Skip to content

Instantly share code, notes, and snippets.

Last active March 3, 2024 23:21
Show Gist options
  • Star 21 You must be signed in to star a gist
  • Fork 8 You must be signed in to fork a gist
  • Save SaltwaterC/ef49c8a4df81c8896153 to your computer and use it in GitHub Desktop.
Save SaltwaterC/ef49c8a4df81c8896153 to your computer and use it in GitHub Desktop.
OpenWrt support for Netgear WNR1000v2


As usual, use it at your own risk. I am not to be held responsible for your actions.

Supported devices: WNR1000v2 (tested by me), WNR1000v2-VC (provided by Comcast for free; tested by Douglas Fraser)

Notice: Upgrade WNR1000v2 to the latest factory firmware: Otherwise, the power LED may not behave properly.

You need to place the device into failsafe mode. For booting into failsafe mode, you need to power up the device while holding the reset button with a pin. The power LED should have an amber colour. Hold the button until it is starting to flash green. It starts to flash green after it flashes the amber LED for six times. After that, the device is in failsafe mode, accepting a firmware via its TFTP server. The device should respond to pings at, although the responses may be malformed.

Configure your ethernet interface with a IP address. I use with netmask but it should work with any free address from that block.

You need a TFTP client for this purpose. You may check the OpenWrt wiki for more information if you aren't familiar with the procedure.

Barrier Breaker

With the OS X tftp client, and the Linux tftp client, the flashing procedure is something like:

For WNR1000v2

> binary
> trace
> put openwrt-ar71xx-generic-wnr1000v2-squashfs-factory-barrier-breaker-r44095.img

For WNR1000v2-VC

> binary
> trace
> put openwrt-ar71xx-generic-wnr1000v2-vc-squashfs-factory-barrier-breaker-r44095.img

Please don't use the WNR1000v2 firmware file for the WNR1000v2-VC model. Every time you do that, a kitten dies.

The power LED turns off during the upload. If it starts to flash green after the upload, then the firmware is rejected (usually the case with a corrupted or wrong firmware). Otherwise, it should be green and it stops flashing (but sometimes it may stay off). You should wait until the device finishes the upgrade procedure. Usually it is under three minutes. It should boot into OpenWrt.

If the connection drops during the upload, you may end up with a corrupted firmware and the device is booting into failsafe mode. Just repeat the flashing procedure.

Please notice that the power LED flashes green during the normal boot. However, it flashes at a faster rate compared to a device in failsafe mode. If unsure, let the device to stay in that state at least for a minute before deciding that it needs reflashing. After a normal boot, you should get a solid green on the power LED.

Chaos Calmer (trunk)

The Chaos Calmer patch was created against r44154. It was tested succesfully on WNR1000v2 and WNR1000v2-VC, but the device may require a power cycle after the flash. It may boot in (an unusable) failsafe mode. This happened on WNR1000v2 by going from Barrier Breaker to Chaos Calmer via TFTP flashing.

For building it, you can not use the Barrier Breaker config. For creating the build config, you need to pick the "Atheros AR7xxx/AR9xxx" Target System, the "Generic" Subtarget, and optionally the WNR1000v2 driver profile.

Please notice that the images may not build succesfully without a clean tree and config.


You need an OpenWrt Buildroot. I use Debian 7.x for this purpose.

# Aka cloning this particular gist
git clone
cd ef49c8a4df81c8896153
# This is the Barrier Breaker branch
git clone git://
cd openwrt
# Apply the patch for WNR1000v2/WNR1000v2-VC support
patch -p1 < ../wnr1000v2+vc-barrier-breaker-r44095.patch
# Add the LuCI support into the OpenWrt tree
./scripts/feeds update luci
./scripts/feeds install luci
# Get the generic config for AR71xx
wget -O .config
# when doing the menuconfig, you need to go to LuCI > Collections and 
# make sure that {*} luci is selected, otherwise LuCI is built as module
# and it won't be available into the built image, only the package is built
make menuconfig
# The final step for building the image. You may replace "make" with
# "make -j number-of-cpu-cores+1" for faster building on a multi-core CPU

The images will be in the "bin/ar71xx" directory. After that, follow the above Install instructions.

5b95005158eb064f63bf46bb32bc4bf2 *openwrt-ar71xx-generic-wnr1000v2-squashfs-factory-barrier-breaker-r44095.img
852f6f0028c9fca542f8658f7834043c *openwrt-ar71xx-generic-wnr1000v2-squashfs-sysupgrade-barrier-breaker-r44095.bin
271cdf6e3db97e645b8563f394e8cd5c *openwrt-ar71xx-generic-wnr1000v2-vc-squashfs-factory-barrier-breaker-r44095.img
813eafe9f2790ff78fd017b4331dc43b *openwrt-ar71xx-generic-wnr1000v2-vc-squashfs-sysupgrade-barrier-breaker-r44095.bin
fd67f85b43d195ea28f04a72397e7001 *openwrt-ar71xx-generic-wnr1000v2-squashfs-factory-chaos-calmer-r44154.img
9078821e10656d62ac6e87dd6f21039a *openwrt-ar71xx-generic-wnr1000v2-squashfs-sysupgrade-chaos-calmer-r44154.bin
9c7cbb3cee1829c11440129ce155a425 *openwrt-ar71xx-generic-wnr1000v2-vc-squashfs-factory-chaos-calmer-r44154.img
c766344bbc11ceb51228a222de172a6e *openwrt-ar71xx-generic-wnr1000v2-vc-squashfs-sysupgrade-chaos-calmer-r44154.bin
View raw

(Sorry about that, but we can’t show files that are this big right now.)

