ZTE MF286D: internal 4G modem

Installing and Using OpenWrt
1

ZTE MT286D and OpenWrt, a question...

Will OpenWrt successfully operate with the MF286D internal/onboard 4G LTE modem?

I have a Three (physically) branded MF286D and was using a Smarty (Three MVNO) SIM with stock router and modem firmware. All was fine, good connectivity using with a Poynting XPOL 4G directional antenna.

Given OpenWrt is supported on the router, I titted a right angle 4 pin 0.1" header to the PCB with access carefully 'engineered' through the side of the unit. All good, U-Boot bootloader access achieved. After saving the original NAND partitions when OpenWrt initramfs was loaded I then installed OpenWrt 23.05.0 (then 'reverted' to OpenWrt 22.03.5). Both OpenWrt builds worked, proven only with routing to upstream device and LAN connex. However, 4G connectivity is a problem.

Using picocom and executing ATI to the internal 4G modem I confirmed that the internal 4G modem firmware revision is BD_MF286DMODULEV1.0.0B06.

Using uqmi I can interrogate the modem:

uqmi -d /dev/cdc-wdm0 --get-data-status returns "disconnected"

uqmi -d /dev/cdc-wdm0 --get-signal-info returns "type: lte, etc"

However, all attempts to have the 4G modem connect to Smarty/Three fail (using same SIM card as used previously in the router, and that works in another 'MiFi' router). The uqmi command to start the LTE connection does not return, interrupting the command returns "Unknown Error".

Should I expect the internal 4G modem to function with OpenWrt? My assumption is that 'airside' config is as used with stock router firmware. Is some magic enabling string required between OpenWrt and the internal 4G modem to allow LTE network connection?

Is it necessary to upgrade the internal 4G modem firmware to restore 4G connectivity to this MF286D?

2

works for me

Mine is Telia branded. Don't know if that matters:

root@mf286d:~# qmicli -p -d /dev/cdc-wdm0   --dms-get-revision
[/dev/cdc-wdm0] Device revision retrieved:
        Revision: 'BD_TELIAMF286DV1.0.0B11'

Did it literally say "etc"? If so, then I'm afraid there's something wrong with your modem.

(you might want to post actual output if you want help from those of us with limited mind reading capabilities)

Which command is that?

3

Thank you for responding, copy & paste of uqmi output below:

root@OpenWrt:/# uqmi -d /dev/cdc-wdm0 --get-serving-system
{
        "registration": "registered",
        "plmn_mcc": 234,
        "plmn_mnc": 20,
        "plmn_description": "▒fPJ▒\u0002",
        "roaming": false
}
root@OpenWrt:/# uqmi -d /dev/cdc-wdm0 --get-signal-info
{
        "type": "lte",
        "rssi": -76,
        "rsrq": -12,
        "rsrp": -107,
        "snr": 3.000000
}
root@OpenWrt:/# uqmi -d /dev/cdc-wdm0 --get-current-settings
"Out of call"
root@OpenWrt:/# uqmi -d /dev/cdc-wdm0 --get-data-status
"disconnected"
root@OpenWrt:/# uqmi -d /dev/cdc-wdm0 --get-device-operating-mode
"online"

root@OpenWrt:/# uqmi -d /dev/cdc-wdm0 --start-network mob.asm.net --autoconnect
<Ctrl-C>
"Unknown error"

Connecting to the internal LTE modem with picocom I can interrogate it with AT commands, an APN is set for my network (which operates only IPv4 & without authentication).

AT+CGDCONT?
+CGDCONT: 1,"IP","mob.asm.net","0.0.0.0",0,0,0,0

I'm attempting to confirm that the LTE modem can connect to the network, before returning to the OpenWrt configuration and configure the interface.

4

Success!

Installing the luci-proto-modemmanager package and defining a config via LuCi resulted in the internal LTE modem operating as expected. The '3G/4G' LED flashes regularly, as it did when the MF286D operated with ZTE 'stock' firmware and data flows through the LTE/WWAN interface. I did not uninstall luci-proto-qmi.

ModemManager creates entries in /etc/config/network, from LuCi entries as below:

config interface 'WWAN'
        option proto 'modemmanager'
        option device '/sys/devices/platform/soc/8af8800.usb3/8a00000.dwc3/xhci-hcd.0.auto/usb2/2-1'
        option apn 'mob.asn.net'
        option auth 'none'
        option iptype 'ipv4'
        option signalrate '5'

config device
        option name 'wwan0'
        option ipv6 '0'

Stopping the WAN interface in LuCi resulted in data passing over the WWAN interface, and vice versa.

I shall check out mwan3, if that works as intended, I will reinstall with 23.05.0 (aim is to have a set of routers 'baselined' on 23.05.0)

2 Likes
5

Hi, how to enable/disable on Openwrt external aerials connected via two sma connectors on the back, or is it relevant to manually enable once connected? I know with other routers (i.e. Huawei) there was such option in oem firmware, and with some models external aerial connections were disabled by default in the firmware.

