Orbi 5G (NBR750, NBK752) How-To / Megathread
Posted: Tue Jun 21, 2022 11:42 pm
Introduction
Most likely you've purchased or are considering purchasing an Netgear NBR750/NBK752 (the latter being the bundle SKU with an additional satellite included), a.k.a. "Orbi 5G", as your primary or secondary source of Internet connectivity and found your way here through an Amazon review or the 5G LTE Hacks Facebook group. Welcome! Here you will find what you are looking for in terms of working with the unit and getting it to run with your provider and plan of choice. This thread will cover:
DISCLAIMER
This guide is provided as a reference only without any warranty expressed or implied. If you brick your device, the author is not responsible. You understand that by flashing your device with any firmware which was not provided with your specific unit out of the box, you may have voided any warranty or support which you would normally be entitled to from Netgear during their advertised warranty period. Bear in mind that if you are using an RBS750 satellite, Netgear recommends that you flash any firmware updates there first prior to flashing them on the router (to ensure best compatbility). Proceed at your own risk!
What is the Stable Release OEM Firmware and How Do I Get It?
OEM stands for "Original Equipment Manufacturer", in this case Netgear. While 5G Orbis purchased directly from Netgear or Amazon today likely already have the stable release OEM firmware, it has been found that many of the earlier models that shipped to cellular carriers in Canada or elsewhere have custom firmware based on a early beta release from Netgear.
While these may run well enough, they are missing some goodies like native TTL adjustment in the GUI and possibly security/bug fixes that Netgear added to the first stable release of official OEM firmware which is version 4.6.5.11. All of my discovery and work on this unit so far has been on this release of firmware thus that will be the one recommended to flash to your unit for the purposes of this tutorial. If that should change I will update the OP here. The 4.6.5.11 stable release can be obtained directly from Netgear here and I have found no ill effects from flashing units which previously had Canadian carrier-specific or other beta releases already present:
https://www.downloads.netgear.com/files ... 1.5.64.zip
(Older, initial version can be found here for posterity but is *NOT* recommended since it is missing important security patches: https://www.downloads.netgear.com/files ... 6.5.11.zip)
To flash the Netgear OEM firmware above, simply extract the .chk file from the .zip, then login to the web GUI (usually by browsing to 'http://192.168.1.1') and go to 'Advanced > Administration > Firmware Update > Manual Update > Update > Browse' to select the extracted .chk file; click Upload and confirm the update allowing time for the upload/flash/reboot to complete. After the unit comes back online, you need to reset it to factory defaults ('Advanced > Administration > Backup Settings > Erase'). Be aware that you will have to go through the initial setup in the web browser again when performing this step. You can now proceed with the rest of this guide.
Unbricking After a Bad Firmware Flash
If you have accidentally bricked your device during firmware flash and it will no longer boot up completely, please refer to the following Netear KBA for recovery instructions. When performing a recovery flash it is recommended to flash back to Netgear stock v4.6.5.11:
https://kb.netgear.com/000059634/How-do ... =000059634
The Netgear KBA requires TFTP. If you don't have TFTP installed on your PC, refer to the following:
https://teckangaroo.com/enable-tftp-windows-10/
NOTE
Be aware there is modem firmware separate from the NBR750 router firmware. The modem inside is a Quectel RM502Q-AE and, as of this writing the current LTE firmware for the NBR750 modem is version the R11A04 revision which seems to work fine. I have not tested either the later R11 revisions or R13 firmware from Quectel directly at this time. If you decide to test this be aware it may cause issues as the RM502Q-AE in the NBR750 is in PCIe mode which uses the new Modem Host Interface (MHI) instead of the USB 3.0 bus to pass data. This is fairly unique to this unit as most RM502Q-AE setups using m.2/NGFF connections which do not have PCIe bus access (nor does any mainline OpenWRT kernel mod package exist for MHI yet). This may be confusing information but suffice it to say the mode of operation for the modem in the NBR750 is unique so flashing it with the latest Quectel firmware has the potential to cause issues since nearly all other routers using this model of modem have only be tested using the USB bus to pass data.
