OpenWrt support for Xiaomi AX3000T

For Developers
3737

I had a similar problem. The Wi-Fi speed was asymmetric. The link speed of one of the Ethernet interfaces affected the download speed on the bridge where the Wi-Fi was connected (sometimes it was 10/100/1000 Mbps). This issue is described here as a problem with DSA. I solved it by disconnecting the problematic Ethernet interface from DSA and adding it to the software bridge.

3738

Hey guys these are my spec:

Model	Xiaomi Mi Router AX3000T (OpenWrt U-Boot layout)
Architecture	ARMv8 Processor rev 4
Target Platform	mediatek/filogic
Firmware Version	OpenWrt 23.05.5 r24106-10cc5fcd00 / LuCI openwrt-23.05 branch git-24.264.56413-c7a3562
Kernel Version	5.15.167

just before i had tried to update to release 24.10. I made a backup of the config and proceed with the update with the file “openwrt-24.10.2-mediatek-filogic-xiaomi_mi-router-ax3000t-ubootmod-squashfs-sysupgrade.itb” after about 5 minutes waiting with no response, I tried to reload the page and I got the answer ERR_CONNECTION_REFUSED. I tried to access it through SSH and I got something like Connection wasn’t established because the destination actively refused it.

Looks like the router still have the configs because one of my settings for this router is to keep the lights off, and every time i try to reboot it, it blinks orange, then shows the blue light for a very short time and then switch it off.

An Update: I tried to make a factory reset, and it worked. I could access the router, but when I tried to restore the backup, I got the same problem. I didn’t want to setup everything manually again.

Another update: I went back to release 23.05. After restore the backup, I got the same problems. May be some problem on the backup file? Is there any problem If I share the backup file here to be checked?

Any Help?

3739

If you installed recovery kernel system will boot to recovery kernel, if not it will get to failsafe mode, either way it will be 192.168.1.1 with ssh

3740

No.. it’s not 192.168.1.1, unless I make the facttory reset. But, if I restore the backup, those problems happens and it’s 192.168.1.2, not 192.168.1.1, but I can’t access.

3741

Somebody has any idea why the router is being locked when I restore the backup?

Thanks.

3742

Probably some issue with your old configuration. Maybe you need to reconfigure it from scratch and generate a new (and valid) backup.

1 Like
3743

RD23: new stock firmware version 1.0.97

RD03: new stock firmware version 1.0.98

Request/Response logs 
Request URL for RD23:
http://eu.api.miwifi.com/rs/grayupgrade/recovery?countryCode=EU&deviceID=&rom=1.0.90&hardware=RD23&cfe=&linux=0.0.1&ramfs=0.0.1&sqafs=0.0.1&rootfs=0.0.1&channel=release&locale=en_US&serialNumber=554xxF4NV0xxx0&s=c97bd6b8627ca0298f9c1615d101b405&time=2025-08-29--15:48:07&token=8007236f-a2d6-4847-ac83-c49395ad6d65
Status code: 200

Response: {"code":"0","data":{"needUpgrade":true,"size":25627916,"buildTime":1747292344223,"changelogUrl":"https://cdn.azams0.fds.api.mi-img.com/miwifi/6b72187e-4510-4494-a90e-83666799d337.html","toVersionName":"1.0.97","link":"https://cdn.cnbj1.fds.api.mi-img.com/xiaoqiang/rom/rd23/miwifi_rd23_all_cea07_1.0.97_INT.bin","description":"","weight":"1","otherParam":"{\"cfe\":1000002,\"buildTime\":\"1747292344223\",\"linux\":1,\"rootfs\":1,\"weight\":1,\"sqafs\":1,\"ramfs\":1}","upgradeId":"15341","hash":"c552a5864922a684c0d40032451cea07","toVersion":"1.0.97"}}

