CMCC RAX3000M is a router customized by China Mobile, available in two versions: EMMC version (high-performance) and NAND version (standard). The difference is that the high-performance version has 64GB of eMMC, while the standard version has 128MB of flash storage.
CMCC RAX3000M offers great value for money and is currently the highest configuration equipped with the MediaTek MT7981B chip. The main parameters are as follows:
-
Processor: MediaTek MT7981B Dual-core 1.3GHz -
RAM: 512MB -
eMMC Storage: 64GB -
FEM Amplifier: Integrated 5-path -
Wireless Protocol: Wi-Fi 6 (802.11ax) -
2.4G WiFi 2×2 574Mbps -
5G WiFi 2×2 2402Mbps -
Network Ports: Gigabit Ports × 4 -
USB Ports: USB 3.0 × 1
Detailed parameters: https://mao.fan/Router/telecom/RAX3000MS
The standard version is about 110 RMB on second-hand markets, while the high-performance version is around 140 RMB. With 512MB of RAM and USB 3.0 configuration, this is quite luxurious compared to other routers that usually cost several hundred RMB.
CMCC RAX3000M
▲ I bought a brand new one for 145 RMB at a seafood market, documenting the process of tinkering with it.
▲ Why does it look so much like Huawei’s AX3? It even won the 2023 Red Dot Design Award, making it one of the few operator routers with a sense of design.
Identifying RAX3000M Version
The mainstream method online is to check the label on the back of the router. Look for the label slightly above the back of the router marked “Manufacturer” and find the letters CH:
-
NAND: Only CH -
EMMC: CH is followed by EC
Version Identification
However, this method is not absolute. The only definitive standard is to enable SSH and input the command df -h to check the size of your storage space. If there is a partition of over 50GB, it indicates EMMC; otherwise, it is NAND.
Enabling SSH
Mobile System
▲ The official firmware has no playability and may even lock the device. To unleash the hardware’s performance, flashing is necessary.
The steps to enable SSH for both EMMC and NAND are the same: export configuration -> decrypt -> modify configuration -> encrypt -> import configuration. Reference tutorial: https://blog.codee.top/rax3000m%E6%90%9E%E6%9C%BA%E7%9B%AE%E5%BD%95/
The production date of my router is 20240117, and the configuration file is encrypted. If yours is the same as mine, you can use my modified configuration file.
RAX3000M High-Performance Flashing Package
Flashing Package
Quark cloud disk link: https://pan.quark.cn/s/5843822ebc54
Ali cloud disk link: https://www.alipan.com/s/yzpEccRk2at
Step 1: Export Configuration File
First, in the system: Configuration Management -> Export Configuration File to obtain a configuration file named cfg_export_config_file.conf.
Step 2: Modify Configuration File
Download the cfg_export_config_file.conf and upload it to a Linux system, or use the WSL subsystem. I am using Ubuntu here.
Decrypt the configuration file:
openssl aes-256-cbc -d -pbkdf2 -k $CmDc#RaX30O0M@\!$ -in cfg_export_config_file.conf -out - | tar -zxvf -
Use an editor to modify the etc/config/dropbear file,
vim etc/config/dropbear
▲ Press i to enter insert mode and change option enable '0' to option enable '1' to enable SSH service. Press esc then :wq to save and exit.
Use an editor to modify the /etc/shadow file to clear the root user password:
vim /etc/shadow
▲ Delete the password between the two colons for root, then :wq to save.
Use the encryption packaging command:
tar -zcvf - etc | openssl aes-256-cbc -pbkdf2 -k $CmDc#RaX30O0M@\!$ -out cfg_export_config_file_new.conf
▲ Here, a permission error may appear, but ignore it; the encryption packaging has been completed.
Import New Configuration File
Go to the system backend Configuration Management -> Import Configuration File, select the modified cfg_export_config_file_new.conf, and after rebooting the router, you can access it via SSH with the root user at the default address: 192.168.10.1.
Writing U-Boot File
This device’s U-Boot has three types. Generally, the U-Boot from ImmortalWrt is used more often due to better compatibility, so I will use this one.
Reference for flashing U-Boot: https://github.com/AngelaCooljx/Actions-rax3000m-emmc
Download the U-Boot file and upload it to the router’s /tmp/uboot directory.
Upload U-Boot File
▲ Use WinSCP tool to upload the downloaded U-Boot file to /tmp/uboot/. Note that there is no U-Boot folder in the tmp directory, so we need to create one.
Then SSH into that directory and enter the command:
md5sum mt7981-cmcc_rax3000m-emmc-gpt.bin
md5sum mt7981-cmcc_rax3000m-emmc-bl2.bin
md5sum mt7981-cmcc_rax3000m-emmc-fip.bin
Compare the MD5 values:
e6ceec4b9d3e86ef538c8b45c1b6ffed mt7981-cmcc_rax3000m-emmc-gpt.bin
5b061eed5827146b0a14b774c3c57ab2 mt7981-cmcc_rax3000m-emmc-bl2.bin
f1e0b2f1618857ad4e76c8e1b91e7214 mt7981-cmcc_rax3000m-emmc-fip.bin
Ensure the MD5 values match; otherwise, please stop the following write operations.
The following command is for flashing the EMMC version of U-Boot; do not flash the NAND version randomly.
dd if=mt7981-cmcc_rax3000m-emmc-gpt.bin of=/dev/mmcblk0 bs=512 seek=0 count=34 conv=fsync
echo 0 > /sys/block/mmcblk0boot0/force_ro
dd if=/dev/zero of=/dev/mmcblk0boot0 bs=512 count=8192 conv=fsync
dd if=mt7981-cmcc_rax3000m-emmc-bl2.bin of=/dev/mmcblk0boot0 bs=512 conv=fsync
dd if=/dev/zero of=/dev/mmcblk0 bs=512 seek=13312 count=8192 conv=fsync
dd if=mt7981-cmcc_rax3000m-emmc-fip.bin of=/dev/mmcblk0 bs=512 seek=13312 conv=fsync
Write U-Boot
▲ No errors indicate that U-Boot has been successfully flashed!
Flashing OpenWrt Firmware
There are many firmware shared by experts on the Enshan Forum. Here are the functions I want to achieve by flashing:
-
USB auto-mounting -
USB network sharing -
Internet access -
DDNS functionality -
Download functionality -
Aliyun WebDAV -
AdGuard Home -
WeChat notification push -
Intranet penetration -
Speed test service -
Link aggregation -
Running PCDN
Flashing Firmware
▲ The flashing process is quite simple. Connect the router to the computer, set the computer’s fixed IP to the 192.168.1.x subnet, and enter 192.168.1.1 in the browser to upload the OpenWrt firmware. Click Update and wait about 3 minutes. Set the computer to DHCP and check if it has obtained an IP address.
OpenWrt
▲ Default username and password: root. Backend address: 192.168.100.1
System Display
▲ Compiled a firmware that meets the requirements, comes with the istore app store, making it easy to install common plugins, very user-friendly for beginners.
5G Wireless Speed Test
The router is placed on the sofa, about 1 meter above the ground, in a 90-square-meter apartment. I tested four positions (a, b, c, d), each tested three times, only measuring the 5G signal to simulate coverage for a three-bedroom apartment.
5G speed test results are as follows:
Speed Test Results
5G Speed Test
▲ The 5G signal speed test results are not very good. Among MT7981B routers, this one has relatively weak signal. I’m not sure if it’s due to the firmware or if the router is just at this level.
EMMC Partition
After entering the system, I found that the eMMC was not mounted. By default, there are no partitions, and there is some idle space that needs to be partitioned using the cfdisk command:
opkg update
opkg install cfdisk
cfdisk
▲ Use SSH tool to connect to the router and install cfdisk command.
Create New Partition
cfdisk /dev/mmcblk0
▲ Find the bottom Free Space and select New.
▲ The maximum remaining space is allocated by default; just press enter.
▲ Move to write and press enter, type yes, then press q to exit.
▲ The system will automatically mount, and you can check the mount point for new space.
Rebirth of PCDN
This rax3000m high-performance version was designed by Mobile to exploit users’ bandwidth. It’s not fair, and I don’t know why it later failed. Let’s not forget our original intention; we can set up the router to earn a few cents every day, which is pretty good!
Here are three PCDN programs that can be run:
-
TianTian Wish -
WangXin Cloud -
Station
TianTian Wish requires using Docker containers, which is a bit complex, so I gave up; WangXin Cloud requires 200GB of hard disk space, so I also gave up. The Station has no requirements, so I used the built-in eMMC to run it casually.
Station – Edge Computing
▲ Install directly from the istore store, select the storage path, and save to start. After a few days of testing, the built-in 64GB storage can earn about 0.2 RMB per day.
USB Interface Features
The router has a USB interface, which generally has three functions: inserting a USB hard drive to share files, sharing a USB printer, and connecting to the internet via USB!
USB File Sharing Read Speed
▲ Inserted a 128GB solid-state drive, which auto-mounted.
▲ Network sharing → Check the option in the image above → Name it arbitrarily → Copy the mount point path and save to apply.
▲ Using the Samba4 protocol, I achieved a stable reading speed of 105MB/s, which is quite fast and nearly full gigabit internal network speed.
USB Mobile Network Sharing
In places where broadband access is inconvenient, you can use your phone to share a hotspot, with the router’s USB port acting as the WAN port to use the phone as a gateway.
This firmware has already compiled the USB network sharing plugin. If your router does not have this plugin, you can install it manually. The steps are as follows:
First, update the software repository:
opkg update
Install the following components:
-
kmod-usb-net -
kmod-usb-net-rndis -
kmod-usb-net-cdc-ether -
usbutils
Install them all at once using the following command:
opkg install kmod-usb-net kmod-usb-net-rndis kmod-usb-net-cdc-ether usbutils
Note: You must insert the USB device (phone) for USB network sharing to be recognized!!!
▲ After inserting the phone’s USB, this interface will appear; otherwise, it won’t show up.
▲ Select the firewall area for the interface as WAN and save.
▲ You can see that the USB interface has obtained an IP address and has data. You can open a webpage to access the internet.
For USB printers, use the CUPS printing service, which is an open-source printing system from Apple that can be used on Unix-like systems. After installing it from the istore and connecting the printer, install the corresponding drivers; I won’t demonstrate this here!
Power Consumption & Summary
As a device that stays online 24/7 at home, power consumption is also important. I measured the daily power consumption and power consumption with a USB hard drive connected as a reference.
Standby Power Consumption
Power Consumption with USB
The power consumption is at the normal level for MT7981B routers, with an increase of 2W after connecting the USB device, which is standard.
The Mobile RAX3000M EMMC customized device has been tinkered with for about a week. This router has a high playability factor, essentially functioning as a low-end soft router with 64GB of space, 512MB of memory, and USB 3.0 interface, allowing for various functionalities to be tried out. The downsides are the weak 5G signal and slightly high CPU temperature (60-70 degrees), with poor heat dissipation!