Flash on Zyxel NR7101

you can set qmi, but it will crash usb bus.
Also, why use normal wrt, while you can use ROOter and have an easy life?
anyway no, in qmi it will crash, i can reach 200 in downlload, and it crash. maybe if you stay around 100 mbps it can keep on, but after that it always crashed to me.
Need to stick whit MBIM

hey thanks for your detail replays. I found some different Models. Are there importen Hardware differences i should now?
could not found some issues and rison why i should buy the expensive r one?

NR7101-EUZNN1F
NR7101-EU01V1F

Not sure about this, but I believe the EUZNN1F variant is the "Nebula NR7101". See https://www.zyxel.com/products_services/Nebula-5G-NR-Outdoor-Router-Nebula-NR7101/

If you don't know what that is, then you probably don't want it...

Hmm no problems so far here in qmi mode. I also use daily reboot during the night, as the internet connection sometimes "hangs" unusable after 24...72 hours of nonstop use.

what you use, modemmanager?

Hi all,

I also went the route of getting a used Telenor branded nr7101. I have gotten the supervisor password and a serial console, removed the iptables rules to enable access to the webinterface. However Im having issues logging into the web interface. Neither admin/supervisor/root work with the supervisor password or the default "1234".

Peeking into /data/zcfg_config.json seems to show that the supervisor and admin account is disabled - and no password set for the root account.

Any idea on how to get access to the web interface? Can i update the /data/zcfg_config.json to enable the admin account and set a password?

Will the passwords be reset to a known default if I manually flash the stock fw, either by adding it to the /root/fw directory or performing the procedure in the wiki?

> "Account":[
>           {
>             "AutoShowQuickStart":false,
>             "Enabled":true,
>             "EnableQuickStart":false,
>             "Page":"",
>             "Username":"root",
>             "Password":"",
>             "PasswordHash":"", 
>             "Privilege":"login",      
>             "AccountIdleTime":900                                 
>           },                 
>           {
>             "AutoShowQuickStart":false,
>             "Enabled":false,
>             "EnableQuickStart":false,
>             "Page":"",
>             "Username":"supervisor",
>             "Password":"",
>             "PasswordHash":"",
>             "Privilege":"login,httpd,samba",
>             "AccountIdleTime":900
>           }
> 
> {
>             "AutoShowQuickStart":true,
>             "Enabled":false,
>             "EnableQuickStart":true,
>             "Page":"Broadband,Wireless,Home_Networking,Routing,NAT,DNS,IGMP_MLD,Vlan_Group,Interface_Grouping,Firewall,MAC_Filter,Certificates,Log,Traffic_Status,ARP_Table,Routing_Table,CellWan_Status,System,User_Account,Remote_MGM
>             "Username":"admin",
>             "Password":"",
>             "PasswordHash":"",
>             "Privilege":"login,httpd,samba"
>           }
>         ],

Update:
I booted the stock firmware from RAM using the TFTP procedure in the wiki. That allowed me to login using supervisor and the generated password (same as for SSH). I then added a new administrator account to the web interface, flashed the stock firmware from the web interface. This has left me with full access to the device. If you want to add a user to the web interface directly in the zcfg_config.json this is a working format for NEWUSERNAME/Abcde123

{                                       
            "Enabled":true, 
            "EnableQuickStart":true,
            "Page":"",   
            "Username":"NEWUSERNAME", 
            "Password":"_encrypt_qRHR47FeuZNpaAD75lAhdA==",
            "DefaultPassword":"_encrypt_qRHR47FeuZNpaAD75lAhdA==",
            "DefaultGuiPassword":"",        
            "ResetDefaultPassword":false,
            "shadow":"",       
            "smbpasswd":"",           
            "ConfigAccountFromWAN":false,  
            "PasswordHash":"",     
            "DefPwLength":8,       
            "AccountCreateTime":0,        
            "AccountRetryTime":3,
            "AccountIdleTime":300,   
            "AccountLockTime":300,      
            "RemoHostAddress":"",   
            "DotChangeDefPwd":true,
            "ShowSkipBtnInChgDefPwdPage":false,
            "AutoGenPwdBySn":false,
            "AutoShowQuickStart":false,
            "Privilege":"_encrypt_YGgzSKoZTnvsKEsFYUG4fgR2cLz+zcudbgkKsNq5fVc=",
            "RemoteAccessPrivilege":"LAN",
            "OldDefaultPassword":"",
            "CardOrder":"",            
            "ThemeColor":"",
            "HiddenPage":"",       
            "SshKeyBaseAuthPublicKey":"",
            "GetConfigByFtp":false 
          }                  

today i got my second NR7101 because the first one was direct "dead on arrival"
They deliefert me the second NR7101 with the Firmware V1.00(ABVC.3)C0

and Modul Version:
RG502QEAAAR11A03M4G

I'm just curious how it is with you

1 Like

Mine arrived the same way (EU version). I advise you to update the stock modem and firmware from zyxel before you put the device to daily production usage. If it still doesn't keep stable, maybe tryout openwrt a little later...
The official zyxel updates deliver 5G-NSA support which wasn't part of the old initially delivered firmware.