6

Please see External Antenna on 4G router - #2 by AndrewZ and the following comments.

1 Like
7

I'm not succeeding in activating the modem, neither with qmi or with modemmanager.
The modem worked with the stock firmware (NORDIC_B14), the version of the modem as reported by qmicli (when it works)

root@OpenWrt:~# qmicli -p  -d /dev/cdc-wdm0 --dms-get-revision
[03 Mar 2025, 08:19:23] -Warning ** Cannot read from istream: connection broken
error: couldn't create client for the 'dms' service: CID allocation failed in the CTL client: endpoint hangup
root@OpenWrt:~# qmicli -p  -d /dev/cdc-wdm0 --dms-get-revision
[/dev/cdc-wdm0] Device revision retrieved:
        Revision: 'BD_TELIAMF286DV1.0.0B14'

the problem seems to be that both qmi and modemmanager don't set the username, just the password:

root@OpenWrt:~# uqmi -d /dev/cdc-wdm0 --get-profile-settings 3gpp,1
{
        "apn": "movistar.es",
        "pdp-type": "ipv4v6",
        "username": "",
        "password": "MOVISTAR",
        "auth": "chap",
        "no-roaming": false,
        "apn-disabled": false
}

but if I change it manually with uqmi -d /dev/cdc-wdm0 --modify-profile 3gpp,1 --username MOVISTAR then uqmi -d /dev/cdc-wdm0 --start-network --apn movistar.es just hangs there (note that I deleted the interface from luci so that it wouldn't interfere with my manual tries). If I CTRL+C it I get an Unkwnon error

I'm pasting it the result of the same commands posted by @reddily , with the same results

root@OpenWrt:~# uqmi -d /dev/cdc-wdm0 --get-device-operating-mode
"online"
root@OpenWrt:~# uqmi -d /dev/cdc-wdm0 --get-serving-system
{
        "registration": "registered",
        "radio_interface": [
                "umts"
        ],
        "plmn_mcc": 214,
        "plmn_mnc": 7,
        "plmn_description": "ͷ==���",
        "roaming": false
}
root@OpenWrt:~# uqmi -d /dev/cdc-wdm0 --get-signal-info
{
        "type": "wcdma",
        "rssi": -100,
        "ecio": 37
}
root@OpenWrt:~# uqmi -d /dev/cdc-wdm0 --get-current-settings
"Out of call"
root@OpenWrt:~# uqmi -d /dev/cdc-wdm0 --get-device-operating-mode
"online"
8

Forgot to say: openwrt 24.10.0.

9

I cannot find a comprehensive guide to AT commands, but while the qmi cellular interface says it's not connected, with the AT+CGPADDR command I see that the modem gets an IP address.

at+cgpaddr

+CGPADDR: 1,83.48.204.33
+CGPADDR: 2,42.2.145.48.128.149.157.233.24.41.70.222.180.169.238.145
+CGPADDR: 3,10.92.153.130
+CGPADDR: 4,0.0.0.0,0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0

meanwhile in the log (repeated continuosly)

Mon Mar  3 11:23:03 2025 daemon.notice netifd: wwan (11092): Starting network wwan
Mon Mar  3 11:23:09 2025 daemon.notice netifd: wwan (11092): Request timed out
Mon Mar  3 11:23:09 2025 daemon.notice netifd: wwan (11092): Unable to connect IPv4
Mon Mar  3 11:23:09 2025 daemon.notice netifd: wwan (11220): Stopping network wwan
Mon Mar  3 11:23:09 2025 daemon.notice netifd: wwan (11220): Command failed: ubus call network.interface notify_proto { "action": 0, "link-up": false, "keep": false, "interface": "wwan" } (Permission denied)
Mon Mar  3 11:23:09 2025 daemon.notice netifd: Interface 'wwan' is now down
Mon Mar  3 11:23:09 2025 daemon.notice netifd: Interface 'wwan' is setting up now
Mon Mar  3 11:23:09 2025 daemon.notice netifd: wwan (11228): Waiting for SIM initialization
Mon Mar  3 11:23:10 2025 daemon.warn odhcpd[1629]: No default route present, overriding ra_lifetime to 0!
Mon Mar  3 11:23:10 2025 daemon.notice netifd: wwan (11228): Failed to parse message data
Mon Mar  3 11:23:10 2025 daemon.notice netifd: wwan (11228): PIN verification is disabled
Mon Mar  3 11:23:11 2025 daemon.notice netifd: wwan (11228): Device does not support 802.3 mode. Informing driver of raw-ip only for wwan0 ..
Mon Mar  3 11:23:11 2025 daemon.notice netifd: wwan (11228): Waiting for network registration
Mon Mar  3 11:23:16 2025 daemon.notice netifd: wwan (11228): Starting network wwan
Mon Mar  3 11:23:22 2025 daemon.notice netifd: wwan (11228): Request timed out
Mon Mar  3 11:23:22 2025 daemon.notice netifd: wwan (11228): Unable to connect IPv4
Mon Mar  3 11:23:22 2025 daemon.notice netifd: wwan (11356): Stopping network wwan

Edit:

I rigged /lib/netifd/proto/qmi.sh so I can see the uqmi commands sent and their replies.
The reply to the --start-network command is Unkwnon error

>>> uqmi -d /dev/cdc-wdm0 -t 3000 --get-pin-status
<<< "Not supported"
>>> uqmi -s -d /dev/cdc-wdm0 -t 1000 --get-pin-status
<<< "Not supported"
>>> uqmi -s -d /dev/cdc-wdm0 -t 1000 --uim-get-sim-state
<<< {"card_slot":1,"card_application_state":"ready","pin1_status":"disabled","pin1_verify_tries":3,"pin1_unlock_tries":10,"pin2_status":"not_verified","pin2_verify_tries":3,"pin2_unlock_tries":10}
>>> uqmi -s -d /dev/cdc-wdm0 -t 1000 --uim-get-sim-state
<<< {"card_slot":1,"card_application_state":"ready","pin1_status":"disabled","pin1_verify_tries":3,"pin1_unlock_tries":10,"pin2_status":"not_verified","pin2_verify_tries":3,"pin2_unlock_tries":10}
>>> uqmi -s -d /dev/cdc-wdm0 -t 1000 --get-pin-status
<<< "Not supported"
>>> uqmi -s -d /dev/cdc-wdm0 -t 1000 --stop-network 0xffffffff --autoconnect
<<< "No effect"
>>> uqmi -s -d /dev/cdc-wdm0 -t 1000 --set-ip-family ipv6 --stop-network 0xffffffff --autoconnect
<<< "No effect"
>>> uqmi -s -d /dev/cdc-wdm0 -t 1000 --set-device-operating-mode online
<<< 
>>> uqmi -s -d /dev/cdc-wdm0 -t 1000 --set-data-format 802.3
<<< 
>>> uqmi -s -d /dev/cdc-wdm0 -t 1000 --wda-set-data-format 802.3
<<< 
>>> uqmi -s -d /dev/cdc-wdm0 -t 1000 --wda-get-data-format
<<< "raw-ip"
>>> uqmi -s -d /dev/cdc-wdm0 -t 1000 --sync
<<< 
>>> uqmi -s -d /dev/cdc-wdm0 -t 20000 --network-register
<<< 
>>> uqmi -s -d /dev/cdc-wdm0 -t 1000 --get-serving-system
<<< {"registration":"registered","radio_interface":["lte"],"plmn_mcc":214,"plmn_mnc":7,"plmn_description":"ͷ==���","roaming":false}
>>> uqmi -s -d /dev/cdc-wdm0 -t 1000 --modify-profile 3gpp,1 --apn movistar.es --pdp-type ipv4v6
<<< 
>>> uqmi -s -d /dev/cdc-wdm0 -t 1000 --get-client-id wds
<<< 19
>>> uqmi -s -d /dev/cdc-wdm0 -t 1000 --set-client-id wds,19 --set-ip-family ipv4
<<< 
>>> uqmi -s -d /dev/cdc-wdm0 -t 5000 --set-client-id wds,19 --start-network --apn movistar.es --auth-type chap --username MOVISTAR --password MOVISTAR
<<< "Unknown error"
>>> uqmi -s -d /dev/cdc-wdm0 -t 1000 --set-client-id wds,19 --release-client-id wds
<<<

I took the apn data from another 4g router working with the same sim, though I also tried with PAP authentication and IPV4 only

10

as said in the wiki:

don't set IP type to IPV4V6 until you're 100% sure that provider supports IPv6 , that is critical in QMI mode

11

As I said, I also tried with IPV4 only as well as PAP authentication.

Edit: besides adding the log with ipv4 only, on the eko.one.pl forum they report problems with b14 and openwrt :cry:
I have to find a way to downgrade the modem firmware to B12.