View raw

(Sorry about that, but we can’t show files that are this big right now.)

View raw

(Sorry about that, but we can’t show files that are this big right now.)

View raw

(Sorry about that, but we can’t show files that are this big right now.)

View raw

(Sorry about that, but we can’t show files that are this big right now.)

View raw

(Sorry about that, but we can’t show files that are this big right now.)

View raw

(Sorry about that, but we can’t show files that are this big right now.)

View raw

(Sorry about that, but we can’t show files that are this big right now.)

View raw

(Sorry about that, but we can’t show files that are this big right now.)

Copy link

User2uk commented Sep 16, 2015

I followed the above instruction and when do build root get the follwing error at the end
" make -r world: build failed. Please re-run make with V=s to see what's going on make: *** [world] Error 1

how to work around this error?


Copy link

I guess the easiest is to pull the latest CC sources. The CC patch has been mainlined.

Copy link

Just flashed this and amazingly got it on the first try. Just a couple thoughts to help windows users out as I had no idea what I was doing.
After downloading the correct image above, place it in windows/system32 and rename to something simple. Go into programs and features and enable telnet and tftp clients. Open a command prompt and enter "tftp -i PUT openwrt-xxxx.img" (thanks to jenom in the forum post) following the procedure posted above. Of course you put in the file name that you chose earlier.

For me the light started blinking so I thought it was rejected but it flashed correctly.

Copy link

baab22 commented Feb 21, 2016

I think I flashed by accident the Chaos Calmer image on top of the Barrier Breaker image and now I cannot flash any images anymore. I can still enter failsafe mode but uploading stops after a few bytes. I assume I'm stuck in the "unusable failsafe mode" you mentioned. Did you figure out a way to fix this?

Copy link

dammer commented Feb 23, 2016

Today flasing WNR1000 v2h2 with openwrt-ar71xx-generic-wnr1000v2-squashfs-factory-barrier-breaker-r44095.img
It just work fine!