General 'Mobile Broadband' WAN Notes
If you will be using the router's modem as your main source of Internet connection (WAN) then under 'Advanced > Setup > Internet Setup > Mobile Broadband Settings' you will need to make sure you choose the dropdown option for 'Always use Mobile Broadband'. Also, in many cases you will need to set your appropriate APN information here as well and for PDP setting most carriers now require at least 'IPV4V6' or 'IPV6'. If you are using a voice/phone line SIM in the device from a carrier such as T-Mobile then you will likely notice that no connected devices have no Internet connectivity if your PDP is set to 'IPV4' only. This is because most cellular carriers and ISPs use IPV6 across their entire network stack and rely on the cellular modem or connected router on the client side to perform IPV4 to IPV6 translation.
How to Get Command Line Access - UPDATED METHOD
Install Python 3.8+ and download the 'telnet-enable2.py' script from here:
https://github.com/bkerler/netgear_telnet
From the PC with the Python script installed, open a command prompt in the directory where the script has been downloaded and issue the following command:
Where '[XX:XX:XX:XX:XX:XX]' is the MAC address printed on the bottom of your NBR750 unit (with colon separators between each pair of alphanumeric characters), and '[password]' is the password you set for the 'admin' user during the initial setup of the router. Once the script completes you can then login to the router via Telnet (port 23/tcp) using Windows telent client or another favorite Telnet client such as Putty. The username will be 'admin' and the password would be the same as the one you used in the command above (which was set by you in the initial router setup).
How to Get Command Line Access - OLD METHOD
This method has only been tested with the initial OEM firmware release from netgear (NBR750-V4.6.5.11.zip) and has not been tested with newer firmware. Do *NOT* perform the following steps to restore the configuration backup file if you've already used the 'UPDATED METHOD' in the previous section. The configuration file link and instructions are being left here only for posterity for those who may have some issue with a future Netgear firmware.
Once the aforementioned OEM firmware is installed cleanly and you've performed the required factory reset, you will then need to load a configuration backup to enable Telnet command line access on the device which will allow us to perform subsequent tweaks/mods of our choosing such as issuing AT commands to the Quectel modem inside etc. The configuration backup file can be downloaded below and can be uploaded to your unit in the web interface under 'Advanced > Administration > Backup Settings > Browse > Restore'. It may take a number of minutes for the restore to complete then the router will restart.
https://mega.nz/file/yEETmKoA#6SmlM6QrT ... vtcbR_8guk
Once the configuration backup is restored your Wi-Fi SSID will have been changed to "Orbi62" and the password for both it and the "admin" web interface account will be "Geardog123!" (no quotes). You may also need to update your cellular carrier settings for APN, PDP, etc. in case they were overwritten as well. At this point you should be able to login to the router via Telnet (port 23/tcp) using Windows telnet client (if you have it installed from 'Add/Remove Windows Features') or another Telnet client such as Putty. The username will be "admin" and password is the same "Geardog123!" you use for the account in the web interface already. You are free to change the web interface "admin" password, SSID password, or telnet "admin" password to anything you like at this point.
Using SSH Instead of Telnet
Telnet is pretty rudimentary and not very robust; it also does not allow easy transfer of files to/from the unit so I prefer to configure SSH instead. From a Telnet session you can execute the following which will enable SSH (dropbear daemon):
Now SSH (port 22/tcp) from the Windows 10 command prompt or Putty to 'root@192.168.1.1' and enter "admin" password to login. Then enter the following commands from the SSH prompt to enable SSH to persist after the device is restarted:
At this point it would be a good idea to set a password for 'root' as it's not set by default. To do so enter the following command and hit return:
It will prompt you to enter a password and then prompt a second time to confirm it. I usually recommend setting the 'root' password to the same thing you are using for 'admin' (ex. "Geardog123!" in the case of 'admin' from our config backup), but you can set it to whatever you want. The more complex password the better it is. Or you can get fancy and setup SSH keys which is even more secure but I am not going to cover that in this guide 
If you wish to disable Telnet on the device at this point you can enter the following commands (will need a restart of the device to take effect):
How to disable bloatware (Armor/Circle/ReadyCLOUD/AWS IoT) and Auto Updates
By default we still have Netgear bloatware like Armor, ReadyCLOUD, and AWS IoT. Fortunately, Circle does not seem to be a thing this time around but the firmware still has traces of it so that can likely be disabled as well. We can disable all these resource hogging features (assuming you don't use them) via the following commands:
Note that AWS IoT is required for using the Netgear mobile app with the device so disabling that would require you to use the web interface only.
