3D-Printer: Bambu Lab A1 – Linux

This is about the newest member of my geek collection: My new Bambu Lab A1 3D Printer.

Cloud or LAN-only?

First of all: The Bambu printer series seems to be quite cloud centric, there is however a LAN-only mode (with limited functionality and even less documentation).

As I am planning to use the printer in this mode (and behind a firewall), we need to know a little about the services this little thing provides.

linux # nmap -O 192.168.2.10 -p 1-65535
Starting Nmap 7.80 ( https://nmap.org )
Nmap scan report for bambu.linux-ng.de (192.168.2.10)
Host is up (0.051s latency).
Not shown: 65530 closed ports
PORT     STATE SERVICE
990/tcp  open  ftps
2025/tcp open  ellpack
2026/tcp open  scrabble
6000/tcp open  X11
8883/tcp open  secure-mqtt

From a firewall perspective access to the following ports of the device are required in order to use LAN-only mode:

Port	Protocol	What for?
990	tcp	FTP (with implicit TLS)
2024	tcp	???
2025	tcp	???
2026	tcp	???
6000	tcp	???
8883	tcp	MQTT (SSL)

Available ports on Bambu Labs A1

Direct access to data / services

It looks like the Bambu’s control unit is accessible via different ways (even in LAN-only mode):

FTP

FTP: To connect to the device we need to use port 990 and ftp using “implicit FTP over TLS” (that’s how Filezilla describes it). Login is “bblp” the password is the “Access Code” shown on the devices terminal.

You could also use lftp command line tool, to automate connections:

linux # lftp -c "set ftp:ssl-force true; set ssl:verify-certificate no; open ftps://bblp:12345678@192.168.2.10:990; ls"

Interesting files can be found in the directories “ipcam/” and “timelapse/”. The AVIs stored there seem to be “kind of broken” (at least VLC complains, but are playable anyway).

The transfer speed via ftps was about 250 KB/s – far from what the wireless could achieve, but maybe the CPU is to slow for more encrypted traffic?

MQTT

Same is true for MQTT: SSL on port 8883, login and password as above.

However make sure to access the device from the same subnet, otherwise the connection will fail! Maybe they just delete the default gateway when activating LAN-only mode?

While trying to access MQTT I got stuck with a “certificate verify failed” message. Even adding an “–insecure” option to my mosquitto_sub command didn’t help:

linux # mosquitto_sub -h 192.168.2.10 -p 8883 --insecure  -u bblp -P 12345678 -t \#  -d
Client (null) sending CONNECT
OpenSSL Error[0]: error:0A000086:SSL routines::certificate verify failed
Error: A TLS error occurred.

So it has been some time, but finally I found (some time and) the solution for this problem: Seems like the option “–insecure” is not sufficient to ignore the failing verification of the printers SSL certificate.
With the correct CA however, things start to work: problem was about finding the right one. So I had a look at the Bambu Studio code on github and found to certificates used there:

linux # git clone https://github.com/bambulab/BambuStudio.git
linux # cd BambuStudio
linux # find . -name "*.cer"
./resources/cert/printer.cer
./resources/cert/slicer_base64.cer

Looking at both those certificates and the one of the mqtt service itself by using some “openssl x509” magic, their data looked similar enough to just give them a try:

linux # mosquitto_sub -h 192.168.2.10 -p 8883 -u bblp -P 12345678 -t \# --tls-version tlsv1.2 --insecure --cafile resources/cert/printer.cer

So this time connection got established, but still nothing to see. Digging a little further the right topic to choose seems to be “device/<id>/report” (where “device” is the … of your printer):

linux # mosquitto_sub -h 192.168.2.10 -p 8883 -u bblp -P 12345678 -t "device/01234567890123/report" --tls-version tlsv1.2 --insecure --cafile resources/cert/printer.cer
{"print":{"nozzle_temper":220.03125,"bed_temper":65,"mc_print_line_number":"31927","command":"push_status","msg":1,"sequence_id":"56736"}}
{"print":{"nozzle_temper":220.125,"bed_temper":65.03125,"mc_print_line_number":"31953","command":"push_status","msg":1,"sequence_id":"56737"}}
{"print":{"mc_print_line_number":"31996","command":"push_status","msg":1,"sequence_id":"56738"}}
<...>