Create a gist now

Instantly share code, notes, and snippets.

What would you like to do?
OpenWrt support for Netgear WNR1000v2


As usual, use it at your own risk. I am not to be held responsible for your actions.

Supported devices: WNR1000v2 (tested by me), WNR1000v2-VC (provided by Comcast for free; tested by Douglas Fraser)

Notice: Upgrade WNR1000v2 to the latest factory firmware: Otherwise, the power LED may not behave properly.

You need to place the device into failsafe mode. For booting into failsafe mode, you need to power up the device while holding the reset button with a pin. The power LED should have an amber colour. Hold the button until it is starting to flash green. It starts to flash green after it flashes the amber LED for six times. After that, the device is in failsafe mode, accepting a firmware via its TFTP server. The device should respond to pings at, although the responses may be malformed.

Configure your ethernet interface with a IP address. I use with netmask but it should work with any free address from that block.

You need a TFTP client for this purpose. You may check the OpenWrt wiki for more information if you aren't familiar with the procedure.

Barrier Breaker

With the OS X tftp client, and the Linux tftp client, the flashing procedure is something like:

For WNR1000v2

> binary
> trace
> put openwrt-ar71xx-generic-wnr1000v2-squashfs-factory-barrier-breaker-r44095.img

For WNR1000v2-VC

> binary
> trace
> put openwrt-ar71xx-generic-wnr1000v2-vc-squashfs-factory-barrier-breaker-r44095.img

Please don't use the WNR1000v2 firmware file for the WNR1000v2-VC model. Every time you do that, a kitten dies.

The power LED turns off during the upload. If it starts to flash green after the upload, then the firmware is rejected (usually the case with a corrupted or wrong firmware). Otherwise, it should be green and it stops flashing (but sometimes it may stay off). You should wait until the device finishes the upgrade procedure. Usually it is under three minutes. It should boot into OpenWrt.

If the connection drops during the upload, you may end up with a corrupted firmware and the device is booting into failsafe mode. Just repeat the flashing procedure.

Please notice that the power LED flashes green during the normal boot. However, it flashes at a faster rate compared to a device in failsafe mode. If unsure, let the device to stay in that state at least for a minute before deciding that it needs reflashing. After a normal boot, you should get a solid green on the power LED.

Chaos Calmer (trunk)

The Chaos Calmer patch was created against r44154. It was tested succesfully on WNR1000v2 and WNR1000v2-VC, but the device may require a power cycle after the flash. It may boot in (an unusable) failsafe mode. This happened on WNR1000v2 by going from Barrier Breaker to Chaos Calmer via TFTP flashing.

For building it, you can not use the Barrier Breaker config. For creating the build config, you need to pick the "Atheros AR7xxx/AR9xxx" Target System, the "Generic" Subtarget, and optionally the WNR1000v2 driver profile.

Please notice that the images may not build succesfully without a clean tree and config.


You need an OpenWrt Buildroot. I use Debian 7.x for this purpose.

# Aka cloning this particular gist
git clone
cd ef49c8a4df81c8896153
# This is the Barrier Breaker branch
git clone git://
cd openwrt
# Apply the patch for WNR1000v2/WNR1000v2-VC support
patch -p1 < ../wnr1000v2+vc-barrier-breaker-r44095.patch
# Add the LuCI support into the OpenWrt tree
./scripts/feeds update luci
./scripts/feeds install luci
# Get the generic config for AR71xx
wget -O .config
# when doing the menuconfig, you need to go to LuCI > Collections and 
# make sure that {*} luci is selected, otherwise LuCI is built as module
# and it won't be available into the built image, only the package is built
make menuconfig
# The final step for building the image. You may replace "make" with
# "make -j number-of-cpu-cores+1" for faster building on a multi-core CPU

The images will be in the "bin/ar71xx" directory. After that, follow the above Install instructions.