[    0.000000] Linux version 3.10.49 (build@downloadfast01) (gcc version 4.8.3 (OpenWrt/Linaro GCC 4.8-2014.04 r44065) ) #3 Sat Jan 24 17:35:02 EST 2015
[    0.000000] MyLoader: sysp=a2ba20aa, boardp=aaabaa02, parts=aabaaaaa
[    0.000000] bootconsole [early0] enabled
[    0.000000] CPU revision is: 00019374 (MIPS 24Kc)
[    0.000000] SoC: Atheros AR7240 rev 2
[    0.000000] Clocks: CPU:340.000MHz, DDR:340.000MHz, AHB:170.000MHz, Ref:5.000MHz
[    0.000000] Determined physical RAM map:
[    0.000000]  memory: 02000000 @ 00000000 (usable)
[    0.000000] Initrd not found or empty - disabling initrd
[    0.000000] Zone ranges:
[    0.000000]   Normal   [mem 0x00000000-0x01ffffff]
[    0.000000] Movable zone start for each node
[    0.000000] Early memory node ranges
[    0.000000]   node   0: [mem 0x00000000-0x01ffffff]
[    0.000000] On node 0 totalpages: 8192
[    0.000000] free_area_init_node: node 0, pgdat 80334b60, node_mem_map 81000000
[    0.000000]   Normal zone: 64 pages used for memmap
[    0.000000]   Normal zone: 0 pages reserved
[    0.000000]   Normal zone: 8192 pages, LIFO batch:0
[    0.000000] Primary instruction cache 64kB, VIPT, 4-way, linesize 32 bytes.
[    0.000000] Primary data cache 32kB, 4-way, VIPT, cache aliases, linesize 32 bytes
[    0.000000] pcpu-alloc: s0 r0 d32768 u32768 alloc=1*32768
[    0.000000] pcpu-alloc: [0] 0 
[    0.000000] Built 1 zonelists in Zone order, mobility grouping on.  Total pages: 8128
[    0.000000] Kernel command line:  board=WNR1000V2 console=ttyS0,115200 mtdparts=spi0.0:256k(u-boot)ro,64k(u-boot-env)ro,3712k(firmware),64k(art)ro rootfstype=squashfs,jffs2 noinitrd
[    0.000000] PID hash table entries: 128 (order: -3, 512 bytes)
[    0.000000] Dentry cache hash table entries: 4096 (order: 2, 16384 bytes)
[    0.000000] Inode-cache hash table entries: 2048 (order: 1, 8192 bytes)
[    0.000000] Writing ErrCtl register=00000000
[    0.000000] Readback ErrCtl register=00000000
[    0.000000] Memory: 28588k/32768k available (2369k kernel code, 4180k reserved, 621k data, 272k init, 0k highmem)
[    0.000000] SLUB: HWalign=32, Order=0-3, MinObjects=0, CPUs=1, Nodes=1
[    0.000000] NR_IRQS:51
[    0.080000] Calibrating delay loop... 226.09 BogoMIPS (lpj=1130496)
[    0.080000] pid_max: default: 32768 minimum: 301
[    0.080000] Mount-cache hash table entries: 512
[    0.090000] NET: Registered protocol family 16
[    0.100000] MIPS: machine is NETGEAR WNR1000 V2
[    0.510000] registering PCI controller with io_map_base unset
[    0.520000] bio: create slab <bio-0> at 0
[    0.530000] PCI host bridge to bus 0000:00
[    0.530000] pci_bus 0000:00: root bus resource [mem 0x10000000-0x13ffffff]
[    0.540000] pci_bus 0000:00: root bus resource [io  0x0000]
[    0.540000] pci_bus 0000:00: No busn resource found for root bus, will use [bus 00-ff]
[    0.550000] pci 0000:00:00.0: [168c:002b] type 00 class 0x028000
[    0.550000] pci 0000:00:00.0: fixup device configuration
[    0.550000] pci 0000:00:00.0: reg 10: [mem 0x00000000-0x0000ffff 64bit]
[    0.550000] pci 0000:00:00.0: supports D1
[    0.550000] pci 0000:00:00.0: PME# supported from D0 D1 D3hot
[    0.550000] pci_bus 0000:00: busn_res: [bus 00-ff] end is updated to 00
[    0.550000] pci 0000:00:00.0: BAR 0: assigned [mem 0x10000000-0x1000ffff 64bit]
[    0.560000] pci 0000:00:00.0: using irq 40 for pin 1
[    0.560000] Switching to clocksource MIPS
[    0.570000] NET: Registered protocol family 2
[    0.580000] TCP established hash table entries: 512 (order: 0, 4096 bytes)
[    0.580000] TCP bind hash table entries: 512 (order: -1, 2048 bytes)
[    0.590000] TCP: Hash tables configured (established 512 bind 512)
[    0.590000] TCP: reno registered
[    0.600000] UDP hash table entries: 256 (order: 0, 4096 bytes)
[    0.600000] UDP-Lite hash table entries: 256 (order: 0, 4096 bytes)
[    0.610000] NET: Registered protocol family 1
[    0.610000] PCI: CLS 0 bytes, default 32
[    0.640000] squashfs: version 4.0 (2009/01/31) Phillip Lougher
[    0.640000] jffs2: version 2.2 (NAND) (SUMMARY) (LZMA) (RTIME) (CMODE_PRIORITY) (c) 2001-2006 Red Hat, Inc.
[    0.660000] msgmni has been set to 55
[    0.660000] io scheduler noop registered
[    0.660000] io scheduler deadline registered (default)
[    0.670000] Serial: 8250/16550 driver, 16 ports, IRQ sharing enabled
[    0.700000] serial8250.0: ttyS0 at MMIO 0x18020000 (irq = 11) is a 16550A
[    0.710000] console [ttyS0] enabled, bootconsole disabled
[    0.730000] ath79-spi ath79-spi: master is unqueued, this is deprecated
[    0.740000] m25p80 spi0.0: found w25q32, expected m25p80
[    0.740000] m25p80 spi0.0: w25q32 (4096 Kbytes)
[    0.750000] 4 cmdlinepart partitions found on MTD device spi0.0
[    0.750000] Creating 4 MTD partitions on "spi0.0":
[    0.760000] 0x000000000000-0x000000040000 : "u-boot"
[    0.760000] 0x000000040000-0x000000050000 : "u-boot-env"
[    0.770000] 0x000000050000-0x0000003f0000 : "firmware"
[    0.780000] 2 netgear-fw partitions found on MTD device firmware
[    0.780000] 0x000000050000-0x000000162440 : "kernel"
[    0.790000] mtd: partition "kernel" must either start or end on erase block boundary or be smaller than an erase block -- forcing read-only
[    0.800000] 0x000000162440-0x0000003f0000 : "rootfs"
[    0.810000] mtd: partition "rootfs" must either start or end on erase block boundary or be smaller than an erase block -- forcing read-only
[    0.820000] mtd: device 4 (rootfs) set to be root filesystem
