OpenWRT as transparent firewall on a NanoPi R5S

Really nothing creatibe there in instructions

If you want to resize rootfs set its size to 1024 in attendedsysupgrade/owut conf file.

I think I've bricked my NanoPi R5S trying to get this working. So I need someone who knows their way around the NanoPi R5S. I'm trying to flash FriendlyWRT to the eMMC using the image "rk3568-eflasher-friendlywrt-24.10-20251222.img.gz". The red LED blinks at about 1 Hz, and the three green LEDs are constantly lit when I have the SD card with the image inserted. This doesn't change.

Pretty sure they're quite unbrickable, unless you throw it against a wall or run it over with your car.

Can you please help me to get it running again (tomorrow)?

Hook up serial or HDMI, see what it's up to while (not) booting.

The HDMI output shows nothing. When I boot from the SD card with the image rk3568-eflasher-friendlywrt-24.10-20251222.img, the LED initially blinks twice quickly, pauses, and so on. Then it blinks very quickly for a while. After that, it blinks at approximately 1 Hz, and the three green LEDs remain lit. If I connect a LAN cable, the LED on the LAN port lights up, but the NanoPi is unreachable.

If I then remove the SD card and boot, the LED initially blinks twice quickly, pauses, and so on, but nothing happens.

Serial it is then ...

It is alive again... I need to use the 2nd LAN-Port now. The blinking seems not to have any meaning. :slight_smile: :slight_smile: :slight_smile:

But now I have FriendlyWRT running on it. Should I use this or should I try to get OpenWRT running on it? If OpenWRT how to get it in the eMMC?

Uncompress the OpenWrt sysupgrade and write it to a micro SD card or
internal eMMC using dd.

The R5S needs the Mask button held in to boot from SD if there is aready a bootable OS on the eMMC, I believe.

4 seconds should do it, until the red LED blinks faster

To upgrade FriendlyWRT to vanilla OpenWrt, you can do this from the FriendlyWRT LuCI interface.

1 Like

Hello everyone,

It was a bit tricky to bring the device back to life. I started it using the Maskrom button on my Windows PC. (Important: You have to use the USB port directly above the button.) You have to hold the button down while connecting the NanoPi to power, and then keep holding the button until, for example, Windows recognizes the USB device (don't forget to install DriverAssitant_v5.0.zip beforehand). Then I flashed the MiniLoaderAll.bin image onto the NanoPi using the rkdeveloptool-windows-main.zip tool. After that, I took an SD card and flashed the openwrt-25.12.0-rc5-rockchip-armv8-friendlyarm_nanopi-r5s-squashfs-sysupgrade.img image onto it using balenaEtcher. Then I disconnected the NanoPi from power, inserted the SD card, and reconnected it to power. It takes a while, during which the red LED blinks in various patterns. When all three green LEDs are lit and the red LED is blinking at approximately 1 Hz, the process is complete. Disconnect the NanoPi from power and remove the SD card. Connect the LAN cable to LAN1 (use this exact port) and connect it directly to a PC. Then reconnect the power. After the subsequent boot process, the NanoPi was accessible again at 192.168.2.1.

Now back to the next steps. In the web GUI, I see an option called eMMC Tools, where I can upload an image. Is that the option you mean, @hedzwillroll? Can I simply upload an OpenWRT image there (e.g., openwrt-25.12.0-rc5-rockchip-armv8-friendlyarm_nanopi-r5s-squashfs-sysupgrade.img.gz)? Is it better to upload the *.gz file or the extracted *.img file? According to the instructions, both work. I'm just wondering why the FriendlyWRT image is about 200 MB, but the OpenWRT image is only about 9 MB. Is that possible?

Thanks!

Regards,
Mic.

Because it is not compressed, base system is like those 9MB and the rest is just empty disk partition.

Are you sure it’s an R5S? I don’t have a USB port above the Mask button.

I’m fairly sure you can just flash a downloaded sysupgrade image without having to uncompress it, but I guess it wouldn’t hurt to uncompress it. As you’re now familiar with FriendlyElec’s recovery process, you should be able to recover anyway. Just remember to clear all settings when flashing OpenWrt.

You can also flash a vanilla OpenWrt image to the eMMC using the rkdeveloptool I seem to remember (sorry it’s been a while). Think you need an ekflasher image from FriendlyElec and then drop the OpenWrt image on the same card and edit the coifig file on the SD to point to the OpenWrt image. Instructions are on their wiki for that.
I like the device and it’s been stable for me, powered by a PoE splitter from my PoE switch.
It’s a shame they didn’t include an SPI chip and therefore I can’t boot from the NVME drive in the PCIe port.

By the way, do you have video output?

To add to what brada4 said, some of the FriendlyWRT images also have extras like Docker

I would say yes, it is a NanoPi R5S. I bought it like this and also the images for R5S did work. Maybe there are different versions of it. The pictures I found in the Internet also don't have this button but I opened the housing and saw "mask rom" written close by the button. See my red arrow on this photo:

This is the button I pressed and the USB3 port above was able to connect to my Windows 11 PC.

I was finally able to flash the OpenWRT 25.12-rc5 image onto the eMMC using FriendlyWRT's web interface, and it's working now. There's one small catch to be aware of: the default IP address changes from 192.168.2.1 to 192.168.1.1.

One thing is a shame about OpenWRT for the R5S: the eMMC Tools option has disappeared from the web interface. Perhaps the OpenWRT developers could include it from FriendlyWRT. That would be great.

Thanks for your help so far.

Oh OK, my R5S has the Mask button on the side round from the HDMI port. Apparently there are some R5S’ that have an SPI chip, perhaps they are different physically too? Does yours have SPI do you know?

OpenWrt’s default IP address is 192.168.1.1
I guess FriendlyElec decided on 192.168.2.1 for some reason.

Not sure why you would needeMMC Tools now? As you’re booting OpenWrt from eMMC, any upgrade you do will just work. Do you mean if you wanted to flash something else? You can use an ekflasher image for that.

EDIT: a little bit of Googling later, it appears your variant is the R5S-LTS and they have moved the mask button where yours is. Gemini thinks the only other real difference is a newer U-boot and kernel.

Yes, it could be the LTS version. That's probably the last version, since you can already buy the NanoPi R6S (which seems too expensive, too power-hungry, and also overkill for my needs).

I installed the OpenWRT image using a file via the eMMC Tools in FriendlyWRT. How would I install a newer version using such a file? Or how would an update to the next release candidate or even the final release of OpenWRT 25.12 work?

I've now disabled routing and DHCP in OpenWRT, so it simply always gets the same IP address from my Fritz!Box as soon as I connect to it.

1 Like

The best ways are ASU and owut.

There is an option in the menu in LuCI called Attended Sysupgrade. This will allow you to upgrade OpenWrt when new versions are released. This option also allows you to preserve your settings when upgrading

Hi. Thank you for this information. I was not aware I will be able to update to a new RC of my currently installed OpenWRT 25.12-rc5 just by using the update option in LuCI. This means, when a 25.12-rc6 is avaliable for my device it will be offered in this menu (or in case the final release is out). This is good news...
Regards
Mic.