Anleitung – Unbrick Nanostation

Manual for Unbrick a UBNT Nanostation

compatible for:

  • Nanostation M2
  • Nanostation M2 XW
  • Nanostation loco M2
  • Nanostation loco M2 XW
  • Nanostation M5
  • Nanostation M5 XW
  • Nanostation loco M5
  • Nanostation loco M5 XW

(1) Download the AirOS 5.5.x firmware executable from the Ubiquiti website. Choose XM or XW version depending on your device, If you don’t know, take a guess!

  • XM.v5.5.11.28002.150723.1344.bin, changelog
    • for: AG-HP-2G16, AG-HP-5G23, AG-HP-5G27, AirGrid M2, AirGrid M5, AR, AR-HP, BM2HP, BM2-Ti, BM5HP, BM5-Ti, LiteStation M5, locoM2, locoM5, locoM9, M2, M3, M365, M5, M900, NB-2G18, NB-5G25, NBM3, NBM365, NBM9, NS2, NSM3, NSM365, NSM5, PBM10, PBM3, PBM5, Power AP N
  • XW.v5.5.10-u2.28005.150723.1358.bin, changelog
    • for: AG-HP-2G16, AG-HP-2G20, AG-HP-5G23, AG-HP-5G27, AirGrid M, AirGrid M2, AirGrid M5, locoM2, locoM5, locoM9, M2, M3, M365, M5, M900, NBE-M2-13, NBE-M5-16, NBE-M5-19, NSM2, NSM3, NSM365, NSM5, PBM3, PBM365, PBM5, RM2-Ti, RM5-Ti

(2) Start device into config/maintenance mode: in this precise order, unpower device,

  • configure PC into static IP Netmask
  • press and maintain reset button
  • plug device in, release reset button as soon as LEDs blink (please wait 20-30 seconds)
  • (note 1: LED blink pattern is different depending on device: Sometimes a single LED blinking 3/4 on, 1/4 off, sometimes two LEDs blinking "sideways")
  • (note 2: the static-IP connection to the device must be established before it boots into config mode. It was tricky rebooting the device fast enough that the PC connection did not go down. YMMV.)

(3) TFTP the AirOS 5.5.x firmware into the device:


(note: use this IP regardless of what firmware is already on the device)

tftp > bin
tftp > put complicatedfirmwarefilename.bin flash_upgrade

(note 1: this should only last 3 or 4 seconds, if not, you've done something wrong)

(note 2: it's possible that the device checks whether the firmware is version XW/XM at this point, and refuse to load an incorrect firmware)

tftp > quit

(4) wait approx 10 minutes for the device to reboot (note: don’t try to be too smart, and be patient!)

(5) At this point the AirOS firmware is loaded, but the old settings are still in place. Here I was only able to connect to the device via with read-only credentials. To reset the settings (bu not the firmware), when the device has already booted, press the reset button until LEDs blink, without ever unplugging it.

(6) Now finally we have a factory-setting M5. It gives us an IP in DHCP, and the interface is at, login ubnt/ubnt

(7) And navigating in the admin interface, we can upload the Freifunk firmware for the M5, which we download from

(8) Upon reboot, the device (now on gluon firmware) starts in config mode and with the same static IP set-up as before, we can access the set-up screen at .

From now on, config mode is simply accessed by pressing reset button 5 seconds or so. There is no need to reboot the device.

(9) Finally, do yourself/a future owner a favor: take a sharpie marker, and write down the type of hardware (XW or XM) on the device itself!

further information: UniFi - TFTP soft recovery for bricked access point

→ zurück zu den Anleitungen

CC BY-SA 4.0 2016 Freifunk Magdeburg

freifunk/anleitungen/unbricknanostation.txt · Zuletzt geändert: 2018-01-25 21:30 von tux