[    0.830000] 1 squashfs-split partitions found on MTD device rootfs
[    0.840000] 0x000000390000-0x0000003f0000 : "rootfs_data"
[    0.840000] 0x0000003f0000-0x000000400000 : "art"
[    0.960000] libphy: ag71xx_mdio: probed
[    1.540000] ag71xx ag71xx.0: connected to PHY at ag71xx-mdio.0:04 [uid=004dd041, driver=Generic PHY]
[    1.550000] eth0: Atheros AG71xx at 0xb9000000, irq 4, mode:MII
[    2.120000] ag71xx-mdio.0: Found an AR7240/AR9330 built-in switch
[    3.150000] eth1: Atheros AG71xx at 0xba000000, irq 5, mode:GMII
[    3.160000] TCP: cubic registered
[    3.160000] NET: Registered protocol family 17
[    3.160000] Bridge firewalling registered
[    3.170000] 8021q: 802.1Q VLAN Support v1.8
[    3.180000] VFS: Mounted root (squashfs filesystem) readonly on device 31:4.
[    3.190000] Freeing unused kernel memory: 272K (8034c000 - 80390000)
[    6.590000] usbcore: registered new interface driver usbfs
[    6.600000] usbcore: registered new interface driver hub
[    6.600000] usbcore: registered new device driver usb
[    6.610000] ehci_hcd: USB 2.0 'Enhanced' Host Controller (EHCI) Driver
[    6.620000] ehci-platform: EHCI generic platform driver
[    6.630000] ohci_hcd: USB 1.1 'Open' Host Controller (OHCI) Driver
[    9.290000] eth1: link up (1000Mbps/Full duplex)
[   11.540000] eth1: link down
[   13.360000] NET: Registered protocol family 10
[   13.380000] nf_conntrack version 0.5.0 (450 buckets, 1800 max)
[   13.390000] ip6_tables: (C) 2000-2006 Netfilter Core Team
[   13.410000] Loading modules backported from Linux version master-2014-05-22-0-gf2032ea
[   13.420000] Backport generated by backports.git backports-20140320-37-g5c33da0
[   13.430000] ip_tables: (C) 2000-2006 Netfilter Core Team
[   13.490000] xt_time: kernel timezone is -0000
[   13.530000] cfg80211: Calling CRDA to update world regulatory domain
[   13.530000] cfg80211: World regulatory domain updated:
[   13.540000] cfg80211:  DFS Master region: unset
[   13.540000] cfg80211:   (start_freq - end_freq @ bandwidth), (max_antenna_gain, max_eirp), (dfs_cac_time)
[   13.550000] cfg80211:   (2402000 KHz - 2472000 KHz @ 40000 KHz), (N/A, 2000 mBm), (N/A)
[   13.560000] cfg80211:   (2457000 KHz - 2482000 KHz @ 40000 KHz), (N/A, 2000 mBm), (N/A)
[   13.570000] cfg80211:   (2474000 KHz - 2494000 KHz @ 20000 KHz), (N/A, 2000 mBm), (N/A)
[   13.580000] cfg80211:   (5170000 KHz - 5250000 KHz @ 160000 KHz), (N/A, 2000 mBm), (N/A)
[   13.580000] cfg80211:   (5250000 KHz - 5330000 KHz @ 160000 KHz), (N/A, 2000 mBm), (0 s)
[   13.590000] cfg80211:   (5490000 KHz - 5730000 KHz @ 160000 KHz), (N/A, 2000 mBm), (0 s)
[   13.600000] cfg80211:   (5735000 KHz - 5835000 KHz @ 80000 KHz), (N/A, 2000 mBm), (N/A)
[   13.610000] cfg80211:   (57240000 KHz - 63720000 KHz @ 2160000 KHz), (N/A, 0 mBm), (N/A)
[   13.710000] PPP generic driver version 2.4.2
[   13.710000] NET: Registered protocol family 24
[   13.770000] PCI: Enabling device 0000:00:00.0 (0000 -> 0002)
[   13.780000] ath: phy0: Enable LNA combining
[   13.790000] ath: phy0: eeprom contains invalid mac address: ff:ff:ff:ff:ff:ff
[   13.800000] ath: phy0: random mac address will be used: f6:14:b6:30:14:4c
[   13.800000] ath: EEPROM regdomain: 0x0
[   13.800000] ath: EEPROM indicates default country code should be used
[   13.800000] ath: doing EEPROM country->regdmn map search
[   13.800000] ath: country maps to regdmn code: 0x3a
[   13.800000] ath: Country alpha2 being used: US
[   13.800000] ath: Regpair used: 0x3a
[   13.820000] ieee80211 phy0: Selected rate control algorithm 'minstrel_ht'
[   13.830000] cfg80211: Calling CRDA for country: US
[   13.840000] ieee80211 phy0: Atheros AR9285 Rev:2 mem=0xb0000000, irq=40
[   13.850000] cfg80211: Regulatory domain changed to country: US
[   13.860000] cfg80211:  DFS Master region: FCC
[   13.860000] cfg80211:   (start_freq - end_freq @ bandwidth), (max_antenna_gain, max_eirp), (dfs_cac_time)
[   13.870000] cfg80211:   (2402000 KHz - 2472000 KHz @ 40000 KHz), (N/A, 3000 mBm), (N/A)
[   13.880000] cfg80211:   (5170000 KHz - 5250000 KHz @ 80000 KHz), (N/A, 1700 mBm), (N/A)
[   13.890000] cfg80211:   (5250000 KHz - 5330000 KHz @ 80000 KHz), (N/A, 2300 mBm), (0 s)
[   13.900000] cfg80211:   (5735000 KHz - 5835000 KHz @ 80000 KHz), (N/A, 3000 mBm), (N/A)
[   13.910000] cfg80211:   (57240000 KHz - 63720000 KHz @ 2160000 KHz), (N/A, 4000 mBm), (N/A)
[   25.860000] jffs2_scan_eraseblock(): End of filesystem marker found at 0x0
[   25.890000] jffs2_build_filesystem(): unlocking the mtd device... done.
[   25.890000] jffs2_build_filesystem(): erasing all blocks after the end marker... done.
[   27.070000] jffs2: notice: (906) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found.
[   30.760000] IPv6: ADDRCONF(NETDEV_UP): eth1: link is not ready
[   30.760000] device eth1 entered promiscuous mode
[   30.780000] IPv6: ADDRCONF(NETDEV_UP): br-lan: link is not ready
[   30.820000] IPv6: ADDRCONF(NETDEV_UP): eth0: link is not ready
[   31.860000] eth1: link up (1000Mbps/Full duplex)
[   31.860000] br-lan: port 1(eth1) entered forwarding state
[   31.870000] br-lan: port 1(eth1) entered forwarding state
[   31.870000] IPv6: ADDRCONF(NETDEV_CHANGE): eth1: link becomes ready
[   31.900000] IPv6: ADDRCONF(NETDEV_CHANGE): br-lan: link becomes ready
[   33.870000] br-lan: port 1(eth1) entered forwarding state
[  145.640000] nf_conntrack: automatic helper assignment is deprecated and it will be removed soon. Use the iptables CT target to attach helpers instead.

