ZTE MF286D: internal 4G modem

ZTE MT286D and OpenWrt, a question...

Will OpenWrt successfully operate with the MF286D internal/onboard 4G LTE modem?

I have a Three (physically) branded MF286D and was using a Smarty (Three MVNO) SIM with stock router and modem firmware. All was fine, good connectivity using with a Poynting XPOL 4G directional antenna.

Given OpenWrt is supported on the router, I titted a right angle 4 pin 0.1" header to the PCB with access carefully 'engineered' through the side of the unit. All good, U-Boot bootloader access achieved. After saving the original NAND partitions when OpenWrt initramfs was loaded I then installed OpenWrt 23.05.0 (then 'reverted' to OpenWrt 22.03.5). Both OpenWrt builds worked, proven only with routing to upstream device and LAN connex. However, 4G connectivity is a problem.

Using picocom and executing ATI to the internal 4G modem I confirmed that the internal 4G modem firmware revision is BD_MF286DMODULEV1.0.0B06.

Using uqmi I can interrogate the modem:

uqmi -d /dev/cdc-wdm0 --get-data-status returns "disconnected"

uqmi -d /dev/cdc-wdm0 --get-signal-info returns "type: lte, etc"

However, all attempts to have the 4G modem connect to Smarty/Three fail (using same SIM card as used previously in the router, and that works in another 'MiFi' router). The uqmi command to start the LTE connection does not return, interrupting the command returns "Unknown Error".

Should I expect the internal 4G modem to function with OpenWrt? My assumption is that 'airside' config is as used with stock router firmware. Is some magic enabling string required between OpenWrt and the internal 4G modem to allow LTE network connection?

Is it necessary to upgrade the internal 4G modem firmware to restore 4G connectivity to this MF286D?

works for me

Mine is Telia branded. Don't know if that matters:

root@mf286d:~# qmicli -p -d /dev/cdc-wdm0   --dms-get-revision
[/dev/cdc-wdm0] Device revision retrieved:
        Revision: 'BD_TELIAMF286DV1.0.0B11'

Did it literally say "etc"? If so, then I'm afraid there's something wrong with your modem.

(you might want to post actual output if you want help from those of us with limited mind reading capabilities)

Which command is that?

Thank you for responding, copy & paste of uqmi output below:

root@OpenWrt:/# uqmi -d /dev/cdc-wdm0 --get-serving-system
        "registration": "registered",
        "plmn_mcc": 234,
        "plmn_mnc": 20,
        "plmn_description": "▒fPJ▒\u0002",
        "roaming": false
root@OpenWrt:/# uqmi -d /dev/cdc-wdm0 --get-signal-info
        "type": "lte",
        "rssi": -76,
        "rsrq": -12,
        "rsrp": -107,
        "snr": 3.000000
root@OpenWrt:/# uqmi -d /dev/cdc-wdm0 --get-current-settings
"Out of call"
root@OpenWrt:/# uqmi -d /dev/cdc-wdm0 --get-data-status
root@OpenWrt:/# uqmi -d /dev/cdc-wdm0 --get-device-operating-mode

root@OpenWrt:/# uqmi -d /dev/cdc-wdm0 --start-network mob.asm.net --autoconnect
"Unknown error"

Connecting to the internal LTE modem with picocom I can interrogate it with AT commands, an APN is set for my network (which operates only IPv4 & without authentication).

+CGDCONT: 1,"IP","mob.asm.net","",0,0,0,0

I'm attempting to confirm that the LTE modem can connect to the network, before returning to the OpenWrt configuration and configure the interface.


Installing the luci-proto-modemmanager package and defining a config via LuCi resulted in the internal LTE modem operating as expected. The '3G/4G' LED flashes regularly, as it did when the MF286D operated with ZTE 'stock' firmware and data flows through the LTE/WWAN interface. I did not uninstall luci-proto-qmi.

ModemManager creates entries in /etc/config/network, from LuCi entries as below:

config interface 'WWAN'
        option proto 'modemmanager'
        option device '/sys/devices/platform/soc/8af8800.usb3/8a00000.dwc3/xhci-hcd.0.auto/usb2/2-1'
        option apn 'mob.asn.net'
        option auth 'none'
        option iptype 'ipv4'
        option signalrate '5'

config device
        option name 'wwan0'
        option ipv6 '0'

Stopping the WAN interface in LuCi resulted in data passing over the WWAN interface, and vice versa.

I shall check out mwan3, if that works as intended, I will reinstall with 23.05.0 (aim is to have a set of routers 'baselined' on 23.05.0)

1 Like