This video provides a comprehensive, step-by-step tutorial on installing the OpenWrt open-source firmware on a Xiaomi AX3000T router. The primary motivation is to replace the feature-limited and potentially intrusive stock firmware with a more secure, customizable, and private alternative. The installation process leverages a vulnerability in an older version of the stock firmware (1.0.47) to gain initial administrative access.
The core procedure involves downgrading the router's firmware, extracting a temporary session token from the web interface, and using this token in a series of curl commands to unlock the SSH port. Once shell access is established, the guide details how to navigate the router's dual-partition system, flash the OpenWrt image to the inactive partition using the ubiformat command, and modify the bootloader environment variables to make the new OpenWrt installation the default. The video confirms a successful installation while also demonstrating that the original stock firmware remains intact on the alternate partition, allowing for a dual-boot capability.
Installing OpenWrt on the Xiaomi AX3000T Router: A Step-by-Step Guide
0:00 Introduction to the AX3000T: The video introduces the Xiaomi AX3000T router as an ideal choice for OpenWrt, citing its low cost ($30-$40), capable Mediatek processor, and Wi-Fi 6 support.
0:51 Why Choose OpenWrt?: The creator advocates for switching to OpenWrt to gain more features, control, and privacy. OpenWrt is an open-source operating system that, unlike some stock firmwares, does not secretly track internet activity.
1:57 The Main Hurdle: Unlocking SSH: The primary challenge is that the manufacturer locks administrative SSH access by default. The entire process hinges on finding a way to enable it.
2:48 Downgrade for Vulnerability: To unlock SSH, the router's stock firmware must first be downgraded to version 1.0.47, which contains a known vulnerability that can be exploited.
3:53 Using a Token to Unlock SSH: After downgrading, a temporary session "token" is copied from the address bar of the router's web admin page. This token is then inserted into a series of curl commands, which are run from a computer to finally enable the SSH service on the router.
6:08 Understanding the Dual-Partition System: The router features two separate firmware partitions (UBI file system 0 and 1). The installation strategy is to flash OpenWrt onto the partition that is not currently in use, preserving the original firmware as a backup.
7:17 Flashing the OpenWrt Image: Using the scp command, the OpenWrt firmware image is copied to the router's temporary directory. The ubiformat command is then run on the router to write this image to the inactive partition.
8:03 Changing the Boot Sequence: After the firmware is flashed, specific commands are run to change the router's boot settings, instructing it to load from the partition where OpenWrt was just installed.
10:11 Retaining Dual-Boot Capability: The process does not erase the original stock firmware. The creator demonstrates that by changing the boot sequence back, it is possible to boot into the stock firmware, providing a reliable fallback option.
13:51 Future Possibilities: The creator notes the existence of an open-source bootloader for the router, suggesting it as a potential topic for a future video for even greater system control.