Copy link

Hello, I see others have been successful flashing this but I'm new to flashing router firmware & have had no luck yet installing this on my WNR1000v2-VC, hoping someone with more competence & experience can offer advice.

I'm using Windows 7 on my laptop & telnet & tftp have been enabled. Router is connected via network cable to its ethernet port & port 1 on the WNR1000. Firmware.img has been put in windows/system32 & renamed to "openwrt-chaos".

Then I turn on the router with paperclip depressing the reset button until power icon flashes amber, then green. Running as admin I bring up a terminal window using command prompt & type in "tftp -i PUT openwrt-chaos.img".

In the command prompt window I get the message "tftp: can't read from local file 'openwrt-chaos.img'". I'm a bit lost how to proceed, thanks.

Copy link

Hello, before I start flashing my WNR1000 V2 router I have some doubts: The Build section is needed for install OpenWRT successfully in my router?, or is it only for an specific scenario?, I see the build steps kind of complex because don't have Debian installed and don't use much Git, and of course don't want to start without I'm sure what I'm doing. Thanks in advance for your clarification.

Copy link

As a comment I found that my Router NetGear WNR1000 V2, is only upgradeable to this version: V1.1.2.54NA, not as stated above.

Copy link

Kindly please tell me the way to upgrade my WNR1000 to openwrt using windows. I tried using firmware upgrade but error with "unable to get response from server". Plz guide me with windows step. Unclear instruction in openwrt web. Please

Copy link

ronle commented Aug 14, 2016

You will need to use ftp client once the device is in failsafe mode.
The instructions on choosing and running the ftp client are here -

I have successfully installed and running this build though I'm wondering if there is a later build available.
I'm getting some bizarre errors when trying to play with FW and it seems to be blocking port forwarding without any real reason. Changing / disabling the FW will deem the router unusable and it will no longer be accessible from any interface (have not checked ssh). Was able to recover eventually but not without a struggle...

Read somewhere that this is related to some of the OpenWRT versions.

Copy link

Finally i can using a wrong image to flash all this time. Anyhow after successful installation, now i couldn't install SQM package as its not available in the list. Kindly plz help since the internet says BB 14.07 can support SQM.

Copy link

Worked fine for me

Copy link

ogdento commented Apr 17, 2017

Thank you very much for sharing the firmware modification and these instructions!

I had trouble flashing a WNR1000v2-VC (on firmware, but finally got it. My failsafe mode appeared to be hosed. I got the correct power light patterns and could ping the device in failsafe mode but the TFTP would never work... it would either timeout or just hang indefinitely.

I flashed it without failsafe mode... I needed to execute the TFTP command during the window when the bootloader pauses to wait for a TFTP connection. I used 2 command windows... cmd 1 was set to run this ping command - "ping -t -w 2" (which will repeatedly ping the address forever), and cmd 2 was set to run the TFTP command. I fired off the cmd 1 pings, set focus on cmd 2, powered on the router (not in failsafe mode), and as soon as I saw the first good ping response on cmd 1 I hit return (in cmd 2) to execute the TFTP. Worked on the first try.

