GPON SFP Module Pinout — SFP UART (RX / TX) Reference
Part of the GPON SFP serial-console guide.
GPON / XGS-PON SFP "ONU stick" modules run a full Linux SoC, and most expose a serial console (UART) on their edge connector — handy to flash firmware, change the SN/PLOAM, or recover a brick. But the SFP MSA never defined a UART, so vendors repurpose spare low-speed pins. This page is the reference: the standard 20-pin pinout, where the console usually hides, and a verified per-module table.
The standard SFP 20-pin pinout (SFF-8074i / SFF-8419)
Looking at the contact side of the module (gold fingers), latch facing away from you. Pins 1–10 are the lower row, 11–20 the upper.
Module gold-finger edge (contact side up)
+---------------------------------------------+
| 11 12 13 14 15 16 17 18 19 20 (upper row) |
| 10 9 8 7 6 5 4 3 2 1 (lower row) |
+---------------------------------------------+
inserts into SFP cage / breakout| Pin | Name | 3.3 V? | Use when hunting for UART |
|---|---|---|---|
| 1 | VeeT | GND | ground reference |
| 2 | TX_Fault | LVTTL | console — most sticks (pair w/ 7) |
| 3 | TX_Disable | LVTTL | input — usually not console |
| 4 | SDA | LVTTL | UART candidate (I²C-pin variant) |
| 5 | SCL | LVTTL | UART candidate (I²C-pin variant) |
| 6 | MOD_ABS | LVTTL | presence — leave alone |
| 7 | RS0 | LVTTL | console — most sticks (pair w/ 2) |
| 8 | RX_LOS | LVTTL | UART candidate |
| 9 | RS1 | LVTTL | UART candidate |
| 10 | VeeR | GND | ground reference |
| 11 | VeeR | GND | ground reference |
| 12 | RD− | HS | high-speed diff — not UART |
| 13 | RD+ | HS | high-speed diff — not UART |
| 14 | VeeR | GND | ground reference |
| 15 | VccR | +3.3 V | power in |
| 16 | VccT | +3.3 V | power in |
| 17 | VeeT | GND | ground reference |
| 18 | TD+ | HS | high-speed diff — not UART |
| 19 | TD− | HS | high-speed diff — not UART |
| 20 | VeeT | GND | ground reference |
Rules of thumb
- Power: +3.3 V to pin 15 or 16, ground to any Vee pin (1/10/11/14/17/20).
- The console is on the LVTTL low-speed pins — never the high-speed differential pairs (RD±/TD±, pins 12/13/18/19).
- 3.3 V logic only. A 5 V adapter can damage the module — set USB-TTL adapters to 3.3 V.
Where the UART hides
The SFP MSA does not define a UART. Module designers repurpose the low-speed LVTTL pins their SoC isn't using. In practice, across the most common GPON and XGS-PON sticks the console lands on the same two pins:
- Pin 2 (TX_Fault) and pin 7 (RS0) — by far the most common.
- SDA / SCL (pins 4 / 5) — on modules that expose the console over the I²C pins.
- RX_LOS / RS1 (pins 8 / 9) — occasionally.
Heads-up: which of pins 2/7 is TX vs RX is labeled inconsistently across breakouts. If you get power but no readable text, swap the two wires — it's the single most common mistake. Common baud rate is 115200 8N1; some modules use 9600 or 38400.
Verified module table
Cross-checked against the hack-gpon.org wiki and the 8311 community. TX/RX orientation varies by source — swap pins 2↔7 if you get no output. All use +3.3 V on pin 15/16 and GND on a Vee pin.
| Module | SoC / standard | UART pins | Baud | Notes |
|---|---|---|---|---|
| Huawei MA5671A | Lantiq · GPON | 2 & 7 | 115200 8N1 | The most popular GPON stick. Stock firmware also has SSH (root / admin123). |
| V-SOL V2801F | Realtek RTL9601CI · GPON | 2 & 7 | 115200 8N1 | Realtek-family reference stick. Needs OMCI_FAKE_OK or it auto-reboots. |
| T&W TWCGPON657 | Realtek RTL9601CI · GPON | 2 & 7 | 115200 8N1 | Same SoC as V2801F, 16 MB NAND. |
| ODI DFP-34X-2C2 | Realtek RTL9601D · GPON | 2 & 7 | 115200 8N1 | Newer/cheaper, runs cool. |
| Ubiquiti U-Fiber Instant | Realtek RTL9601CI · GPON | 2 & 7 | 115200 8N1 | Rebranded Realtek stick. |
| FS.com GPON-ONU-34-20BI | Realtek RTL960x · GPON | 2 & 7 | 115200 8N1 | FS.com rebrand of the Realtek family. |
| CarlitoxxPro CPGOS03-0490 v2.0 | Realtek RTL9601C · GPON | 2 & 7 | 115200 8N1 | Reference hardware for Carlito firmware. |
| Nokia / Alcatel G-010S-P | GPON | 2 & 7 | 115200 8N1 | Console on pin 2; swap to 7 if nothing appears. |
| BFW WAS-110 | MaxLinear PRX126 · XGS-PON | 2 & 7 | 115200 8N1 | The 8311-community flagship. Spam Esc at power-on to drop into U-Boot. |
| FS.com XGS-ONU-25-20NI | CIG · XGS-PON | 2 & 7 (family default) | 115200 8N1 | CIG-based XGS-PON stick: dual firmware slots, mgmt IP 192.168.100.1. A bad flash needs UART to recover. |
Breaking the pins out the easy way
You can hand-solder or use pogo pins, but it's fiddly and the jig drifts. The simplest path is a purpose-built breakout: slot the module in and all 20 pins land on labeled 2.54 mm headers, RX/TX silkscreened.
➡️ SFP-to-TTL Adapter — no soldering, ships worldwide.
Once you have a console, follow the serial-console + flashing guide or, for a Huawei stick, the Carlito firmware guide.
Pinout sources: SFF-8074i (SFP MSA), SFF-8419 (low-speed electrical), cross-checked against vendor datasheets and the hack-gpon.org wiki.