Request URL for RD03:
http://api.miwifi.com/rs/grayupgrade/recovery?deviceID=&rom=1.0.90&hardware=RD03&cfe=&linux=0.0.1&ramfs=0.0.1&sqafs=0.0.1&rootfs=0.0.1&channel=release&locale=en_US&serialNumber=554xxF4NV0xxx0&s=838bd1a3b9f87e40aae59c4454109ca2&time=2025-08-29--16:00:56&token=8007236f-a2d6-4847-ac83-c49395ad6d65
Status code: 200

Response: {"code":"0","data":{"needUpgrade":true,"size":23725064,"buildTime":1756110356099,"changelogUrl":"https://cdn.cnbj1.fds.api.mi-img.com/miwifi/ca5cb4be-3f34-40ce-b05c-dfa0dd61a993.html","toVersionName":"1.0.98","link":"http://cdn.cnbj1.fds.api.mi-img.com/xiaoqiang/rom/rd03/miwifi_rd03_firmware_48abd_1.0.98.bin","description":"","weight":"1","otherParam":"{\"cfe\":1000002,\"buildTime\":\"1756110356099\",\"linux\":1,\"rootfs\":1,\"weight\":1,\"sqafs\":1,\"ramfs\":1}","upgradeId":"114957","hash":"3e41c586ccaf5eb43e9eb8ffcf048abd","toVersion":"1.0.98"}}
3744

Does it mean that both stock uboot and openwrt uboot snapshot images are considered safe to flash nowadays?

But when next stable 24.10.3 is eventually released only stock uboot would be safe?

Sorry if it's a too obvious question.

3745

It is like 2 different devices - one with OpenWrt uboot, other with factory uboot.

3746

If you have Foresee NAND, then yes, both Snapshot versions (for stock and openwrt uboot) should be safe nowadays because the bugfix is included there.

Stock uboot will definitely be safe on 24.10.3 for routers with Foresee NAND.
As for OpenWrt uboot after the 24.10.3 release, it's best to check with the developers just to be sure.

@csharper2005, looking at the warning in the OpenWrt U-Boot Wiki, am I getting this right:

??after the 24.10.3 release, routers with Foresee NAND can be switched to the openwrt uboot bootloader using a mix of:

  • BL2 (preloader.bin) and FIP (uboot.fip) files from Snapshot OpenWrt uboot version.
  • other files (*.initramfs-factory.ubi, *.recovery.itb (aka Kernel), *.sysupgrade.itb) from the stable 24.10.3 OpenWrt uboot version.

Is this the correct combination?

1 Like
3747

@alexq everything is correct. @dsouza's PR and PR 2 for 24.10 (FORESEE and AN8855 support in u-boot) haven't been merged yet.

1 Like
3748

You might stumble across following problem when trying to flash OpenWrt 24.10.2 on your Xiaomi AX3000T (RD23) router with original firmware 1.0.91 or later:

The suggested way with exploiting a router's vulnerability to gain ssh access didn't work for me anymore. Xiaomi has fixed that vulnerability in their latest firmwares, so it's not possible anymore to prepare the router's ssh access for OpenWrt installation.

There is also no straightforward way to downgrade the original firmware to an older version, because Xiaomi's firmware update policy (and according update routine on the router's GUI) forbids to flash an older firmware version than the one installed.

I used following trick to make it work:
by using the Windows tool "MIWIFIRepairTool.x86" (only available in chinese language, quite hard to use because you literally drive blind when you're not Chinese) which is using TFTP to provide a firmware to the router when it asks for it.
You can use any Xiaomi firmware you want with the tool, so be careful to not brick it.
I chose the first available RD23 firmware 1.0.49 (INT) which is also listed on the AX3000T information page.