5b95005158eb064f63bf46bb32bc4bf2 *openwrt-ar71xx-generic-wnr1000v2-squashfs-factory-barrier-breaker-r44095.img
852f6f0028c9fca542f8658f7834043c *openwrt-ar71xx-generic-wnr1000v2-squashfs-sysupgrade-barrier-breaker-r44095.bin
271cdf6e3db97e645b8563f394e8cd5c *openwrt-ar71xx-generic-wnr1000v2-vc-squashfs-factory-barrier-breaker-r44095.img
813eafe9f2790ff78fd017b4331dc43b *openwrt-ar71xx-generic-wnr1000v2-vc-squashfs-sysupgrade-barrier-breaker-r44095.bin
fd67f85b43d195ea28f04a72397e7001 *openwrt-ar71xx-generic-wnr1000v2-squashfs-factory-chaos-calmer-r44154.img
9078821e10656d62ac6e87dd6f21039a *openwrt-ar71xx-generic-wnr1000v2-squashfs-sysupgrade-chaos-calmer-r44154.bin
9c7cbb3cee1829c11440129ce155a425 *openwrt-ar71xx-generic-wnr1000v2-vc-squashfs-factory-chaos-calmer-r44154.img
c766344bbc11ceb51228a222de172a6e *openwrt-ar71xx-generic-wnr1000v2-vc-squashfs-sysupgrade-chaos-calmer-r44154.bin
View Raw

(Sorry about that, but we can’t show files that are this big right now.)

View Raw

(Sorry about that, but we can’t show files that are this big right now.)

View Raw

(Sorry about that, but we can’t show files that are this big right now.)

View Raw

(Sorry about that, but we can’t show files that are this big right now.)

View Raw

(Sorry about that, but we can’t show files that are this big right now.)

View Raw

(Sorry about that, but we can’t show files that are this big right now.)

View Raw

(Sorry about that, but we can’t show files that are this big right now.)

View Raw

(Sorry about that, but we can’t show files that are this big right now.)

View Raw

(Sorry about that, but we can’t show files that are this big right now.)

User2uk commented Sep 16, 2015

I followed the above instruction and when do build root get the follwing error at the end
" make -r world: build failed. Please re-run make with V=s to see what's going on make: *** [world] Error 1

how to work around this error?



I guess the easiest is to pull the latest CC sources. The CC patch has been mainlined.


Just flashed this and amazingly got it on the first try. Just a couple thoughts to help windows users out as I had no idea what I was doing.
After downloading the correct image above, place it in windows/system32 and rename to something simple. Go into programs and features and enable telnet and tftp clients. Open a command prompt and enter "tftp -i PUT openwrt-xxxx.img" (thanks to jenom in the forum post) following the procedure posted above. Of course you put in the file name that you chose earlier.

For me the light started blinking so I thought it was rejected but it flashed correctly.

baab22 commented Feb 21, 2016

I think I flashed by accident the Chaos Calmer image on top of the Barrier Breaker image and now I cannot flash any images anymore. I can still enter failsafe mode but uploading stops after a few bytes. I assume I'm stuck in the "unusable failsafe mode" you mentioned. Did you figure out a way to fix this?

dammer commented Feb 23, 2016

Today flasing WNR1000 v2h2 with openwrt-ar71xx-generic-wnr1000v2-squashfs-factory-barrier-breaker-r44095.img
It just work fine!