I used the barrier-breaker factory image and then upgraded to the latest 15.05.1 (using system upgrade bin, not factory img) from the openwrt web interface.

Copy link

truquete commented Jun 2, 2017

Great information, thanks! I have been using it for a while without issues, but now I have a problem. For a chain of reasons that I don't want to get into details now, I have flashed the WNR1000v2 Firmware on a WNR1000v2-VC. Router doesn't boot now. I'm not be able to boot into failsafe either, router just blinks green slowly (0.5 seconds). I don't get any messages sent upon start (checked with tcpdump). Is there anything I can do, or is the router ready for the trashcan?
I've heard about bootloader mode, but I'm not sure how to do that. Thanks.

Copy link

botzkobg commented Jun 9, 2017

Hello all,

I have WNR1000v2 and I'm trying to flash the openwrt-ar71xx-generic-wnr1000v2-squashfs-factory-chaos-calmer-r44154.img but so far without any success. My router is upgraded to the latest factory firmware:
Before start the router I'm connecting my PC with the router and the cable is in port 1 of the router.
On my PC I'm executing:

timeout 100
put openwrt-ar71xx-generic-wnr1000v2-squashfs-factory-chaos-calmer-r44154.img

After this I'm starting the router in failsafe mode - Power indicator is flashing 6 times with amber color and after this start flashing in green.
tftp output is

sent WRQ <file=openwrt-ar71xx-generic-wnr1000v2-squashfs-factory-chaos-calmer-r44154.img, mode=octet>
sent WRQ <file=openwrt-ar71xx-generic-wnr1000v2-squashfs-factory-chaos-calmer-r44154.img, mode=octet>
sent WRQ <file=openwrt-ar71xx-generic-wnr1000v2-squashfs-factory-chaos-calmer-r44154.img, mode=octet>
sent WRQ <file=openwrt-ar71xx-generic-wnr1000v2-squashfs-factory-chaos-calmer-r44154.img, mode=octet>
sent WRQ <file=openwrt-ar71xx-generic-wnr1000v2-squashfs-factory-chaos-calmer-r44154.img, mode=octet>
sent WRQ <file=openwrt-ar71xx-generic-wnr1000v2-squashfs-factory-chaos-calmer-r44154.img, mode=octet>
Transfer timed out.

And the router is flashing constantly.

Any idea what is my issue?

Kind regards.

Copy link

botzkobg commented Jun 9, 2017

I have found my problem - the cable was not attached to my machine but it was attached to the machine of my wife :).
Now everything is working.

Thank you for your work SaltwaterC.

Copy link

I have also solved my problem... it turns out that flashing the v2 on a v2-vc is not the end of the world. I essentially follow the steps from ogdento and I could flash from the bootloader. The problem was that I was trying to flash the official OpenWrt release. And someone that is not accepted by the bootloader. I could flash the version from SaltwaterC, and it works.

I then tried upgrading from the firmware posted by SaltwaterC to the latest release via Luci, and although it worked, the settings do not survive a single reboot. I then noticed that the software tab in Luci reports a memory size of 16MB, which is wrong! This would explain why I couldn't flash it from the bootloader. Now this beg the next question: has anyone succeed in flashing the release version on top of SaltwaterC's? Is this a problem with the image, or my internal memory partition is somehow messed up? Thanks

Copy link

For the benefit of anyone else coming here with a WN604.

I successfully installed the image openwrt-ar71xx-generic-wnr1000v2-squashfs-factory-barrier-breaker-r44095.img from this repo after customising the bootcmd as described in this openwrt forum post. In summary:

ar7240> setenv bootargs "squashfs init=/etc/preinit mtdparts=ar7240-nor0:256k(u-boot),64k(u-boot-env),3328k(rootfs),64k(config),128k(language_table),64k(pot),64k(traffic_meter),64k(ART),3473344@327744(mount_fs)"
ar7240> setenv bootcmd "fsload 80800000 image/uImage;bootm 80800000"
ar7240> saveenv

I also tried openwrt-ar71xx-generic-wnr1000v2-squashfs-factory-chaos-calmer-r44154.img and lede-17.01.2-ar71xx-generic-wnr1000v2-squashfs-factory.img (official LEDE image) but they wouldn't boot.

Copy link

Apologies for ignoring these comments. GitHub doesn't sent notifications for Gist comments.

although it worked, the settings do not survive a single reboot

I've seen this myself. CC 15.05.1 and LEDE 17.01.2 can be upgraded via sysupgrade / LuCI, but the settings don't survive upon reboot. All my attempts to make them stick have failed.

has anyone succeed in flashing the release version on top of SaltwaterC's?

