QMI-expert needed for TP-Link MR6400v5

Dear QMI-experts,

I need some advice for my TP-Link MR6400v5 router.

I successfully used the internal LTE-modem with the original TP-Link firmware. My provider offers two APNs. A regular one, that uses WAN.adress from 10.x.y.z and onother one for testing purposes that uses public IP-addresses from 30.x.y.z. With the TP-Link firmware I was able to use DynDNS and reach the router from the internet via LTE.

I installed latest OpenWRT 21.02.0 and added "-t 1000" to two invocations of uqmi in line 84 and line 97 of qmi.sh. This avoids the initial hang of uqmi.

Here's some output:

root@OpenWrt:~# ifconfig wwan0
wwan0     Link encap:UNSPEC  HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00
          inet addr:10.29.148.85  P-t-P:10.29.148.85  Mask:255.255.255.252
          inet6 addr: fe80::f32f:9bb:2150:92a5/64 Scope:Link
          UP POINTOPOINT RUNNING NOARP MULTICAST  MTU:1500  Metric:1
          RX packets:11 errors:0 dropped:0 overruns:0 frame:0
          TX packets:241 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000
          RX bytes:396 (396.0 B)  TX bytes:17890 (17.4 KiB)
root@OpenWrt:~# route
Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
default         10.29.148.86    0.0.0.0         UG    0      0        0 wwan0
10.29.148.84    *               255.255.255.252 U     0      0        0 wwan0
192.168.1.0     *               255.255.255.0   U     0      0        0 br-lan
192.168.2.0     *               255.255.255.0   U     0      0        0 eth0.2
root@OpenWrt:~# ping 10.29.148.86
PING 10.29.148.86 (10.29.148.86): 56 data bytes
^C
--- 10.29.148.86 ping statistics ---
13 packets transmitted, 0 packets received, 100% packet loss
root@OpenWrt:~# uqmi -d /dev/cdc-wdm0 --get-data-status
"connected"
root@OpenWrt:~# uqmi -d /dev/cdc-wdm0 --get-signal-info
{
        "type": "lte",
        "rssi": -88,
        "rsrq": -9,
        "rsrp": -110,
        "snr": 142
}
root@OpenWrt:~# uqmi -d /dev/cdc-wdm0 --wda-get-data-format
"raw-ip"

And here's the relevant part of /etc/config/network:

config interface 'LTE'
        option proto 'qmi'
        option device '/dev/cdc-wdm0'
        option apn 'internet.t-d1.de'
        option pincode '****'
        option dhcp '0'
        option auth 'both'
        option pdptype 'ipv4'
        option username 't-mobile'
        option password 'tm'

Everything seems to be fine. wwan0-Interface got 10.29.148.85/30 address. Default route points to
10.29.148.86. Point-to-Point address of wwan0 is 10.29.148.85 but from what I read about point-to-point interfaces it's no problem if IP-address and point-to-point address are identical. It just confused me a little.

Pinging 10.29.148.86 or any other IP-address will raise the TX-counter of wwan0 but the ping-packets do not reach their destinations (I checked that by pinging a machine with public IP-address and observing incoming ICMP-packets with tcpdump on that machine).

Is there anything I can do to debug this problem? dmesg shows nothing of interest. Maybe some kernel-parameters might increase qmi-debugging?

Does anybody out there has sucessfully used the LTE-modem of a MR6400v5?

Kind regards

Peter