Revert to Default Firmware - Zyxel GS1900-24E

Installing and Using OpenWrt
1

Hi. I installed OpenWrt on my Zyxel GS1900-24E switch today out of curiosity. I am out of my technical depth and can't get the GUI to work, unless I change the IP address of my router.

In short I would really like to get the switch back to the factory firmware. I've seen a few references to it, but are there any fairly easy instructions on how to safely do this please?

Kind regards

2

Before you do, what's the IP of your router, and what do you change it to ?

3

Thank you so much for the reply! My router IP is 192.168.1.1. OpenWrt seems to want to force my switch to use that. I tried disabling DHCP on the LAN interface in OpenWrt and setting a static IP, but it doesn't seem to have worked.

4

Do step 1 and 3 from https://openwrt.org/docs/guide-user/network/wifi/wifiextenders/bridgedap#method_1configuration_via_editing_config_files, and your Openwrt problem should be solved.

5

Thanks. I cannot seem to access the switch with OpenWrt now. I set a static IP to .221 but when I use that to access the GUI, I just get an arrow on the browser page then it times out. Apologies for being such a noddy!

Is there a way I can revert the switch to the default firmware at all? I'm rather out of my depth I'm afraid.

6
7

Thanks. I have tried a factory reset (holding button for more 10 seconds) but nothing happens. If i then turn off and on again, it restarts still with OpenWrt.

8

Then you'll probably need serial to go back to stock.

9

I don't believe it has a serial port on the device.

10

It does

https://git.openwrt.org/?p=openwrt/openwrt.git;a=commit;h=b515ad10a6e1bd5c5da0ea95366fb19c92a75dea

11

It must be internal as there is no serial port on the outside.

The device is dual boot, with OpenWrt on partition 1. Partition 2 will still have the factory firmware on. I'm seeing if I can somehow get the switch to boot from that, giving me OEM again.

12

With >=24.10.x it no longer is dual-boot (due to growing firmware sizes).

13

Thank you for the reply. Does that mean that OpenWrt will have used both partitions?

I have downloaded a file from the OpenWrt GUI that suggests the OEM firmware is still on:

"bîresetdefault=0 dualfname0=openwrt-24.10.1-gs1900-24e-kernel.bin mac_end=60:31:97:F7:F8:81 mac_start=60:31:97:F7:F8:69 sn=S173C14002197 dualfname1=runtime-GS1900-24Ev2-V2.90(AAHK.1).bix bootpartition=2"

Would you agree that suggests it is still there?

14

Yes.

No.

You have to distinguish between bootloader and its idea of the partitioning, which is -using the OEM (or old OpenWrt, <=23.05.x) firmware- an a/b dual-firmware setup (without automatic failover) - and the actual usage of the running firmware.

OpenWrt barely fits into 6'976 KB anymore (24.10.x technically still does, but barely, future versions won't), so the way out is merging both slots into one (giving you 13'952 KB). The way this works, is configuring the bootloader to use the first firmware slot (a), but from there on the kernel/ rootfs/ overlay goes beyond the limits of its intended slot into the b slot. This is a tad unclean, but works out fine, as there is no automated failover switching by the bootloader - as long as you don't manually reconfigure it to boot from the b-slot (as there isn't anything bootable at the expected location, just random data from rootfs/ overlay).
tl;dr: leave the bootloader alone, don't even think about reconfiguring it for the second-/ b-slot.

15

Thanks for the explanation slh and apologies for my lack of knowledge. So separate bootloaders, but the 'partitions' are both used by OpenWrt.

Would I be correct in assuming on that basis that re-flashing the switch with the original OEM firmware would not be a simple process?

16

It's possible, but not necessarily trivial. At the very least it requires a two step process.

Disclaimer: I do use several gs1900 devices, but I haven't tried reverting the merged-firmware to OEM myself, so the following is academic and untested! Yes, I did test going back and forth before, several times, but under distinctively different circumstances, as I:

  • had serial console access (you really want that, when testing potentially harmful things)
  • had full backups of all partitions from the untouched switch in vanilla OEM state
  • tested this long time ago, before the merged partitions
  • ...and in the worst case, I would have spi-nor flasher, soic-8 clamps and soldering iron at hand, so I could recover 'anything', if push comes to shove

so a quite different starting position.

The below is just an untested high-level overview of what could -probably- be done, serial console access (and flash backups) strongly recommended(!):

  • first you need to revert to the dual-partition scheme, namely <= 23.05.x, by reversing the upgrade information for 23.05.x --> 24.10.x
    • I would do this by tftpbooting the 23.05.x initramfs image via serial console
    • but it would probably also be possible to force-sysupgrade the 23.05.x initramfs image
  • boot into 23.05.x, with its split partitioning scheme, make sure that everything works
  • now you need to fix/ reflash the (now existing again) second b-partition slot with the OEM firmware
    • I would do this by simply rewriting my backups, I took before touching my device
    • if you don't have full backups of everything (all mtds), at least take them now!!!
    • if you don't have a backup, you must check first how to do this (careful checking the OEM firmware structure/ size of how to write it back (mtd?))
  • toggle the boot order and hope for the best...

I strongly recommend to have (and use) a 3.3V(!) usb2serial adapter at hand!
I have never checked the OEM firmware format (if it can be written back by mtd or if changes are required before), because I had my own backups and didn't need to bother about that question. You do want to get a second opinion/ confirmation about the process from someone who has done it this way before. And you want a safety net (serial, spi-nor writer, etc.), don't try to attempt any of this unless you completely understand each step, down to the details and triple check everything - you have one chance and a considerable chance to mess up!

My suggestion would be to first get OpenWrt working as you originally wanted, this is:

  • easier
  • less risky
  • buys you time to investigate the process and get a second opinion
17

Never do any of this, if you

  • aren't 101% sure about each step and dotted all i's and crossed all t's
  • don't have full backups
  • are in a hurry
  • are tired
  • or are otherwise not completely focussed on the task at hand

...and you really want the peace of mind of having serial console access

18

Hi slh. Thank you so much for such a detailed and through set of instructions! That is very kind of you to take the time out to write this. Great warning advice too! I won't rush into it, but this does sound like a (well rested!) Sunday project at some point. The unit I have doesn't have an external serial port, though I believe there is an internal one (some more reading for me to do). I'll take the backups and do some more reading on each of the steps.

Fantastic guidance, thank you again!

19

Fully agree with all of @slh 's points.

But if you do want to take the risk, then I believe reverting is as simple as

  • download and unzip the correct(!) OEM firmware
  • scp the *.bix file to /tmp/
  • sysupgrade -n -F /tmp/*.bix

I haven't tested this... And could very well be wrong. In which case you will need a serial console to fix the resulting brick.

20

The GS1900-24E like most of the Zyxel switches has a populated 4-pin serial connector. It can be seen on the image available at https://svanheule.net/switches/gs1900-24e. Some of the Zyxel switches make this easily available through the vents in the case, but I don't believe this is the case with the GS1900-24E.

1 Like