Orbi LBR20 How-To / Megathread

How To Tutorials related to Routers and Firmware
Forum rules
This forum is for tutorials only--not for help or assistance.
dhare72
Posts: 1
Joined: Fri Sep 24, 2021 11:19 am
Has thanked: 0
Been thanked: 0

Re: Orbi LBR20 How-To / Megathread

Post by dhare72 » Fri Sep 24, 2021 11:21 am

Can anyone post a video tutorial on accessing ORBI LRB20 shell using a Mac (terminal)?
I want to change TTL allowing me past the 5MB limit and I am stuck on how to access the shell.

IronBorg
Posts: 2
Joined: Mon Sep 27, 2021 1:25 pm
Has thanked: 0
Been thanked: 0

Re: Orbi LBR20 How-To / Megathread

Post by IronBorg » Mon Sep 27, 2021 1:28 pm

Hello and thank you for the awesome firmware. I'm currently running V9.2.5.2.25SF-HW and have successfully connected to the router using SSH. Can someone please help me with enabling bridge mode please?

little-endian
Posts: 5
Joined: Tue Sep 28, 2021 8:46 am
Has thanked: 0
Been thanked: 2 times

Re: Orbi LBR20 How-To / Megathread

Post by little-endian » Tue Sep 28, 2021 9:11 am

ajipro wrote:
Thu Sep 16, 2021 8:16 pm
1; How do I see what bands I'm currently on?

Code: Select all

echo -ne "AT+QCAINFO?\r\n" | microcom -X -t 1000 /dev/ttyUSB2
ajipro wrote:
Thu Sep 16, 2021 8:16 pm
2: What's the telnet command for changing the bands?
Since the access method depends on your firmware and settings (telnet OR ssh), not a "telnet" command per se, but rather one of the device itself, but it seems to have been already covered here.
dhare72 wrote:
Fri Sep 24, 2021 11:21 am
Can anyone post a video tutorial on accessing ORBI LRB20 shell using a Mac (terminal)?
Maybe I'm missing something, but a video tutorial for the following one-liner would be a bit gushy:

Code: Select all

ssh -l root 192.168.1.1


I also have a few points on my own to all of you:

Somehow, the cell lock behaviour is quite strange in my case. When I lock it to one only, I partly still end up with CA enabled (as far as I can tell):

root@LBR20:~# echo -ne "AT+QNWLOCK=\"common/4g\",1,1600,292\r\n" | microcom -X -t 1000 /dev/ttyUSB2
root@LBR20:~#
root@LBR20:~#
root@LBR20:~# echo -ne "AT+QCAINFO?\r\n" | microcom -X -t 1000 /dev/ttyUSB2
AT+QCAINFO?
+QCAINFO: "pcc",1600,75,"LTE BAND 3",1,264,-99,-20,-60,12
+QCAINFO: "scc",6200,50,"LTE BAND 20",1,38,-91,-18,-62,-5,DL

Furthermore, at some point, the LBR20 decided to only use Band 1, even after rebooting or entering the command

Code: Select all

echo -ne "AT+QNWLOCK=\"common/4g\",0\r\n" | microcom -X -t 1000 /dev/ttyUSB2
Not only should the cell locking be persistent after a reboot, nor should it have any effect at latest after entering the command above, should it?

The only way to restore the usual B3+B7+B20 combination however for me was to perform a factory reset, hardly convenient for any testing or tuning. :roll:

Independently of that - has anyone managed to route the guest wifi over a VPN with "kill switch" functionality yet? My goal is to run the OpenVPN client according to the readme provided by the Voxel firmware, however only for traffic passing the guest SSID and nothing else. If anyone happens to have some working iptables or ebtables or whatnot script, I would greatly appreciate any help, thanks.

am888
Posts: 23
Joined: Wed Aug 19, 2020 9:31 am
Has thanked: 4 times
Been thanked: 5 times

Re: Orbi LBR20 How-To / Megathread

Post by am888 » Wed Sep 29, 2021 9:14 pm

IronBorg wrote:
Mon Sep 27, 2021 1:28 pm
Hello and thank you for the awesome firmware. I'm currently running V9.2.5.2.25SF-HW and have successfully connected to the router using SSH. Can someone please help me with enabling bridge mode please?
There is no bridge mode, for all practical purposes, on the LBR20.

Dman1049
Posts: 4
Joined: Fri Oct 01, 2021 12:08 am
Has thanked: 0
Been thanked: 0

Re: Orbi LBR20 How-To / Megathread

Post by Dman1049 » Sun Oct 03, 2021 12:05 pm

Ive got the most recent voxel on the lbr20... I'm not understanding how to lock bands and modify ttl settings. As in remove the 5gb limit. I don't understand how to send commands. Is there any video tutorials on how to do any of this?