To disable automatic firmware updates from Netgear, we can execute the following commands:
How to set DNS and TTL (to keep data use "on-device")
DISCLAIMER
TTL modification may violate your carrier's ToS. The author of this guide is not responsible if your carrier terminates your service due to TTL modification.
To use your own DNS servers you simply need to set them under 'Advanced > Setup > Internet Setup > Mobile Broadband Settings > Domain Name Server (DNS) Address' and enter the IPs for primary and secondary DNS of your choosing there (Ex. 8.8.8.8/8.8.4.4 for Google or 1.1.1.1/1.0.0.1 for CloudFlare). To change the TTL this time around Netgear has made it easy for us. In the web interface simply to to 'Advanced > Setup > Internet Setup > Mobile Broadband Settings > TTL' and enter your desired TTL for the modem interface ('64' for most carriers will work, I use '65' for T-Mobile, Visible users may need '66' etc. Basically just trying to make it ~64 once it reaches the carrier network). Click 'Apply' to save your DNS and TTL changes. Saving will take a minute or two but this value should persist across reboots.
Sending AT Commands to the Modem
Once logged into SSH (or Telnet if you chose to keep that enabled) you can echo your desired AT commands and pipe to the inbuilt 'microcom' function of BusyBox like so:
(If you want to perform "magic" on your modem the above example is exactly what you would execute; just swap the digits with a valid IMEI. This particular command should be issued only without a SIM inserted.)
DISCLAIMER
"Magic" (aka IMEI repair) may violate your carrier's ToS or country's regulatory laws. The author of this guide is not responsible if your carrier terminates your service and/or if you suffer any legal repercussions which may result from the modification of your device's factory-issued IMEI.
There is a specific syntax for echoing commands to microcom:
If you want to send commands interactively to the modem you can do so by opening a connection with microcom directly to the secondary AT port:
You can exit the prompt by pressing 'Ctrl+X'. Be aware that the system may be using the same tty to talk to the modem already so your input may be interrupted by other commands already being sent to the modem. This is why echo piped to microcom is the preferred way of issuing commands at this time.
Not all AT commands are published but all the ones that are can be found the source modem documentation for the RM502Q-AE (the Quectel modem inside the NBR750): https://www.quectel.com/wp-content/uplo ... l_V1.2.pdf
Band Locking
First, ask yourself why you need to band lock. In most cases you don't need to do this and will really just kneecap yourself from higher speeds. This is because when you band lock you must create a collection of bands to lock and any bands not included will not be used at all. So, if you create a collection (band index) of only one or two bands you will lose carrier aggregation (CA) abilities on any bands not included (assuming the tower allows CA on such bands).
If you still believe band locking is what you want to do you can use the AT command guide linked above to study the proper syntax for doing so. If someone wants to point me to a thread which already has the guide for doing this on the RM502Q-AE then I will be happy to come back and add it to this section. Be aware the commands for this modem are much different than those used in the modem for the LBR20 or other earlier Quectel modems; do not try to use those with this modem.
Cell Locking
As an alternative to band locking, you can lock to a specific cell which, IMHO, is a much more straightforward approach than band locking and will allow you to retain CA abilities without having to guess at the bands. For LTE/DSS at least, cell locking requires physical cell ID (PCI) and E-UTRA Absolute Radio Frequency Channel Number (EARFCN) as input values. There is nuance to LTE cell locking with 5G NSA and the commands will be different for NR compared to LTE. Much of this is covered in the aforementioned AT command guide and I will flesh out further instruction here if someone would like to point me in the direction of pre-written instructions else I will flesh this out as time and interest permit.
