Unifi 6 LR Issues

Could you post your terminal history here? Might be useful. You should obfuscate any sensitive information.

$ ssh -oHostKeyAlgorithms=+ssh-rsa ubnt@<link local ipv6 addr>
ubnt@<link local ipv6 addr>'s password: 

BusyBox v1.25.1 () built-in shell (ash)

  ___ ___      .__________.__
 |   |   |____ |__\_  ____/__|
 |   |   /    \|  ||  __) |  |   (c) 2010-2022
 |   |  |   |  \  ||  \   |  |   Ubiquiti Inc.
 |______|___|  /__||__/   |__|
            |_/                  https://www.ui.com

      Welcome to UniFi U6-LR!

********************************* NOTICE **********************************
* By logging in to, accessing, or using any Ubiquiti product, you are     *
* signifying that you have read our Terms of Service (ToS) and End User   *
* License Agreement (EULA), understand their terms, and agree to be       *
* fully bound to them. The use of SSH (Secure Shell) can potentially      *
* harm Ubiquiti devices and result in lost access to them and their data. *
* By proceeding, you acknowledge that the use of SSH to modify device(s)  *
* outside of their normal operational scope, or in any manner             *
* inconsistent with the ToS or EULA, will permanently and irrevocably     *
* void any applicable warranty.                                           *

U6-LR-BZ.6.0.21# ls /proc/
1                  2561               3031               3420               564                713                919                fs                 modules            stat_interval      version
10                 2562               3054               351                567                729                buddyinfo          gpio               mounts             svs                vmallocinfo
11                 2563               3061               360                584                737                bus                interrupts         mtd                sys                vmstat
12                 2564               3063               361                6                  738                clkdbg             iomem              mtkcooler          sysrq-trigger      wdk
13                 2565               3064               3615               635                7474               cmdline            ioports            mtketh             sysvipc            zoneinfo
1362               2566               3065               3619               640                7495               config.gz          irq                mtktz              thermlmt
1364               264                3066               419                645                7496               consoles           kallsyms           net                thread-self
1556               2663               3067               434                650                7498               cpuinfo            kmsg               nfbypass           timer_list
2                  3                  3068               5                  655                7562               crypto             kpagecount         pagetypeinfo       tty
227                3021               3069               546                660                7588               device-tree        kpageflags         partitions         ubnt_frame_id
229                3023               3071               549                665                7589               devices            loadavg            rtk_gsw            ubnt_peek
230                3024               3072               552                670                8                  diskstats          locks              self               ubnt_rx_task
232                3025               3074               555                675                854                driver             loglevel           slabinfo           ubnthal
234                3027               3075               558                680                865                execdomains        meminfo            softirqs           uid_time_in_state
2560               3028               3130               561                7                  9                  filesystems        misc               stat               uptime
U6-LR-BZ.6.0.21# echo "
U6-LR-BZ.6.0.21# ls /proc/ubnthal
board        status       system.info
U6-LR-BZ.6.0.21# ls /proc/ubnthal/.uf
U6-LR-BZ.6.0.21# cat /proc/ubnthal/.uf
cat: read error: I/O error
U6-LR-BZ.6.0.21# cat /proc/mtd
dev:    size   erasesize  name
mtd0: 00040000 00001000 "Preloader"
mtd1: 00020000 00001000 "ATF"
mtd2: 00060000 00001000 "u-boot"
mtd3: 00010000 00001000 "u-boot-env"
mtd4: 00040000 00001000 "Factory"
mtd5: 00010000 00001000 "EEPROM"
mtd6: 00010000 00001000 "bs"
mtd7: 00100000 00001000 "cfg"
mtd8: 01ee0000 00001000 "kernel0"
mtd9: 01ee0000 00001000 "kernel1"
U6-LR-BZ.6.0.21# echo "5edfacbf" > /proc/ubnthal/.uf
U6-LR-BZ.6.0.21# dd if=/dev/zero bs=1 count=1 of=/dev/mtdblock6
1+0 records in
1+0 records out
U6-LR-BZ.6.0.21# dd if=
U6-LR-BZ.6.0.21# ls
cfg                    dropbear_dss_host_key  v1.bin
U6-LR-BZ.6.0.21# dd if=v1.bin of=/dev/mtdblock8 status=progress
BusyBox v1.25.1 () multi-call binary.

Usage: dd [if=FILE] [of=FILE] [ibs=N] [obs=N] [bs=N] [count=N] [skip=N]
	[seek=N] [conv=notrunc|noerror|sync|fsync] [iflag=skip_bytes]

Copy a file with converting and formatting

	if=FILE		Read from FILE instead of stdin
	of=FILE		Write to FILE instead of stdout
	bs=N		Read and write N bytes at a time
	ibs=N		Read N bytes at a time
	obs=N		Write N bytes at a time
	count=N		Copy only N input blocks
	skip=N		Skip N input blocks
	seek=N		Skip N output blocks
	conv=notrunc	Don't truncate output file
	conv=noerror	Continue after read errors
	conv=sync	Pad blocks with zeros
	conv=fsync	Physically write data out before finishing
	conv=swab	Swap every pair of bytes
	iflag=skip_bytes	skip=N is in bytes

N may be suffixed by c (1), w (2), b (512), kB (1000), k (1024), MB, M, GB, G
U6-LR-BZ.6.0.21# dd if=v1.bin of=/dev/mtdblock8
17920+1 records in
17920+1 records out
U6-LR-BZ.6.0.21# dd if=v1.bin of=/dev/mtdblock9
17920+1 records in
17920+1 records out
U6-LR-BZ.6.0.21# sync
U6-LR-BZ.6.0.21# Connection to <link local ipv6 addr> closed.

Where v1.bin was https://downloads.openwrt.org/releases/22.03.3/targets/mediatek/mt7622/openwrt-22.03.3-mediatek-mt7622-ubnt_unifi-6-lr-v1-squashfs-sysupgrade.bin that I had scp'd over.

The only other difference I can think of the second time was that instead of using the reboot command like I did the first time, after a minute when I came back to it, I pulled the plug and plugged it back in.

After reading this thread

It looks as though the tftp recovery can use different IP addresses to the default once openwrt is flashed. It won't respond to ping either.

Can you try the following

  1. Make sure your AP is powered on, and has one available ethernet port.

  2. Press and hold the Reset button. Do not release it until step 4.

  3. While continuing to press the Reset button, connect your computer to the available ethernet port of the AP.

  4. Continue holding the Reset button until the light begins flashing white > blue > off as indicated in our LED Status Guide. This indicates your device is ready for TFTP Recovery and you can release the button.

  5. Set a static IP address on your computer to communicate with the AP

Static IP:

  1. Run nmap to determine the routers IP address
sudo nmap -sn 192.168.1.*
  1. Send firmware using tftp to the discovered IP address

Can you post the output of nmap please? Hopefully you can see the host during the scan!

Yeah, I've tried that already, haven't found any way to get the AP into the TFTP mode, the light won't do anything other than stay on at a constant white, not matter how long I hold the button down (I've tried as long as over 1 minute). And I've used nmap+tcpdump to verify it's not just leaving the led alone but actually in TFTP mode - the AP simply will not respond to ARP at all for any address in, nor respond to ipv6 pings on ff02::1.

Hmm, one other thing I did just notice is that when I first powered it up it had U6-LR-BZ.6.0.24 as the installed firmware, but when I flashed it back after the first attempt, I used the U6-LR-BZ.6.0.21 firmware linked on the device page https://openwrt.org/toh/ubiquiti/unifi_6_lr. Again that doesn't seem like that should brick things either though, and it did boot into that firmware after I flashed it. But I didn't test the TFTP mode after that but before trying to install openwrt again. Oh I may have also tried to tftp the openwrt image first too - not sure if maybe that could have overwritten things it shouldn't have.

And you are powering the AP on (i.e connecting ethernet) while the button pressed? The LED should never go to steady white between power-on and tftp recovery mode.

