Xiaomi Mi Router 4A 100M Edition (R4AC) - OpenWrt Installation and Access Point Configuration Guide
This guide documents the complete process used to install OpenWrt on a Xiaomi Mi Router 4A 100M Edition (R4AC) and configure it as an Access Point behind an ISP router.
I Worked out in my home, with a laptop and ethernet cable.
Hardware Used
Model:
Xiaomi Mi Router 4A 100M Edition (R4AC)
OpenWrt firmware used:
https://downloads.openwrt.org/releases/23.05.5/targets/ramips/mt76x8/openwrt-23.05.5-ramips-mt76x8-xiaomi_mi-router-4a-100m-squashfs-sysupgrade.bin
Important: Always verify your router model before downloading firmware. Different Xiaomi 4A variants require different firmware images.
Part 1 - Installing OpenWrt
Requirements
On a Linux machine install:
- Git
- Python 3
- GitHub CLI (optional)
Step 1 - Clone OpenWRTInvasion
Using GitHub CLI:
gh repo clone acecilia/OpenWRTInvasion
Or using Git:
git clone https://github.com/acecilia/OpenWRTInvasion.git
Enter the project directory:
cd OpenWRTInvasion
Step 2 - Download the OpenWrt Firmware
Download the firmware image corresponding to the R4AC model:
https://downloads.openwrt.org/releases/23.05.5/targets/ramips/mt76x8/openwrt-23.05.5-ramips-mt76x8-xiaomi_mi-router-4a-100m-squashfs-sysupgrade.bin
Store the file in a local directory.
For example:
mkdir ~/firmware
Copy the downloaded firmware into that folder.
Step 3 - Start a Local HTTP Server
Open a terminal inside the firmware directory:
cd ~/firmware
python3 -m http.server 8000
Keep this terminal open.
The firmware will now be available at:
http://YOUR_PC_IP:8000/
Example:
http://192.168.31.100:8000/
Step 4 - Run OpenWRTInvasion
Open a second terminal:
cd OpenWRTInvasion
Run:
python3 remote_command_execution_vulnerability.py
Follow the prompts.
When asked for the firmware URL, provide the URL from your local HTTP server.
Example:
http://192.168.31.100:8000/openwrt-23.05.5-ramips-mt76x8-xiaomi_mi-router-4a-100m-squashfs-sysupgrade.bin
Replace the IP address with your PC's actual address.
Step 5 - Wait for Installation
The script will:
- Gain access to the Xiaomi firmware.
- Download the OpenWrt image from your local server.
- Flash the firmware.
- Reboot the router automatically.
Do not disconnect power during this process.
The first boot may take several minutes.
Step 6 - Connect to OpenWrt
After reboot:
ssh root@192.168.1.1
Step 7 - Set a Root Password
passwd
Assign a password for the root user.
This will also enable web access through LuCI.
Step 8 - Access LuCI
Open:
http://192.168.1.1
Login with:
Username: root
Password: <the password you just configured>
Step 9 - Configure Wi-Fi
Navigate to:
Network → Wireless
Configure:
SSID: MyRouterName
Security: WPA2-PSK
Password: ********
Save and apply changes.
Result of Part 1
At this point OpenWrt operates as a standalone router.
Internet
│
▼
OpenWrt
│
┌──┴──┐
LAN Wi-Fi
Features:
- DHCP enabled
- NAT enabled
- Firewall enabled
- OpenWrt fully manages the network
Part 2 - Configuring OpenWrt as an Access Point
This section is optional.
Use it if you already have an ISP router and want OpenWrt to extend wireless coverage.
Objective
Keep the ISP router responsible for:
- Gateway
- DHCP
- NAT
- Firewall
Use OpenWrt only as:
- Access Point
- Ethernet Switch
Final Topology
Internet
│
▼
Main Router
│
├── Clients
│
└── LAN
│
▼
OpenWrt
│
├── Wi-Fi
└── LAN
Step 1 - Configure a Static IP Address
Navigate to:
Network → Interfaces → LAN
Configure:
IPv4 Address: 192.168.1.2
Netmask: 255.255.255.0
Gateway: 192.168.1.1
DNS: 192.168.1.1
Save and apply.
Example Addressing Used in This Guide
Main Router: 192.168.1.1
OpenWrt: 192.168.1.2
Step 2 - Disable DHCP
Navigate to:
Network → Interfaces → LAN → DHCP Server
Enable:
Ignore Interface
From this point forward, the main router becomes the only DHCP server.
Step 3 - Keep Everything in the Same Subnet
OpenWrt must remain in the same subnet as the main router.
Example:
Main Router: 192.168.1.1/24
OpenWrt: 192.168.1.2/24
All devices should receive IP addresses from the same network.
Step 4 - Connect LAN to LAN
Correct configuration:
Main Router (LAN)
│
▼
OpenWrt (LAN)
Do NOT connect:
Main Router (LAN)
│
▼
OpenWrt (WAN)
when using OpenWrt as an Access Point.
Step 5 - Configure Wi-Fi for Roaming
Configure exactly the same:
- SSID
- Password
- Security mode
Example:
SSID: MyRouterName
Security: WPA2-PSK
Password: ********
on both devices.
Note
Client devices (iPhone, Android, Windows, macOS, Linux, etc.) decide when to roam between access points.
Using the same SSID, password, and security settings enables roaming.
Enabling 802.11r significantly reduces transition time between compatible access points.
Step 6 - Use Different Channels
Example:
Main Router:
Channel 1
OpenWrt:
Channel 6
or
Channel 11
Avoid using the same channel to reduce interference.
Step 7 - Enable 802.11r Fast Roaming
Navigate to:
Network → Wireless → Edit
Enable:
802.11r Fast Transition
Configuration used:
Mobility Domain: a1b2
FT Mode: Over the Air
Generate PMK Locally: Enabled
Save and apply.
Tested Final Configuration
Hardware:
Xiaomi Mi Router 4A 100M Edition (R4AC)
Software:
OpenWrt 23.05.5
Operating Mode:
Access Point (AP)
Example Addressing:
Main Router: 192.168.1.1
OpenWrt: 192.168.1.2
DHCP:
Disabled on OpenWrt
Enabled on Main Router
Connection:
LAN ↔ LAN
Wi-Fi:
Same SSID
Same Password
WPA2-PSK
Different Channels
802.11r Enabled
Final Result
- Single local network
- No double NAT
- No DHCP conflicts
- Extended Wi-Fi coverage
- Easy administration through LuCI
- Functional roaming between access points
- Ready for future enhancements such as 802.11k/v, DAWN, or usteer
After several rounds of testing and troubleshooting, this proved to be the simplest and most stable configuration for reusing a Xiaomi Mi Router 4A 100M Edition (R4AC) as an OpenWrt-based Access Point behind an existing ISP router.
Available to answer questions, even though I'm not an expert.