[    0.000000] Linux version 3.10.49 (build@downloadfast01) (gcc version 4.8.3 (OpenWrt/Linaro GCC 4.8-2014.04 r44065) ) #3 Sat Jan 24 17:35:02 EST 2015
[    0.000000] MyLoader: sysp=a2ba20aa, boardp=aaabaa02, parts=aabaaaaa
[    0.000000] bootconsole [early0] enabled
[    0.000000] CPU revision is: 00019374 (MIPS 24Kc)
[    0.000000] SoC: Atheros AR7240 rev 2
[    0.000000] Clocks: CPU:340.000MHz, DDR:340.000MHz, AHB:170.000MHz, Ref:5.000MHz
[    0.000000] Determined physical RAM map:
[    0.000000]  memory: 02000000 @ 00000000 (usable)
[    0.000000] Initrd not found or empty - disabling initrd
[    0.000000] Zone ranges:
[    0.000000]   Normal   [mem 0x00000000-0x01ffffff]
[    0.000000] Movable zone start for each node
[    0.000000] Early memory node ranges
[    0.000000]   node   0: [mem 0x00000000-0x01ffffff]
[    0.000000] On node 0 totalpages: 8192
[    0.000000] free_area_init_node: node 0, pgdat 80334b60, node_mem_map 81000000
[    0.000000]   Normal zone: 64 pages used for memmap
[    0.000000]   Normal zone: 0 pages reserved
[    0.000000]   Normal zone: 8192 pages, LIFO batch:0
[    0.000000] Primary instruction cache 64kB, VIPT, 4-way, linesize 32 bytes.
[    0.000000] Primary data cache 32kB, 4-way, VIPT, cache aliases, linesize 32 bytes
[    0.000000] pcpu-alloc: s0 r0 d32768 u32768 alloc=1*32768
[    0.000000] pcpu-alloc: [0] 0 
[    0.000000] Built 1 zonelists in Zone order, mobility grouping on.  Total pages: 8128
[    0.000000] Kernel command line:  board=WNR1000V2 console=ttyS0,115200 mtdparts=spi0.0:256k(u-boot)ro,64k(u-boot-env)ro,3712k(firmware),64k(art)ro rootfstype=squashfs,jffs2 noinitrd
[    0.000000] PID hash table entries: 128 (order: -3, 512 bytes)
[    0.000000] Dentry cache hash table entries: 4096 (order: 2, 16384 bytes)
[    0.000000] Inode-cache hash table entries: 2048 (order: 1, 8192 bytes)
[    0.000000] Writing ErrCtl register=00000000
[    0.000000] Readback ErrCtl register=00000000
[    0.000000] Memory: 28588k/32768k available (2369k kernel code, 4180k reserved, 621k data, 272k init, 0k highmem)
[    0.000000] SLUB: HWalign=32, Order=0-3, MinObjects=0, CPUs=1, Nodes=1
[    0.000000] NR_IRQS:51
[    0.080000] Calibrating delay loop... 226.09 BogoMIPS (lpj=1130496)
[    0.080000] pid_max: default: 32768 minimum: 301
[    0.080000] Mount-cache hash table entries: 512
[    0.090000] NET: Registered protocol family 16
[    0.100000] MIPS: machine is NETGEAR WNR1000 V2
[    0.510000] registering PCI controller with io_map_base unset
[    0.520000] bio: create slab <bio-0> at 0
[    0.530000] PCI host bridge to bus 0000:00
[    0.530000] pci_bus 0000:00: root bus resource [mem 0x10000000-0x13ffffff]
[    0.540000] pci_bus 0000:00: root bus resource [io  0x0000]
[    0.540000] pci_bus 0000:00: No busn resource found for root bus, will use [bus 00-ff]
[    0.550000] pci 0000:00:00.0: [168c:002b] type 00 class 0x028000
[    0.550000] pci 0000:00:00.0: fixup device configuration
[    0.550000] pci 0000:00:00.0: reg 10: [mem 0x00000000-0x0000ffff 64bit]
[    0.550000] pci 0000:00:00.0: supports D1
[    0.550000] pci 0000:00:00.0: PME# supported from D0 D1 D3hot
[    0.550000] pci_bus 0000:00: busn_res: [bus 00-ff] end is updated to 00
[    0.550000] pci 0000:00:00.0: BAR 0: assigned [mem 0x10000000-0x1000ffff 64bit]
[    0.560000] pci 0000:00:00.0: using irq 40 for pin 1
[    0.560000] Switching to clocksource MIPS
[    0.570000] NET: Registered protocol family 2
[    0.580000] TCP established hash table entries: 512 (order: 0, 4096 bytes)
[    0.580000] TCP bind hash table entries: 512 (order: -1, 2048 bytes)
[    0.590000] TCP: Hash tables configured (established 512 bind 512)
