Three ZTE MC7010 Outdoor 5G router

[bon]

Let's start a separate thread about this specific router as the other one is become hard to read through.

I've just bought the Three model that an eBay seller has on their marketplace - anyone know if this is flashable with alternate firmwares without killing its ability to get a signal? Ideally I'm looking for the ability to cell lock and as I understand it the Chinese firmware has this but I cannot find evidence that anyone has flashed a Three varient yet.


[edit]
What we know about the Three model

​

• Credentials are user / password, rather than 'admin' / password as you'd expect

• Model is 'D' variant (MC7010D) and so is only flashable with other 'D' firmware types.

• Bridge mode works with no issues.

• Latest firmware available is from Nov 2023. You do not need a Three SIM to receive the update, it seems to work on any network. H3G_GB_MC7010DV1.0.1B01

• Cell locking / band selection works still via javascript hack: https://gist.githubusercontent.com/...937d1ade3f4f563891752a86a3f7bcb096d6f9/zte.js

• Works with a normal PoE switch / adaptor (i.e. isn't passive)

 

[meritez]

4PDA MC7010 firmware

 

[graffiti9912]

Hi. I've also ordered this router from ebay as £150 seems like a very good price and I might be able to get better signal than with indoor router.

My question is how to mount it on a window? I've seen that the newer model of this router comes with suction window mount, but this one doesn't. Any solutions for that? Maybe someone can recommend a 3rd party suction mount that I would be able to adapt (with tape/cable ties/etc) to fit this router to a window?

 

[meritez]

@graffiti9912 I tend to use 3M Command Strips for non-permanent fixtures.

 

[bon]

4PDA MC7010 firmware

Appreciate it, however I was looking more for experiences of anyone who has had the courage to try and flash a Three branded MC7010 with alternative firmware.

I've already killed an MC801a in the past doing this and don't fancy making another sacrifice! Maybe user@555 could restore it if it goes ***s up...?

 

[meritez]

@bon @USER@555 may respond to this thread, it's more of a link to known working firmware, I'm not wanting anyone to just try to flash the MC7010.

 

[bon]

Hi. I've also ordered this router from ebay as £150 seems like a very good price and I might be able to get better signal than with indoor router.

My question is how to mount it on a window? I've seen that the newer model of this router comes with suction window mount, but this one doesn't. Any solutions for that? Maybe someone can recommend a 3rd party suction mount that I would be able to adapt (with tape/cable ties/etc) to fit this router to a window?

I'm not sure I could ever trust suction mounts with the weight of these things - in my case I drilled the mount to an external wall though I understand not everyone is willing/able to do this.

 

[bon]

It seems like you can't back up the .qcn file as the (Three) router will not go in to diagnostics mode when you run the "switchport" program. I've confirmed it to work on the mc801a I have spare so it's not a PC config issue. Maybe Three have disabled the USB port.

I assume it's still able to be put in to 'flash' mode via the test points on the motherboard but I wouldn't fancy doing that without a backup of the nvram/qcn...

 

[USER@555]

It seems like you can't back up the .qcn file as the (Three) router will not go in to diagnostics mode when you run the "switchport" program. I've confirmed it to work on the mc801a I have spare so it's not a PC config issue. Maybe Three have disabled the USB port.

to switch router MC7010 in diagnostic ports you need to connect the usb cable and run it within 1 second Sales_DC_SwitchPortV1.00.00.exe as soon as usd cdrom appears
but do not flash it otherwise you will get a brick with problem no service

 

[bon]

You are correct, I had to keep clicking "switchport" every other second for it to recognise, it seems more particular/fussy than the mc801a I have.

But are you saying the Three model is unflashable without 'no service' problem, or an issue with mc7010 in general?

 

[TheGreatDivide]

How easily can Three's firmware be backed up? I mean, backed up in a way where it can be used with the ZTE Framework tool?

I never had any service issues when I flashed my MC7010 (stock v1.0 chinese) to different firmwares (Elisa, PLY, v2.0 chinese). But I went through the ZTE Framework tool and maybe that's why

IIRC, one of them wouldn't connect to 5G (probably didn't support n78). But all was fine when I went back to v2.0 chinese firmware

 

[bon]

The zte tools wont allow you to back up firmware unfortunately, you have to rely on the original firmware being made available publicly and certain models are damaged after flashing to the point of not being able to obtain a signal. If the original firmware isn't available (as is the case with Three) then the unit is useless. As I understand it user555 has a way of fixing failed units but the information to do so yourself hasn't been shared.

 

[daveake]

Let's start a separate thread about this specific router as the other one is become hard to read through.

I've just bought the Three model that an eBay seller has on their marketplace - anyone know if this is flashable with alternate firmwares without killing its ability to get a signal? Ideally I'm looking for the ability to cell lock and as I understand it the Chinese firmware has this but I cannot find evidence that anyone has flashed a Three varient yet.

[Edit: see later posts as issues now resolved]

Mine arrived today. Experience so far is ... mixed.

Connected directly over the LAN port, I can open the web UI however the printed (but faded) password on the label doesn't work. So I can't get past that bit.

Connected via my Draytek load-balancing router, it gives the Draytek and indeed itself a random IP address each time it boots. The web UI doesn't even load via the Draytek.

It does however connect to the internet, using my Vodafone SIM card, and gives me speeds of up to 370/18 Mbps. This is indoors, in a window, where the MC801A would give 250/4. So the hardware seems good but the firmware is broken. Severely.

I've put a 3 SIM in it,, in the hope that new firmware gets pushed out.
Even then I won't be able to login so I'll get back to the ebay supplier about that.

 

[daveake]

I'm not sure I could ever trust suction mounts with the weight of these things - in my case I drilled the mount to an external wall though I understand not everyone is willing/able to do this.

Mine will get screwed to the wall; we're on a hill with no wind cover, and the winds here can get pretty epic.

 

[bon]

@daveake, TheGreatDivide helped me with the auth issue - turns out these Three routers have 'user' as the username rather than 'admin' as you would expect. If you try 'user' along with the password (the password is also printed on the PoE brick if the other one is faded) it'll likely allow you access to the Web based management.

Regarding accessing the Web interface via your Draytek, if it's in load balancing mode you may need to set a rule to forward traffic to 192.168.254.1 to the specific WAN port/gateway. I had to set a similar rule on the ASUS I've used (involving a static route and IPtables) before I could gain access to WBM over the WAN.

As far as it giving itself/passing through a random IP, that's likely just the nature of mobile Internet and something you'd have had on your other router I'd have thought. Voda runs CGNAT anyway so not like it really makes any difference to anything.

 

[bon]

I've put a 3 SIM in it,, in the hope that new firmware gets pushed out.

Mine updated to B09 immediately using a Voda SIM, no Three SIM required unlike my MC801a.

 

[daveake]

The password does work in the ZTE Helper app, so maybe the username isn't admin. More work required ...

Also, re the IP address, according to the ZTE app it's set to 192.168.254.1, but the Draytek was handed a public IP address. I've fixed the WAN IP addresses in the Draytek so that's solved that one.

 

[daveake]

@daveake, TheGreatDivide helped me with the auth issue - turns out these Three routers have 'user' as the username rather than 'admin' as you would expect. If you try 'user' along with the password (the password is also printed on the PoE brick if the other one is faded) it'll likely allow you access to the Web based management.

Regarding accessing the Web interface via your Draytek, if it's in load balancing mode you may need to set a rule to forward traffic to 192.168.254.1 to the specific WAN port/gateway. I had to set a similar rule on the ASUS I've used (involving a static route and IPtables) before I could gain access to WBM over the WAN.

As far as it giving itself/passing through a random IP, that's likely just the nature of mobile Internet and something you'd have had on your other router I'd have thought. Voda runs CGNAT anyway so not like it really makes any difference to anything.

Yeah, my problem was that I didn't understand what was happening, so I tried to open the ZTE UI via the gateway address that the Draytek was handed. I'd not seen this with other routers.

 

[daveake]

@daveake, TheGreatDivide helped me with the auth issue - turns out these Three routers have 'user' as the username rather than 'admin' as you would expect. If you try 'user' along with the password (the password is also printed on the PoE brick if the other one is faded) it'll likely allow you access to the Web based management.

Bingo! Cheers, saved me an email + embarrassment

 

[daveake]

So, now that I've got this setup (cheers @bon!), I can run the "band lock" javascript and see the cell info, signal strength etc.

Firmware is B09.