How To Receive SMS
Netgear has included an option on the left-hand side of the 'Advanced' page of the web interface which allows you to read SMS messages. This is straightforward. No option to send SMS is included, however.
How to split wifi SSIDs (separate 2.4Ghz and 5Ghz SSIDs)
In theory this can be done in the same way as other Orbi units but be warned I have not tested this specifically on the NBR750. If someone tests this please let me know for confirmation that it does indeed still work...
Refer to the following and read it entirely all the way until the end of the page:
https://digiex.net/threads/step-by-step ... ter.15648/
To simplify the main CLI commands:
The commands below check the values have been set as required and apply a reboot when ready:
Using the NBR750 as WAN on another router (DMZ mode and disabling wifi radios)
If you only intend to use the NBR750 for the modem and wish to use it as WAN on another router you should disable routing functions like the LAN DHCP server, change the NBR750 IP to use an address that does not conflict with the address range your other router is already using, and utilize the DMZ functionality.
To disable the DHCP server in the web gui go to "Advanced > Setup > LAN Setup" and un-check the option for "Use Router as DHCP Server". Click Apply.
To change the IP address of the NBR750 so that it does not conflict with the IP range of your other router, in the web gui go to "Advanced > Setup > LAN Setup" and change the IP address from the default (usually '192.168.1.1') to another range such as '192.168.115.1'. Click Apply.
To set the DMZ address (the static address which will be set for the WAN on your other router) in the web gui go to 'Advanced > Setup > WAN Setup' and select the "Default DMZ Server" option then enter the desired IP address (ex. 192.168.115.2). Click Apply.
NOTE
Once you disabled DHCP and change the IP address of the NBR750 you will no longer be able to connect to it automatically from your PC. In order to connect to it directly you would need to set your PC's IP address manually (statically) to an address within the new IP range of the router. Example: If the NBR750's IP address is set to '192.168.115.1' you would set your PC's IP address to something like '192.168.115.5' in order to access the NBR750 web gui or SSH to it directly. If you are unfamiliar with how to statically assign your PC's IP address you can refer to a guide like the one below:
https://pureinfotech.com/set-static-ip- ... indows-10/
Once your NBR750 has been set to use an IP outside of the range of your other router, has had DHCP disabled, and the DMZ IP configured, you can go to your other router's WAN configuration page and select the 'Static' address option and enter the DMZ IP you designated in the DMZ page of the NBR750. If need to access the NBR750 web gui from a PC connected to the LAN of the other router, you would use the DMZ IP you configured for it (ex. 'http://192.168.115.2'). Some routers' firewall may block access between the LAN and WAN by default so be aware you may need to create a firewall rule to allow LAN clients on the other router to access the WAN IP address of your NBR750.
If you wish to disable wifi completely on the NBR750 when using it with another router you can simply issue 'wifi down' interactively at the SSH prompt. Conversely, if you wanted to create a script that disables wifi after every reboot, you could do so by creating a script file such as '/opt/scripts/wifi_down.sh' with the following content (first 'mkdir /opt/scripts' to create the file under):
The above waits for 2 minutes to make sure all services on the NBR750 have loaded after reboot then issues 'wifi down' in background (redirecting output to 'null' so it doesn't echo to the console for any logged in root user who may have connected via SSH) which deactivates the wifi radios. Once the script is created do not forget to make it executable (chmod +x /opt/scripts/wifi_down.sh) and make it execute at startup by adding a call to it in '/etc/rc.local'.
