The Banana Pi BPI-R4 Pro is a new router board based on MediaTek Filogic 880 (MT7988A) Cortex-A73 SoC offering two 10GbE SFP+ cages/RJ45 ports combos, four 2.5GbE RJ45 ports, two Gigabit Ethernet interfaces, and optional WiFi 7 support via the Banana Pi BPI-R4-MIC-BE14 dual mini PCIe module.
As its name implies, it’s a Pro/upgraded version of the Banana Pi BPI-R4 board first introduced in 2023, which doubles the memory to 8GB DDR4, doubles the SPI flash’s capacity to 256MB, and adds a few networking ports, M.2 expansion slots for a total of six, and a few other minor features highlighted in bold in the specifications below.
Banana Pi BPI-R4 Pro specifications:
- SoC – MediaTek MT7988A (Filogic 880) quad-core Arm Corex-A73 processor @ 1.8GHz with AI-powered packet accelerator called TOPS (Tunnel Offload Processor System)
- System Memory – 8GB DDR4
- Storage
- 8GB eMMC flash
- 256MB SPI NAND Flash
- MicroSD card slot
- 2x M.2 Key-M sockets for NVMe SSDs (see Expansion section for details)
- Networking
- 2x 10GbE SFP+ cages multiplexed with adjacent 10GbE RJ45 jacks. Implemented through Aeonsemi AS21010P controllers
- 4x 2.5 Gbps Ethernet RJ45 ports; note: MaxLinear MxL86252C switch used
- Gigabit Ethernet RJ45 port
- Gigabit Ethernet via FPC connector (Note: connector 30 in photos below)
- USB – USB 3.2 port, USB 2.0 port
- Expansion
- 3x M.2 Key-B slots with USB 3.2 interface for 5G or 4G LTE connectivity, plus three nanoSIM slots, and an external SIM card slot connector
- 2x M.2 Key-M slots with 1-lane PCIe 3.0 for NVMe SSDs (note multiplexed with Key-B slots)
- 2x mini PCIe slots with 2-lane PCIe 3.0 for Wi-Fi 7 NIC (Network Interface Card)
- 26-pin GPIO header for expansion
- Debugging – USB Type-C debug console (instead of header)
- Misc
- Reset button, WPS button
- Cellular module LEDs, 8x LEDs, external LED FPC connector
- Bootstrap switch
- RTC battery connector
- 4-pin 12V PWM fan connector
- Power Supply
- 12V or 24V via 5.5/2.1mm DC jack
- 20V DC input via header or USB Type-C port
- Optional PoE module (RT5400)
- 4-pin 5V/12V output connector
- 2-pin 20V output connector
- Dimensions – 194 x 134 mm (Quite larger than previous Banana Pi BPI-R boards)
- Weight – TBD
On the software side, the Pro board should benefit from the work done on the earlier BPI-R4 board, and support “OpenWrt MTK”, Debian 12, and eventually mainline OpenWrt. However, the documentation website has no links to the system images at this time, only hardware information, the MT7988 datasheet, and a few links to related kernel commits and forum posts (requiring login, which is annoying).
The Banana Pi BPI-R4 Pro board can be purchased on the BPI shop for $165. It’s not listed for sale on the SinoVoIP Aliexpress store yet, but one third-party AliExpress seller is offering it at a premium with ($311) or without ($216) the WiFi 7 module. As a side note, the Banana Pi BPI-R4 is now available as a complete router called “Banana Pi BPI-R4 Finished Set” for about $190 with the board itself, the BE14 Wi-Fi 7 module, a cooling fan, a bottom heat sink for the Wi-Fi module, a metal enclosure, six Wi-Fi antennas, an Ethernet cable, and a 12V/5A power adapter. There have been complete kits on Amazon for a while, but as far as I can remember, not from Banana Pi themselves.
Jean-Luc started CNX Software in 2010 as a part-time endeavor, before quitting his job as a software engineering manager, and starting to write daily news, and reviews full time later in 2011.
Support CNX Software! Donate via cryptocurrencies, become a Patron on Patreon, or purchase goods on Amazon or Aliexpress. We also use affiliate links in articles to earn commissions if you make a purchase after clicking on those links.
“Wifi 7 support” have they actually fixed their wifi 7 cards yet even?
What’s the issue with their WiFi 7 card?
Their current BE14 card has no shielding and some batches weren’t programmed correctly. It’s a headache, there’s a huge thread on the openwrt forum about this.
There are some good points, but a number of bad ones as well. First, the console should be on the same side as the ports, because in a rack, you want a router to expose its ports so that you can visually check the LEDs when debugging, or even temporarily connect your laptop to a spare port (e.g. the GigE port here). Second, the fact that the 2.5G ports are in fact all connected to a switch is suddenly less appealing if the bandwidth is shared between all of them. Also it would be interesting to know if the device boots with all ports in the same VLAN until configured. Third, the huge heatsink and fan visible on the aliexpress link above is a real concern. I was naive enough to imagine that the chip was efficient and could run fanless, but one definitely doesn’t want a fan in such a low-end router. For example, the venerable old Macchiato-bin was already capable of 2×10+2.5+1G in a fanless form factor. There are much more efficient options in the x86 world that make it loses some interest (typically C3558R-based router boards from Qotom).
Another option I find interesting (which is what I’m doing now) is to combine a 2-port machine with a cheap managed switch that splits the VLANs. Devices like this one for example, provide 2x10G + 8×2.5G and are VLAN-capable for around 75 EUR.
Any reason in particular you need a 2-port machine if you already have a VLAN-aware switch? Or you just want to keep the WAN physically separate?
Usually you want to at least separate outside from inside. Either you group internet and DMZ together using VLANs and consider that DMZ are sacrifiable and want to absolutely protect the internal LAN on its own port, or you want to protect both internal and DMZ from the hostile internet and then put internet on its own LAN.
Most often the first option prevails since the net itself is not as dangerously exposed to VLAN bouncing (generally behind a router), while DMZs are where most intrusions happen, thus L2 attacks (such as spoofing or forced 802.1q encapsulation) originate from.
Also it’s important to keep in mind how devices fail. For example, a linux firewall might not finish to boot due to failing to mount some FS, and might for example enable forwarding and firewalling but not logging, or nothing at all. this is of moderate severity. Most switches start fully open with everything on the same LAN until they load their config. Some will automatically reset to factory config if their config is corrupted on the flash (e.g. after a series of power outages happening in the middle of the boot). So if it fails open with everything connected together, that stinks. Also sometimes you’re seeing infrastructures with cascaded switches using a trunk between them. These ones often use a default VLAN that’s part of the trunk and is usable for bouncing from one VLAN to another, so even without a power outage sometimes it’s possible to bounce to another VLAN. Thus in short, never ever trust VLANs when it comes to security, consider that it’s good enough to isolate your devices from accidental/undesired communication.
Thanks for the detailed reply!
I’d say L2 attacks are fairly well known and understood and can be mitigated in consumer switches as well (at least in some of them – maybe a €20 switch doesn’t have these features). Setting a port in access mode and dropping all tagged packets should take care of the problem.
The failure scenarios are interesting, though. A switch rebooting and losing all config (thus placing all ports in vlan 1) is indeed something to think about. I have a Lenovo tiny pc acting as a router and I use subinterfaces on the link to the switch. Had several power outages, but each time the Zyxel switch came back ok. Writing this I remembered that on my previous router (some Atom-based miniPC with 4 ethernet ports) I had the ISP link plugged directly into the router and, because I did not have an IP KVM at the time, I configured the router to first boot from PXE (had a PXE server in the LAN). Unfortunately, there was no option in BIOS to choose on which of the 4 ethernet ports to PXE boot, so it tried all of them. 🙂 That was, of course, not the best, as it would briefly expose the device to being taken over (assuming, of course, the ISP network allowed for L2 traffic between clients – but with security stuff it’s always preferable to assume the worst scenarios).
Do I still need a heat sink with 10G SFP+ Copper module on R4 Pro?
https://wiki.banana-pi.org/Getting_Started_with_BPI-R4#1.1.EF.BC.8910G_SFP.2B_Copper_Module
Why you want to insert it if you have RJ45 connected to both SFP cages?
Those old 10GBASE-T transceivers rated for 30 meters generate lots of heat and should really only be used as a last resort. Modern ones rated at 80 or 100 meters are significantly better, but fiber transceivers or DACs are still preferred.
In this case, the Pro model already has 10GBASE-T ports so I would stick to those. 🙂
Is the Banana Pi BPI-R4 Finished Set certified? Otherwise it’s technically illegal to use for consumers.
I’m honestly not sure. There must be a reason why they keep calling it a development board. Whether that is due to the lack of certification, more of an explanation of why you have to assemble it yourself, or if they simply see it as a hardware demo platform that they can use to get contract manufacturing deals with other brands is unknown to me.
Is it just me, or is the MaxLinear MxL86252C switch connected to one of the 10 Gbps PHYs?
The MT7988 only has a single 2.5 Gbps MAC and it’s shared with the second 10 Gbps MAC.
It seems like they’re routing a 10 Gbps signal to the MxL86252C, which has two 10 Gbps SerDes interfaces, making the second set of 10 Gbps connected via the switch.
This suggests that if the 10 Gbps port is running at full speed, you won’t be able to use the 2.5 Gbps ports.
I was wondering where they were connecting it, not knowing the details of the SoC. But what you describe makes perfect sense, so we’d have:
Pretty ugly indeed, as this means that the 2.5G ports and the 10G one are shared. So it should rather be seen as one 10G WAN port and one switch for the LAN on which there’s one 10G and four 2.5G.
Get the Banana Pi BPI-RV2 instead. Its RISC-V hardware combined with a ath9k card is the best fully free usable router hardware at the moment.
[citation needed]
The SF21H8898 does not even have mainline u-boot support. There’s nothing close to it in the RISC-V tree in u-boot. The MT7988 is already supported in u-boot. Pray tell, how open source is the BPI-RV2?
100% Bananaware… What the world needs
I didn’t know that banana pi had so many lanes for this much io. WoW 😳
It seems interesting but I am not buying another ARM device. If it was risc-v I would start a company just to bulk order these. Nobody wants to invest in yesterday’s dead technology.
> If it was risc-v I would start a company just to bulk order these. Nobody wants to invest in yesterday’s dead technology.
Good one 🙂