Skip to content

Instantly share code, notes, and snippets.

@SaltwaterC
Last active March 3, 2024 23:21
Show Gist options
  • Save SaltwaterC/ef49c8a4df81c8896153 to your computer and use it in GitHub Desktop.
Save SaltwaterC/ef49c8a4df81c8896153 to your computer and use it in GitHub Desktop.
OpenWrt support for Netgear WNR1000v2

Install

As usual, use it at your own risk. I am not to be held responsible for your actions.

Supported devices: WNR1000v2 (tested by me), WNR1000v2-VC (provided by Comcast for free; tested by Douglas Fraser)

Notice: Upgrade WNR1000v2 to the latest factory firmware: 1.1.2.58. Otherwise, the power LED may not behave properly.

You need to place the device into failsafe mode. For booting into failsafe mode, you need to power up the device while holding the reset button with a pin. The power LED should have an amber colour. Hold the button until it is starting to flash green. It starts to flash green after it flashes the amber LED for six times. After that, the device is in failsafe mode, accepting a firmware via its TFTP server. The device should respond to pings at 192.168.1.1, although the responses may be malformed.

Configure your ethernet interface with a 192.168.1.0/24 IP address. I use 192.168.1.2 with netmask 255.255.255.0 but it should work with any free address from that block.

You need a TFTP client for this purpose. You may check the OpenWrt wiki for more information if you aren't familiar with the procedure.

Barrier Breaker

With the OS X tftp client, and the Linux tftp client, the flashing procedure is something like:

For WNR1000v2

tftp 192.168.1.1
> binary
> trace
> put openwrt-ar71xx-generic-wnr1000v2-squashfs-factory-barrier-breaker-r44095.img

For WNR1000v2-VC

tftp 192.168.1.1
> binary
> trace
> put openwrt-ar71xx-generic-wnr1000v2-vc-squashfs-factory-barrier-breaker-r44095.img

Please don't use the WNR1000v2 firmware file for the WNR1000v2-VC model. Every time you do that, a kitten dies.

The power LED turns off during the upload. If it starts to flash green after the upload, then the firmware is rejected (usually the case with a corrupted or wrong firmware). Otherwise, it should be green and it stops flashing (but sometimes it may stay off). You should wait until the device finishes the upgrade procedure. Usually it is under three minutes. It should boot into OpenWrt.

If the connection drops during the upload, you may end up with a corrupted firmware and the device is booting into failsafe mode. Just repeat the flashing procedure.

Please notice that the power LED flashes green during the normal boot. However, it flashes at a faster rate compared to a device in failsafe mode. If unsure, let the device to stay in that state at least for a minute before deciding that it needs reflashing. After a normal boot, you should get a solid green on the power LED.

Chaos Calmer (trunk)

The Chaos Calmer patch was created against r44154. It was tested succesfully on WNR1000v2 and WNR1000v2-VC, but the device may require a power cycle after the flash. It may boot in (an unusable) failsafe mode. This happened on WNR1000v2 by going from Barrier Breaker to Chaos Calmer via TFTP flashing.

For building it, you can not use the Barrier Breaker config. For creating the build config, you need to pick the "Atheros AR7xxx/AR9xxx" Target System, the "Generic" Subtarget, and optionally the WNR1000v2 driver profile.

Please notice that the images may not build succesfully without a clean tree and config.

Build

You need an OpenWrt Buildroot. I use Debian 7.x for this purpose.

# Aka cloning this particular gist
git clone https://gist.github.com/ef49c8a4df81c8896153.git
cd ef49c8a4df81c8896153
# This is the Barrier Breaker branch
git clone git://git.openwrt.org/14.07/openwrt.git
cd openwrt
# Apply the patch for WNR1000v2/WNR1000v2-VC support
patch -p1 < ../wnr1000v2+vc-barrier-breaker-r44095.patch
# Add the LuCI support into the OpenWrt tree
./scripts/feeds update luci
./scripts/feeds install luci
# Get the generic config for AR71xx
wget https://downloads.openwrt.org/barrier_breaker/14.07/ar71xx/generic/config.ar71xx_generic -O .config
# when doing the menuconfig, you need to go to LuCI > Collections and 
# make sure that {*} luci is selected, otherwise LuCI is built as module
# and it won't be available into the built image, only the package is built
make menuconfig
# The final step for building the image. You may replace "make" with
# "make -j number-of-cpu-cores+1" for faster building on a multi-core CPU
make

The images will be in the "bin/ar71xx" directory. After that, follow the above Install instructions.

5b95005158eb064f63bf46bb32bc4bf2 *openwrt-ar71xx-generic-wnr1000v2-squashfs-factory-barrier-breaker-r44095.img
852f6f0028c9fca542f8658f7834043c *openwrt-ar71xx-generic-wnr1000v2-squashfs-sysupgrade-barrier-breaker-r44095.bin
271cdf6e3db97e645b8563f394e8cd5c *openwrt-ar71xx-generic-wnr1000v2-vc-squashfs-factory-barrier-breaker-r44095.img
813eafe9f2790ff78fd017b4331dc43b *openwrt-ar71xx-generic-wnr1000v2-vc-squashfs-sysupgrade-barrier-breaker-r44095.bin
fd67f85b43d195ea28f04a72397e7001 *openwrt-ar71xx-generic-wnr1000v2-squashfs-factory-chaos-calmer-r44154.img
9078821e10656d62ac6e87dd6f21039a *openwrt-ar71xx-generic-wnr1000v2-squashfs-sysupgrade-chaos-calmer-r44154.bin
9c7cbb3cee1829c11440129ce155a425 *openwrt-ar71xx-generic-wnr1000v2-vc-squashfs-factory-chaos-calmer-r44154.img
c766344bbc11ceb51228a222de172a6e *openwrt-ar71xx-generic-wnr1000v2-vc-squashfs-sysupgrade-chaos-calmer-r44154.bin
View raw

(Sorry about that, but we can’t show files that are this big right now.)

View raw

(Sorry about that, but we can’t show files that are this big right now.)

View raw

(Sorry about that, but we can’t show files that are this big right now.)

View raw

(Sorry about that, but we can’t show files that are this big right now.)

View raw

(Sorry about that, but we can’t show files that are this big right now.)

View raw

(Sorry about that, but we can’t show files that are this big right now.)

View raw

(Sorry about that, but we can’t show files that are this big right now.)

View raw

(Sorry about that, but we can’t show files that are this big right now.)

View raw

(Sorry about that, but we can’t show files that are this big right now.)

@botzkobg
Copy link

botzkobg commented Jun 9, 2017

Hello all,

I have WNR1000v2 and I'm trying to flash the openwrt-ar71xx-generic-wnr1000v2-squashfs-factory-chaos-calmer-r44154.img but so far without any success. My router is upgraded to the latest factory firmware: 1.1.2.58.
Before start the router I'm connecting my PC with the router and the cable is in port 1 of the router.
On my PC I'm executing:

tftp 192.168.1.1
binary
trace
timeout 100
put openwrt-ar71xx-generic-wnr1000v2-squashfs-factory-chaos-calmer-r44154.img

After this I'm starting the router in failsafe mode - Power indicator is flashing 6 times with amber color and after this start flashing in green.
tftp output is

sent WRQ <file=openwrt-ar71xx-generic-wnr1000v2-squashfs-factory-chaos-calmer-r44154.img, mode=octet>
sent WRQ <file=openwrt-ar71xx-generic-wnr1000v2-squashfs-factory-chaos-calmer-r44154.img, mode=octet>
sent WRQ <file=openwrt-ar71xx-generic-wnr1000v2-squashfs-factory-chaos-calmer-r44154.img, mode=octet>
sent WRQ <file=openwrt-ar71xx-generic-wnr1000v2-squashfs-factory-chaos-calmer-r44154.img, mode=octet>
...
...
sent WRQ <file=openwrt-ar71xx-generic-wnr1000v2-squashfs-factory-chaos-calmer-r44154.img, mode=octet>
sent WRQ <file=openwrt-ar71xx-generic-wnr1000v2-squashfs-factory-chaos-calmer-r44154.img, mode=octet>
Transfer timed out.

And the router is flashing constantly.

Any idea what is my issue?

Kind regards.

@botzkobg
Copy link

botzkobg commented Jun 9, 2017

I have found my problem - the cable was not attached to my machine but it was attached to the machine of my wife :).
Now everything is working.

Thank you for your work SaltwaterC.

@truquete
Copy link

I have also solved my problem... it turns out that flashing the v2 on a v2-vc is not the end of the world. I essentially follow the steps from ogdento and I could flash from the bootloader. The problem was that I was trying to flash the official OpenWrt release. And someone that is not accepted by the bootloader. I could flash the version from SaltwaterC, and it works.

I then tried upgrading from the firmware posted by SaltwaterC to the latest release via Luci, and although it worked, the settings do not survive a single reboot. I then noticed that the software tab in Luci reports a memory size of 16MB, which is wrong! This would explain why I couldn't flash it from the bootloader. Now this beg the next question: has anyone succeed in flashing the release version on top of SaltwaterC's? Is this a problem with the image, or my internal memory partition is somehow messed up? Thanks

@johnlane
Copy link

For the benefit of anyone else coming here with a WN604.

I successfully installed the image openwrt-ar71xx-generic-wnr1000v2-squashfs-factory-barrier-breaker-r44095.img from this repo after customising the bootcmd as described in this openwrt forum post. In summary:

ar7240> setenv bootargs "squashfs init=/etc/preinit mtdparts=ar7240-nor0:256k(u-boot),64k(u-boot-env),3328k(rootfs),64k(config),128k(language_table),64k(pot),64k(traffic_meter),64k(ART),3473344@327744(mount_fs)"
ar7240> setenv bootcmd "fsload 80800000 image/uImage;bootm 80800000"
ar7240> saveenv

I also tried openwrt-ar71xx-generic-wnr1000v2-squashfs-factory-chaos-calmer-r44154.img and lede-17.01.2-ar71xx-generic-wnr1000v2-squashfs-factory.img (official LEDE image) but they wouldn't boot.

@SaltwaterC
Copy link
Author

Apologies for ignoring these comments. GitHub doesn't sent notifications for Gist comments.

although it worked, the settings do not survive a single reboot

I've seen this myself. CC 15.05.1 and LEDE 17.01.2 can be upgraded via sysupgrade / LuCI, but the settings don't survive upon reboot. All my attempts to make them stick have failed.

has anyone succeed in flashing the release version on top of SaltwaterC's?

I definitely have not. CC fails to boot and LEDE goes into a boot loop. I didn't have my serial adapter at hand to get some actual debug info. Anyway, something is broken upstream since the patch has been merged. Flashed back my CC build with the WNR1000v2 patch. It works as expected. In the mean time, I've donated the device, therefore can't help with tracing the upstream issue.

PS: as small hardware hack, I've replaced the crappy built in antenna with a RP-SMA connector. It's actually pretty straightforward. It's possible to add a secondary RP-SMA connector in the place of the power switch, but I haven't attempted this myself.

@om23
Copy link

om23 commented Sep 29, 2017

I've been having trouble flashing openwrt on my WNR1000v2-vc. I have 2 laying around and I followed the instructions here multiple times. And when I'm trying to tftp put it times out (the power led never stops blinking green). I am able to ping it, etc.

I was able to access the serial port (UART) on the router and tried multiple ways of sending the image (even using ymodem). Also tried tftp when the modem was on (theoritically I should still be able to transfer the image and reboot, right). But none of these worked. I saw when starting in failsafe mode, the tftpt server was running (through serial I could see it). But tftp wouldn't connect, I tried on osx and ubuntu too.

Copy link

ghost commented Jan 12, 2018

Om23,

I had a similar issue and resolved it. Try this:
I downgraded to Netgear Firmware WNR1000v2-VC-V1.0.0.3NA, then retried the tftp upload. Worked like a charm!
Note, the Netgear firmware that I had been running on the 1000v2-VC was WNR1000v2-VC-V1.1.2.56. If a user is also running this identical firmware, they may encounter the same tftp issues that I did.

See my original posts here:
https://forum.openwrt.org/viewtopic.php?pid=263053

Copy link

ghost commented Jan 14, 2018

Update: I'm currently running LEDE Reboot 17.01.4 r3560-79f57e422d successfully with LuCi on a WNR1000V2-VC. No bootloops and it the config is preserved when rebooting. The key seems to be using an image size smaller than the prebuilt default image found in the LEDE repository. If an image is much larger than ~3.4MB it will loop and/or not preserve settings upon reboot.