NOTE
@gilbreen has pointed out that, while 'wifi down' in the CLI does indeed take down the wifi radios, the web interface still shows that wifi is enabled which is different than other units like the LBR20 which show wifi as disabled in the web interface. Just something to be aware of. Also, you'll need to ensure the wifi monitor has been deactivated as well:
Most likely you've purchased or are considering purchasing an Netgear NBR750/NBK752 (the latter being the bundle SKU with an additional satellite included), a.k.a. "Orbi 5G", as your primary or secondary source of Internet connectivity and found your way here through an Amazon review or the 5G LTE Hacks Facebook group. Welcome! Here you will find what you are looking for in terms of working with the unit and getting it to run with your provider and plan of choice. This thread will cover:
- How to flash stable, OEM Netgear firmware
- Unbricking After a Bad Firmware Flash
- General 'Mobile Broadband' WAN Notes
- How to get Command Line Access
- Using SSH Instead of Telnet
- How to disable bloatware (Armor/Circle/ReadyCLOUD) and Auto Updates
- How to set DNS and TTL (to keep data use "on-device")
- How to execute AT commands for "magic" etc.
- How to band or cell lock your modem
- How to receive SMS
- How to split wifi SSIDs (separate 2.4Ghz and 5Ghz SSIDs)
- How to setup DNSCrypt/stubby/OpenVPN/WireGuard or Something Else
- Using the NBR750 as WAN on another router (DMZ mode and disabling wifi radios)
DISCLAIMER
This guide is provided as a reference only without any warranty expressed or implied. If you brick your device, the author is not responsible. You understand that by flashing your device with any firmware which was not provided with your specific unit out of the box, you may have voided any warranty or support which you would normally be entitled to from Netgear during their advertised warranty period. Bear in mind that if you are using an RBS750 satellite, Netgear recommends that you flash any firmware updates there first prior to flashing them on the router (to ensure best compatbility). Proceed at your own risk!
What is the Stable Release OEM Firmware and How Do I Get It?
OEM stands for "Original Equipment Manufacturer", in this case Netgear. While 5G Orbis purchased directly from Netgear or Amazon today likely already have the stable release OEM firmware, it has been found that many of the earlier models that shipped to cellular carriers in Canada or elsewhere have custom firmware based on a early beta release from Netgear.
While these may run well enough, they are missing some goodies like native TTL adjustment in the GUI and possibly security/bug fixes that Netgear added to the first stable release of official OEM firmware which is version 4.6.5.11. All of my discovery and work on this unit so far has been on this release of firmware thus that will be the one recommended to flash to your unit for the purposes of this tutorial. If that should change I will update the OP here. The 4.6.5.11 stable release can be obtained directly from Netgear here and I have found no ill effects from flashing units which previously had Canadian carrier-specific or other beta releases already present:
https://www.downloads.netgear.com/files ... 1.5.64.zip
(Older, initial version can be found here for posterity but is *NOT* recommended since it is missing important security patches: https://www.downloads.netgear.com/files ... 6.5.11.zip)
To flash the Netgear OEM firmware above, simply extract the .chk file from the .zip, then login to the web GUI (usually by browsing to 'http://192.168.1.1') and go to 'Advanced > Administration > Firmware Update > Manual Update > Update > Browse' to select the extracted .chk file; click Upload and confirm the update allowing time for the upload/flash/reboot to complete. After the unit comes back online, you need to reset it to factory defaults ('Advanced > Administration > Backup Settings > Erase'). Be aware that you will have to go through the initial setup in the web browser again when performing this step. You can now proceed with the rest of this guide.
Unbricking After a Bad Firmware Flash
If you have accidentally bricked your device during firmware flash and it will no longer boot up completely, please refer to the following Netear KBA for recovery instructions. When performing a recovery flash it is recommended to flash back to Netgear stock v4.6.5.11:
https://kb.netgear.com/000059634/How-do ... =000059634
The Netgear KBA requires TFTP. If you don't have TFTP installed on your PC, refer to the following:
https://teckangaroo.com/enable-tftp-windows-10/
NOTE
Be aware there is modem firmware separate from the NBR750 router firmware. The modem inside is a Quectel RM502Q-AE and, as of this writing the current LTE firmware for the NBR750 modem is version the R11A04 revision which seems to work fine. I have not tested either the later R11 revisions or R13 firmware from Quectel directly at this time. If you decide to test this be aware it may cause issues as the RM502Q-AE in the NBR750 is in PCIe mode which uses the new Modem Host Interface (MHI) instead of the USB 3.0 bus to pass data. This is fairly unique to this unit as most RM502Q-AE setups using m.2/NGFF connections which do not have PCIe bus access (nor does any mainline OpenWRT kernel mod package exist for MHI yet). This may be confusing information but suffice it to say the mode of operation for the modem in the NBR750 is unique so flashing it with the latest Quectel firmware has the potential to cause issues since nearly all other routers using this model of modem have only be tested using the USB bus to pass data.
