I've found openwrt for the Zyxel NR7101 but would it please be possible to make it for the Zyxel NR5101?
https://openwrt.org/docs/guide-developer/adding_new_device
Have you found the serial port or the chipset it uses or?
Try to extract boot logs from the device, they may indicate SOC, mem, flash sizes.
pretty sure the NR5101 hardware is mostly the same, except for the indoor casing and the additional connectors that allows. To be sure, I took a quick look at the OEM firmware and it definitely says MT7621 in the header.
So this should be fairly easy to get running if you can get shell access somehow. Console is a must, but in my experience Zyxel are very friendly and even include the header pins. They also pretty much standardize the pinout. So just look at for example the NR7101 device page to get some hints.
Note that U-Boot input might be disabled by default. If it is, then you need an OEM root shell to fix it. Hoping the DebugFlag trick works.
ram booting was a bit finicky on the NR7101. I needed to set "eth0addr" twice to make arp work, for unknown reasons. Note that both OEM firmware and the NR7101 OpenWrt initramfs images include an additional 0x17C bytes header for flash. But you don't have to strip it to ram boot. Just load the image with header and all to 0x88000000 and then boot from 0x8800017C.
My ramboot notes for NR7101:
# stop boot
<esc>
# enter U-Boot shell
atgu
4
# set mac addr twice (work around arp bug)
setenv eth0addr 08:26:97:xx:xx:xx
setenv eth0addr 08:26:97:xx:xx:xx
# load image (ipaddr=10.10.10.123, serverip=10.10.10.3, filename=test.bin
tftpboot
# boot from memory, skipping ZyXEL header (0x17c bytes)
bootm 8800017C
Hope this helps. If possible, make sure to take a complete backup of all flash before you write anything to it. It's not only useful for restoring OEM later. On my NR7101 there was a file system in what was supposed to be empty space between n 0x2000000 and 0x2140000.This was a jffs2 file system with OpenWrt config files:
-rw-rw-r-- 1 bjorn bjorn 2526 Mar 26 12:08 account
-rw-rw-r-- 1 bjorn bjorn 247 Mar 26 12:08 ddns
-rw-rw-r-- 1 bjorn bjorn 34 Mar 26 12:08 default_lan_radvd
-rw-rw-r-- 1 bjorn bjorn 916 Mar 26 12:08 dhcp
-rw-rw-r-- 1 bjorn bjorn 861 Mar 26 12:08 dhcp6c
-rw-rw-r-- 1 bjorn bjorn 113 Mar 26 12:08 dhcp6s
-rw-rw-r-- 1 bjorn bjorn 1122 Mar 26 12:08 easycwmp
-rw-rw-r-- 1 bjorn bjorn 3546 Mar 26 12:08 firewall
-rw-rw-r-- 1 bjorn bjorn 183 Mar 26 12:08 firewall6
-rw-rw-r-- 1 bjorn bjorn 395 Mar 26 12:08 fstab
-rw-rw-r-- 1 bjorn bjorn 1706 Mar 26 12:08 gpio
-rw-rw-r-- 1 bjorn bjorn 188 Mar 26 12:08 ifce_group
-rw-rw-r-- 1 bjorn bjorn 243 Mar 26 12:08 igmpproxy
-rwxrwxr-x 1 bjorn bjorn 754 Mar 26 12:08 lteinfo
-rwxrwxr-x 1 bjorn bjorn 754 Mar 26 12:08 lteinfo_runtime
-rw-rw-r-- 1 bjorn bjorn 816 Mar 26 12:08 luci
-rw-rw-r-- 1 bjorn bjorn 2857 Mar 26 12:08 network
-rw-rw-r-- 1 bjorn bjorn 193 Mar 26 12:08 privilege
-rw-rw-r-- 1 bjorn bjorn 652 Mar 26 12:08 qos
-rw-rw-r-- 1 bjorn bjorn 621 Mar 26 12:08 radvd
-rw-rw-r-- 1 bjorn bjorn 332 Mar 26 12:08 remote_mgmt
-rw-rw-r-- 1 bjorn bjorn 98 Mar 26 12:08 syslogd
-rw-rw-r-- 1 bjorn bjorn 863 Mar 26 12:08 system
-rw-rw-r-- 1 bjorn bjorn 574 Mar 26 12:08 time
-rw-rw-r-- 1 bjorn bjorn 744 Mar 26 12:08 ucitrack
-rw-rw-r-- 1 bjorn bjorn 976 Mar 26 12:08 upnpd
-rw-rw-r-- 1 bjorn bjorn 635 Mar 26 12:08 wifi_schedule
-rw-rw-r-- 1 bjorn bjorn 635 Mar 26 12:08 wifi_schedule5G
-rw-rw-r-- 1 bjorn bjorn 2081 Mar 26 12:08 wireless
These weren't in use by the installed OEM firmware, but very useful for mappng the LED GPIOs etc.
Many thanks for the detailed reply, very helpful.