Klockwork77
Posts: 2
Joined: Mon Sep 27, 2021 3:13 pm
Has thanked: 0
Been thanked: 0

Re: Orbi LBR20 How-To / Megathread

Post by Klockwork77 » Mon Oct 04, 2021 11:25 am

Is there an error log somewhere after getting error sending AT commands?

hazarjast
Posts: 133
Joined: Wed Dec 11, 2019 8:38 am
Has thanked: 16 times
Been thanked: 35 times

Re: Orbi LBR20 How-To / Megathread

Post by hazarjast » Tue Oct 05, 2021 1:07 pm

little-endian wrote:
Tue Sep 28, 2021 9:11 am

Code: Select all

echo -ne "AT+QCAINFO?\r\n" | microcom -X -t 1000 /dev/ttyUSB2
...

I also have a few points on my own to all of you:

Somehow, the cell lock behaviour is quite strange in my case. When I lock it to one only, I partly still end up with CA enabled (as far as I can tell):

root@LBR20:~# echo -ne "AT+QNWLOCK=\"common/4g\",1,1600,292\r\n" | microcom -X -t 1000 /dev/ttyUSB2
root@LBR20:~#
root@LBR20:~#
root@LBR20:~# echo -ne "AT+QCAINFO?\r\n" | microcom -X -t 1000 /dev/ttyUSB2
AT+QCAINFO?
+QCAINFO: "pcc",1600,75,"LTE BAND 3",1,264,-99,-20,-60,12
+QCAINFO: "scc",6200,50,"LTE BAND 20",1,38,-91,-18,-62,-5,DL

Furthermore, at some point, the LBR20 decided to only use Band 1, even after rebooting or entering the command

Code: Select all

echo -ne "AT+QNWLOCK=\"common/4g\",0\r\n" | microcom -X -t 1000 /dev/ttyUSB2
Not only should the cell locking be persistent after a reboot, nor should it have any effect at latest after entering the command above, should it?

The only way to restore the usual B3+B7+B20 combination however for me was to perform a factory reset, hardly convenient for any testing or tuning. :roll:

Independently of that - has anyone managed to route the guest wifi over a VPN with "kill switch" functionality yet? My goal is to run the OpenVPN client according to the readme provided by the Voxel firmware, however only for traffic passing the guest SSID and nothing else. If anyone happens to have some working iptables or ebtables or whatnot script, I would greatly appreciate any help, thanks.
'AT+QCAINFO?' can give you band info but it is specifically used for showing info about carrier aggregation status. I think mostly Netgear and folks interactively querying the modem are using 'AT+QENG="servingcell" to check the currently connected cell and its associated band info.

In regards to cell lock, you are correct, CA will still function when locked to a specific cell; this is one reason I prefer cell locking over band locking given you don't have to play 'guess what's in the carrier's head' when it comes to CA band index creation. But, if this behavior is undesirable then band locking would be the alternative where you can more precisely define exactly what bands it is directed to connect to. As mentioned in the previous point 'AT+QCAINFO' will give you the last reported carrier aggregation status of the modem, which is not necessarily the same as the current connected cell and band info (i.e. 'AT+QENG="servingcell"').

Cell locking is definitely not reboot persistent so either there is a specific bug with B1 locking in the Quectel firmware you are on, or (more likely) the firmware algorithm, which is mostly based on preferring the strongest signal available, has preferred B1 even after the lock was removed. I see this behavior frequently in my area when locking B66/B4. It is possible a factory reset cleared something 'stuck' but equally it is possible that RF signal composition/signal changed in relation to the unit in the time period between when the modem was restarted multiple times causing it to 'settle' on the desired band combo once again. Unfortunately B1 is not available in my area to perform any testing to validate whether a specific bug exists or not.

In regards to your OpenVPN query, what you are after is referred to as 'split-tunneling' (aka 'split-tunnel routing') which involves creating two separate networks/gateways to route traffic out of. Since the LBR20 is based on OpenWRT you should be able to find a decent amount of high level instructions and info by searching for something like "OpenVPN split-tunnel on OpenWRT". One such example of this type of guide: https://medium.com/@ingamedeo/openvpn-s ... 302a1a4e12

One challenge you will face with following any of these guides on the LBR20 is that, since the device isn't a typical 'full' install of OpenWRT with accompanying LuCI GUI interface, creating the required separate interfaces and gateways for the routing piece will likely have to be done with 'uci' at the command line. The LBR20 by default bridges the WiFi radios with physical interface 'eth0' creating the bridged interface 'br0'. I'm honestly not sure offhand how one would create a new bridge interface with only the 'guest' SSID and the OpenVPN tunnel interface leaving only the 'non-guest' LAN bridge ('br0') intact.