The downgrade works this way:

  • Download the AX3000T RD23 firmware 1.0.49 (INT) from the link provided in the AX3000T information page on openwrt.org
  • Install "MIWIFIRepairTool x86" (there are several things to consider like turning off AV and allowing the tool in Windows Firewall to communicate on the network - read more on the Internet about it.)
  • Disconnect the Windows computer from the network, turn off wifi
  • Configure the Windows computer for static IP, choose "192.168.31.100" and subnet mask "255.255.255.0"
  • Power off the AX3000T by pulling the power cable
  • Connect the router on one of the 3 LAN ports (look closer on the backside of the router which one to use) to the computer with the provided network cable
  • Run MIWIFIRepairTool x86, load the firmware 1.0.49 (INT) file so that the tool will provide it to the router once it asks for it
  • Press and hold the reset button on the router with a paper clip or similar item
  • Plug in the power cable to the router and let it start by still holding the reset button
  • After ~ 8 sec the router's status light will start to blink orange with high frequency - this is the right point when to let go the reset button.
  • The MIWIFIRepairTool x86 will show a file transfer to the router
  • After the file transfer has been finalized, the router status led stays either orange without any blinking, or it will start blinking orange, and will start loading and installing the firmware. Be cautious at this stage: Do not power off or disturb the router, to not risk bricking it.
  • the installation can take from just some seconds to some minutes
  • After it's finalized, the router's status led will start blinking blue with high frequency.
  • From what I learned the firmware update is finalized when this blue blinking occurs, but I gave the router just 1-2 more minutes to be on the very safe side
  • Power-cycle the router and you have the old firmware available
  • the rest works like described on the OpenWrt information page (initially setting up the router with original firmware, copying the blok information from the web link, etc pp)

AX3000 Router Overview Page here on openwrt.org:
https://openwrt.org/inbox/toh/xiaomi/ax3000t

Old RD23 firmware which is still vulnerable to the ssh hack:
AX3000T RD23 firmware 1.0.49 (INT)
https://cdn.cnbj1.fds.api.mi-img.com/xiaoqiang/rom/rd23/miwifi_rd23_firmware_153e1_1.0.49_INT.bin

MIWIFIRepairTool:
https://bigota.miwifi.com/xiaoqiang/tools/MIWIFIRepairTool.x86.zip
Be careful with this software, as virus scanner flag it as malware or claim it would contain a virus, even though it's provided directly from one of Xiaomi's web pages miwifi.com.
If you want to be very sure, choose a computer that's not having production or personal data, or which OS you can dispose after the firmware downgrade procedure.

A guide on how to use the MIWIFIRepairTool:
It's for another router, but you'll get the point

1 Like
3749

no need to link externally, it's also posted at the forum - Xiaomi Mi Router 4A Gigabit Edition (R4AG/R4A Gigabit) -- fully supported and flashable with OpenWRTInvasion - #747 by Zorro.

1 Like
3750

thx, didn't see that - link changed accordingly

3751

You don’t need MIWIFIRepairTool. The wiki page has instructions on how to set up TFTP to work with this device.

1 Like
3752

I have a router with the FORESEE NAND chip. I want to install OWRT on it, but as I understand there is a chance some problems may occur with devices with the mentioned nand chip when they flash the owrt. I also understand that fix will be included in the 24.10.3 stable release. Is it recommended to wait for this or should I go with snapshots? Is there any way I can eliminate the risk associated with bad blocks and just flash the 24.10.2 without the fix?

3754

Use Snapshot now, and once 24.10.3 is released, just apply 24.10.3 sysupgrade file to update.

There is no workaround. The result is unpredictable and depends on how lucky you are.
Snapshot is the better option in this case (don't forget to install LuCi, as the Snapshot doesn't include it).

1 Like
3755

Esmt F50L1G41LB 1.0.31 int
Opwrt 24.10.2 I tried to install it, the LED is solid blue, can you help me?
Rd23

​​​Reply

3756

Solid blue should indicate that everything is working fine. If you cannot log in to 192.168.1.1 when the LAN cable is connected to any of the middle ports, press the reset button to reset the router. If that doesn't help, restore the stock firmware and reinstall OpenWrt. The AX3000T is highly reliable, and it's extremely difficult to kill it.

3757

It meets the OOWRT requirement. I don't understand why the blue light is on. I pressed the reset button. It turned orange and then went off. Sobra blue remained on.