Skip to content

Instantly share code, notes, and snippets.

@SaltwaterC
Last active March 3, 2024 23:21
Show Gist options
  • Save SaltwaterC/ef49c8a4df81c8896153 to your computer and use it in GitHub Desktop.
Save SaltwaterC/ef49c8a4df81c8896153 to your computer and use it in GitHub Desktop.
OpenWrt support for Netgear WNR1000v2

Install

As usual, use it at your own risk. I am not to be held responsible for your actions.

Supported devices: WNR1000v2 (tested by me), WNR1000v2-VC (provided by Comcast for free; tested by Douglas Fraser)

Notice: Upgrade WNR1000v2 to the latest factory firmware: 1.1.2.58. Otherwise, the power LED may not behave properly.

You need to place the device into failsafe mode. For booting into failsafe mode, you need to power up the device while holding the reset button with a pin. The power LED should have an amber colour. Hold the button until it is starting to flash green. It starts to flash green after it flashes the amber LED for six times. After that, the device is in failsafe mode, accepting a firmware via its TFTP server. The device should respond to pings at 192.168.1.1, although the responses may be malformed.

Configure your ethernet interface with a 192.168.1.0/24 IP address. I use 192.168.1.2 with netmask 255.255.255.0 but it should work with any free address from that block.

You need a TFTP client for this purpose. You may check the OpenWrt wiki for more information if you aren't familiar with the procedure.

Barrier Breaker

With the OS X tftp client, and the Linux tftp client, the flashing procedure is something like:

For WNR1000v2

tftp 192.168.1.1
> binary
> trace
> put openwrt-ar71xx-generic-wnr1000v2-squashfs-factory-barrier-breaker-r44095.img

For WNR1000v2-VC

tftp 192.168.1.1
> binary
> trace
> put openwrt-ar71xx-generic-wnr1000v2-vc-squashfs-factory-barrier-breaker-r44095.img

Please don't use the WNR1000v2 firmware file for the WNR1000v2-VC model. Every time you do that, a kitten dies.

The power LED turns off during the upload. If it starts to flash green after the upload, then the firmware is rejected (usually the case with a corrupted or wrong firmware). Otherwise, it should be green and it stops flashing (but sometimes it may stay off). You should wait until the device finishes the upgrade procedure. Usually it is under three minutes. It should boot into OpenWrt.

If the connection drops during the upload, you may end up with a corrupted firmware and the device is booting into failsafe mode. Just repeat the flashing procedure.

Please notice that the power LED flashes green during the normal boot. However, it flashes at a faster rate compared to a device in failsafe mode. If unsure, let the device to stay in that state at least for a minute before deciding that it needs reflashing. After a normal boot, you should get a solid green on the power LED.

Chaos Calmer (trunk)

The Chaos Calmer patch was created against r44154. It was tested succesfully on WNR1000v2 and WNR1000v2-VC, but the device may require a power cycle after the flash. It may boot in (an unusable) failsafe mode. This happened on WNR1000v2 by going from Barrier Breaker to Chaos Calmer via TFTP flashing.

For building it, you can not use the Barrier Breaker config. For creating the build config, you need to pick the "Atheros AR7xxx/AR9xxx" Target System, the "Generic" Subtarget, and optionally the WNR1000v2 driver profile.

Please notice that the images may not build succesfully without a clean tree and config.

Build

You need an OpenWrt Buildroot. I use Debian 7.x for this purpose.

# Aka cloning this particular gist
git clone https://gist.github.com/ef49c8a4df81c8896153.git
cd ef49c8a4df81c8896153
# This is the Barrier Breaker branch
git clone git://git.openwrt.org/14.07/openwrt.git
cd openwrt
# Apply the patch for WNR1000v2/WNR1000v2-VC support
patch -p1 < ../wnr1000v2+vc-barrier-breaker-r44095.patch
# Add the LuCI support into the OpenWrt tree
./scripts/feeds update luci
./scripts/feeds install luci
# Get the generic config for AR71xx
wget https://downloads.openwrt.org/barrier_breaker/14.07/ar71xx/generic/config.ar71xx_generic -O .config
# when doing the menuconfig, you need to go to LuCI > Collections and 
# make sure that {*} luci is selected, otherwise LuCI is built as module
# and it won't be available into the built image, only the package is built
make menuconfig
# The final step for building the image. You may replace "make" with
# "make -j number-of-cpu-cores+1" for faster building on a multi-core CPU
make

The images will be in the "bin/ar71xx" directory. After that, follow the above Install instructions.