I definitely have not. CC fails to boot and LEDE goes into a boot loop. I didn't have my serial adapter at hand to get some actual debug info. Anyway, something is broken upstream since the patch has been merged. Flashed back my CC build with the WNR1000v2 patch. It works as expected. In the mean time, I've donated the device, therefore can't help with tracing the upstream issue.

PS: as small hardware hack, I've replaced the crappy built in antenna with a RP-SMA connector. It's actually pretty straightforward. It's possible to add a secondary RP-SMA connector in the place of the power switch, but I haven't attempted this myself.

Copy link

om23 commented Sep 29, 2017

I've been having trouble flashing openwrt on my WNR1000v2-vc. I have 2 laying around and I followed the instructions here multiple times. And when I'm trying to tftp put it times out (the power led never stops blinking green). I am able to ping it, etc.

I was able to access the serial port (UART) on the router and tried multiple ways of sending the image (even using ymodem). Also tried tftp when the modem was on (theoritically I should still be able to transfer the image and reboot, right). But none of these worked. I saw when starting in failsafe mode, the tftpt server was running (through serial I could see it). But tftp wouldn't connect, I tried on osx and ubuntu too.

Copy link

ghost commented Jan 12, 2018


I had a similar issue and resolved it. Try this:
I downgraded to Netgear Firmware WNR1000v2-VC-V1.0.0.3NA, then retried the tftp upload. Worked like a charm!
Note, the Netgear firmware that I had been running on the 1000v2-VC was WNR1000v2-VC-V1.1.2.56. If a user is also running this identical firmware, they may encounter the same tftp issues that I did.

See my original posts here:

Copy link

ghost commented Jan 14, 2018

Update: I'm currently running LEDE Reboot 17.01.4 r3560-79f57e422d successfully with LuCi on a WNR1000V2-VC. No bootloops and it the config is preserved when rebooting. The key seems to be using an image size smaller than the prebuilt default image found in the LEDE repository. If an image is much larger than ~3.4MB it will loop and/or not preserve settings upon reboot.

I built a custom image using the Image Builder based on the 17.01.4 release, removing IPv6 support and PPP. It weighs in at 3,407,876 bytes. For comparison, the prebuilt LEDE image is 3,538,948 bytes.

My "PACKAGE=" string for image builder was make -j4 image PROFILE=WNR1000V2_VC PACKAGES="libiwinfo-lua liblua libubus-lua libuci-lua lua luci luci-base luci-lib-ip luci-lib-nixio luci-mod-admin-full luci-theme-bootstrap uhttpd uhttpd-mod-ubus ntpd ntp-utils -dnsmasq -odhcp6c -firewall -fstools -ip6tables -ppp -ppp-mod-pppoe"

I flashed my LEDE 17.01.4 sysupgrade.bin to a clean install of the stock 15.05.1, which had itself been previously upgraded from Saltwater's chaos-calmer-r44154.bin. Note: While running the stock 15.05.1 image I was unable to preserve settings upon reboot, so I had to flash from within the GUI without rebooting.

The build manifest is below.

base-files - 173.1-r3560-79f57e422d busybox - 1.25.1-4 dnsmasq - 2.78-4 dropbear - 2017.75-4 firewall - 2017-05-27-a4d98aea-1 fstools - 2017-06-30-bdcb075f-1 fwtool - 1 hostapd-common - 2016-12-19-ad02e79d-7 iptables - 1.4.21-2 iw - 4.9-1 jshn - 2018-01-07-1dafcd78-1 jsonfilter - 2016-07-02-dea067ad-1 kernel - 4.4.92-1-45d282495a15974d60f8edb091d0e2a9 kmod-ath - 4.4.92+2017-01-31-3 kmod-ath9k - 4.4.92+2017-01-31-3 kmod-ath9k-common - 4.4.92+2017-01-31-3 kmod-cfg80211 - 4.4.92+2017-01-31-3 kmod-gpio-button-hotplug - 4.4.92-2 kmod-ipt-conntrack - 4.4.92-1 kmod-ipt-core - 4.4.92-1 kmod-ipt-nat - 4.4.92-1 kmod-mac80211 - 4.4.92+2017-01-31-3 kmod-nf-conntrack - 4.4.92-1 kmod-nf-ipt - 4.4.92-1 kmod-nf-nat - 4.4.92-1 lede-keyring - 2017-01-20-a50b7529-1 libblobmsg-json - 2018-01-07-1dafcd78-1 libc - 1.1.16-1 libgcc - 5.4.0-1 libip4tc - 1.4.21-2 libip6tc - 1.4.21-2 libiwinfo - 2016-09-21-fd9e17be-1 libiwinfo-lua - 2016-09-21-fd9e17be-1 libjson-c - 0.12.1-1 libjson-script - 2018-01-07-1dafcd78-1 liblua - 5.1.5-1 libnl-tiny - 0.1-5 libpthread - 1.1.16-1 libubox - 2018-01-07-1dafcd78-1 libubus - 2017-02-18-34c6e818-1 libubus-lua - 2017-02-18-34c6e818-1 libuci - 2018-01-01-141b64ef-1 libuci-lua - 2018-01-01-141b64ef-1 libuclient - 2017-11-02-4b87d831-1 libxtables - 1.4.21-2 logd - 2017-03-10-16f7e161-1 lua - 5.1.5-1 luci - git-18.007.32064-ff21f2f-1 luci-app-firewall - git-18.007.32064-ff21f2f-1 luci-base - git-18.007.32064-ff21f2f-1 luci-lib-ip - git-18.007.32064-ff21f2f-1 luci-lib-jsonc - git-18.007.32064-ff21f2f-1 luci-lib-nixio - git-18.007.32064-ff21f2f-1 luci-mod-admin-full - git-18.007.32064-ff21f2f-1 luci-proto-ipv6 - git-18.007.32064-ff21f2f-1 luci-proto-ppp - git-18.007.32064-ff21f2f-1 luci-theme-bootstrap - git-18.007.32064-ff21f2f-1 mtd - 21 netifd - 2017-01-25-650758b1-1 odhcpd - 2017-10-02-c6f3d5d4-2 opkg - 2017-03-23-1d0263bb-1 procd - 2017-08-08-66be6a23-1 rpcd - 2017-12-07-cfe1e75c-1 swconfig - 11 uboot-envtools - 2015.10-1 ubox - 2017-03-10-16f7e161-1 ubus - 2017-02-18-34c6e818-1 ubusd - 2017-02-18-34c6e818-1 uci - 2018-01-01-141b64ef-1 uclient-fetch - 2017-11-02-4b87d831-1 uhttpd - 2017-11-04-a235636a-1 uhttpd-mod-ubus - 2017-11-04-a235636a-1 usign - 2015-07-04-ef641914-1 wpad-mini - 2016-12-19-ad02e79d-7

