AiMesh on a T-Mobile AC-1900

The wifi in my house can best be defined as tolerable. Occasionally, for no reason I can decipher, it’s great, but there are dead spots and other issues. A lot of it has to do with plaster in the walls I assume, even though I’ve got an Asus RT-AC68U, and a couple of Airport Extremes distributed around. I’ve been considering replacing it all with a mesh router system from Eeero, Google, etc. but they’re pricey and I’m not convinced it’ll fix anything (ever the sceptic). A pair of stories changed that this week. First, Asus released a firmware update to allow their RT-AC68U (and other) routers to be part of a mesh network. Second, refurbished T-Mobile AC-1900 routers (which are just a rebranded RT-AC68U) were on sale for $50. So I took a chance and snagged one.

NOTE: This procedure worked for me, but I started with a modified CFE, copied from my existing RT-AC68U to make it work.  As soon as you put a non-standard firmware on your router, your warranty is over, and you might have a brick on your hands.  The risk is all yours.

What you’re doing in all of this is two parts, you’re replacing the T-Mobile CFE, which is the low-level code and details that get the router started, with one from an official Asus RT-AC68U.  The hardware is the same, the CFE describes it differently and enables the hardware to do its thing.  Next, you’re updating the firmware with one from Asus that does what you want.  When complete, the T-Mobile router will claim to be an Asus RT-AC68U.

I googled around and found various posts related to flashing the AC-1900 to be able to accept normal Asus firmware updates. These were mostly from people who spend a lot of time mucking around with their routers, so their instructions are often lacking much explanation or background.  Hopefully this post will help out the more casual hobbyist, like me.

The main sources for a working procedure came from this excellent post from goggles99, which is really 99% of the process that worked for me and about 1/10th the size of this post.

I also got a good idea of what was going on from although following their process never fully worked for me and I never could figure out why, but rather than use the online CFEditor, once I decided to just copy the CFE from my old router, I was successful.  One thing that’s really nice about CFEditor though, is that it’s a quick and easy way to see your MAC addresses from your new router.  Just upload the CFE from the AC-1900 (details, below) and it’ll show them. Obviously, if you want, you can pick a new Source CFE version, and generate a new file to use.  Easier than manually editing.  YMMV.

If you’ve already got an official Asus RT-AC68U, then rather than trust the internet, you can copy the CFE from that to put on your AC-1900. If you don’t have one, maybe you just bought a couple of the T-Mobile AC-1900’s, then you’ll need to get a copy of a CFE from this CFE Dumps page.

I first updated the firmware on my existing RT-AC68U by downloading the firmware file from Asus (you’ll need this later, so keep the file locally – the one I downloaded was RT-AC68U_3.0.0.4_384_10007-g8e859e9.trx) and then upgrading from the file. No problem, and when complete, by default it was set to be used as the mesh Router.  In simple terms, this is the hub and any other devices in the mesh are Nodes that connect back to it.

I also backed up my router configuration in case I did something stupid along the way.

Enable ssh to your router by going to, under the Administration menu, System tab.  I’m on a Mac, so I just use Terminal for all my ssh/scp needs – if on Windows, use Putty.  If on Linux, I’ll assume you don’t need any of my help at this level.

$ ssh
admin@RT-AC68U:/tmp/home/root# cat /dev/mtd0 > rt68u_cfe.bin
admin@RT-AC68U:/tmp/home/root# exit
Connection to closed.
$ scp .

Next, I turned on the AC-1900, plugged into my laptop directly (not on your LAN with the other router, turn of wifi), and enabled ssh on it as well, and did the same thing to make a backup of its original CFE.

$ ssh admin@
admin@AC-1900:/tmp/home/root# cat /dev/mtd0 > original_ac1900_cfe.bin
admin@AC-1900:/tmp/home/root# exit
Connection to closed.
$ scp admin@ .

When that’s done, you’ll have a copy of your rt68u_cfe.bin and your original_ac1900_cfe.bin file.  Next you’ll need a hex editor to modify the rt68u_cfe.bin.  I used HexFiend, but there are other tools, such as CFE Editor listed on this page in the Tools section.

Open both the original_ac1900_cfe.bin file and the rt68u_cfe.bin file in your editor.  You’ll be copying the MAC addresses (3 of them) from the AC-1900 to your RT-AC68U.

  1. Search for “mac” in the AC-1900 file, you’ll find 3 instances of MAC addresses
  2. Copy each of them to the same relative location in the RT-AC68U file
  3. Use Save As to save the RT-AC68U file as rt68u_mod_cfe.bin

Next, you’ll copy your modified RT-AC68U CFE back to your AC-1900, along with the mtd-write script located in the MTD-WRITE section of this page.

First, copy all the files you need to your router (the AC-1900)
$ scp rt68u_mod_cfe.bin mtd-write RT-AC68U_3.0.0.4_384_10007-g8e859e9.trx admin@
$ ssh admin@

Next, make mtd-write executable…
admin@AC-1900:/tmp/home/root# chmod u+x mtd-write

Write the modified CFE to the device using mtd-write…
admin@AC-1900:/tmp/home/root# ./mtd-write rt68u_mod_cfe.bin boot

Update the firmware using mtd-write2 (which is already on the device – at least it was for me)…
admin@AC-1900:/tmp/home/root# ./mtd-write2 RT-AC68U_3.0.0.4_384_10007-g8e859e9.trx linux

Clear out the nvram and reboot…
admin@AC-1900:/tmp/home/root# mtd-erase2 nvram
admin@AC-1900:/tmp/home/root# reboot

At this point, your AC-1900 should reboot, claim itself to be an RT-AC68U, and have the latest firmware on it. As a last step in all of this, I went ahead and held the reset button for 5-10 sec, forcing a reset to factory settings (which is probably unnecessary, but I did it anyhow).

Now, before doing anything else, disconnect from your new router, get back on your LAN (wired or wifi) and log in to your existing router. On the Network Map page, there’s an AiMesh button under your Clients list. Click that, and the right tab will let you Find AiMesh nodes. Click the Search button and your new router should show up as an RT-AC68U. Select it an Add it as an AiMesh node. When done, it’ll be part of your mesh.

All that got a little longwinded, but hopefully it explains some of the process and gets yo up and running. Thanks to all the people who did the real work to make this possible.