Hmm, that might cause problems I guess. I believe this will downgrade the bootloader as well. And with the all the hardware revisions out there, there's no guarantee that an older than original bootloader will work properly. But the reset button and LEDs should still work, so even if my far fetched theory is correct, it can't explain the symptoms

Yeah I tried holding the reset button while powering on, and still the led goes steady white the instant it gets power.

I can't think of much more to try aside from cracking it open to get at the serial pins. Definitely going to try that eventually but might be a while before I do because of how much of a pain that seems to be.

Ok, got ahold of another unifi 6 lr, and this time it seems it worked better than before at least - the new one seems to boot normally as it goes through a phase of blinking the led white, and then settles on blue, and I can still get back into tftp mode. However, once it's booted I still cannot access it at all which is confusing, trying a ping scan of 192.168.1.* doesn't find anything and neither does pinging ff02::1.

Interestingly I noticed that this one came with firmware version 6.0.25, and neither 6.0.24 (what came on the last one) nor 6.0.25 are available for download from ubiquiti. When I initially flashed this unit with the v1 openwrt firmware, it seemed not to be working, though perhaps it was just in the same state of "booted" but not responding at all, and just not controlling the led because my unit is probably v2. I went back into tftp mode, flashed the latest firmware, then flashed the v2 openwrt firmware and got to the state described above. Definitely better than completely bricked like the first one, but not sure why it wouldn't respond to anything, unless I'm missing something about what it's default IP address is or something.

I also do not see the udp packet mentioned here https://openwrt.org/docs/guide-user/troubleshooting/failsafe_and_factory_reset. Additionally while it seems I can trigger failsafe mode (and get the faster blinking during boot), it never seems to finish booting in failsafe mode and just continues the fast blinking (though I'm going to leave it for a little while longer and see if maybe it's just being slow to boot or something).

I've also just tried the initramfs kernel image in addition to the sysupgrade image mentioned in the install instructions, and both result in the same behavior of not responding to anything on the ethernet port. Now I'm wondering if I still need to open at least one of these up since it seems like this one at least would for sure have useful info on the serial port - e.g. some logs about why ethernet isn't working or something. Might have a chance to get one open in the next few weeks so we'll see.

Did you see the thread at UniFi 6 LR v2 ethernet not working ?

Looks like there are several different hardware revisions out there. And the current ethernet mac/pcs driver isn't so forgiving wrt phy configuration. I beleive the symptoms you describe could match non-working ethernet on an otherwise functional device.

@daniel is working on a fix for the mtk_eth_soc driver which looks really promising. But it's not ready for OpenWrt yet AFAIK. Depends on lots of rather new phylink stuff. In the meantime you could try the DTS changes suggested in that thread. But console will make the debugging easier than blindly trying to guess what's wrong...

Ah yeah thanks for the pointer, that thread didn't come up in my searching somehow. That does sound like the issue I'm having with the new one.

If it helps I can provide you a full dump of the flash of a not modified U6-LR v3, you will have to open the unit up and desolder the flash and write it using a programmer. If nothing else works and the device is still bricked this will solve your problem.

That may help, depending on what's going on when I get a chance to solder some pins on to access the serial port. Just got the case open earlier. Would dumping an existing working device using dd be equivalent to the raw dump you're talking about? Since I do have a second working device I could do that from too.

I've just fixed it, and I do believe it was because I flashed 6.0.21 onto a v3 device, that older firmware I'm guessing doesn't support the newer hardware variation. More details in the other thread UniFi 6 LR v2 ethernet not working - #53 by pythoner6

I did the same and have the same problem with Unifi 6 LR. It has a steady white color and TFTP recovery mode does not work. How did you fix your device?

As I mentioned in the other thread I linked, I took it apart to get at the serial pins for the device. At that point the device was in a state where it had a openwrt image that was working aside from the Ethernet port. To recover I enabled wifi using the serial console, connected from my laptop, copied over a bootloader image from another non-bricked u6 lr and flashed that.

Thank ou very much. How did you do that? Is there any tutorilal about this method?

Is taking apart the device the only way to recover it? And no easier way!!