General 'Mobile Broadband' WAN Notes
If you will be using the router's modem as your main source of Internet connection (WAN) then under 'Advanced > Setup > Internet Setup > Mobile Broadband Settings' you will need to make sure you choose the dropdown option for 'Always use Mobile Broadband'. Also, in many cases you will need to set your appropriate APN information here as well and for PDP setting most carriers now require at least 'IPV4V6' or 'IPV6'. If you are using a voice/phone line SIM in the device from a carrier such as T-Mobile then you will likely notice that no connected devices have no Internet connectivity if your PDP is set to 'IPV4' only. This is because most cellular carriers and ISPs use IPV6 across their entire network stack and rely on the cellular modem or connected router on the client side to perform IPV4 to IPV6 translation.
How to Get Command Line Access - UPDATED METHOD
Install Python 3.8+ and download the 'telnet-enable2.py' script from here:
https://github.com/bkerler/netgear_telnet
From the PC with the Python script installed, open a command prompt in the directory where the script has been downloaded and issue the following command:
Code: Select all
telnet-enable2.py 192.168.1.1 [XX:XX:XX:XX:XX:XX] admin [password]
How to Get Command Line Access - OLD METHOD
This method has only been tested with the initial OEM firmware release from netgear (NBR750-V4.6.5.11.zip) and has not been tested with newer firmware. Do *NOT* perform the following steps to restore the configuration backup file if you've already used the 'UPDATED METHOD' in the previous section. The configuration file link and instructions are being left here only for posterity for those who may have some issue with a future Netgear firmware.
Once the aforementioned OEM firmware is installed cleanly and you've performed the required factory reset, you will then need to load a configuration backup to enable Telnet command line access on the device which will allow us to perform subsequent tweaks/mods of our choosing such as issuing AT commands to the Quectel modem inside etc. The configuration backup file can be downloaded below and can be uploaded to your unit in the web interface under 'Advanced > Administration > Backup Settings > Browse > Restore'. It may take a number of minutes for the restore to complete then the router will restart.
https://mega.nz/file/yEETmKoA#6SmlM6QrT ... vtcbR_8guk
Once the configuration backup is restored your Wi-Fi SSID will have been changed to "Orbi62" and the password for both it and the "admin" web interface account will be "Geardog123!" (no quotes). You may also need to update your cellular carrier settings for APN, PDP, etc. in case they were overwritten as well. At this point you should be able to login to the router via Telnet (port 23/tcp) using Windows telnet client (if you have it installed from 'Add/Remove Windows Features') or another Telnet client such as Putty. The username will be "admin" and password is the same "Geardog123!" you use for the account in the web interface already. You are free to change the web interface "admin" password, SSID password, or telnet "admin" password to anything you like at this point.
