Flash on Zyxel NR7101

Hi, i've buyed the Zyxel LTE5398-M904. I searched the forum and finded nothing. The system to get into root shell is the same as the NR7101, the cpu is the same MT7621 the modem is a Quectel LTE cat 18 that work perfectly in openwrt. I'm asking if it's possible to compile a version compatible with my device. I'm not capable myself... is anyone interested? Thanks a lot

@bmork and others concerning this portion:

Copying OpenWrt to the recovery partition

Verify that you are running a working OpenWrt recovery image from flash
ssh to root@ and run:
fw_setenv CheckBypass 0
mtd -r erase Kernel2

I didn't have 'fw_setenv' after flashing?

So I gave up and flashed sysupgrade.

Also doesn't that command just erase Kernel2? What effects the copy from Kernel to Kernel2?

How how do I correctly copy OpenWrt to the recovery partition after having flashed the sysupgrade?

The modem seems to be working fine but I can't get it to connect to an APN. Is there a command to return available APNs? If not I tried to set mine but it didn't seem to want to connect. I presume I can't yet issue AT commands to disable auto APN and VoLTE as suggested on the wiki because I need an as yet uninstalled package to do so?

Strange. I worried I might have messed up something, but AFAICS uboot-envtools has been part of the nr7101 DEVICE_PACKAGES since the initial commit.

Yes, it just erases the partition. U-boot will copy Kernel to Kernel2 on the next boot if Kernel2 is empy

But this part of the instructions needs a rewrite after the discovery of the BootingFlag variable, which makes Kernel2 more than an emergency rescue partition.

I believe newer OEM firmwares might be installed to and boot from Kernel2. This possibility should be considered during OpenWrt installation. We could even use it for dual partition support with the newer in-kernel ubootenv stuff.

No, this depends on the operator, and AFAIK there is no standard way to retrieve such a list. Commonly used APNs are published on the Internet. But if your subscription requires something special then that won't help.

1 Like

Ah thanks for this.

But I'm left wondering what I should do now to get OpenWrt on Kernel2?

I think uboot-envtools showed up after sysupgrade but prior to that I just saw command not found.

I'm not sure anymore that you should. I imagined this could be useful for some rescue situations, but I've not yet found any way it can be used without having bootloader console access. And then it doesn't make much difference.

I guess the Kernel2 partition would be more useful for a "dual boot" setup, where you switch between OpenWrt and OEM firmware by toggling BootingFlag

1 Like

Makes sense. Thanks for your input here!

Out of curiosity, how do some LTE routers obtain APN information? Is it stored in the SIM card? And do you think it's possible I've not been able to connect to APN yet because of the modem's autoconnect feature you advise to disable with AT commands?

I am going to have a big play with it this afternoon. I had fun sending myself a text yesterday using uqmi.

1 Like

This is often stored in operator specific profiles on the modem, at least for operator branded devices. And usually operator branded router firmwares will also come preconfigured with APN defaults.

For generic routers, there is usually a database of MCC+MNC to APN mappings for most of the world.

There is such a thing for Linux too: https://wiki.gnome.org/Projects/NetworkManager/MobileBroadband/ServiceProviders

But I don't know if we use it in OpenWrt

1 Like

So I've found I can connect and:

uqmi -d /dev/cdc-wdm0 --get-current-settings

Returns sensible values including IP address that look right but it seems my wan device isn't getting an IP.

--get-data-status also returns 'connected'.

I have set my wan in LuCi as device wwan0 and DHCP client.

Any idea what I'm missing?

Update: for anyone reading this just use 'luci-proto-qmi' - it works. You can get this package on your NR7101 using your mobile phone as a hotspot.

1 Like

@bmork If I want to use the Telenor brand, with factory settings, no Telenor settings. What is the best thing to do then? Already have SSH/HTTP access.

"factory settings" depends on context. The Telenor branded NR7101 will always boot with "factory settings". It doesn't store new settings. But the "factory settings" are Telenor specific.

So I assume you want to change firmware to something without the Telenor factory defaults. You could download and install a firmware image from ZyXEL. I haven't tried this so I can't help with that. But if you have shell access then it should be possible either in shell, or in the web GUI after modifying iptables in shell.

1 Like

Why wouldn't you just use OpenWrt though? Having just bought one of these and having replaced OEM with OpenWrt everything seems to work perfectly.

1 Like

So basically everything seems rock solid so far with my Zyxel NR7101 running 22.03. 2. Bandwidth is improved somewhat even when just using this device indoors, and still waiting to use for it to be mounted outdoors.

@bmork any clue whether we can use uqmi or AT commands to see:

  • a) the bandwidth in use on the specific band (e.g. 10MHz or 20MHz), and
  • b) the QAM value (e.g. 256-QAM or 128-QAM)?
1 Like

I don't know these things. It might be coded into the rather unreadable output of


The guys over at the ROOter forum will know more about stuff like this. Or get a copy of the "RG50xQ&RM5xxQ Series AT Commands Manual" or whatever it is titled now. This has been posted on the quetel forums now and then in different versions

OK thanks. For running such commands is the tool 'picocom' the appropriate tool? Might I update the wiki to include mention of 'luci-proto-qmi'? The latter just worked with next to no messing around.

1 Like

Definitive a good thing if you update the wiki with your experiences. Mine are limited.

I'm using picocom, or the --command option with mmcli when running ModemManager.


@bmork my 4G ISP does something at exactly a 48 hour interval that unless properly handled results in blocked internet connectivity - this has occurred with various devices in the past.

And indeed after exactly 48 hours with my NR7101 I saw:

root@OpenWrt:~# uqmi -d /dev/cdc-wdm0 --get-data-status
root@OpenWrt:~# uqmi -d /dev/cdc-wdm0 --get-current-settings
"Out of call"

More details here.

I wonder if you know what is happening exactly here from a 4G perspective?

In any case, am I correct in understanding that on such a 'stale connection', resulting in this disconnect, the modem as configured using 'uqmi' will not automatically reconnect and some external means is needed to:

  • a) detect the disconnection; and
  • b) act upon this by reconnecting.

.. and if so, is this what ModemManager does? I had been really wondering about the difference between using only 'uqmi' and 'ModemManager' given the existence of both 'luci-pro-qmi' and 'luci-proto-modemmanager'.

There's nothing 4G/5G/3G specific here AFAIK. This is probably an attempt to get rid of stale sessions by forcibly disconnecting everything, assuming that any live session is immediately reconnected. Personally I don't think that's a very nice thing to do, but I guess it could be necessary to save shared and limited resources like addresses.


Most modem firmwares can also be configured to auto-connect, but I don't think that's a good idea. The address will change, so there is no way you can avoid getting the OS (OpenWrt) involved. And then it's much better if OpenWrt is in control by managing the connection.

I wish could answer a definiive yes to that. But I'm not 100% sure it does, since I never ever test it. I don't have such periodic disconnects. I have had some USB controller issues in the past where re-connecting ddin't work as expected, but that's really something different. And it might also be fixed. Haven't seen those errors in a long time.

I tried looking in my logs for disconnects, but all I could find were triggered by me. Either rebooting or doing restarting networking or similar.

In any case, I personally prefer ModemManager because

  • I'm used to it from my laptop,
  • it handles all those magic multiplexing netdevs,
  • it knows how to deal with most modem and operator weirdness, and
  • I belive we need some daemon handling modem notifications etc
1 Like

Clear and comprehensive. Thank you so much for this! Will give ModemManager a shot.

On my ISP (Vodafone UK), I've also caught them out selectively applying 10Mbit/s throttling on ports 80 and 443 (circumventable with a VPN).

Sadly the UK regulator Ofcom appears to be too weak and lazy to stand up to the UK mobile networks (EE, O2, Vodafone and Three) and, looking at its annual report, the way it handles the net neutrality provisions imported from EU law seems a little pathetic.

For example, it acknowledged that 'a mobile network' (which is obviously O2) stipulates in its 'Fair Usage Policy' that mobile SIMs are not to be used in a fixed router and that in respect of this it is 'monitoring the situation' (meaning doing nothing).

See here:

That was December 2021 and O2 still have the same Fair Usage Policy now in October 2022:

@bmork following my rant above a further thought struck me: how about "--set-autoconnect"? Shouldn't that automatically reconnect? Is that a command issued to the modem that would need to be issued every reboot of the router?

That's what I mentioned earlier. It will work, and I believe it also is persistent in the modem firmware so it will probably work over a reboot.

But OpenWrt won't know the address changed until it polls the modem, e.g doing a DHCP renew.. And you'll effectively be down from the reconnect event till the netdev is updated. It doesn't help that the modem has reconnected as long as you are using the old address.

I don't see that as a feature. Better catch the disconnect and do the reconnect yourself. Then you can update the interface with the new address immediately, and have an absolute minimum downtime.

1 Like