I supposed to replace my EVA boot loader with u-boot ? If so, which procedure ?

So I connect fritzbox to pc via ethernet, set pc IP address to 192.168.178.2, launch ftp command line utility:

ftp 192.168.1.1

The remaining commands to flash are in the fritzbox wiki.

I started by flashing the Micron NAND images (kernel and filesystem), then rebooted, and got a kernel panic.

[ 0.693473] nand: device found, Manufacturer ID: 0x20, Chip ID: 0xdc
[ 0.698450] nand: ST Micro NAND04GW3B2DN6
[ 0.702517] nand: 512 MiB, SLC, erase size: 128 KiB, page size: 2048, OOB size: 64
[ 0.710024] ------------[ cut here ]------------
[ 0.714626] WARNING: CPU: 1 PID: 1 at drivers/mtd/nand/nand_base.c:4804 nand_scan_tail+0x5ec/0xb58
[ 0.723571] No ECC functions supplied; on-die ECC not possible

So I flashed the Hynix one and it worked.

LAN and WLAN are working.

Now I AM COMPLETELY STUCK WITH THE DSL CONFIGURATION.

From what I gathered, I should use:
G-DMT, which should be Annex A G.992.1.
VPI : 8
VCI : 35
login: myknownlogin@neufpnp
password: neufpnp

And I should choose between:

  • PPPoE : LLC : MTU 1492
  • PPPoA: VC-Mux : MTU 1500

Then there is the firmware file. I followed the tuto, got the 2 firmwares (vr9-A-dsl.bin, and vr9-B-dsl.bin), but I don't which one to choose.

Also in /lib/firmware, there are other firmwares like 'lantiq-vrx200-a.bin'. Should they be selected ?

Anyway, I tried many combinaisons, without success... It feel like the dsl hardware doesn't even turn on. It stays "DOWN" all the time. So maybe my problem is hardware...

If someone could help please, that would be really great !

Here is my config:

config interface 'loopback'
	option ifname 'lo'
	option proto 'static'
	option ipaddr '127.0.0.1'
	option netmask '255.0.0.0'

config globals 'globals'
	option ula_prefix 'fd46:28ef:0c76::/48'

config atm-bridge 'atm'
	option payload 'bridged'
	option nameprefix 'dsl'
	option vci '35'
	option vpi '8'
	option encaps 'vc'

config dsl 'dsl'
	option ds_snr_offset '0'
	option annex 'bdmt'
	option firmware '/lib/firmware/vr9-B-dsl.bin'

config interface 'lan'
	option type 'bridge'
	option ifname 'eth0.1'
	option proto 'static'
	option netmask '255.255.255.0'
	option ip6assign '60'
	option ipaddr '30.0.0.1'

config interface 'wan'
	option ifname 'dsl0'
	option proto 'pppoe'
	option username 'myknownlogin@neufpnp'
	option password 'neufpnp'
	option ipv6 'auto'
	option keepalive '0'

config device 'wan_dev'
	option name 'dsl0'
	option macaddr ':'

config interface 'wan6'
	option ifname '@wan'
	option proto 'dhcpv6'

config switch
	option name 'switch0'
	option reset '1'
	option enable_vlan '1'

config switch_vlan
	option device 'switch0'
	option vlan '1'
	option ports '0 1 2 4 6t'
config defaults
	option syn_flood '1'
	option input 'ACCEPT'
	option output 'ACCEPT'
	option forward 'REJECT'

config zone
	option name 'lan'
	list network 'lan'
	option input 'ACCEPT'
	option output 'ACCEPT'
	option forward 'ACCEPT'

config zone
	option name 'wan'
	list network 'wan'
	list network 'wan6'
	option output 'ACCEPT'
	option masq '1'
	option mtu_fix '1'
	option input 'REJECT'
	option forward 'REJECT'

config forwarding
	option src 'lan'
	option dest 'wan'

config rule
	option name 'Allow-DHCP-Renew'
	option src 'wan'
	option proto 'udp'
	option dest_port '68'
	option target 'ACCEPT'
	option family 'ipv4'