Using SSH Instead of Telnet
Telnet is pretty rudimentary and not very robust; it also does not allow easy transfer of files to/from the unit so I prefer to configure SSH instead. From a Telnet session you can execute the following which will enable SSH (dropbear daemon):
Code: Select all
cp /etc/shells /etc/shells.bak
rm /etc/dropbear/dropbear_rsa_host_key
printf "/bin/ash\n/bin/sh\n" > /etc/shells
dropbear -R
Code: Select all
cp /etc/rc.local /etc/rc.local.bak
printf "dropbear -R\nexit 0\n" > /etc/rc.local
Code: Select all
passwd
If you wish to disable Telnet on the device at this point you can enter the following commands (will need a restart of the device to take effect):
Code: Select all
fnvram set telnet_enable=0
fnvram commit
By default we still have Netgear bloatware like Armor, ReadyCLOUD, and AWS IoT. Fortunately, Circle does not seem to be a thing this time around but the firmware still has traces of it so that can likely be disabled as well. We can disable all these resource hogging features (assuming you don't use them) via the following commands:
Code: Select all
fnvram set noarmor=1
fnvram set nocircle=1
fnvram set nocloud=1
fnvram set noaws=1
fnvram commit
reboot
To disable automatic firmware updates from Netgear, we can execute the following commands:
Code: Select all
cp /etc/hosts /etc/hosts.bak
echo "127.0.0.1 localhost http.fw.updates1.netgear.com devcom.up.netgear.com" > /etc/hosts
DISCLAIMER
TTL modification may violate your carrier's ToS. The author of this guide is not responsible if your carrier terminates your service due to TTL modification.
To use your own DNS servers you simply need to set them under 'Advanced > Setup > Internet Setup > Mobile Broadband Settings > Domain Name Server (DNS) Address' and enter the IPs for primary and secondary DNS of your choosing there (Ex. 8.8.8.8/8.8.4.4 for Google or 1.1.1.1/1.0.0.1 for CloudFlare). To change the TTL this time around Netgear has made it easy for us. In the web interface simply to to 'Advanced > Setup > Internet Setup > Mobile Broadband Settings > TTL' and enter your desired TTL for the modem interface ('64' for most carriers will work, I use '65' for T-Mobile, Visible users may need '66' etc. Basically just trying to make it ~64 once it reaches the carrier network). Click 'Apply' to save your DNS and TTL changes. Saving will take a minute or two but this value should persist across reboots.
Sending AT Commands to the Modem
Once logged into SSH (or Telnet if you chose to keep that enabled) you can echo your desired AT commands and pipe to the inbuilt 'microcom' function of BusyBox like so:
Code: Select all
echo -ne "AT+EGMR=1,7,\"010101010101010\"\r\n" | microcom -X -t 1000 /dev/ttyUSB2DISCLAIMER
"Magic" (aka IMEI repair) may violate your carrier's ToS or country's regulatory laws. The author of this guide is not responsible if your carrier terminates your service and/or if you suffer any legal repercussions which may result from the modification of your device's factory-issued IMEI.
There is a specific syntax for echoing commands to microcom:
- The complete command should be enclosed in double quotes.
- The command must be appended with \r\n to allow it to execute.
- Commands which include double quotes must have each double quote commented out using a backslash (\).
If you want to send commands interactively to the modem you can do so by opening a connection with microcom directly to the secondary AT port:
Code: Select all
microcom /dev/ttyUSB2Not all AT commands are published but all the ones that are can be found the source modem documentation for the RM502Q-AE (the Quectel modem inside the NBR750): https://www.quectel.com/wp-content/uplo ... l_V1.2.pdf
Band Locking
First, ask yourself why you need to band lock. In most cases you don't need to do this and will really just kneecap yourself from higher speeds. This is because when you band lock you must create a collection of bands to lock and any bands not included will not be used at all. So, if you create a collection (band index) of only one or two bands you will lose carrier aggregation (CA) abilities on any bands not included (assuming the tower allows CA on such bands).
If you still believe band locking is what you want to do you can use the AT command guide linked above to study the proper syntax for doing so. If someone wants to point me to a thread which already has the guide for doing this on the RM502Q-AE then I will be happy to come back and add it to this section. Be aware the commands for this modem are much different than those used in the modem for the LBR20 or other earlier Quectel modems; do not try to use those with this modem.
Cell Locking
As an alternative to band locking, you can lock to a specific cell which, IMHO, is a much more straightforward approach than band locking and will allow you to retain CA abilities without having to guess at the bands. For LTE/DSS at least, cell locking requires physical cell ID (PCI) and E-UTRA Absolute Radio Frequency Channel Number (EARFCN) as input values. There is nuance to LTE cell locking with 5G NSA and the commands will be different for NR compared to LTE. Much of this is covered in the aforementioned AT command guide and I will flesh out further instruction here if someone would like to point me in the direction of pre-written instructions else I will flesh this out as time and interest permit.