I built a custom image using the Image Builder based on the 17.01.4 release, removing IPv6 support and PPP. It weighs in at 3,407,876 bytes. For comparison, the prebuilt LEDE image is 3,538,948 bytes.

My "PACKAGE=" string for image builder was make -j4 image PROFILE=WNR1000V2_VC PACKAGES="libiwinfo-lua liblua libubus-lua libuci-lua lua luci luci-base luci-lib-ip luci-lib-nixio luci-mod-admin-full luci-theme-bootstrap uhttpd uhttpd-mod-ubus ntpd ntp-utils -dnsmasq -odhcp6c -firewall -fstools -ip6tables -ppp -ppp-mod-pppoe"

I flashed my LEDE 17.01.4 sysupgrade.bin to a clean install of the stock 15.05.1, which had itself been previously upgraded from Saltwater's chaos-calmer-r44154.bin. Note: While running the stock 15.05.1 image I was unable to preserve settings upon reboot, so I had to flash from within the GUI without rebooting.

The build manifest is below.

base-files - 173.1-r3560-79f57e422d busybox - 1.25.1-4 dnsmasq - 2.78-4 dropbear - 2017.75-4 firewall - 2017-05-27-a4d98aea-1 fstools - 2017-06-30-bdcb075f-1 fwtool - 1 hostapd-common - 2016-12-19-ad02e79d-7 iptables - 1.4.21-2 iw - 4.9-1 jshn - 2018-01-07-1dafcd78-1 jsonfilter - 2016-07-02-dea067ad-1 kernel - 4.4.92-1-45d282495a15974d60f8edb091d0e2a9 kmod-ath - 4.4.92+2017-01-31-3 kmod-ath9k - 4.4.92+2017-01-31-3 kmod-ath9k-common - 4.4.92+2017-01-31-3 kmod-cfg80211 - 4.4.92+2017-01-31-3 kmod-gpio-button-hotplug - 4.4.92-2 kmod-ipt-conntrack - 4.4.92-1 kmod-ipt-core - 4.4.92-1 kmod-ipt-nat - 4.4.92-1 kmod-mac80211 - 4.4.92+2017-01-31-3 kmod-nf-conntrack - 4.4.92-1 kmod-nf-ipt - 4.4.92-1 kmod-nf-nat - 4.4.92-1 lede-keyring - 2017-01-20-a50b7529-1 libblobmsg-json - 2018-01-07-1dafcd78-1 libc - 1.1.16-1 libgcc - 5.4.0-1 libip4tc - 1.4.21-2 libip6tc - 1.4.21-2 libiwinfo - 2016-09-21-fd9e17be-1 libiwinfo-lua - 2016-09-21-fd9e17be-1 libjson-c - 0.12.1-1 libjson-script - 2018-01-07-1dafcd78-1 liblua - 5.1.5-1 libnl-tiny - 0.1-5 libpthread - 1.1.16-1 libubox - 2018-01-07-1dafcd78-1 libubus - 2017-02-18-34c6e818-1 libubus-lua - 2017-02-18-34c6e818-1 libuci - 2018-01-01-141b64ef-1 libuci-lua - 2018-01-01-141b64ef-1 libuclient - 2017-11-02-4b87d831-1 libxtables - 1.4.21-2 logd - 2017-03-10-16f7e161-1 lua - 5.1.5-1 luci - git-18.007.32064-ff21f2f-1 luci-app-firewall - git-18.007.32064-ff21f2f-1 luci-base - git-18.007.32064-ff21f2f-1 luci-lib-ip - git-18.007.32064-ff21f2f-1 luci-lib-jsonc - git-18.007.32064-ff21f2f-1 luci-lib-nixio - git-18.007.32064-ff21f2f-1 luci-mod-admin-full - git-18.007.32064-ff21f2f-1 luci-proto-ipv6 - git-18.007.32064-ff21f2f-1 luci-proto-ppp - git-18.007.32064-ff21f2f-1 luci-theme-bootstrap - git-18.007.32064-ff21f2f-1 mtd - 21 netifd - 2017-01-25-650758b1-1 odhcpd - 2017-10-02-c6f3d5d4-2 opkg - 2017-03-23-1d0263bb-1 procd - 2017-08-08-66be6a23-1 rpcd - 2017-12-07-cfe1e75c-1 swconfig - 11 uboot-envtools - 2015.10-1 ubox - 2017-03-10-16f7e161-1 ubus - 2017-02-18-34c6e818-1 ubusd - 2017-02-18-34c6e818-1 uci - 2018-01-01-141b64ef-1 uclient-fetch - 2017-11-02-4b87d831-1 uhttpd - 2017-11-04-a235636a-1 uhttpd-mod-ubus - 2017-11-04-a235636a-1 usign - 2015-07-04-ef641914-1 wpad-mini - 2016-12-19-ad02e79d-7

@thomasaiman
Copy link

I can confim what jlpapple and SaltwaterC have said so far. I flashed openwrt-ar71xx-generic-wnr1000v2-squashfs-factory-barrier-breaker-r44095.img via tftp, and then used a sysupgrade.bin to get LEDE Reboot 17.01.4 r3560-79f57e422d running on a WNR1000v2. All settings are lost on reboot. Haven't tried building an image as jlpapple suggested.

I had an odd problem when trying to use tftp: Windows doesn't seem to work when flashing firmware to this router via tftp. The tftp2.exe GUI client didn't work ('Unable to get responses from server') and the built-in command line tftp seemed to transfer the file, but the firmware was always rejected (flashing green light). This was true for both OpenWrt and the Netgear OEM firmware. Tftp on Linux Mint 18.3 worked fine for both of those firmwares.

Copy link

ghost commented Jun 22, 2019

I'm now running OpenWRT Snapshot r10242-3c401f4 (19.0X) from June 17, 2019 successfully on my WNR1000V2-VC. This is a standard snapshot with no modification, downloaded straight from "https://downloads.openwrt.org/snapshots/targets/ar71xx/tiny/openwrt-ar71xx-tiny-wnr1000v2-vc-squashfs-sysupgrade.bin"

As this is a snapshot build, so there is no LuCi, resulting in a firmware size of 3392.0 KB. Anything over 3400KB is likely to produce a bootloop and/or not enable you to preserve settings upon reboot.

TOP reports 6MB of free RAM. I'm using this router as a Dumb Access Point.

@SaltwaterC
Copy link
Author

I remember being plagued by tftp issues under Windows. Ended up using https://github.com/gagle/node-tftp - in fact, I have tried this on all platforms that I normally use.

Copy link

ghost commented Jun 23, 2019

FYI. I've created stable builds for 18.06.02 and 17.01.06 using OpenWRT Image Builder.

https://forum.openwrt.org/t/wnr1000v2-builds-for-netgear/39360

In the process of creating these builds I bricked my router once due to a bad flash. Here is how I recovered the router in failsafe:

Note: This method is for Netgear WNR1000v2-VC North America Model only - although if you locate the right OEM Netgear firmware it will likely work for WNR1000v2 as well. I've placed the original firmware for the v2-VC in the same folder as the builds above.

  1. If you brick your router trying to upgrade to OpenWRT and need to revert your WNR1000v2-VC back to stock Netgear firmware via a TFTP flash, use the “WNR1000v2-VC-V1.0.0.12NA.img” file first. It is likely the only firmware that will be accepted via TFTP flash.

  2. Once you’ve successfully flashed above, login to the router web interface and update the firmware using the “WNR1000v2-VC-V1.2.2.56NA.img” file, as this is likely the only OEM firmware version that will accept the “openwrt-ar71xx-generic-wnr1000v2-vc-squashfs-factory-barrier-breaker-r44095.img” file from SaltwaterC’s flash method.

  3. Once you’ve flashed to SaltwaterC’s Breaker Barrier img file you can then upgrade via sysupgrade files to OpenWRT. I suggest unchecking "Keep settings" for maximum reliability when you upgrade between versions.

Copy link

ghost commented Jul 30, 2019

I've created downloadable firmwares for OpenWRT 17.01.7, 18.06.4, and 19.07 (08-01-19 Snapshot) for both the VC and V2 models.

Available at https://forum.openwrt.org/t/wnr1000v2-builds-for-netgear/39360

Copy link

ghost commented Jun 13, 2020

New builds for 19.07.3 and 18.06.8 are now available.

https://forum.openwrt.org/t/wnr1000v2-builds-for-netgear/39360

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment