Introduction.
Toob and Community Fiber ISPs are installing routers that use the Qualcom IPQ5018 chip. Some of these routers are appearing on sites like ebay. So I bought one with the aim of replacing the stock ISP firmware with OpenWRT firmware.
Why?
Having my own router with OpenWRT reduces the stress when I change my ISP. Only the connection to the ISP has to be configured. The rest of my home network remains the same. I don’t have to learn a new user interface, and no-one else is updating and rebooting my system at random times in the middle of the night.
This guide documents a way to install OpenWrt on the Linksys SPNMX5600TB (the Toob variant of SPNMX56 or MX56 or SPNMX56TB). I’m using Ubuntu terminals, picocom, and tftpd-hpa. Other OSs and utilities are of course available…
The guide assumes that you’ve used OpenWRT and that you are fairly comfortable with using a Linux terminal. If you’re a noob then this journey will involve some learning. Be kind to yourself.
Currently (April 2026) the device is only supported by OpenWRT’s Development / Snapshot builds. It is in the nature of snapshot builds that exact filenames will change, but there are clues that will enable you to identify the file that you need.
ISPs have blocked the ‘easy’ Linksys upgrade paths. The tftp route still seems to be open to us.
Process
- download the utilities and the OpenWRT files that we’ll be needing (Requires a PC / laptop with an internet connection)
- remove the case to access the router (Requires a small phillips screwdriver and a thin prizing tool)
- Set up an Ethernet and a serial connection between a PC/laptop and the router (Requires an Ethernet cable and a UART to USB adapter)
- install a RAM-only version of OpenWrt
- (optionally) make a backup of the ISP firmware
- flash OpenWRT firmware to permanent memory
- connect to your ISP and add user-friendly features
- (optionally) remove all of the ISP firmware
- reassemble the router into its case
- If anything goes wrong during the process then simply return to step 4
Download the utilities and OpenWRT files
PC utility – Picocom
We need a utility to communicate with the router over the serial connector. I used Picocom.
Open a terminal window (Ctrl+Alt+T)
$ sudo apt update
$ sudo apt install picocom
To use Picocom and access the serial port you’ll need to add yourself to the “dialout” user-group.
$ sudo adduser $USER dialout
Logout and log back in. Check that you were successful.
$ groups $USER
PC utility - tftpd-hpa
We’ll install a RAM-only version of OpenWRT using tftp. More tftp information here: https://linuxvox.com/blog/linux-tftp-server-ubuntu/
$ sudo apt install -y tftpd-hpa
$ sudo systemctl start tftpd-hpa
$ sudo service tftpd-hpa status
OpenWRT files.
Download from OpenWrt snapshots https://downloads.openwrt.org/snapshots/targets/qualcommax/ipq50xx/
We need two files. One is a version of OpenWRT that can be initially loaded into the router’s RAM and the other is a permanent version of OpenWRT.
Both file names are most likely to include ‘spnmx56’, ‘ipq50xx’, or ‘linksys’. The first will almost certainly include 'initramfs’ and be a '.itb' filetype. The second will almost certainly include ‘sysupgrade’ and be a '.bin' filetype. Download
<initramfs>.itb
and
<sysupgrade>.bin
I left the <sysupgrade>.bin file in my Downloads folder and copied the <initramfs>.itb (RAM-only) to /srv/tftp. You’ll need administrator privileges to write to the /srv folder:
$ nautilus admin:/
or
$ sudo cp <initramfs>.itb /srv/tftp/
Remove the case to access the router
Disconnect all cables
Prize off the top. Use a broad thin blade to avoid damaging the plastic.
image|545x500
(Image refused)
Underneath I found and removed a phillips screw
The bottom was held by 4 more phillips screws hiding under the rubber
image|412x500
(Image refused)
With the top and bottom removed, the router can be pressed out of the case (mine needed a bit of a shove).
You might discover that your case is assembled in a different way. Here is a video of a similar case being destroyed: https://www.youtube.com/watch?v=JELVEofJwBg
Set up an Ethernet and a serial connection between a PC/laptop and the router
Connect an Ethernet cable between the PC and one of the Ethernet sockets on the router (do not use the internet socket).
Locate the serial pins on the router and connect the USB-UART adapter
Only the Ground (GND) pin is labeled. The next pin isn’t used, the next two are Receive (Rx) and Transmit (Tx). Do not use the last pin. At the USB-UART adapter, connect GND to GND, Rx to Tx and Tx to Rx. ** Image and Pin information stolen from georgem83 **
Navigate to your Downloads folder, right-click, and select ‘Open in terminal’.
Find out where Ubuntu has attached the USB serial adapter. It will probably be attached to ttyUSB0.
$ dmesg | grep tty
[0.000000] console [tty0] enabled
[27.438164] usb 6-1: ch341-uart converter now attached to ttyUSB0
Start Picocom and link it with the USB-UART adapter
$ sudo picocom -b 115200 /dev/ttyUSB0
Hopefully there will be some blah blah ending with,
Terminal ready
Plug in the router’s power supply.
The boot log will start to scroll past in the terminal window. Hit any key to stop the boot and you’ll arrive at a prompt from the router
IPQ5018#
From now on commands entered at this terminal window will be actioned by the router not by the PC
If you miss the opportunity to stop the boot, then power the router off-on and try again.
Use tftp to install a RAM-only version of OpenWrt
Check the default IP addresses of the router, and of the tftp server (ie. the PC)
# printenv
...
ipaddr=192.168.1.1
...
serverip=192.168.1.254
Make sure that there are no other devices on the network that share these IPs. Set the IP address of the PC side of the Ethernet cable to 192.168.1.254.
Use tftp to load the RAM-only version of OpenWRT
# tftp $loadaddr <initramfs>.itb
Watch with satisfaction as the progress gets measured with hash characters that fill the terminal window. When done, boot into OpenWRT
# bootm $loadaddr
Arrive at the OpenWRT command prompt:
root@OpenWrt:~#
Make a backup of the ISP stock Firmware
I forgot to do this and anyway I have no desire to keep the ISP firmware. However, should you wish to be able to return the router to its original configuration:
Make a copy of the active boot partition
# sysupgrade -b /tmp/backup.tar.gz
Open a new terminal on the PC and copy the backup from the router to the PC
$ scp root@192.168.1.1:/tmp/backup.tar.gz . (that 'dot' at the end signifies something - go figure!)
Flash OpenWRT firmware to permanent memory
Open a new terminal window on the PC and copy the <sysupgrade>.bin file from the PC to the router
$ scp <sysupgrade>.bin root@192.168.1.1:/tmp/
Go back to the terminal window that has the OpenWrt prompt and upgrade OpenWRT
# sysupgrade -n /tmp/<sysupgrade>.bin
<initramfs> will do whatever is required to tailor OpenWRT to the router’s partitions, bootloader, etc. When it has finished, the router will reboot with the newly installed firmware.
Connect to your ISP and add user-friendly features
Plug in the internet cable. If your ISP expects access credentials, then open a terminal, ssh into the router, and use UCI to set up the WAN parameters required by your ISP (the default settings worked for me, so I skipped this step). Reboot and, fingers crossed, your PC now has access to the web.
Almost there! Two more steps: one to make the router a little more user-friendly, and another to stop the router reverting back to the ISP firmware.
The Development / snapshot versions of OpenWRT are rather minimal. If we want a router with a familiar user interface then we need to enable wifi and install LuCI.
Open a terminal and ssh back into the router
$ ssh root@192.168.1
- Enable WiFi:
# uci set wireless.radio0.disabled='0'
# uci set wireless.radio1.disabled='0'
# uci set wireless.default_radio0.disabled='0'
# uci set wireless.default_radio1.disabled='0'
# uci commit wireless
# wifi reload
The wifi SSID “OpenWRT” should now be visible.
- Install LuCI:
# apk update
# apk add luci
# /etc/init.d/uhttpd restart
Access LuCI via a browser and configure your network, passwords, etc
http://192.168.1.1/cgi-bin/luci
NB: Use the full URL in the address bar. The Development firmware might not redirect / to LuCI.
Remove all of the ISP firmware
The router has two firmware partitions. One active and the other inactive. The router boots using the firmware on the active partition. If the boot fails for any reason (including three consecutive power failures during the boot process) then the router automatically switches to the other (inactive) boot partition and makes it the active partition.
New firmware is automatically installed on the inactive partition. That partition is made the active partition and the the router reboots using the new firmware. If the new firmware fails, the router automatically ‘rolls back’ to the earlier working firmware on the other partition and (ideally) overwrites the faulty firware with a copy of the working firmware.
All of which is a long-winded way of saying that at this stage the router still has a boot partition with an ISPs firmware lurking on it. I replaced the ISP firmware using LuCI to flash the .bin image for a second time.
LuCI preserves the configuration settings, but apk’s (ie. LuCI) have to be re-installed.
Reassemble the router into its case
Reassembly is the reverse of the removal. Take care with the base and the on-off switch. I found it easiest to fit the base onto the router before sliding the router completely into the case. Again the router needed a shove to persuade it to seat properly.