Baicells Nova 430H Unlock Procedure

Follow this procedure to remove the Helium/FreedomFi lock from a Baicells Nova 430H and load standard Baicells OEM firmware so the radio can be used with a normal EPC.

Helium locked the web management interface on these units. After the CBRS network was shut down, the only practical recovery path is to enable the local interface, then flash official Baicells firmware. Baicells has charged for factory resets; this procedure is the free method that was circulated by Helium support and later refined by owners.

What you need

• Baicells Nova 430H
• Computer with an Ethernet port
• Ethernet cable
• Official Baicells firmware files (see notes below)

1. Connect to the radio

1. Power the radio.
2. Connect an Ethernet cable directly from the radio to your computer.
3. Set your computer’s Ethernet interface to a static address:
   IP: 192.168.150.2
   Subnet: 255.255.255.0
4. The radio will try to get a DHCP address on its WAN side, but SSH and the management interface use the static LAN address 192.168.150.1. Use the direct connection.

2. Check if it is already unlocked

Open a browser and go to https://192.168.150.1.

• If the login page appears, the unit is already unlocked. Log in with:
  Username: admin
  Password: S95585UHsq0M
  Then skip to the firmware update section.
• If the page does not load, continue below.

3. Enable the web management interface

Helium firmware disables the web interface. You must turn it back on over SSH.

1. Open a terminal and connect:

   ssh admin@192.168.150.1 -p 27149
   

2. Password: S95585UHsq0M
3. At the shell, run these commands in order:

   cli
   oam.set LMT_ENABLE 1 FAP.0
   exit
   

4. You should see OK after the oam.set command.
5. Disconnect from SSH.

4. Log in to the web interface

1. Open a browser and go to https://192.168.150.1.
2. Log in with:
   Username: admin
   Password: S95585UHsq0M

5. Update to OEM firmware

1. Download the latest appropriate OEM firmware from Baicells:
   https://www.baicells.com/Service/Firmware
   The version most people use is BaiBLQ_3.0.12.
2. In the web interface, go to the firmware update / upgrade section.
3. Select the OEM firmware file and start the upgrade.
4. Wait for the radio to finish and reboot.

6. If the upgrade fails (common on older Helium firmware)

Many units that were still new in the box or running older Helium firmware will reject the jump straight to BaiBLQ_3.0.12. You will typically see an error such as:

Error: code1, System error!

or a log message similar to:

BaiBLQ_3.0.12 don't support upgrade Helium. The customer version is BaiBS_QRTB_2.9.19.3_Helium

Workaround A — intermediate firmware (preferred)
Flash the last Helium-released firmware that still allows the subsequent OEM upgrade:
BaiBS_QRTB_2.12.14_Helium

After that succeeds, flash BaiBLQ_3.0.12.

Workaround B — bypass the version check
If the intermediate file is not available or still blocked:

1. SSH in again (ssh admin@192.168.150.1 -p 27149, password S95585UHsq0M).
2. Run:

   touch /tmp/upgradeAll.flag
   

3. Exit SSH.
4. Immediately start the OEM firmware upgrade from the web interface.

This flag tells the upgrade script to skip the Helium version restriction.

7. Confirm the unlock

After the radio reboots:

1. Log back into https://192.168.150.1 with the same credentials.
2. Check the software version. It should now show the OEM firmware (BaiBLQ_3.0.12 or whatever you flashed).
3. The radio is now a standard Baicells eNodeB and can be configured for any compatible EPC or private LTE/CBRS use.

Notes and tips

• The default credentials (admin / S95585UHsq0M) and the oam.set LMT_ENABLE 1 FAP.0 command came from Helium support responses. They work on the majority of 430H units.
• Logs that show why an upgrade failed are available in the web interface (keylog download) or on the unit at /mnt/log.
• The same general approach (SSH + enable LMT + OEM firmware) is used on related locked Baicells models, but always match the firmware file to the exact hardware.
• After a successful unlock the radio is no longer tied to Helium. It will not automatically join the old Helium CBRS network.
• Keep a copy of the working firmware files. Once the unit is on pure OEM firmware the Helium-specific images are no longer needed.

This is the practical field procedure that has been used successfully on locked 430H radios.