[    0.590000] TCP: reno registered
[    0.600000] UDP hash table entries: 256 (order: 0, 4096 bytes)
[    0.600000] UDP-Lite hash table entries: 256 (order: 0, 4096 bytes)
[    0.610000] NET: Registered protocol family 1
[    0.610000] PCI: CLS 0 bytes, default 32
[    0.640000] squashfs: version 4.0 (2009/01/31) Phillip Lougher
[    0.640000] jffs2: version 2.2 (NAND) (SUMMARY) (LZMA) (RTIME) (CMODE_PRIORITY) (c) 2001-2006 Red Hat, Inc.
[    0.660000] msgmni has been set to 55
[    0.660000] io scheduler noop registered
[    0.660000] io scheduler deadline registered (default)
[    0.670000] Serial: 8250/16550 driver, 16 ports, IRQ sharing enabled
[    0.700000] serial8250.0: ttyS0 at MMIO 0x18020000 (irq = 11) is a 16550A
[    0.710000] console [ttyS0] enabled, bootconsole disabled
[    0.730000] ath79-spi ath79-spi: master is unqueued, this is deprecated
[    0.740000] m25p80 spi0.0: found w25q32, expected m25p80
[    0.740000] m25p80 spi0.0: w25q32 (4096 Kbytes)
[    0.750000] 4 cmdlinepart partitions found on MTD device spi0.0
[    0.750000] Creating 4 MTD partitions on "spi0.0":
[    0.760000] 0x000000000000-0x000000040000 : "u-boot"
[    0.760000] 0x000000040000-0x000000050000 : "u-boot-env"
[    0.770000] 0x000000050000-0x0000003f0000 : "firmware"
[    0.780000] 2 netgear-fw partitions found on MTD device firmware
[    0.780000] 0x000000050000-0x000000162440 : "kernel"
[    0.790000] mtd: partition "kernel" must either start or end on erase block boundary or be smaller than an erase block -- forcing read-only
[    0.800000] 0x000000162440-0x0000003f0000 : "rootfs"
[    0.810000] mtd: partition "rootfs" must either start or end on erase block boundary or be smaller than an erase block -- forcing read-only
[    0.820000] mtd: device 4 (rootfs) set to be root filesystem
[    0.830000] 1 squashfs-split partitions found on MTD device rootfs
[    0.840000] 0x000000390000-0x0000003f0000 : "rootfs_data"
[    0.840000] 0x0000003f0000-0x000000400000 : "art"
[    0.960000] libphy: ag71xx_mdio: probed
[    1.540000] ag71xx ag71xx.0: connected to PHY at ag71xx-mdio.0:04 [uid=004dd041, driver=Generic PHY]
[    1.550000] eth0: Atheros AG71xx at 0xb9000000, irq 4, mode:MII
[    2.120000] ag71xx-mdio.0: Found an AR7240/AR9330 built-in switch
[    3.150000] eth1: Atheros AG71xx at 0xba000000, irq 5, mode:GMII
[    3.160000] TCP: cubic registered
[    3.160000] NET: Registered protocol family 17
[    3.160000] Bridge firewalling registered
[    3.170000] 8021q: 802.1Q VLAN Support v1.8
[    3.180000] VFS: Mounted root (squashfs filesystem) readonly on device 31:4.
[    3.190000] Freeing unused kernel memory: 272K (8034c000 - 80390000)
[    6.590000] usbcore: registered new interface driver usbfs
[    6.600000] usbcore: registered new interface driver hub
[    6.600000] usbcore: registered new device driver usb
[    6.610000] ehci_hcd: USB 2.0 'Enhanced' Host Controller (EHCI) Driver
[    6.620000] ehci-platform: EHCI generic platform driver
[    6.630000] ohci_hcd: USB 1.1 'Open' Host Controller (OHCI) Driver
[    9.290000] eth1: link up (1000Mbps/Full duplex)
[   11.540000] eth1: link down
[   13.360000] NET: Registered protocol family 10
[   13.380000] nf_conntrack version 0.5.0 (450 buckets, 1800 max)
[   13.390000] ip6_tables: (C) 2000-2006 Netfilter Core Team
[   13.410000] Loading modules backported from Linux version master-2014-05-22-0-gf2032ea
[   13.420000] Backport generated by backports.git backports-20140320-37-g5c33da0
[   13.430000] ip_tables: (C) 2000-2006 Netfilter Core Team
[   13.490000] xt_time: kernel timezone is -0000
[   13.530000] cfg80211: Calling CRDA to update world regulatory domain
