Networking¶

Preferred Field Network at TMU¶

Use the GL.iNet field router as the internet and tailnet gateway.

TMU Wi-Fi (WPA2-Enterprise)
    |
GL.iNet GL-MT3000 "eph107"
    - uplink: TMU via 5 GHz station
    - downlink AP: GL-MT3000-8b4 via 2.4 GHz
    - 5 GHz private AP: disabled
    - LAN: 192.168.8.0/24
    - Tailscale: 100.84.198.19
    - Web UI: https://eph107.tailee9084.ts.net/
    |
Mac Wi-Fi: 192.168.8.x
jeffxi-ubuntu: 192.168.8.241 Ethernet / 192.168.8.242 Wi-Fi backup
iDevices Switch 00101614: 192.168.8.115, main robot power switch
robot tools / tablets / dev devices: 192.168.8.x

The Mac should connect to the GL.iNet 2.4 GHz Wi-Fi, not TMU directly, when using this setup. The GL.iNet 5 GHz radio is reserved for the TMU WPA2-Enterprise uplink.

networksetup -setairportnetwork en0 GL-MT3000-8b4 '<router-wifi-password>'
route -n get default

Expected:

gateway: 192.168.8.1
interface: en0

The router handles the ugly part: TMU WPA2-Enterprise / PEAP / MSCHAPv2. Keep TMU credentials out of this repo. See Field Router.

Current GL.iNet persisted radio split:

wireless.default_radio0.disabled=0   # 2.4 GHz local AP on
wireless.default_radio1.disabled=1   # 5 GHz local AP off
wireless.tmu_sta.disabled=0          # 5 GHz TMU client/uplink on

If the router is rebooted and loses internet, check that wireless.tmu_sta.disabled did not come back as 1.

Jeff Xi Ubuntu Operator Host¶

jeffxi-ubuntu is an Ubuntu desktop on the GL.iNet field LAN. It is useful as a Linux operator/flashing/deploy host when a native Ubuntu machine is better than the Mac.

Current network state:

eno1 Ethernet:        DHCP reservation 192.168.8.241/24, default via 192.168.8.1, metric 100
wlxa8b58e476aec WiFi: DHCP reservation 192.168.8.242/24, default via 192.168.8.1, metric 600
tailscale0:           100.108.86.74/32

Ethernet is the preferred path. The GL.iNet has a DHCP reservation for the Ubuntu Ethernet MAC so 192.168.8.241 stays stable across reboots. Wi-Fi is enabled as backup on the same GL.iNet AP with a worse route metric, so Ethernet stays primary when both links are up.

Verify:

ip -br addr show eno1
ip -br addr show wlxa8b58e476aec
ip route

Docker and Home Assistant should come back after reboot:

docker.service: enabled
homeassistant container: restart=unless-stopped, network=host
sleep/suspend/hibernate targets: masked

Home Assistant and Robot Power Switch¶

The lab Ubuntu host runs Home Assistant as the local HomeKit controller:

Switch 00101614 is the main robot power switch. It is paired to Home Assistant through HomeKit Controller, not Apple Home.

Read-only state check:

curl -sS http://192.168.8.241:8123/api/states/switch.switch_00101614 \
  -H "Authorization: Bearer $HA_TOKEN"

Connecting from Mac¶

1. Plug USB-A to USB-C ethernet adapter into Mac
2. Connect ethernet cable from Mac to G1 port 4 or 5
3. Set static IP:

   sudo ifconfig en13 192.168.123.100 netmask 255.255.255.0 up
   

4. SSH into the Jetson:

   ssh unitree@192.168.123.164
   # password: 123
   

Legacy Direct-Mac Topology¶

Internet uplink (TMU directly, or GL.iNet field router Wi-Fi)
    |
  Mac en0 (Wi-Fi) ---- internet
  Mac en13 (USB ethernet) ---- 192.168.123.100
    |
  G1 port 4/5
    |
  G1 internal L2 switch
    |
  WG827 Router (192.168.123.1) ---- add-on, WiFi + optional 4G/5G
  Jetson eth0 (192.168.123.164) ---- wlan0 disabled
  Locomotion (192.168.123.161)
    ├── eth0: 192.168.123.161 (wired, internal)
    ├── wlan0: STA mode (client, for internet, disconnected)
    └── wlan1: AP mode (192.168.12.1, SSID "UnitreeG1", built-in hotspot)
          |
        iPad / phone (192.168.12.x) ---- app control via Bluetooth + Wi-Fi
  Livox Mid-360 Lidar (192.168.123.20)

WG827 Uplink Through GL.iNet¶

The preferred robot-mounted setup is to let the GL.iNet field router handle TMU and let the WG827 use the GL.iNet 2.4 GHz AP as its upstream.

This keeps WPA2-Enterprise, Tailscale, WebFinder, and school-network weirdness on the GL.iNet, which is much better suited to that job. The WG827 just NATs the wired 192.168.123.0/24 robot network out through the GL.iNet.

Current verified state:

Mac Wi-Fi: 192.168.8.109/24, gateway 192.168.8.1
GL.iNet DHCP reservation: f8:5e:3c:ee:42:5e -> 192.168.8.190
GL.iNet static route: 192.168.123.0/24 via 192.168.8.190
GL.iNet 2.4 GHz AP: channel 11, HE20, legacy rates disabled
GL.iNet 5 GHz AP: disabled; 5 GHz radio is reserved for TMU uplink
WG827 br-lan: 192.168.123.1/24
WG827 wlan0: GL-MT3000-8b4 client, DHCP 192.168.8.190/24
WG827 default route: 192.168.8.1
Jetson eth0: 192.168.123.164/24, default route via 192.168.123.1

With the route and firewall rules applied, the Mac can reach 192.168.123.1 and 192.168.123.164 over Wi-Fi only. The Ethernet cable between the GL.iNet and robot/WG827 is not required for SSH or Jetson internet.

UnitreeRouter AP is disabled in this mode. The WG827 has only one 2.4 GHz radio; AP+STA was tested against both TMU and the GL.iNet AP and was not reliable on this GoldenOrb firmware.

DHCP roles are split by subnet:

• GL.iNet serves 192.168.8.0/24 for Mac/iPad/operator devices.
• WG827 serves only 192.168.123.0/24 for robot-side LAN clients.
• WG827 DHCP is explicitly ignored on wwan2/wlan0, so it does not serve the GL.iNet LAN.

WG827 Direct TMU Uplink¶

The WG827 can join TMU directly as a WPA2-Enterprise client and route the wired 192.168.123.0/24 robot network to the internet, but this is a fallback, not the preferred setup.

Verified direct-TMU state:

WG827 br-lan: 192.168.123.1/24
WG827 wlan0: TMU WPA2-Enterprise client, DHCP 10.16.139.247/20
Jetson eth0: 192.168.123.164/24, default route via 192.168.123.1

The current GoldenOrb firmware has the required direct-TMU pieces installed:

• wpad provides wpa_supplicant / hostapd
• CA bundle exists at /etc/ssl/certs/ca-certificates.crt
• TMU PEAP/MSCHAPv2 authentication succeeds after the router clock is correct

Do not try to run TMU uplink and UnitreeRouter AP on this firmware unless you are debugging radio behavior. The MT7603E is a single 2.4 GHz radio and GoldenOrb failed to keep AP+STA up together after successful EAP auth (HOSTAPD_START_FAILED). STA-only works, but GL.iNet upstream is cleaner.

Locomotion Computer Wi-Fi (built-in)¶

The RK3588 locomotion computer has two Wi-Fi interfaces:

• wlan1 (AP mode): Broadcasts a hotspot (configurable SSID, likely "UnitreeG1" or "G1-XXXXXX") at 192.168.12.1. This is the default connection for the Unitree Explore app. iPad/phone connects here directly — no router needed.
• wlan0 (STA/client mode): For connecting the robot to external Wi-Fi (internet access, OTA updates). The app's Bluetooth provisioning flow sends WiFi credentials to this interface, but it currently fails ("Internet Disconnected"). May require Unitree cloud registration.

Jetson Wi-Fi Hotspot (optional, does not persist after reboot)¶

The Jetson's Realtek wlan0 is disabled by default (radio off, hostapd disabled). It can be re-enabled to provide a bridged WiFi AP that puts iPad/phone on the same 192.168.123.0/24 subnet as the wired network. This is useful for iPad app connectivity when the locomotion computer's built-in AP (192.168.12.0/24) is on a separate, unrouted subnet.

Important: nmcli/wpa_supplicant AP mode does NOT work with this Realtek adapter (kicks clients with reason_code=2). Must use hostapd.

Setup Script¶

Run these commands on the Jetson via SSH. None of this persists after reboot.

# 1. Tell NetworkManager to ignore wlan0
sudo nmcli device set wlan0 managed no

# 2. Create bridge and move eth0 into it
#    (briefly disrupts SSH - run in one session)
sudo ip link add br0 type bridge
sudo ip link set br0 up
sudo ip link set eth0 master br0
sudo ip addr del 192.168.123.164/24 dev eth0
sudo ip addr add 192.168.123.164/24 dev br0

# 3. Write hostapd config
sudo tee /etc/hostapd/hostapd.conf << EOF
interface=wlan0
bridge=br0
driver=nl80211
ssid=UnitreeG1-Dev
hw_mode=g
channel=6
wmm_enabled=1
macaddr_acl=0
auth_algs=1
wpa=2
wpa_passphrase=Temp1234
wpa_key_mgmt=WPA-PSK
rsn_pairwise=CCMP
ieee80211n=1
ht_capab=[SHORT-GI-20]
EOF

# 4. Start hostapd
sudo systemctl unmask hostapd
sudo hostapd -B /etc/hostapd/hostapd.conf

# 5. Allow bridge traffic (Docker's FORWARD policy is DROP)
sudo iptables -I FORWARD -i br0 -o br0 -j ACCEPT

# 6. Start DHCP server for Wi-Fi clients
sudo dnsmasq --interface=br0 --bind-interfaces \
  --dhcp-range=192.168.123.200,192.168.123.250,255.255.255.0,12h \
  --dhcp-option=3,192.168.123.164 \
  --dhcp-option=6,8.8.8.8,8.8.4.4 \
  --log-dhcp --no-daemon &

iPad Connection¶

• SSID: UnitreeG1-Dev
• Password: Temp1234
• iPad gets IP in 192.168.123.200-250 range, same L2 subnet as the robot
• Uses a different SSID than the locomotion computer's "UnitreeG1" to avoid confusion

Sharing Internet with G1¶

The field router gives the Mac internet on en0, but the G1 wired network is still separate.

Preferred options:

• Use WG827 Uplink Through GL.iNet when the GL.iNet field router is available.
• Use WG827 Direct TMU Uplink only as a fallback when the GL.iNet is unavailable.
• Use Mac pf NAT when you are directly cabled to the G1 and do not want the WG827 handling upstream internet.

On Mac (zmac)¶

# Enable IP forwarding and NAT (en0 = Wi-Fi with internet, usually via GL.iNet)
sudo sysctl -w net.inet.ip.forwarding=1
echo 'nat on en0 from 192.168.123.0/24 to any -> (en0)' | sudo pfctl -ef -

On Jetson¶

# Set Mac as default gateway and configure DNS
sudo ip route add default via 192.168.123.100
sudo bash -c 'echo nameserver 8.8.8.8 > /etc/resolv.conf'

On WG827 Router (gives internet to all LAN devices + WiFi clients)¶

# SSH into router first
ssh root@192.168.123.1  # password: indr0.com

# Add default route via Mac
ip route add default via 192.168.123.100
echo 'nameserver 8.8.8.8' > /tmp/resolv.conf.auto

This gives internet to the WG827 itself and all WiFi clients connected to the legacy UnitreeRouter AP.

Known Issues¶