5b95005158eb064f63bf46bb32bc4bf2 *openwrt-ar71xx-generic-wnr1000v2-squashfs-factory-barrier-breaker-r44095.img
852f6f0028c9fca542f8658f7834043c *openwrt-ar71xx-generic-wnr1000v2-squashfs-sysupgrade-barrier-breaker-r44095.bin
271cdf6e3db97e645b8563f394e8cd5c *openwrt-ar71xx-generic-wnr1000v2-vc-squashfs-factory-barrier-breaker-r44095.img
813eafe9f2790ff78fd017b4331dc43b *openwrt-ar71xx-generic-wnr1000v2-vc-squashfs-sysupgrade-barrier-breaker-r44095.bin
fd67f85b43d195ea28f04a72397e7001 *openwrt-ar71xx-generic-wnr1000v2-squashfs-factory-chaos-calmer-r44154.img
9078821e10656d62ac6e87dd6f21039a *openwrt-ar71xx-generic-wnr1000v2-squashfs-sysupgrade-chaos-calmer-r44154.bin
9c7cbb3cee1829c11440129ce155a425 *openwrt-ar71xx-generic-wnr1000v2-vc-squashfs-factory-chaos-calmer-r44154.img
c766344bbc11ceb51228a222de172a6e *openwrt-ar71xx-generic-wnr1000v2-vc-squashfs-sysupgrade-chaos-calmer-r44154.bin
View raw

(Sorry about that, but we can’t show files that are this big right now.)

View raw

(Sorry about that, but we can’t show files that are this big right now.)

View raw

(Sorry about that, but we can’t show files that are this big right now.)

View raw

(Sorry about that, but we can’t show files that are this big right now.)

View raw

(Sorry about that, but we can’t show files that are this big right now.)

View raw

(Sorry about that, but we can’t show files that are this big right now.)

View raw

(Sorry about that, but we can’t show files that are this big right now.)

View raw

(Sorry about that, but we can’t show files that are this big right now.)

View raw

(Sorry about that, but we can’t show files that are this big right now.)

Copy link

ghost commented Jan 14, 2018

Update: I'm currently running LEDE Reboot 17.01.4 r3560-79f57e422d successfully with LuCi on a WNR1000V2-VC. No bootloops and it the config is preserved when rebooting. The key seems to be using an image size smaller than the prebuilt default image found in the LEDE repository. If an image is much larger than ~3.4MB it will loop and/or not preserve settings upon reboot.

I built a custom image using the Image Builder based on the 17.01.4 release, removing IPv6 support and PPP. It weighs in at 3,407,876 bytes. For comparison, the prebuilt LEDE image is 3,538,948 bytes.

My "PACKAGE=" string for image builder was make -j4 image PROFILE=WNR1000V2_VC PACKAGES="libiwinfo-lua liblua libubus-lua libuci-lua lua luci luci-base luci-lib-ip luci-lib-nixio luci-mod-admin-full luci-theme-bootstrap uhttpd uhttpd-mod-ubus ntpd ntp-utils -dnsmasq -odhcp6c -firewall -fstools -ip6tables -ppp -ppp-mod-pppoe"

I flashed my LEDE 17.01.4 sysupgrade.bin to a clean install of the stock 15.05.1, which had itself been previously upgraded from Saltwater's chaos-calmer-r44154.bin. Note: While running the stock 15.05.1 image I was unable to preserve settings upon reboot, so I had to flash from within the GUI without rebooting.

The build manifest is below.

base-files - 173.1-r3560-79f57e422d busybox - 1.25.1-4 dnsmasq - 2.78-4 dropbear - 2017.75-4 firewall - 2017-05-27-a4d98aea-1 fstools - 2017-06-30-bdcb075f-1 fwtool - 1 hostapd-common - 2016-12-19-ad02e79d-7 iptables - 1.4.21-2 iw - 4.9-1 jshn - 2018-01-07-1dafcd78-1 jsonfilter - 2016-07-02-dea067ad-1 kernel - 4.4.92-1-45d282495a15974d60f8edb091d0e2a9 kmod-ath - 4.4.92+2017-01-31-3 kmod-ath9k - 4.4.92+2017-01-31-3 kmod-ath9k-common - 4.4.92+2017-01-31-3 kmod-cfg80211 - 4.4.92+2017-01-31-3 kmod-gpio-button-hotplug - 4.4.92-2 kmod-ipt-conntrack - 4.4.92-1 kmod-ipt-core - 4.4.92-1 kmod-ipt-nat - 4.4.92-1 kmod-mac80211 - 4.4.92+2017-01-31-3 kmod-nf-conntrack - 4.4.92-1 kmod-nf-ipt - 4.4.92-1 kmod-nf-nat - 4.4.92-1 lede-keyring - 2017-01-20-a50b7529-1 libblobmsg-json - 2018-01-07-1dafcd78-1 libc - 1.1.16-1 libgcc - 5.4.0-1 libip4tc - 1.4.21-2 libip6tc - 1.4.21-2 libiwinfo - 2016-09-21-fd9e17be-1 libiwinfo-lua - 2016-09-21-fd9e17be-1 libjson-c - 0.12.1-1 libjson-script - 2018-01-07-1dafcd78-1 liblua - 5.1.5-1 libnl-tiny - 0.1-5 libpthread - 1.1.16-1 libubox - 2018-01-07-1dafcd78-1 libubus - 2017-02-18-34c6e818-1 libubus-lua - 2017-02-18-34c6e818-1 libuci - 2018-01-01-141b64ef-1 libuci-lua - 2018-01-01-141b64ef-1 libuclient - 2017-11-02-4b87d831-1 libxtables - 1.4.21-2 logd - 2017-03-10-16f7e161-1 lua - 5.1.5-1 luci - git-18.007.32064-ff21f2f-1 luci-app-firewall - git-18.007.32064-ff21f2f-1 luci-base - git-18.007.32064-ff21f2f-1 luci-lib-ip - git-18.007.32064-ff21f2f-1 luci-lib-jsonc - git-18.007.32064-ff21f2f-1 luci-lib-nixio - git-18.007.32064-ff21f2f-1 luci-mod-admin-full - git-18.007.32064-ff21f2f-1 luci-proto-ipv6 - git-18.007.32064-ff21f2f-1 luci-proto-ppp - git-18.007.32064-ff21f2f-1 luci-theme-bootstrap - git-18.007.32064-ff21f2f-1 mtd - 21 netifd - 2017-01-25-650758b1-1 odhcpd - 2017-10-02-c6f3d5d4-2 opkg - 2017-03-23-1d0263bb-1 procd - 2017-08-08-66be6a23-1 rpcd - 2017-12-07-cfe1e75c-1 swconfig - 11 uboot-envtools - 2015.10-1 ubox - 2017-03-10-16f7e161-1 ubus - 2017-02-18-34c6e818-1 ubusd - 2017-02-18-34c6e818-1 uci - 2018-01-01-141b64ef-1 uclient-fetch - 2017-11-02-4b87d831-1 uhttpd - 2017-11-04-a235636a-1 uhttpd-mod-ubus - 2017-11-04-a235636a-1 usign - 2015-07-04-ef641914-1 wpad-mini - 2016-12-19-ad02e79d-7