Hello guys.
Sorry for asking newbie questions here, but what's the easiest way of getting either Openwrt or OEM firmware into a Telenor branded NR7101?
I see there are different methods of doing this in the wiki, but I don't really understrand the "Halt boot by pressing Escape on console". I'm familiar with SSH and basics, but the tutorial in the wiki is a little bit over my head :stuck_out_tongue:

Hi and welcome.

These are the high level steps I used to get back to stock FW:

  1. Get a USB Serial adapter and connect to the on-board connector.
  2. Connect with a terminal application as the device boots up. This will give you a shell session on the device, but without using the network.
  3. Temporarily enable http/https/ssh connectivity (iptables). This will open the device to allow you to connect to it through its internal Wifi AP.
  4. Use Web GUI to flash stock Zyxel FW.
  5. Flash OpenWRT from the Zyxel web GUI (optional).

@bmork provided at lot more detail on the individual steps. the nvram command is used to set the DebugFlag and CheckBypass NVRAM variables that allows you to keep access to the bootloader.

All in all it was worth all the work. The device is very stable and fast, with good reception. I have run it without issue for 90+ days without a reboot. I was happy with stock FW so I never tried OpenWRT.

Good luck!

1 Like

Finally managed to get http and ssh running. What I did wrong was that I logged into shell with the supervisor account and not the root account. No iptables for supervisor I guess..

Now I'm wondering what to do next, I want to flash the zyxel stock fw:
Could I flash zyxel fw using the "From OEM ssh" method? Or do I need to flash Openwrt first and go to stock fw from there?

Edit: I flashed Openwrt using SSH and then flashed StockFW with OpenWrt. Then again flashed StockFW with StockFW just to make sure everything was ok. Now everything is working the way it should :slight_smile: No dropouts for one hour now so I think everything is good. Anything else I should do or must check before I close up the device again and mount it 6m up in the air? :smiley:

If you are on stable stock firmware, everything is ok. you can close and that's it.
The only thing you have to do, if you did not untill now, is putting firmware on kernel 2, because if something happen, it would pull kernel 2 firmware, which if it's telenoir locked firmware, you would get back to the start.
so whit scp upload the stable firmware, which is V5 as of now, on /tmp folder, then log ssh as root:

nvram setro uboot DebugFlag 0x1
nvram setro uboot CheckBypass 0
nvram commit
cd /tmp
mtd_write -w write 100ABUV5C0.bin Kernel2

Then you are done for good.

Log in as “supervisor” on https://172.17.1.1/

the default IP of my NR7101 is 192.168.1.1
when I try to connect to https://172.17.1.1 it does not work ( PC IP manually set to 172.17.1.2 )
when I try to login to 192.168.1.1 admin & pw from label works
but supervisor with password from generator (correct IMEI) does not work.
(nor does SSH with root )
does this work only with older firmware ?

Not IMEI. Serialnumber of the router. This looks like Syy0Zwwnnnnnn

sorry , yes SN - I already had used SN, but PW does not work

1 Like

I got the root & supervisor password from zyxel support by incident in a teamviever support session.
the password from the generator is wrong calculated
i tried the calculator on 2 new installed machines.

2 Likes

A post was split to a new topic: Zyxel NR7101 bricked?

Following the upgrade instructions, you can upgrade your modem to version 11A03

at + qfotadl = "http://get.dyn.mork.no/nr7101/RG502QEAAAR01A04-R11A03.zip"

What will this command look like, if possible, to upload the firmware in version: RG502QEAAAR11A07M4G_01.001.01.001

Ok I did it myself

Is there any way to prevent the qmi protocol from crashing the router as the speed is above 200mbit / s?

1 Like
at+qfotadl="http://get.dyn.mork.no/nr7101/RG502QEAAAR11A06M4G-RG502QEAAAR11A07M4G.zip"

Alternate Source: http://79.161.156.252/RG502QEAAAR11A06M4G-RG502QEAAAR11A07M4G.zip and http://79.161.156.252/ for the file index.

Can anyone here using zyxel nr7101 check such a thing. On 7101 I have openwrt version 22.03 installed. The modem works as qmi. When the router turns on for me and establishes the connection itself, I have the maximum speed I can achieve from the operator (about 130mb/s). As soon as I execute the ifdown wan and then ifup wan command, the maximum speed I can get to about 15mb / s. (the same eNodeB - LAC - CID) Only restart helps then I have full speed again. I tested on the same card in the same place in the samsung A8 and netgear mr1100 and the speed is always maximum there. Note interesting stuff. When I run the command iperf -c ping.online.net from the console - the speed is also maximum. It turns out that the problem is with qmi - lan or router - lan. What is wrong? Why do the above commands cause a drop in speed?