There's a lot of Netgear 'baked-in' configuration governing interfaces, WLAN bridging, and firewalling which you would have to reverse engineer a bit else risk borking something by just jumping in and starting to reconfigure the logical interfaces and network routing. If you were able to get the split-tunnel setup working as desired you would then likely need to capture all the configuration changes into a script which could run on each reboot (after all Netgear boot config completes) as I believe such changes would typically revert when a restart or power loss occurs since we are only modifying firmware running in RAM and not base config on the ROM itself.

Given the configuration complexities required for split-tunnel routing, I have personally let the LBR20 stick to what it does best, which is act as an LTE modem for my Internet connection, leaving the VPN and split-tunnel routing to my upstream router/firewall (pfSense). However, if you put the time in and are able to successfully configure the LBR20 for split-tunnel VPN routing, I'm certain more than a few other LBR20 owners would be indebted to you for posting your configuration detail/tutorial for the same :)

hazarjast
Posts: 133
Joined: Wed Dec 11, 2019 8:38 am
Has thanked: 16 times
Been thanked: 35 times

Re: Orbi LBR20 How-To / Megathread

Post by hazarjast » Tue Oct 05, 2021 1:27 pm

am888 wrote:
Wed Sep 29, 2021 9:14 pm
There is no bridge mode, for all practical purposes, on the LBR20.
This is true. The real question becomes 'Why do you require a bridge?'. For most folks, the answer is usually "Because I need open NAT for gaming / running a server / torrenting.' In that case, bridging 'wwan0' from the modem to your LAN interface won't really help you since the IP it gets assigned by the cellular carrier is not publicly routable in practice nine times out of ten. This is because addresses assigned to the modem interface, even if in pubic address space, will be behind carrier grade NAT (CGNAT).

There are ways to work around CGNAT with proxies/VPNs/etc. but layer 2 bridging of the modem and LAN, even if technically possible, would typically not be helpful in this scenario. If you are just using the LBR20 LTE connection as WAN on another router device and want to be sure all traffic is passed unimpeded out of the unit, you can use the DMZ function which will mostly accomplish the same end goals as bridging in this scenario (yes, a layer 3 solution is not equivalent to layer 2 bridging but achieves what is required for most which is bypassing the LBR20's firewall etc. when another router is in play).

hazarjast
Posts: 133
Joined: Wed Dec 11, 2019 8:38 am
Has thanked: 16 times
Been thanked: 35 times

Re: Orbi LBR20 How-To / Megathread

Post by hazarjast » Tue Oct 05, 2021 1:38 pm

Klockwork77 wrote:
Mon Oct 04, 2021 11:25 am
Is there an error log somewhere after getting error sending AT commands?
Unfortunately, no; at least not easily accessible outside of the modem's internal logging. But, even if such a log existed that we could access from the LBR20 itself, it would likely not provide anything more verbose than the "ERROR" message you already see echoed to the terminal. In most cases "ERROR" indicates that either the AT command does not exist *or* the syntax/options passed were incorrect (typos, etc.).

"ERROR" can also occur if the modem is busy and your command is trying to execute in the middle of something like a status query or connection sequence of commands already being issued to the modem by the LBR20 itself. For this reason it is best to run some more 'sensitive' commands when there is no SIM inserted to lower the chances of this happening

Is there a specific command you are trying to issue to the modem which is resulting in "ERROR" being returned? If you are able to post the exact command and/or a screenshot we may be able to tell you whether the command exists for this particular Quectel modem and whether it is syntactically sound.

Klockwork77
Posts: 2
Joined: Mon Sep 27, 2021 3:13 pm
Has thanked: 0
Been thanked: 0

Re: Orbi LBR20 How-To / Megathread

Post by Klockwork77 » Tue Oct 05, 2021 6:07 pm

hazarjast wrote:
Tue Oct 05, 2021 1:38 pm
Is there a specific command you are trying to issue to the modem which is resulting in "ERROR" being returned? If you are able to post the exact command and/or a screenshot we may be able to tell you whether the command exists for this particular Quectel modem and whether it is syntactically sound.
I'm trying to send AT command using what you posted through ssh.

Code: Select all

cat /dev/ttyUSB2` echo -e "AT +EMGR=1,7,\"012345678911121\"\r\n" > /dev/ttyUSB2`
You can ignore the proton email I sent you about this topic if you reply here.

Post Reply