[   13.530000] cfg80211: World regulatory domain updated:
[   13.540000] cfg80211:  DFS Master region: unset
[   13.540000] cfg80211:   (start_freq - end_freq @ bandwidth), (max_antenna_gain, max_eirp), (dfs_cac_time)
[   13.550000] cfg80211:   (2402000 KHz - 2472000 KHz @ 40000 KHz), (N/A, 2000 mBm), (N/A)
[   13.560000] cfg80211:   (2457000 KHz - 2482000 KHz @ 40000 KHz), (N/A, 2000 mBm), (N/A)
[   13.570000] cfg80211:   (2474000 KHz - 2494000 KHz @ 20000 KHz), (N/A, 2000 mBm), (N/A)
[   13.580000] cfg80211:   (5170000 KHz - 5250000 KHz @ 160000 KHz), (N/A, 2000 mBm), (N/A)
[   13.580000] cfg80211:   (5250000 KHz - 5330000 KHz @ 160000 KHz), (N/A, 2000 mBm), (0 s)
[   13.590000] cfg80211:   (5490000 KHz - 5730000 KHz @ 160000 KHz), (N/A, 2000 mBm), (0 s)
[   13.600000] cfg80211:   (5735000 KHz - 5835000 KHz @ 80000 KHz), (N/A, 2000 mBm), (N/A)
[   13.610000] cfg80211:   (57240000 KHz - 63720000 KHz @ 2160000 KHz), (N/A, 0 mBm), (N/A)
[   13.710000] PPP generic driver version 2.4.2
[   13.710000] NET: Registered protocol family 24
[   13.770000] PCI: Enabling device 0000:00:00.0 (0000 -> 0002)
[   13.780000] ath: phy0: Enable LNA combining
[   13.790000] ath: phy0: eeprom contains invalid mac address: ff:ff:ff:ff:ff:ff
[   13.800000] ath: phy0: random mac address will be used: f6:14:b6:30:14:4c
[   13.800000] ath: EEPROM regdomain: 0x0
[   13.800000] ath: EEPROM indicates default country code should be used
[   13.800000] ath: doing EEPROM country->regdmn map search
[   13.800000] ath: country maps to regdmn code: 0x3a
[   13.800000] ath: Country alpha2 being used: US
[   13.800000] ath: Regpair used: 0x3a
[   13.820000] ieee80211 phy0: Selected rate control algorithm 'minstrel_ht'
[   13.830000] cfg80211: Calling CRDA for country: US
[   13.840000] ieee80211 phy0: Atheros AR9285 Rev:2 mem=0xb0000000, irq=40
[   13.850000] cfg80211: Regulatory domain changed to country: US
[   13.860000] cfg80211:  DFS Master region: FCC
[   13.860000] cfg80211:   (start_freq - end_freq @ bandwidth), (max_antenna_gain, max_eirp), (dfs_cac_time)
[   13.870000] cfg80211:   (2402000 KHz - 2472000 KHz @ 40000 KHz), (N/A, 3000 mBm), (N/A)
[   13.880000] cfg80211:   (5170000 KHz - 5250000 KHz @ 80000 KHz), (N/A, 1700 mBm), (N/A)
[   13.890000] cfg80211:   (5250000 KHz - 5330000 KHz @ 80000 KHz), (N/A, 2300 mBm), (0 s)
[   13.900000] cfg80211:   (5735000 KHz - 5835000 KHz @ 80000 KHz), (N/A, 3000 mBm), (N/A)
[   13.910000] cfg80211:   (57240000 KHz - 63720000 KHz @ 2160000 KHz), (N/A, 4000 mBm), (N/A)
[   25.860000] jffs2_scan_eraseblock(): End of filesystem marker found at 0x0
[   25.890000] jffs2_build_filesystem(): unlocking the mtd device... done.
[   25.890000] jffs2_build_filesystem(): erasing all blocks after the end marker... done.
[   27.070000] jffs2: notice: (906) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found.
[   30.760000] IPv6: ADDRCONF(NETDEV_UP): eth1: link is not ready
[   30.760000] device eth1 entered promiscuous mode
[   30.780000] IPv6: ADDRCONF(NETDEV_UP): br-lan: link is not ready
[   30.820000] IPv6: ADDRCONF(NETDEV_UP): eth0: link is not ready
[   31.860000] eth1: link up (1000Mbps/Full duplex)
[   31.860000] br-lan: port 1(eth1) entered forwarding state
[   31.870000] br-lan: port 1(eth1) entered forwarding state
[   31.870000] IPv6: ADDRCONF(NETDEV_CHANGE): eth1: link becomes ready
[   31.900000] IPv6: ADDRCONF(NETDEV_CHANGE): br-lan: link becomes ready
[   33.870000] br-lan: port 1(eth1) entered forwarding state
[  145.640000] nf_conntrack: automatic helper assignment is deprecated and it will be removed soon. Use the iptables CT target to attach helpers instead.

Hello, I see others have been successful flashing this but I'm new to flashing router firmware & have had no luck yet installing this on my WNR1000v2-VC, hoping someone with more competence & experience can offer advice.

I'm using Windows 7 on my laptop & telnet & tftp have been enabled. Router is connected via network cable to its ethernet port & port 1 on the WNR1000. Firmware.img has been put in windows/system32 & renamed to "openwrt-chaos".

Then I turn on the router with paperclip depressing the reset button until power icon flashes amber, then green. Running as admin I bring up a terminal window using command prompt & type in "tftp -i PUT openwrt-chaos.img".

In the command prompt window I get the message "tftp: can't read from local file 'openwrt-chaos.img'". I'm a bit lost how to proceed, thanks.


Hello, before I start flashing my WNR1000 V2 router I have some doubts: The Build section is needed for install OpenWRT successfully in my router?, or is it only for an specific scenario?, I see the build steps kind of complex because don't have Debian installed and don't use much Git, and of course don't want to start without I'm sure what I'm doing. Thanks in advance for your clarification.


As a comment I found that my Router NetGear WNR1000 V2, is only upgradeable to this version: V1.1.2.54NA, not as stated above.


Kindly please tell me the way to upgrade my WNR1000 to openwrt using windows. I tried using firmware upgrade but error with "unable to get response from server". Plz guide me with windows step. Unclear instruction in openwrt web. Please

ronle commented Aug 14, 2016

You will need to use ftp client once the device is in failsafe mode.
The instructions on choosing and running the ftp client are here -

I have successfully installed and running this build though I'm wondering if there is a later build available.
I'm getting some bizarre errors when trying to play with FW and it seems to be blocking port forwarding without any real reason. Changing / disabling the FW will deem the router unusable and it will no longer be accessible from any interface (have not checked ssh). Was able to recover eventually but not without a struggle...

Read somewhere that this is related to some of the OpenWRT versions.


Finally i can using a wrong image to flash all this time. Anyhow after successful installation, now i couldn't install SQM package as its not available in the list. Kindly plz help since the internet says BB 14.07 can support SQM.


Worked fine for me

ogdento commented Apr 17, 2017

Thank you very much for sharing the firmware modification and these instructions!

I had trouble flashing a WNR1000v2-VC (on firmware, but finally got it. My failsafe mode appeared to be hosed. I got the correct power light patterns and could ping the device in failsafe mode but the TFTP would never work... it would either timeout or just hang indefinitely.

I flashed it without failsafe mode... I needed to execute the TFTP command during the window when the bootloader pauses to wait for a TFTP connection. I used 2 command windows... cmd 1 was set to run this ping command - "ping -t -w 2" (which will repeatedly ping the address forever), and cmd 2 was set to run the TFTP command. I fired off the cmd 1 pings, set focus on cmd 2, powered on the router (not in failsafe mode), and as soon as I saw the first good ping response on cmd 1 I hit return (in cmd 2) to execute the TFTP. Worked on the first try.

I used the barrier-breaker factory image and then upgraded to the latest 15.05.1 (using system upgrade bin, not factory img) from the openwrt web interface.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment