Factory Image is OpenWRT? Zyxel Armor Z1 NBG6816

So I got this old thing on ebay and honestly I am impressed by the performance. I was wondering, why there is no official support for this device (found an old thread, nothing more).

Surprisingly enough, this is what I saw on the telnet terminal:
(was unable to login via ssh, since it is so mega-outdated, that I failed to convinced my shell to accept its key algorithms)

telnet 192.168.6.1
Trying 192.168.6.1...
Connected to 192.168.6.1.
Escape character is '^]'.
NBG6816 login: root
Password: 


BusyBox v1.19.4 (2020-02-23 21:12:34 CST) built-in shell (ash)
Enter 'help' for a list of built-in commands.

  _______                     ________        __
 |       |.-----.-----.-----.|  |  |  |.----.|  |_
 |   -   ||  _  |  -__|     ||  |  |  ||   _||   _|
 |_______||   __|_____|__|__||________||__|  |____|
          |__| W I R E L E S S   F R E E D O M
 -----------------------------------------------------
 (unknown)

cat /etc/openwrt_version 
IPQ806X.LN

So what is this? Did someone flash OpenWRT on it? Or does it come with OpenWRT? Is there any option to upgrade it?

It is qca sdk, not openwrt. Try ubus call system board to confirm.

https://openwrt.org/toh/linksys/ea8500#oem_bootlog

doesn't work:

root@NBG6816:~# ubus list
network
network.device
network.interface
network.interface.lan
network.interface.loopback
network.interface.vpn
network.interface.wan
network.interface.wan6in4
network.interface.wan6to4
service
root@NBG6816:~# ubus call system
Usage: ubus [<options>] <command> [arguments...]
Options:
 -s <socket>:           Set the unix domain socket to connect to
 -t <timeout>:          Set the timeout (in seconds) for a command to complete
 -S:                    Use simplified output (for scripts)
 -v:                    More verbose output

Commands:
 - list [<path>]                        List objects
 - call <path> <method> [<message>]     Call an object method
 - listen [<path>...]                   Listen for events
 - send <type> [<message>]              Send an event

root@NBG6816:~# ubus call system board
Command failed: Not found

Should I try the ea8500 image?

Nope, jost that it is normal that oem fw is heavily modified openwrt.

Probably because no-one has shown interest in adding it; you (or some else that owns it) needs to do the work. It has an ipq8064 SoC (same as Netgear R7800 among others) so it's definitely supportable from that point of view.

The 5GHz antenna is a Quantenna QT3840BC + Quantenna QT2518B which isn't supported in OpenWrt (see Netgear R7500 v1), so even if support is added WiFi will be hampered alot.

Internal photos at https://fcc.report/FCC-ID/I88NBG6816/2658782.pdf

No, you'll definitely brick it.

too bad. Well, thanks for the info. Maybe I'll tinker with it later. Is there a good starter documentation to follow? Assume general programming skills, while in general far away from the hardware (java, dotnet) but familiar with posix systems.

https://openwrt.org/docs/guide-developer/add.new.device
https://openwrt.org/docs/guide-developer/hw.hacking.first.steps

Also looking at recent commits on how support is added for devices with the same target (ipq806x) would help, for example https://github.com/openwrt/openwrt/commit/3aef61060e3f51aa43fe494d5ff173e81dd43003

1 Like

This topic was automatically closed 10 days after the last reply. New replies are no longer allowed.