How To Receive SMS
Netgear has included an option on the left-hand side of the 'Advanced' page of the web interface which allows you to read SMS messages. This is straightforward. No option to send SMS is included, however.
How to split wifi SSIDs (separate 2.4Ghz and 5Ghz SSIDs)
In theory this can be done in the same way as other Orbi units but be warned I have not tested this specifically on the NBR750. If someone tests this please let me know for confirmation that it does indeed still work...
Refer to the following and read it entirely all the way until the end of the page:
https://digiex.net/threads/step-by-step ... ter.15648/
To simplify the main CLI commands:
Code: Select all
config set wifison-monitor_stop=1
config set wl_ssid="YOUR SSID 2.4Ghz NAME"
config set wla_ssid="YOUR SSID 5Ghz NAME"
config commit
Code: Select all
config get wifison-monitor_stop
config get wl_ssid
config get wla_ssid
reboot
If you only intend to use the NBR750 for the modem and wish to use it as WAN on another router you should disable routing functions like the LAN DHCP server, change the NBR750 IP to use an address that does not conflict with the address range your other router is already using, and utilize the DMZ functionality.
To disable the DHCP server in the web gui go to "Advanced > Setup > LAN Setup" and un-check the option for "Use Router as DHCP Server". Click Apply.
To change the IP address of the NBR750 so that it does not conflict with the IP range of your other router, in the web gui go to "Advanced > Setup > LAN Setup" and change the IP address from the default (usually '192.168.1.1') to another range such as '192.168.115.1'. Click Apply.
To set the DMZ address (the static address which will be set for the WAN on your other router) in the web gui go to 'Advanced > Setup > WAN Setup' and select the "Default DMZ Server" option then enter the desired IP address (ex. 192.168.115.2). Click Apply.
NOTE
Once you disabled DHCP and change the IP address of the NBR750 you will no longer be able to connect to it automatically from your PC. In order to connect to it directly you would need to set your PC's IP address manually (statically) to an address within the new IP range of the router. Example: If the NBR750's IP address is set to '192.168.115.1' you would set your PC's IP address to something like '192.168.115.5' in order to access the NBR750 web gui or SSH to it directly. If you are unfamiliar with how to statically assign your PC's IP address you can refer to a guide like the one below:
https://pureinfotech.com/set-static-ip- ... indows-10/
Once your NBR750 has been set to use an IP outside of the range of your other router, has had DHCP disabled, and the DMZ IP configured, you can go to your other router's WAN configuration page and select the 'Static' address option and enter the DMZ IP you designated in the DMZ page of the NBR750. If need to access the NBR750 web gui from a PC connected to the LAN of the other router, you would use the DMZ IP you configured for it (ex. 'http://192.168.115.2'). Some routers' firewall may block access between the LAN and WAN by default so be aware you may need to create a firewall rule to allow LAN clients on the other router to access the WAN IP address of your NBR750.
If you wish to disable wifi completely on the NBR750 when using it with another router you can simply issue 'wifi down' interactively at the SSH prompt. Conversely, if you wanted to create a script that disables wifi after every reboot, you could do so by creating a script file such as '/opt/scripts/wifi_down.sh' with the following content (first 'mkdir /opt/scripts' to create the file under):
Code: Select all
#!/bin/sh
sleep 120
wifi down >/dev/null 2>/dev/null
NOTE
@gilbreen has pointed out that, while 'wifi down' in the CLI does indeed take down the wifi radios, the web interface still shows that wifi is enabled which is different than other units like the LBR20 which show wifi as disabled in the web interface. Just something to be aware of. Also, you'll need to ensure the wifi monitor has been deactivated as well:
Code: Select all
fnvram set wifison-monitor_stop=1
fnvram commit
reboot