Copy link

I can confim what jlpapple and SaltwaterC have said so far. I flashed openwrt-ar71xx-generic-wnr1000v2-squashfs-factory-barrier-breaker-r44095.img via tftp, and then used a sysupgrade.bin to get LEDE Reboot 17.01.4 r3560-79f57e422d running on a WNR1000v2. All settings are lost on reboot. Haven't tried building an image as jlpapple suggested.

I had an odd problem when trying to use tftp: Windows doesn't seem to work when flashing firmware to this router via tftp. The tftp2.exe GUI client didn't work ('Unable to get responses from server') and the built-in command line tftp seemed to transfer the file, but the firmware was always rejected (flashing green light). This was true for both OpenWrt and the Netgear OEM firmware. Tftp on Linux Mint 18.3 worked fine for both of those firmwares.

Copy link

ghost commented Jun 22, 2019

I'm now running OpenWRT Snapshot r10242-3c401f4 (19.0X) from June 17, 2019 successfully on my WNR1000V2-VC. This is a standard snapshot with no modification, downloaded straight from ""

As this is a snapshot build, so there is no LuCi, resulting in a firmware size of 3392.0 KB. Anything over 3400KB is likely to produce a bootloop and/or not enable you to preserve settings upon reboot.

TOP reports 6MB of free RAM. I'm using this router as a Dumb Access Point.

Copy link

I remember being plagued by tftp issues under Windows. Ended up using - in fact, I have tried this on all platforms that I normally use.

Copy link

ghost commented Jun 23, 2019

FYI. I've created stable builds for 18.06.02 and 17.01.06 using OpenWRT Image Builder.

In the process of creating these builds I bricked my router once due to a bad flash. Here is how I recovered the router in failsafe:

Note: This method is for Netgear WNR1000v2-VC North America Model only - although if you locate the right OEM Netgear firmware it will likely work for WNR1000v2 as well. I've placed the original firmware for the v2-VC in the same folder as the builds above.

  1. If you brick your router trying to upgrade to OpenWRT and need to revert your WNR1000v2-VC back to stock Netgear firmware via a TFTP flash, use the “WNR1000v2-VC-V1.0.0.12NA.img” file first. It is likely the only firmware that will be accepted via TFTP flash.

  2. Once you’ve successfully flashed above, login to the router web interface and update the firmware using the “WNR1000v2-VC-V1.2.2.56NA.img” file, as this is likely the only OEM firmware version that will accept the “openwrt-ar71xx-generic-wnr1000v2-vc-squashfs-factory-barrier-breaker-r44095.img” file from SaltwaterC’s flash method.

  3. Once you’ve flashed to SaltwaterC’s Breaker Barrier img file you can then upgrade via sysupgrade files to OpenWRT. I suggest unchecking "Keep settings" for maximum reliability when you upgrade between versions.

Copy link

ghost commented Jul 30, 2019

I've created downloadable firmwares for OpenWRT 17.01.7, 18.06.4, and 19.07 (08-01-19 Snapshot) for both the VC and V2 models.

Available at

Copy link

ghost commented Jun 13, 2020

New builds for 19.07.3 and 18.06.8 are now available.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment