Installing LEDE/OpenWRT on a BT Home Hub 5 / Plusnet One Router

Installing LEDE/OpenWRT on a BT Home Hub 5 / Plusnet One Router

A Step by step guide to instal LEDE/OpenWRT operating system on a BT Home Hub 5 / Plusnet Router

By Fahad Usman

This guide is to show users how to install LEDE on a BT home hub 5. The following instructions will wipe out the existing BT router firmware with the open source LEDE which is a Linux based router operating system!

I would like to recognise following posts/websites/authors for their excellent supporting material for me to follow and embark on this difficult journey! It must be said that I like a challenge but I am also a bit of a newbie at electronics so not everything was obvious to me.

These instructions are complementary to the guides and information that has already been done by the community and in particular thanks goes out to:

“OpenWRT can help you improve router performance, stop adds at the router, QoS, Port mirroring and much much more”

My guide covers all aspects of this process:

  • Opening the routers case
  • Soldering the serial connection
  • Flashing / Installing LEDE and backup of the orginal router firmware
  • Configuring LEDE on the router

Before you start!

Step 1 – Opening the case

If you do not open the case carefully you will break the ‘fixing tabs’ inside.

Step 2 – Soldering the serial connection

Get some helping hands for soldering:

You can use your own method for soldering the connections as long as you have access to the required connections on the circuit board and can attach them to a USB to TTL Converter.

Be careful! The hubs soldering points are the tiniest in the world! (perhaps). I never done soldering before so I toasted my hub in the first attempt! Had to buy another hub to try again!

Here is the complete setup after soldering:


RX goes in to TX and TX goes into RX from hub to USB TTL.  Refer to the following table:

Pin No.USB Serial to TTL AdapterWire ColourHome Hub Connection Point
 1n/aWhite boot_sel2 / R45 Pad
 2n/an/a GND / Use the USB socket ground/case pin
 3TXGreen RX / R78 Pad
 4RXRed TX  / R77 Pad
 5GNDn/a GND / Use the ground plane connection of the capacitor
  • You need ‘Boot Selection’ and the other is for the ‘Data Connection’
  • There are 2 grounds because each group needs its own ground.

Step 3 – Flashing / Installing LEDE and backup of the orginal router firmware

      • Attach the USB Serial TTL adapter to the laptop/computer
      • Goto System properties and open up the hardware device manager
      • Update the USB TTL adaptor drivers you downloaded from the Internet
      • This will show on which port your USB TTL adaptor is connected (Mine connected on the COM port 5
      • Fire up Putty and setup your Serial connection to the HUB using the PDF
      • PuTTY window will open and it will be blanked ready to talk to the Home HUB
      • Get a LAN cable and attach it to the Routers port # 1 (yellow Ethernet port) and then Attach the power adaptor to the hub
      • Short the boot_sel2 pin to Ground (GND) and power on the HH5A. Now immediately disconnect the boot_sel2 pin from Ground. The UART ‘CFG 04’ prompt will appear in the PUTTY window.
        Do NOT leave it connected any longer than necessary because it may damage the hub, causing it to remain permanently stuck in ‘CFG 04’ mode!
      • CFG04 mode should now appear in the console. This means it is in a read/write mode. This will look like this:
    ROM VER: 1.1.4
    CFG 04

    If you get CFG06 either you soldering is wrong for the boot select, you did not make a good short for long enough or you did not short the pins properly.

    Transfer ‘HH5A LEDE install image’ to the router

    Transfer the lede-lantiq-bthomehubv5a_ram-u-boot.asc (u-boot) to the router

    • Open the .asc file with Notepad++, select all and copy
    • Goto the Putty console window and right click (should still be open and connected to the router showing the UART mode). The asc file will transfer and execute.
    • After about 90 seconds, the custom U-boot will start and the BTHOMEHUBV5A# u-boot prompt will appear. Which looks like this:
U-Boot 2013.10-openwrt4 (Nov 03 2017 - 19:29:53) BTHOMEHUBV5A

Board: BT Home Hub 5A
SoC:   Lantiq VRX268 v1.2
CPU:   125 MHz
IO:    125 MHz
BUS:   125 MHz
DRAM:  128 MiB
NAND:  128 MiB
Using default environment

In:    serial
Out:   serial
Err:   serial
Net:   ltq-eth

  • On you windows PC set IP on the Ethernet connection to the HUB to be
  • Open TFTPD32
  • Go back to putty
    • Type the following command into the console
      BTHOMEHUBV5A # tftpboot 0x81000000 lede-lantiq-xrx200-BTHOMEHUBV5A-installimage.bin; bootm 0x81000000
    • The file should automatically transfer via TFTP
  • Wait 5+ mins for ‘br-lan’ messages to appear in Putty and then press enter to start the LEDE BusyBox v1.25.1 () built-in shell for installation
  • The br-lan msgs look like this:
[  250.601318] br-lan: port 1(eth0.1) entered forwarding state
[  250.609534] br-lan: port 1(eth0.1) entered forwarding state
[  252.611738] br-lan: port 1(eth0.1) entered forwarding state

Backup BT Firmware (eliban 3.0)
Before doing anything else you need to back your routers original firmware. If you don’t do it and want to go back to the original firmware, your router will not work properly using any other nanddump!

When you remove a pendrive from windows you should eject it properly so the volume is not marked as dirty

  • Plug a pendrive into the USB socket of the router (if a FSCK notice is shown, the volume was not unmounted properly, just a warning but it is better to use a clean pendrive). It will auto mount, usually as USB-A1
  • Get the USB mount name by typing
ls /tmp/mounts
  • Check the pendrive works by doing a directory listing
     ls /tmp/mounts/USB-A1
  • Run the backup command to send the nanddump to the pendrive took (15 minutes to complete on mine)
 nanddump --file /tmp/mounts/USB-A1/hh5a.nanddump /dev/mtd4
  • You can Unmount the pendrive and transfer the nandbackup backup to a PC. You can run the backup process again as above and then binary compare them if you want.
 umount /tmp/mounts/USB-A1
  • It’s time to prepare the router to be flashed.
  • Run the prepare script by entering the command below. This will unlock the internal bootloader. Only ever run this once.
  • The prepare script expects you to type YESIHAVEABACKUP (YESIHAVE A BACKUP). I was entering it without the A and going nuts! Therefore just copy and paste the confirmation.
  • The bootloader is now decrypted, unlocked and rewritten back to the firmware
  • The following msgs will appear on the screen when prepare script is executing
 Starting installation...
TRYING to decrypt u-boot env with key B1D3B4BD0970FCA9261E23C2170DB8E52407C71DAC06098678C0885BC7E68CCD
SUCCESSFULLY decrypted u-boot env

BACKING UP original bootcmd in u-boot env
SETTING custom bootcmd in u-boot env
UNLOCKING u-boot prompt

FLASHING updated encrypted u-boot env
Erasing 128 Kibyte @ 0 -- 100 % complete
Writing data to block 0 at offset 0x0

REMOVING ubi volume OpenRG...

REMOVING ubi volume FFS...

Preparation completed!

Your attached USB media is mounted as a subdirectory at /tmp/mounts/

To install LEDE, run:

  sysupgrade /tmp/mounts//lede-17.01.4-lantiq-xrx200-BTHOMEHUBV5A-squashfs-sysupgrade.bin

Sysupgrade will automatically restart your device when it has finished.
If the CFG-04 UART prompt appears, power-cycle your device!
The hub should now boot up using LEDE.
  • Run sysupgrade by:
sysupgrade /tmp/mounts/USB-A1/lede-lantiq-xrx200-BTHOMEHUBV5A-squashfs-sysupgrade.bin
  • The following msgs will appear:
[email protected]:/tmp/run/mountd/sda1# sysupgrade lede-17.01.4-lantiq-xrx200-BTHOMEHUBV
Cannot save config while running from ramdisk.
killall: watchdog: no process killed
Watchdog handover: fd=3
- watchdog -
Nand upgrade failed
Command failed: Request timed out
  • If this happens. then you will need to restore to the original router firmware and start again. by:
[email protected]:/# restore /tmp/mounts/USB-A1/hh5a.nanddump
  • I also unlocked the UART when asked during the restore process.
Do you wish to unlock the u-boot prompt? This will allow use of tftpboot etc.

Unlock [y/N]: y
  • Once restore process is completed, then reboot by = [email protected]:/# reboot
  • start all over again from sending the .asc file to the router and then tftp process and then prepare script execution and then sysupgrade! (I know life is hard) 🙁
  • This should take you to the CFG04 message on screen and this means the flash has finished successfully
  • Powercycle the router 
  • If you get into VR# prompt after powercycle run these two commands and power cycle the router again:
setenv bootcmd ubi part UBI\; ubi read \$(loadaddr) kernel\; bootm \$(loadaddr)
  • Power cycle the router again and you should see: (eventually)
BusyBox v1.25.1 () built-in shell (ash)

    /        /\      _    ___ ___  ___
   /  LE    /  \    | |  | __|   \| __|
  /    DE  /    \   | |__| _|| |) | _|
 /________/  LE  \  |____|___|___/|___|            
 \        \   DE /
  \    LE  \    /  -----------------------------------------------------------
   \  DE    \  /    Reboot (17.01.4, r3560-79f57e422d)
    \________\/    -----------------------------------------------------------

=== WARNING! =====================================
There is no root password defined on this device!
Use the "passwd" command to set up a new password
in order to prevent unauthorized SSH logins.
[email protected]:/#
  • Setup root password to disable telnet and enable ssh by:
    passwd + Enter
  • If you don’t see wireless settings under the Network menu at Then restore stock BT firmware and try flashing LEDE again.Above process can usually be completed in about 10-15 minutes. Refer to section 5 of the Installation Guide.

Leave a Reply

Close Menu