Ubiquiti NanoStation 5AC Loco

NanoStation 5AC Loco

The NanoStation 5AC Loco is a directional, weather resistant, PoE powered radio with a beam width of 90 degrees and a secondary omnidirectional radio. This makes it useful for simultaneously meshing on one radio while providing an access point for client devices on the other.

If you're in a pickle, and need to download opkg files for an offline NanoStation, the architecture is MIPS 24KC.

Files

Stock Firmware v8.5.0.36727

MassMesh Firmware (Factory) (Latest)

MassMesh Firmware (Sysupgrade) (Latest)

Flashing

From Stock Firmware

1. Download the Stock Firmware Image v8.5.0.36727 from above as well as the MassMesh Factory image file
2. Power on the NanoStation via a PoE injector and connect the other side of the PoE injector to a computer
3. Assign a static IP/netmask of 192.168.1.25/24 to the computer
4. Use a browser to visit http://192.168.1.20/
5. Login using the set password or default credentials ubnt / ubnt
6. Navigate to settings and downgrade the stock firmware to v8.5.0.36727 using the downloaded image file
7. Follow the instructions for enabling updates to the firmware on OpenWRT's website.

From OpenWrt

1. Download the latest MassMesh Sysupgrade firmware file from above
2. Connect to the device and navigate to the IP address of the device

   Note: MassMesh MeshRadio firmwares use an IP of 192.168.2.1. To access the administration UI, set an ip/netmask of 192.168.2.10/24 and browse to http://192.168.2.1/

3. Navigate to System → Backup / Flash Firmware → Actions: Flash new firmware image
4. Choose the sysupgrade file previously downloaded and click Flash
5. Wait for the device to complete and reboot

With an external programmer

When your nanostation is bricked, or if the stock firmware won't let you flash our custom firmware, you can use the In-System Programming (ISP) technique to reflash the device (see also the Flashrom wiki. You're going to need:

1. a Pomona 5252 test clip (https://www.digikey.com/product-detail/en/pomona-electronics/5252/501-2059-ND/745103), ~$16
2. a raspberry pi (e.g. a zero w) ~$10
3. some header pins and prototyping wires to connect everything

The Nanostation has a Macronix MX25L12835F rom chip [datasheet https://www.macronix.com/Lists/Datasheet/Attachments/7397/MX25L12835F,%203V,%20128Mb,%20v1.6.pdf], which is an SPI chip with 16 connectors good for 128 Mbit of storage.

We can use Flashrom running on a raspberry pi to read and write that chip, if we hook up the Pomona 5252 test clip to the MX25L12835F and connect it to the correct SPI pins on the pi:

A Raspberry Pi Zero W with SPI headers populated:

Useful resources:

• Flashrom page on using the Raspberry Pi as a flashing tool]

Condensed Command-list

Flash The Stock Ubiquiti Firmware via TFTP

wget https://dl.ubnt.com/firmwares/XC-fw/v8.5.0/WA.v8.5.0.36727.180118.1314.bin
cp https://dl.ubnt.com/firmwares/XC-fw/v8.5.0/WA.v8.5.0.36727.180118.1314.bin firmware.bin
sudo apt install tftp
tftp
tftp> connect 192.168.1.20
tftp> rexmt 1
tftp> timeout 60
tftp> binary
tftp> put firmware.bin

Flash The Mass Mesh Firmware

wget https://github.com/MassMesh/meta-imagebuilder-artifacts/raw/master/massmesh/meshradio/ubnt_nanostation-ac-loco/openwrt-massmesh-meshradio-ath79-generic-ubnt_nanostation-ac-loco-squashfs-factory.bin
scp openwrt-massmesh-meshradio-ath79-generic-ubnt_nanostation-ac-loco-squashfs-factory.bin ubnt@192.168.1.20:/tmp
ssh ubnt@192.168.1.20
hexdump -Cv /bin/ubntbox | sed 's/14 40 fe fe/00 00 00 00/g' | hexdump -R > /tmp/fwupdate.real
chmod +x /tmp/fwupdate.real
/tmp/fwupdate.real -m /tmp/openwrt-massmesh-meshradio-ath79-generic-ubnt_nanostation-ac-loco-squashfs-factory.bin