Ubiquiti NanoStation 5AC Loco

NanoStation 5AC Loco

The NanoStation 5AC Loco is a directional, weather resistant, PoE powered radio with a beam width of 90 degrees and a secondary omnidirectional radio. This makes it useful for simultaneously meshing on one radio while providing an access point for client devices on the other.

Warning: This is a PoE device. Never connect your computer directly to the PoE injector's red port!!!

Note: The Nanostation's architecture is MIPS 24KC.

Warning: As of January 1, 2020, brand new Nanostations do not support downgrading the Ubiquiti AirOS firmware. (Even with the patch.)

Files

Stock Firmware v8.5.0.36727

MassMesh Firmware (Factory) (Latest)

MassMesh Firmware (Sysupgrade) (Latest)

Flashing

From Stock Firmware

Downgrade Ubiquiti AirOS

1. Download the Stock Firmware Image v8.5.0.36727.
2. Power on the Nanostation via a PoE injector. (This is the **red** ethernet port on your injector.)
3. Connect the LAN side of the PoE injector to a computer.
4. Assign a static IP/netmask of 192.168.1.25/24 to the computer
   1. sudo ip addr add 192.168.1.25/24 dev eth0
5. Use a browser to visit http://192.168.1.20/
6. Login using the set password or default credentials ubnt / ubnt
7. Navigate to settings and downgrade the stock firmware to v8.5.0.36727 using the downloaded image file

Install The Mass Mesh OpenWrt Image

Note: Additional instructions are available on OpenWrt's website.

1. Download the latest Mass Mesh firmware here.
2. Copy the firmware onto the nanostation. (We like to put it in the /tmp/ directory.)
3. Open a secure shell on the Nanostation. ssh ubnt@192.168.1.20
4. Patch the fwupdate.real binary a la the instructions here.
5. /tmp/fwupdate.real -m /tmp/openwrt-massmesh-meshradio-ath79-generic-ubnt_nanostation-ac-loco-squashfs-factory.bin

From OpenWrt

Note: Mass Mesh mesh radios have a static IP of 192.168.2.1. To access the admin UI, set your computer's ip/netmask to 192.168.2.10/24, then browse to http://192.168.2.1/ in your favorite web browser.

1. Download the latest MassMesh sysupgrade firmware.
2. Connect to the Nanostation and enter its IP address into your favorite web browser.
   1. If you are using another version of OpenWrt, please refer to its documentation for details about its IP address.
3. Navigate to System → Backup / Flash Firmware → Actions: Flash new firmware image.
4. Choose the sysupgrade file previously downloaded and click Flash
5. Wait for the device to complete and reboot (This can take up to 5 minutes.)

Downgrade Ubiquiti AirOS With An External Programmer

When your nanostation is bricked, or if the stock firmware won't let you flash our custom firmware, you can use the In-System Programming (ISP) technique to reflash the device (see also the Flashrom wiki. You're going to need:

1. a Pomona 5252 test clip (https://www.digikey.com/product-detail/en/pomona-electronics/5252/501-2059-ND/745103), ~$16
2. a raspberry pi (e.g. a zero w) ~$10
3. some header pins and prototyping wires to connect everything

The Nanostation has a Macronix MX25L12835F rom chip (datasheet), which is an SPI chip with 16 connectors good for 128 Mbit of storage.

We can use Flashrom running on a raspberry pi to read and write that chip, if we hook up the Pomona 5252 test clip to the MX25L12835F and connect it to the correct SPI pins on the pi:

A Raspberry Pi Zero W with SPI headers populated:

Useful resources:

• Flashrom page on using the Raspberry Pi as a flashing tool

Condensed Command-list

Flash The Stock Ubiquiti Firmware via TFTP

wget https://dl.ubnt.com/firmwares/XC-fw/v8.5.0/WA.v8.5.0.36727.180118.1314.bin
cp https://dl.ubnt.com/firmwares/XC-fw/v8.5.0/WA.v8.5.0.36727.180118.1314.bin firmware.bin
sudo apt install tftp
tftp
tftp> connect 192.168.1.20
tftp> rexmt 1
tftp> timeout 60
tftp> binary
tftp> put firmware.bin

Flash The Mass Mesh Firmware

wget https://github.com/MassMesh/meta-imagebuilder-artifacts/raw/master/massmesh/meshradio/ubnt_nanostation-ac-loco/openwrt-massmesh-meshradio-ath79-generic-ubnt_nanostation-ac-loco-squashfs-factory.bin
scp openwrt-massmesh-meshradio-ath79-generic-ubnt_nanostation-ac-loco-squashfs-factory.bin ubnt@192.168.1.20:/tmp
ssh ubnt@192.168.1.20
hexdump -Cv /bin/ubntbox | sed 's/14 40 fe fe/00 00 00 00/g' | hexdump -R > /tmp/fwupdate.real
chmod +x /tmp/fwupdate.real
/tmp/fwupdate.real -m /tmp/openwrt-massmesh-meshradio-ath79-generic-ubnt_nanostation-ac-loco-squashfs-factory.bin