config rule
	option name 'Allow-Ping'
	option src 'wan'
	option proto 'icmp'
	option icmp_type 'echo-request'
	option family 'ipv4'
	option target 'ACCEPT'

config rule
	option name 'Allow-IGMP'
	option src 'wan'
	option proto 'igmp'
	option family 'ipv4'
	option target 'ACCEPT'

config rule
	option name 'Allow-DHCPv6'
	option src 'wan'
	option proto 'udp'
	option src_ip 'fc00::/6'
	option dest_ip 'fc00::/6'
	option dest_port '546'
	option family 'ipv6'
	option target 'ACCEPT'

config rule
	option name 'Allow-MLD'
	option src 'wan'
	option proto 'icmp'
	option src_ip 'fe80::/10'
	list icmp_type '130/0'
	list icmp_type '131/0'
	list icmp_type '132/0'
	list icmp_type '143/0'
	option family 'ipv6'
	option target 'ACCEPT'

config rule
	option name 'Allow-ICMPv6-Input'
	option src 'wan'
	option proto 'icmp'
	list icmp_type 'echo-request'
	list icmp_type 'echo-reply'
	list icmp_type 'destination-unreachable'
	list icmp_type 'packet-too-big'
	list icmp_type 'time-exceeded'
	list icmp_type 'bad-header'
	list icmp_type 'unknown-header-type'
	list icmp_type 'router-solicitation'
	list icmp_type 'neighbour-solicitation'
	list icmp_type 'router-advertisement'
	list icmp_type 'neighbour-advertisement'
	option limit '1000/sec'
	option family 'ipv6'
	option target 'ACCEPT'

config rule
	option name 'Allow-ICMPv6-Forward'
	option src 'wan'
	option dest '*'
	option proto 'icmp'
	list icmp_type 'echo-request'
	list icmp_type 'echo-reply'
	list icmp_type 'destination-unreachable'
	list icmp_type 'packet-too-big'
	list icmp_type 'time-exceeded'
	list icmp_type 'bad-header'
	list icmp_type 'unknown-header-type'
	option limit '1000/sec'
	option family 'ipv6'
	option target 'ACCEPT'

config rule
	option name 'Allow-IPSec-ESP'
	option src 'wan'
	option dest 'lan'
	option proto 'esp'
	option target 'ACCEPT'

config rule
	option name 'Allow-ISAKMP'
	option src 'wan'
	option dest 'lan'
	option dest_port '500'
	option proto 'udp'
	option target 'ACCEPT'

config include
	option path '/etc/firewall.user'

Thank you.

That one is missing on https://openwrt.org/docs/guide-user/network/wan/isp-configurations
Would be nice if you could add the configuration for SFR, once you have it working.

1 Like

I will, as soon as it works. :wink:

2 Likes

On an ADSL line, Annex A requires different hardware than Annex B, they use different frequencies.

Yes I'm understanding it now. So unless I have the Fritzbox 3370 International version (which supports annex A and B), I cannot use the German B version in France ? No way to update a firmware ? Or change (solder/unsolder) another piece of hardware ?
There is this wiki talking about changing from annex B to A, but I don't know if they're talking about the International version or German version...

You can use it for VDSL (which uses the same frequencies throughout europe), but not for ADSL.

1 Like

As far as I currently understand it, the annex is set by one or more of:

  • modem firmware
  • modem chipset set to work in a specific annex in hardware, by a choice of jumpers/resistors/solder bridges
  • supplementary filter/transformer hardware

Some time ago I looked into modifying an Annex-A modem router into Annex-B, and eventually gave up on it. Information is extremely sparse and anecdotal, mostly gathered by observation, and those who managed to convert their modem did not document it very well (i.e., can be summed up by "changed a lot of hardware until it somewhat worked"). IMHO it's a rather excessive amount of time to invest for an uncertain outcome.

As @slh said, you can use it for VDSL just fine. For ADSL I would not bother and get hardware for the correct annex.

