MF286D - Install and Unlock

you have to open the device, in order to install OpenWrt on it, so any warranty is gone anyway.

And even if the original ZTE-firmware is based on OpenWrt too and it might be quite comfortable for the end-user, but it lacks a lot of functionality.

So I recommend using OpenWrt, test the device for some days with the original firmware, then forget the warranty and install OpenWrt - I think the device was not that expensive, that this should be a real problem.

Current (means 04/2024) installation-procedures, problems etc. are described in the threads I opened.

Kind regards, thg

1 Like

thanks for the link!

Don't have Windows, but it might be good to have it anyway, as 4G-device, the router is a quite nice and cheap hardware.

Kind regards, thg

I have nordic B11, how can I go to B12? I guess that I cannot use the framework to go to openwrt if it is on B11/B12 but only via serial? I think I will keep it to B12 for a while and test.

Technically - you can, but it will downgrade the modem back to B02 and you'll have to update the modem by hand from OpenWrt about 7 times, which is doable but painful.

I recommend going to B12 while still on stock FW and doing the serial port method instead - unless you don't have an access to a 3.3V USB-serial adapter - this one is less involved despite need for disassembly.


First of all, thanks for the extra help via PM, I appreciate it.
I used the Nordic to Nordic Framework + OpenWRT to boot the initramfs with OpenWRT. Upgraded to the latest stable and upgraded the modem to B12:

Revision: BD_TELIAMF286DV1.0.0B12
SVN: 12

I have a strange issue while the cabled WAN interface doesn't seems to work (tried DHCP / Static address but I can't even ping it). Using a WWAN client interface to provide Internet at this time instead.
The 5Ghz WLAN interface doesn't seem to work well with channels over 56 (I am not sure if this expected, but I couldn't see the AP's SSID until I configured it as a client.
I will look for a guide to set up LTE but I wanted to thank you all for the help. I am glad I didn't have to use the serial to reach this point and void the warranty.

Without config I can't really tell anything about the cause, but it seems oddly similar to what recently happened on MR33's. A bug in switch driver or default config?

Or a broken physical interface? I had one of such units where I replaced the penta-PHY chip and had to tinker with the connection between Ethernet transformers and the sockets, because the previous owner plugged a DSL or phone line into that port, frying it together with traces inside the PCB. 'twas fun. So check if the link actually physically establishes by the status LED.

You just stumbled at usual DFS behaviour, AP will scan for weather radars for 1 minute on this channels before actually starting to transmit. Please be sure to set the regulatory domain correctly, too.

I think I posted a simple uqmi setup example recently in another MF286D thread, you can look over there.

1 Like

I was busy with work and I couldn't update earlier but I resolved the WAN mystery (at least for the ZTE).
The cable was connected to the LAN/WAN port of another Openwrt router and that explains a lot.
However, I don't recall that I have changed the port on my Openwrt router recently and I used it to configure a Pi zero just few days ago, so I can't explain it but let's say "user error". All working on a normal LAN port.

It seems to take well over a minute before I can actually see the network on my laptop or phone but it does eventually show up. I am using a DFS channel for testing, I will see if I can use a standard channel where I am going to position it.

LTE is all configured and working, followed this guide here:
and added band, status and sms management from
I will do final tests soon but looks good.

One last question. Using the framework, I didn't have the opportunity to backup the original firmware. Do you know a repository where I can retrieve the Nordic B12 firmware, before I look for one?

Thank you all for the great assistance :slight_smile:

This is only to close the loop on the wireless channels, I tested again the DFS channel 120 and I couldn't understand why I couldn't see it. I haven't noticed the 1 minute delay before for other DFS channels but I certainly didn't know the following:

In Europe, DFS channels 120, 124 and 128 are allowed. However, these channels perform a 10 minute radar scanning before becoming an operating channel

I didn't wait 10 minutes but those will be my last choice now :slight_smile:


Testing the router for over 48 hours now and I see the LTE connection dropping roughly after 4 hours (I will grab the logs, if there is a further event). If I restart the QMI interface, the connection comes back in just few seconds. Could that be the provider cutting down the connection? Or do I need to tweak something on the modem itself? Thanks

Probably the provider...

Probably the provider indeed. If using QMI protocol directly and you have only IPv4, then option autoconnect '1' can probably help - the connection always remains active in the background, because LTE uses that for control plane, too - it is just the modem which drops user session if that restarts.
No idea about an analogue of that option for ModemManager, though.

thanks all, I put in place some cron rules to restart the connection a bit less than 4 hours and that seems to work so far.

I also added autoconnect now, my QMI configuration looks like the following:

	option proto 'qmi'
	option device '/dev/cdc-wdm0'
	option apn ''
	option auth 'none'
	option pdptype 'ipv4'
	option peerdns '0'
	list dns ''
	list dns ''
	list dns_search 'lan'
	option autoconnect '1'