>>> uqmi -d /dev/cdc-wdm0 -t 3000 --get-pin-status
<<< "Not supported"
>>> uqmi -s -d /dev/cdc-wdm0 -t 1000 --get-pin-status
<<< "Not supported"
>>> uqmi -s -d /dev/cdc-wdm0 -t 1000 --uim-get-sim-state
<<< {"card_slot":1,"card_application_state":"ready","pin1_status":"disabled","pin1_verify_tries":3,"pin1_unlock_tries":10,"pin2_status":"not_verified","pin2_verify_tries":3,"pin2_unlock_tries":10}
>>> uqmi -s -d /dev/cdc-wdm0 -t 1000 --uim-get-sim-state
<<< {"card_slot":1,"card_application_state":"ready","pin1_status":"disabled","pin1_verify_tries":3,"pin1_unlock_tries":10,"pin2_status":"not_verified","pin2_verify_tries":3,"pin2_unlock_tries":10}
>>> uqmi -s -d /dev/cdc-wdm0 -t 1000 --get-pin-status
<<< "Not supported"
>>> uqmi -s -d /dev/cdc-wdm0 -t 1000 --stop-network 0xffffffff --autoconnect
<<< "No effect"
>>> uqmi -s -d /dev/cdc-wdm0 -t 1000 --set-ip-family ipv6 --stop-network 0xffffffff --autoconnect
<<< "No effect"
>>> uqmi -s -d /dev/cdc-wdm0 -t 1000 --set-device-operating-mode online
<<< 
>>> uqmi -s -d /dev/cdc-wdm0 -t 1000 --set-data-format 802.3
<<< 
>>> uqmi -s -d /dev/cdc-wdm0 -t 1000 --wda-set-data-format 802.3
<<< 
>>> uqmi -s -d /dev/cdc-wdm0 -t 1000 --wda-get-data-format
<<< "raw-ip"
>>> uqmi -s -d /dev/cdc-wdm0 -t 1000 --sync
<<< 
>>> uqmi -s -d /dev/cdc-wdm0 -t 20000 --network-register
<<< 
>>> uqmi -s -d /dev/cdc-wdm0 -t 1000 --get-serving-system
<<< {"registration":"registered","radio_interface":["lte"],"plmn_mcc":214,"plmn_mnc":7,"plmn_description":"ͷ==���","roaming":false}
>>> uqmi -s -d /dev/cdc-wdm0 -t 1000 --modify-profile 3gpp,1 --apn movistar.es --pdp-type ipv4
<<< 
>>> uqmi -s -d /dev/cdc-wdm0 -t 1000 --get-client-id wds
<<< 19
>>> uqmi -s -d /dev/cdc-wdm0 -t 1000 --set-client-id wds,19 --set-ip-family ipv4
<<< 
>>> uqmi -s -d /dev/cdc-wdm0 -t 5000 --set-client-id wds,19 --start-network --apn movistar.es --auth-type pap --username MOVISTAR --password MOVISTAR --autoconnect
<<< "Unknown error"
>>> uqmi -s -d /dev/cdc-wdm0 -t 1000 --set-client-id wds,19 --release-client-id wds
<<<
12

I managed to revert the modem firmware to B12 (read the posts starting here) and now openwrt can bring up the interface just fine.
Maybe somebody with access to the wiki could add a note not to upgrade to B14 (even if it's possible to downgrade it's a lengthy and difficult process).

13

Note added.

1 Like
14

just nitpicking here, but in the note you put BD_TELIAMF286DV1.0.0B02 instead of BD_TELIAMF286DV1.0.0B14

15

The note is correct, your post is not.
0B02 wasn't mentioned in the wiki.

16

I just pasted the output of qmicli -p -d /dev/cdc-wdm0 --dms-get-revision (here)

17

Do you see the same in ATI response?
Here is the output of the script that is used to find the deltas:

Model: MF286D
Firmware: TELIA_MF286DV1.0.0B12
IMEI: xxxxxxxxxxxxxxxxx

Description: NewVersion:Nordic_MF286D_B14; DownloadDelayTimes:1;
URI: https://dleu.ztems.com/zxmdmp/download.do?doWhat=getUp&filename=firmwarepackages/DE/ZTE/MF286D/337964/TELIA_MF286DV1.0.0B12-TELIA_MF286DV1.0.1B02.up

So the next after "0B12" is "1B02" and they call it "B14".

18

I don't have B14 anymore but luckily enough in the konsole history I still have the output of the 3ginfo-lite tool that uses at commands to query the modem:

root@OpenWrt:~# sh -x /usr/share/3ginfo-lite/3ginfo.sh
+ RES=/usr/share/3ginfo-lite
+ /usr/share/3ginfo-lite/detect.sh
+ DEVICE=/dev/ttyUSB2
+ '[' -z /dev/ttyUSB2 ]
.....
+ sms_tool -d /dev/ttyUSB2 at ati
+ OF='
Manufacturer: ZTE CORPORATION
Model: MF286DMODULE
Revision: BD_TELIAMF286DV1.0.0B14
SVN: 14
IMEI: ---------
+GCAP: +CGSM
1 Like
19

That's weird, but thank you for sharing this, it's worth adding to the wiki as another possible representation.

20

Maybe also add some pointers on how to downgrade?
The information is available but not that easy to find.