Yes I agree. This idea is just for curiosity :wink:
I'll see if my ISP can put me in VDSL mode. And if it does, what would be my next step in VDSL configuration ?

VDSL is configured purely in software. Look around on the wiki or in this forum, it's not that complicated, but the details depend on your ISP.

You can pull out the dsl firmware from the international/annex a AVM firmware of the same chipset family (for example the dsl firmware from the 7490 work on the 3370). Wont say how since its not really legal in AVM viewpoint... If youre not using vdsl2, you can try the opensource driver.

I tried a while back to revive a 3370. Sadly i never got it to run stable on my vdsl2 line.

I think I did it, I mentioned it in my first post. I followed this tuto.

Now I've made a big mistake. I went apocalyptic and wiped out my NAND and my NOR with:

erase mtd0  // NAND, kernel
erase mtd1  // NAND, filesystem
erase mtd2  // NAND, reserved-kernel ? what is it ?
erase mtd3  // NAND, reserved-filesystem ? what is it ?
erase mtd4  // NAND, config ? what is it ?
erase mtd5  // NAND, nand-filesystem ? what is it ?
erase mtd6  // NOR, urlader: bootloader 
erase mtd7  // NOR, tffs ? what is it ?
erase mtd8  // NOR, tffs ? what is it ?

I know I know, BIG MISTAKE. Which means no more EVA bootloader, no more serial access, and no more ftp flashing as usual.

Hopefully I've made a backup of every mtdx.

So I was going to try to "JTAG" my fritzbox. But I think I don't need to.
Correct me guys if I'm wrong, but I only need to flash the NOR (mine is MX25L2006E) which contains the bootloader. And once I got the bootloader back, I should be able to flash the NAND via ftp.

IMG_0104

In order to flash the NOR, I've already got my backup, the flashrom utility, a CH341A programmer and a SOIC8 Clip, that I previously used to flash some ThinkPad X230 BIOS.

I'm about to proceed. Any advice is welcome. :wink:

1 Like

Sorry my bad, i wrote this far to late at night :smiley:

Hi guys, I wanna say: it worked !! I managed to flash the NOR with the CH341A programmer, the SOIC8 Clip, and the commands:

cat mtd6_urlader.backup mtd7_tffs_1.backup mtd8_tffs_2.backup > nor.bin

mtd 6-7-8 are my backup done by this tuto

flashrom -p ch341a_spi -c 'MX25L2005(C)/MX25L2006E' -w nor.bin

ch341a_spi is the programmer and 'MX25L2005(C)/MX25L2006E' is the NOR chip for my Fritzbox.
Booting the box, and I'm back in EVA in serial, flashing kernel and filesystem from ftp, and booting OpenWrt again!
I will make a full and detailed tuto on how to do it.
In the mean time, I have a few questions:
my backup look like this:

total 262656
size: 4194304, name: mtd0_kernel.backup*
size: 50331648, name: mtd1_ubi.backup*
size: 4194304, name: mtd2_reserved-kernel.backup*
size: 50331648, name: mtd3_reserved-filesystem.backup*
size: 2097152, name: mtd4_config.backup*
size: 23068672, name: mtd5_nand-filesystem.backup*
size: 131072, name: mtd6_urlader.backup*
size: 65536, name: mtd7_tffs (1).backup*
size: 65536, name: mtd8_tffs (2).backup*

Can someone explain to me why when I flash the kernel image I put it in mtd1, but the kernel backup is from mtd0 ? Same for ubi filesystem.

Next question, it seems I cannot put mtd 2-3-4-5. Why ?? What are they ?

1 Like

Can I update the 3370 page knowing Iā€™m not the author??
I never found an edit button somewhere...

You need to be logged in to the wiki to be able to edit pages.

I am logged in. Where do I click to edit a page ?

Click the pencil on the right side to edit the complete page.
Click one of the Edit buttons to edit the respective section only.

image

Exactly, I don't have this edit button.

54

I'm logged in via email. Should I log in via Github ?

Ok Ok, I got it, I should NOT connect via email.
I've just tried via GitHub, and it worked, I can edit. :sweat_smile: