GNSS-TAA-KIT EVB — standalone 4G NTRIP rover never reaches RTK (NTRIP 403 from BKG casters + UART3 TX not reaching LG290P)

Hi all,

I’m evaluating the High-Precision GNSS-TAA-KIT EVB (GD32 MCU + LG290P + 4G module) for use as a
standalone NTRIP rover ? no host PC, the on-board modem pulls RTCM from a caster, the MCU
forwards it to the LG290P over UART3, and the module computes an RTK fix. I can’t get it to RTK, and
I’ve traced it to three separate issues in the OpenEVB firmware/example code. Posting the full
diagnosis in case others have hit the same thing, and to ask Quectel for a fix.

Key point up front: the LG290P itself is fine ? when I feed the exact same RTCM to the module
directly over its USB port, it goes to RTK fix within seconds. The problems are all in the
MCU/NTRIP firmware path.

Repo for reference: GitHub - quectel-open-source/OpenEVB: OPENEVB is an innovative evaluation platform built upon the GD32F4 series, engineered to significantly expedite the development process involving Quectel GNSS modules such as the LCx9H and LCx6G. This platform serves as a comprehensive solution for developers working on GNSS - related projects. · GitHub
Module FW: LG290P03AANR01A04S

TL;DR

# Issue Effect
1 NTRIP client sends a malformed (v1/v2 hybrid) HTTP request 403 Forbidden from standard BKG casters
2 MCU UART3 TX never reaches the LG290P RTCM “sent” but never applied ? stays GPS-only
3 UART3 baud hardcoded to 115200, overriding saved 460800 Garbled data; resets every boot

Bugs 1 and 2 are both hard blockers for standalone RTK.

Bug 1 ? NTRIP client sends an invalid HTTP request ? 403

quectel/example/src/example_ntrip_client.c:128?133 builds the request as:

GET /<mountpoint> HTTP/1.0\r\n
User-Agent: <ua>\r\n
Host: <host>:<port>\r\n
Authorization: Basic <base64>\r\n
\r\n

This is neither valid NTRIP v1 nor v2:

  • NTRIP v1 ? HTTP/1.0, and no Host header.
  • NTRIP v2 ? HTTP/1.1, with Host and Ntrip-Version: Ntrip/2.0.

The EVB sends HTTP/1.0 with a Host header but without Ntrip-Version. A
BKG Caster 2.0.36 (PositioNZ-RT and most national CORS networks run this) sees the Host
header, treats the request as v2, finds no Ntrip-Version, and rejects it:

HTTP/1.1 403 Forbidden
Server: NTRIP BKG Caster 2.0.36/2.0

The request is built inside the precompiled libqntrip.lib, so it can’t be corrected in
application code.

Confirmed it’s the request format, not credentials/account:

  • A standard Python NTRIP v2 client (HTTP/1.1 + Ntrip-Version: Ntrip/2.0) using the same
    credentials and mountpoint
    connects fine to the same caster (ICY 200 OK / accepted, RTCM
    streaming).
  • The EVB authenticates fine against a non-BKG caster (rtk2go.com / SNIP) ? SOURCETABLE 200 OK.
    So modem, TLS/TCP and credentials all work; only strict BKG casters reject the request.

Bug 2 ? MCU UART3 TX doesn’t reach the LG290P ? corrections never applied

The MCU forwards RTCM to the module over UART3 (GNSS COM1, pins PA0/PA1, ql_uart.c:489?496):

// example_ntrip_client.c
:257  QL_LOG_I("Receiving rtcm & sending GGA...");
:268  Ql_Uart_Write(UART3, NtripClientBuffer, length, 0);

On the debug console the MCU receives ~1.3 kB RTCM every second and calls Ql_Uart_Write(UART3, ?), and it reads NMEA back from the LG290P on UART3 (RX works). But GGA fix quality stays at
1 (GPS-only) forever ? corrections are never applied. Sending a PQTM command out UART3 from the
console gets no response from the module.

Isolation:

  • Same RTCM fed to the LG290P over its USB interface ? RTK fix in seconds (module + RTCM are good).
  • MCU reads NMEA on UART3 but writes don’t reach the module ? the UART3 TX direction is
    the fault.

Ql_Uart_Write() uses a fire-and-forget DMA with timeout=0 (ql_uart.c:825?867) ? it starts the
DMA and returns immediately without waiting for completion, which seems worth checking as a cause.

Bug 3 ? UART3 baud hardcoded to 115200, overriding saved 460800

The LG290P defaults to 460800 on GNSS COM1, and the EVB’s own param defaults match. But the
example re-inits UART3 at 115200:

// example_ntrip_client.c:387
Ql_Uart_Init("GNSS COM1", UART3, 115200, 8192, 2048);

Console then shows:

UART3   BaudNow 115200   BaudCfg 460800   - GNSS COM1

So the MCU writes RTCM at 115200 while the module listens at 460800 ? every byte is garbage.
uart -c 3 -b 460800 fixes it for the session but the hardcoded Ql_Uart_Init() resets it to
115200 on every reboot, so it can’t be made persistent for standalone use. (Moot while Bug 2
stands, but would corrupt data the instant TX is fixed.)

Questions for Quectel

  1. Bug 1: can the NTRIP client be updated to send a spec-compliant request ? proper v2
    (HTTP/1.1 + Host + Ntrip-Version: Ntrip/2.0) or clean v1 (no Host)? This affects every
    BKG-caster CORS network, not just PositioNZ-RT.
  2. Bug 2: any known issue with MCU?LG290P writes on UART3 on this EVB (DMA TX completion, or
    board routing)? This is the hard blocker ? even working around Bug 1 with an external relay, the
    module never gets corrections.
  3. Bug 3: can UART3 be initialized at 460800 (or read from saved config) instead of hardcoded
    115200?
  4. Has anyone got the GNSS-TAA-KIT doing standalone NTRIP RTK against a BKG caster? Keen to know
    if there’s a firmware build or config that works.

Happy to run debug firmware and share full console logs / packet captures.

Environment

Thanks!

Hi @Josh_Martin can you share the firmware version for the 4G module? Best regards.

Hi, thanks for following up. The 4G module is the EG25-G, firmware EG25GGBR07A08M2G.

Full stack for reference:

  • 4G module: EG25-G — EG25GGBR07A08M2G
  • MCU: GNSS_MODULE_EVB_MCU_A_V1.1
  • LG290P: LG290P03AANR01A04S (2025/01/02)

Full boot log (power-on through the NTRIP 403; device/SIM IDs redacted):

I/application [1743] ** GNSS_MODULE_EVB_MCU_A_V1.1 **
I/param [1746] Boot for the 58 times.
I/log [1765] SD Total: 0 GB, Free: 0 GB
W/log [1766] (106 Ql_Log_FileTask)Mount SD Card state wrong
I/sysCheck [1767] Enable the watchdog!
I/sysCheck [1768] Power reset generated!
I/sysCheck [1768] Reboot RSTSCK 0x0c000002, LVDF 0.
E/log [1772 log] (115 Ql_Log_FileTask)Mount SD Card failure
I/autobaud [1879] Autobaud1 success. 115200
I/gnss [1915] TTFF GetFirstNmeaTimeMs: 1915
I/cellular [3965] ---------STARTING Cellular_Task---------
W/log [6792] (129 Ql_Log_FileTask)Suspend log task
E/CELLULAR [8966 cellular] (253 _Cellular_AtcmdRequestTimeoutWithCallbackRaw)pkt_recv status=1,timeoutMS[5000], AT cmd ATE0 timed out
E/CELLULAR [13968 cellular] (253 _Cellular_AtcmdRequestTimeoutWithCallbackRaw)pkt_recv status=1,timeoutMS[5000], AT cmd ATE0 timed out
I/CellularLib [14010] SN[REDACTED],IMEI[REDACTED]
I/CellularLib [14010] modelId[EG25],ver[EG25GGBR07A08M2G]
I/CellularLib [14022] Cellular SIM OK
I/CellularLib [14026] APN is NONE
I/CellularLib [14031] Set pdn OK
I/CellularLib [14316] ICCID[REDACTED],IMSI[REDACTED]
I/CellularLib [14316] Getting cellular service Status…
I/CellularLib [21048] cellular signal value (rsrp): -114
I/cellular [21049] Cellular init OK
I/cellular [21050] ---------STARTING NETWORK---------
I/cellular [21058] Cell_UTC[2026-04-22T09:02:09.000Z]
I/cellular [2026-04-22_09:02:09] calibration by celluar:2026-04-22_09:02:09
I/NCli [2026-04-22_09:02:09] CorsType[2],Ntrip_Step[-1]
I/NCli [2026-04-22_09:02:09] ----- NtripCLI WaitBits[0x1] -----
I/NCli [2026-04-22_09:02:09] CorsType[2],connect to [positionz-rt.linz.govt.nz:2101]

+QIURC:“closed”,0

I/NCli [2026-04-22_09:02:09] rsp:
HTTP/1.1 403 Forbidden
Server: NTRIP BKG Caster 2.0.36/2.0
Date: Wed, 22 Apr 2026 09:02:09 GMT

E/NCli [2026-04-22_09:02:09 NtripRTK] (506 Ql_NtripCli_RtkLogin)NtripClient login failed
E/NCli [2026-04-22_09:02:09 NtripRTK] (950 NtripRTK_Task)something is wrong

You can see the caster’s 403 Forbidden immediately after the client connects — that’s the malformed HTTP/1.0-with-Host-but-no-Ntrip-Version request I described above.

Hi @Josh_Martin

I have tested from my end with below configuration and follow as per user guide for GNSS-TAA-KIT (3.2.2.2. RTK Positioning Over 4G Module and EVB MCU) as here: Quectel_High_Precision_GNSS-TAA-KIT_EVB_Kit_User_Guide_V1.0 | Quectel

Configuration:

  1. LG290P TE-A board (test module) - LG290P03AANR02A01S
  2. EG25-G LTE module - EG25GGBR07A08M2G
  3. EVB kit - GNSS-Module-EVB_V1.3

From Tera Term console it was running default with HTPP/1.0, and run these commands:

ntripclient -h //Check the parameters needed.

ntripclient --type SelfBuild //configure EVB to work in standard NTRIP Client mode

ntripclient --host <host_name> --port <port_no> --user <your_username> --pwd <your_password> --mnt AUTO

ntrip --mode rover

Below is the snapshot from successfully activated:

From QGNSS V2.4, was able to get RTK Float (5), although not aiming for Fixed RTK (4) for the quick testing:


For the HTTP/1.1 403 Forbidden issue, this is a web server response code indicating that the server understood the request but refuses to authorize access to the requested resource.

Can you try with HTTP/1.0 and see if this is able to replicate? Also can you check the pin connection for J0407 (MCU_TX2), J0404 (MCU_TX1) and J0408 (MCU_TX3) whether have the jumper connected?

Best regards.