Change country to unlock channels, increase TX-power. (Use at your own risk)

README.md

Disclaimer

Following instructions are provided without any warranty, and may even get you in trouble legally. The instructions are provided for testing, learning, preventing e-waste, and should be use with care. We (including contributers + commentators) are not responsible for any damage to your device(s) or any legal issues.

Getting Started

Instructions have been moved to https://github.com/francoism90/asus-router. :)

@barkmarkin Did you paste them in init-start as well?

A workaround (if init-start doesn't do the trick) is using a cronjob.

@barkmarkin Did you paste them in init-start as well?

A workaround (if init-start doesn't do the trick) is using a cronjob.

İ used winscp to copy it into init start jffs folder it works what is a cronjob,? I'm code disabled

@barkmarkin https://github.com/RMerl/asuswrt-merlin.ng/wiki/User-scripts#creating-scripts

Make sure the script is executable.

Well it is. Maybe it's not the right settings for ax88u pro but it's all fine unless I change a setting and if I reboot its 28 again and settings persist

@barkmarkin https://gist.github.com/francoism90/3dede7973354d067c41bff5e54203fe9?permalink_comment_id=4620888#gistcomment-4620888

See note/warning - changing (WiFi) settings using the UI, will overrule the nvram changes.

I have improved the instructions, based on comments given on this gist (many thanks for that!).

If anything is missing, please let me know. :)

Well thank you if it says 28 then I'm getting the most out of my device correct?

@barkmarkin It all depends, even if your router uses a different country, the device still can use different/legit settings. I think 28 in tx power?

I've done some reading, and tried multiple things, but it seems WiFi is able to send a signal, which make sure no one can actually change the country, as like forcing Germany when being in the EU.

As said in the disclaimer, it may work, but results may vary.

Hi guys,

None of the settings from above worked on my ASUS ZenWiFi Pro ET12.
I am trying to enable the 6GHz channel but nothing seems to work.

nvram set location_code=#a nvram set 0:ccode=#a nvram set 0:regrev=0 nvram set 1:ccode=#a nvram set 1:regrev=0 nvram set 2:ccode=#a nvram set 2:regrev=0 nvram set territory_code=CN/02 nvram set wl_country_code=#a nvram set wl_reg_mode=h nvram set wl2_country_code=#a nvram set wl2_country_rev=0 nvram set wl2_reg_mode=h nvram set acs_unii4=1 nvram set wl_acs_excl_chans_dfs= nvram set wl_acs_excl_chans= nvram set wl2_acs_dfs=1 nvram set wl2_acs_excl_chans_base= nvram set wl2_acs_excl_chans=

Does anyone have any idea what else they may be locking on this router?

Hi, does anyone know which settings change the "PRE-ISM Channel Availability Check (CAC)" for DFS-channels? I don't want to switch DFS off with #a, In-Service-Monitoring is fine and I think necessary. But I'd like to reduce the initial wait time for the WLAN to come up scanning for 60s after every reboot or WLAN channel change. Any tips appreciated - thanks in advance.

@ovidiu4 @Doc-Steve Please use nvram dump, and check the values.

Hopefully you can force this, by changing the nvram setting.

@francoism90 there are literally 5000 lines in the nvram dump and i have no idea what to look for...
Somehow the radio for the 6GHz band is disabled because even though i can change any settings i want, there is no network broadcasting. Asus technicians are useless like always so i am stuck

Hi everyone, I got a dumb question. What does wl0, wl1 and wl2 stand for? Someone on the other forum said it's corresponding to 2.4GHz, 5GHz and 6GHz, but I start to think that's not the case?

@Warborn123 In most cases they are.

You could dump nvram before and after making changes, so check what values are being adjusted.

If I'm not mistaken commands exists as well, but I'm on mobile atm.

@Warborn123 In most cases they are.

You could dump nvram before and after making changes, so check what values are being adjusted.

If I'm not mistaken commands exists as well, but I'm on mobile atm.

Hmmm, interesting. I found the following code on the other forum, and applied it to my UK version AXE11000, and it worked. But I noticed that there's no wl2 command in there, but the TX power of the 6Ghz did get a massive boost. That's when I start to wonder what do wl0, wl1 and wl2 mean.

nvram set location_code=AU
nvram set wl0_country_code=AU
nvram set 0:ccode=AU
nvram set wl1_country_code=AU
nvram set 1:ccode=AU
nvram commit
service restart_wireless

Also, using this command nvram show | grep -e 'country_code\|location_code\|territory_code\|ccode', I got the following results:

0:ccode=AU
1:ccode=ALL
2:ccode=ALL
3:ccode=ALL
location_code=AU
territory_code=EU/01
size: 112260 bytes (18812 left)
wl0_country_code=ALL
wl1_country_code=ALL
wl2_country_code=ALL
wl_country_code=E0

It's quite strange, isn't it? Although the location code is AU now, but the territory code and wl_country are still EU? I was wondering if it's fine to leave it like this, or maybe I should find the command that change the territory_code and wl_country_code to AU as well? Thanks for your help!

@Warborn123 Unfortunately this is in most cases hardware related. They seem to force the region, with some hidden signals. Yeah, it's pretty weird.

So even when you set it, it doesn't mean it (fully) works.

@Warborn123 : Were you also able to change 6 GHz channels on your AXE11000, i.e., to allow those US/Canada channels (channel 97, 6435 MHz and above) that are "forbidden" here in Europe?

@Warborn123 : Were you also able to change 6 GHz channels on your AXE11000, i.e., to allow those US/Canada channels (channel 97, 6435 MHz and above) that are "forbidden" here in Europe?

Yep, it's quite wild. I guess it has something to do with that ccode=ALL or wl2_country_code=ALL. My router now has almost all the frequency band unlocked for 2.4, 5 and 6GHz.

@Warborn123 : Were you also able to change 6 GHz channels on your AXE11000, i.e., to allow those US/Canada channels (channel 97, 6435 MHz and above) that are "forbidden" here in Europe?

Yep, it's quite wild. I guess it has something to do with that ccode=ALL or wl2_country_code=ALL. My router now has almost all the frequency band unlocked for 2.4, 5 and 6GHz.

Cool! That is good news. Thanks!

@Warborn123 : Were you also able to change 6 GHz channels on your AXE11000, i.e., to allow those US/Canada channels (channel 97, 6435 MHz and above) that are "forbidden" here in Europe?

Yep, it's quite wild. I guess it has something to do with that ccode=ALL or wl2_country_code=ALL. My router now has almost all the frequency band unlocked for 2.4, 5 and 6GHz.

thanks that worked for me and i didnt even have to include a file with that text/commands in init start :D

I am a complete beginner in the field, but I think I was able to increase my signal as well on my RT-AX92U
running 3.0.0.4.388_23630-g9d6ee22, I have set nvram as per:
admin@RT-AX92U-95D0:/tmp/home/root# nvram dump | grep 'country|code|location|txpower'
1:ccode=ALL
2:ccode=ALL
3:ccode=ALL
ddns_return_code=,200
ddns_return_code_chk=,200
size: 83778 bytes (47294 left)
fb_country=
location_code=#a
modem_country=
modem_pincode=
modem_pincode_opt=1
oauth_google_auth_code=
rc_support=mssid 2.4G 5G update usbX2 switchctrl manual_stb 11AX pwrctrl WIFI_LOGO nandflash movistarTriple wifi2017 app ofdma wpa3 reboot_schedule ipv6 ipv6pt s46 ocnvc PARENTAL2 dnsfilter dnspriv dualwan pptpd openvpnd utf8_ssid printer modem webdav rrsut cloudsync media appnet timemachine hdspindown diskutility dnssec usb_bk frs_feedback dblog email 5G-2 bwdpi wrs_wbl ookla HTTPS letsencrypt ssh vpnc vpn_fusion repeater psta wl6 user_low_rssi tcode usericon cfg_wps_btn stainfo cloudcheck realip lacp wanbonding wtfast ifttt alexa ipsec_srv mumimo netool cfg_sync no_finiwl fupgrade afwupg betaupg amas bcmwifi bcmhnd mbo conndiag eula proxysta iperf3 gn_wbl amazon_wss account_binding gameMode wireguard ftp_ssl acl96 dhdlog dis11b smart_connect
secret_code=22774156
territory_code=UK/01
wl0_country_code=ALL
wl0_country_rev=0
wl0_txpower=300
wl1_country_code=ALL
wl1_country_rev=0
wl1_txpower=300
wl2_country_code=ALL
wl2_country_rev=0
wl2_txpower=300
wl_country_code=#a
wl_country_rev=0
wl_txpower=300
admin@RT-AX92U-95D0:/tmp/home/root# wl txpwr_target_max
Maximum Tx Power Target (chanspec:0x100e): 25.00 25.00 25.00

But I think location_code was the one that actually affected txpwr_target_max and had it increased from 15.25 to 25 dBm, and this also seems to be persistent. wl*_country_code are just set by the value of location_code.

Ubiquiti WiFiman also states 25 dBm, and I get the impression that my connection in the, from the router, most remote room has improved.

Quick question. It's great to have a little punch with the increased power, but communication works both ways. So has anyone made any beneficial changes to the rxgain settings?

These settings work great on my RT-AC66U (Asuswrt-Merlin 374 LTS Beta - 374.43_53D7j9527)
I get about -20dBm on 2.4GHz and -10dBm on 5Ghz compared to stock.

#!/bin/sh

# Allow all channels
nvram set pci/1/1/ccode=#a
nvram set pci/1/1/regrev=0
nvram set pci/2/1/ccode=#a
nvram set pci/2/1/regrev=0
nvram set regulation_domain=#a
nvram set regulation_domain_5G=#a
nvram set wl_country_code=#a
nvram set wl_country_rev=0
nvram set wl0_country=#a
nvram set wl0_country_code=#a
nvram set wl0_country_rev=0
nvram set wl0_reg_mode=off
nvram set wl1_country=#a
nvram set wl1_country_code=#a
nvram set wl1_country_rev=0
nvram set wl1_reg_mode=off

# Channel selection
nvram set wl0_chanspec=1l
nvram set wl_chanspec=100/80
nvram set wl1_chanspec=100/80

# Set TX-Power
pci/1/1/maxp2ga0=0x78
pci/1/1/maxp2ga1=0x78
pci/1/1/maxp2ga2=0x78
pci/2/1/maxp5ga0=120,120,120,120
pci/2/1/maxp5ga1=120,120,120,120
pci/2/1/maxp5ga2=120,120,120,120
pci/2/1/maxp2ga0=120
pci/2/1/maxp2ga1=120
pci/2/1/maxp2ga2=120
nvram set wl0_TxPower=708
nvram set wl_TxPower=708
nvram set wl1_TxPower=708

# Commit changes
nvram commit

@sarusani : Cool, let's see how much you are really blowing out 😁

1. First check the maximal allowed dbm per channel, for 5GHz most likely eth6 is the correct interface on your router model: wl -i eth6 chanspec_txpwr_max
2. Then check the nominal power (on some Asus models this is simply the value from 1. minus 1.5 dB): wl -i eth6 txpwr_target_max
3. Check the maximum power with wl -i eth5 txpwr1 (Note: You can set this up to 30.75 dbm or so, but you cannot get this much of power out, because it is capped by the limit from 1.)
4. With this you can check the last actual used power per antenna: wl -i eth6 txpwr_adj_est

Quick question. It's great to have a little punch with the increased power, but communication works both ways. So has anyone made any beneficial changes to the rxgain settings?

Let's see how well your router is hearing your clients

1. First see who is connected, for 5 GHz most likely the interface is eth6: wl -i eth6 assoclist
2. Then for each connected client you can check: wl -i eth6 sta_info MAC ADDRESS OF CLIENT, then you see amomg many things, RSSI

In general, if your client has a very low RSSI seen from the AP, then you should try to improve Tx power on the client side. If your client runs on linux and has a wifi card which is not self-managed, then there might be options to do that, e.g., changing regulatory country settings with iw reg set XX etc. However: If your client has an Intel card, e.g., AX-2XX, with LAR (Location-Aware Regulatory), then you have to stick what LAR detects as country, you cannot override it with iw because the interface is shown as self-managed by LAR 💩

I tried to get some infos, but I'm not very successful...

If I look at the nvram show data I can find eth0 & eth1 eth2:

acs_ifnames=eth1 eth2
wl_ifnames=eth1 eth2
lan_ifnames=vlan1 eth1 eth2
wl_ifname=eth2
wl0_ifname=eth1
wl1_ifname=eth2
wan_ifnames=eth0
wan0_ifname=eth0
ipv6_ifname=eth0

So eth1 is 2.4GHz and eth2 is 5GHz.

chanspec_txpwr_max, txpwr_target_max & txpwr_adj_est report
wl: Unsupported

txpwr1 reports
TxPower is 127 qdbm, 31.75 dbm, 1496 mW Override is Off

_sta_info_
5GHz (eth2)
Closest device: (about 3 meters from antennas)

rateset [ 6 9 12 18 24 36 48 54 ]
idle 10 seconds
in network 671 seconds
state: AUTHENTICATED ASSOCIATED AUTHORIZED
flags 0x613a: WME PS N_CAP
tx pkts: 437
tx failures: 0
rx ucast pkts: 861
rx mcast/bcast pkts: 42
rate of last tx pkt: 866667 kbps
rate of last rx pkt: 6000 kbps
rx decrypt succeeds: 456
rx decrypt failures: 0

Farthest device: (about 20 meters from antennas - one floor down)

rateset [ 6 9 12 18 24 36 48 54 ]
idle 1 seconds
in network 1180 seconds
state: AUTHENTICATED ASSOCIATED AUTHORIZED
flags 0x603a: WME N_CAP
tx pkts: 2772
tx failures: 0
rx ucast pkts: 3193
rx mcast/bcast pkts: 224
rate of last tx pkt: 216000 kbps
rate of last rx pkt: 200000 kbps
rx decrypt succeeds: 3535
rx decrypt failures: 0

2.4GHz (eth1)
Closest device:

rateset [ 1 2 5.5 6 9 11 12 18 24 36 48 54 ]
idle 0 seconds
in network 187 seconds
state: AUTHENTICATED ASSOCIATED AUTHORIZED
flags 0x613a: WME PS N_CAP
tx pkts: 10124
tx failures: 4
rx ucast pkts: 2582
rx mcast/bcast pkts: 55
rate of last tx pkt: 130000 kbps
rate of last rx pkt: 1000 kbps
rx decrypt succeeds: 2083
rx decrypt failures: 0

Farthest device:

rateset [ 1 2 5.5 6 9 11 12 18 24 36 48 54 ]
idle 2 seconds
in network 1707 seconds
state: AUTHENTICATED ASSOCIATED AUTHORIZED
flags 0x613b: BRCM WME PS N_CAP
tx pkts: 798
tx failures: 0
rx ucast pkts: 1570
rx mcast/bcast pkts: 593
rate of last tx pkt: 72222 kbps
rate of last rx pkt: 24000 kbps
rx decrypt succeeds: 1513
rx decrypt failures: 0

Some measurements from my phone: (about 3 meters away)
Stock:
2.4GHz & 5GHz: -37dBm

New:
2.44GHz: -14dBm
5GHz: -26dBm

Quick question. It's great to have a little punch with the increased power, but communication works both ways. So has anyone made any beneficial changes to the rxgain settings?

Let's see how well your router is hearing your clients

1. First see who is connected, for 5 GHz most likely the interface is eth6: wl -i eth6 assoclist
2. Then for each connected client you can check: wl -i eth6 sta_info MAC ADDRESS OF CLIENT, then you see amomg many things, RSSI

In general, if your client has a very low RSSI seen from the AP, then you should try to improve Tx power on the client side. If your client runs on linux and has a wifi card which is not self-managed, then there might be options to do that, e.g., changing regulatory country settings with iw reg set XX etc. However: If your client has an Intel card, e.g., AX-2XX, with LAR (Location-Aware Regulatory), then you have to stick what LAR detects as country, you cannot override it with iw because the interface is shown as self-managed by LAR 💩

Was just an enquiry but i hope your reply helps someone else understand too. I don't really have any connection problems, my furthest device gives an RSSI of -64dBm on 5GHz. I've also managed to tune to output power down a little to reduce interference with my wireless headphones.

is there any way to set the territory code on an ac86u? i have also tried creating a chrono job, but nothing, once the router reboots it returns WE/02 and the AC script is not activated. also i would like to understand which country this code belongs to because it does not appear anywhere

is there any way to set the territory code on an ac86u? i have also tried creating a chrono job, but nothing, once the router reboots it returns WE/02 and the AC script is not activated. also i would like to understand which country this code belongs to because it does not appear anywhere

Please try:
nvram set location_code=#a
nvram commit

And reboot. This trimmed my previously German registered RT-AX92U quite a lot.

already tried it and it doesn't work. the territory code always resets to WE/02 every time the wireless is restarted, and there is no way for it to change unless you manually force it, but it doesn't last long if the router reboots it reverts back to WE/02 the only thing to change is only the location code. actually I don't even know what benefit it gives to change the territory code, since I noticed only the location code to change the transmission speed and the chainspec to unlock hidden channels Il ven 1 mar 2024, 11:22 Jonas ***@***.***> ha scritto:

…

***@***.**** commented on this gist. ------------------------------ is there any way to set the territory code on an ac86u? i have also tried creating a chrono job, but nothing, once the router reboots it returns WE/02 and the AC script is not activated. also i would like to understand which country this code belongs to because it does not appear anywhere Please try: nvram set location_code=#a nvram commit And reboot. This trimmed my previously German registered RT-AX92U quite a lot. — Reply to this email directly, view it on GitHub <https://gist.github.com/francoism90/3dede7973354d067c41bff5e54203fe9#gistcomment-4956644> or unsubscribe <https://github.com/notifications/unsubscribe-auth/BAVJMKBGL6FMQR5L4RN2XIDYWBJFBBFKMF2HI4TJMJ2XIZLTSKBKK5TBNR2WLJDUOJ2WLJDOMFWWLO3UNBZGKYLEL5YGC4TUNFRWS4DBNZ2F6YLDORUXM2LUPGBKK5TBNR2WLJDHNFZXJJDOMFWWLK3UNBZGKYLEL52HS4DFVRZXKYTKMVRXIX3UPFYGLK2HNFZXIQ3PNVWWK3TUUZ2G64DJMNZZDAVEOR4XAZNEM5UXG5FFOZQWY5LFVA4TENZQG44TIONHORZGSZ3HMVZKMY3SMVQXIZI> . You are receiving this email because you commented on the thread. Triage notifications on the go with GitHub Mobile for iOS <https://apps.apple.com/app/apple-store/id1477376905?ct=notification-email&mt=8&pt=524675> or Android <https://play.google.com/store/apps/details?id=com.github.android&referrer=utm_campaign%3Dnotification-email%26utm_medium%3Demail%26utm_source%3Dgithub> .

@Reeplosin and all fyi

In general: If you restart wireless service, you will always return to the values (country etc.) fixed in the driver/firmware (or more precise: To the specific selection burned in the ROM out of all possible values in the driver, see below) So, restarting of wireless service happens also--apart from view exceptions as mentioned above in the comments--when you change settings via GUI.

Thus, there are two ways to overcome this a) put NVRAM changes in the init-start script (and then never issue a restart of wirelss service) or b) do the changes via wl command.

For a) See comments above and follow the golden rule not to restart wireless service!

For b) :

• make sure you have latest wl version, i.e. flash latest merlin firmware. On my AX58U and AXE11000, both on 3004.388.6_2, wl ver Broadcom BCA: 17.10 RC157.2809 wl0: Dec 15 2023 10:37:38 version 17.10.157.2809 (r801046) 8e0370b

• check available commands of wl with: wl -h and, yes this gives a different result, wl -i eth6 -h (assuming eth6 is 5G here, you need to check devices on your router model)

• Check which countries are available in your current firmware: wl country list You can only select one of this country listed here.

• Each country comes with a certain list of "revisions". These are regulatory settings that have changed over time, you can check which ones are supported with e.g., wl country_rev US

• You set a country with a specific revision as wl -i ethXX country "US/699" (For Country = ALL you don't need to specify the revision)

• So, you can do on your asus, assuming eth6 is 5G:

wl -i eth6 down
wl -i eth6 country ALL
wl -i eth6 country_abbrev_override "US"
wl -i eth6 regulatory 1
wl -i eth6 chanspec 36/160
wl -i eth6 up
wl -i eth6 5g_rate auto
wl -i eth6 txpwr1 -o -m 1496

Result:

1. Country ALL will result in the maximum power your device can blow out in 2G / 5G / 6G and make all channels selectable. The maximum power your router can blow out is limited in the driver/firmware for country = ALL. You cannot go higher than this, independant what you select in NVRAM or with 5. below. These values are fixed in the CLM (country locale matrix) Blob loaded into the driver. Check it wich wl clmver. Or if you manage to hack the CLM Blob, you could override and load it via wl -i eth6 clmload

2. country_abbrev_override "US" this will make your wifi now look as if it has country US although it is set to ALL, i.e. the 802.11 beacon contains now country = US. This is very useful, if your clients in STAtion mode detect country settings based on beacon country info. If you don't send country info in the beacons, i.e. just set country to ALL, then your wifi client might switch to "world" mode. This is the least common denominator of all regulations on this planet, i.e. the most conservative setting: No (!) 6G and in 5G only very few channels with very little Tx power...

3. regulatory 1 : Set 5G to 802.11d and disable 802.11h (DSF). You can check it with wl -i eth6 spect 802.11d mode

4. chanspec : Set your channel here NOT in the GUI! Remember: Setting it in the GUI, will return to ROM settiings. For 80 or 160 MHz channels, you need to select a 20 MHz channel in the 80/160 MHz and not the center frequency of the 80/160 MHz channel. This will not work.
   Even on a AX58U you can use the full UNII-4 band, i.e. 165/160 is possible. Don't know if this will work on your router.
   Check settings with wl -i eth6 status Mode: Managed RSSI: 0 dBm SNR: 0 dB noise: -87 dBm Channel: 165/160 ...

5. txpwr1 : See my comment above what this means.

NOTE: If your client uses Intel AX-2xx adpaters: You will always end up in a mess!! They use LAR... I changed to Mediatek MT7922 (RZ616). This one even gives me 6G on Windows 10 and has no LAR, so you can use all wifi channels.