@thomasaiman
Copy link

I can confim what jlpapple and SaltwaterC have said so far. I flashed openwrt-ar71xx-generic-wnr1000v2-squashfs-factory-barrier-breaker-r44095.img via tftp, and then used a sysupgrade.bin to get LEDE Reboot 17.01.4 r3560-79f57e422d running on a WNR1000v2. All settings are lost on reboot. Haven't tried building an image as jlpapple suggested.

I had an odd problem when trying to use tftp: Windows doesn't seem to work when flashing firmware to this router via tftp. The tftp2.exe GUI client didn't work ('Unable to get responses from server') and the built-in command line tftp seemed to transfer the file, but the firmware was always rejected (flashing green light). This was true for both OpenWrt and the Netgear OEM firmware. Tftp on Linux Mint 18.3 worked fine for both of those firmwares.

Copy link

ghost commented Jun 22, 2019

I'm now running OpenWRT Snapshot r10242-3c401f4 (19.0X) from June 17, 2019 successfully on my WNR1000V2-VC. This is a standard snapshot with no modification, downloaded straight from "https://downloads.openwrt.org/snapshots/targets/ar71xx/tiny/openwrt-ar71xx-tiny-wnr1000v2-vc-squashfs-sysupgrade.bin"

As this is a snapshot build, so there is no LuCi, resulting in a firmware size of 3392.0 KB. Anything over 3400KB is likely to produce a bootloop and/or not enable you to preserve settings upon reboot.

TOP reports 6MB of free RAM. I'm using this router as a Dumb Access Point.

@SaltwaterC
Copy link
Author

I remember being plagued by tftp issues under Windows. Ended up using https://github.com/gagle/node-tftp - in fact, I have tried this on all platforms that I normally use.

Copy link

ghost commented Jun 23, 2019

FYI. I've created stable builds for 18.06.02 and 17.01.06 using OpenWRT Image Builder.

https://forum.openwrt.org/t/wnr1000v2-builds-for-netgear/39360

In the process of creating these builds I bricked my router once due to a bad flash. Here is how I recovered the router in failsafe:

Note: This method is for Netgear WNR1000v2-VC North America Model only - although if you locate the right OEM Netgear firmware it will likely work for WNR1000v2 as well. I've placed the original firmware for the v2-VC in the same folder as the builds above.

  1. If you brick your router trying to upgrade to OpenWRT and need to revert your WNR1000v2-VC back to stock Netgear firmware via a TFTP flash, use the “WNR1000v2-VC-V1.0.0.12NA.img” file first. It is likely the only firmware that will be accepted via TFTP flash.

  2. Once you’ve successfully flashed above, login to the router web interface and update the firmware using the “WNR1000v2-VC-V1.2.2.56NA.img” file, as this is likely the only OEM firmware version that will accept the “openwrt-ar71xx-generic-wnr1000v2-vc-squashfs-factory-barrier-breaker-r44095.img” file from SaltwaterC’s flash method.

  3. Once you’ve flashed to SaltwaterC’s Breaker Barrier img file you can then upgrade via sysupgrade files to OpenWRT. I suggest unchecking "Keep settings" for maximum reliability when you upgrade between versions.

Copy link

ghost commented Jul 30, 2019

I've created downloadable firmwares for OpenWRT 17.01.7, 18.06.4, and 19.07 (08-01-19 Snapshot) for both the VC and V2 models.

Available at https://forum.openwrt.org/t/wnr1000v2-builds-for-netgear/39360

Copy link

ghost commented Jun 13, 2020

New builds for 19.07.3 and 18.06.8 are now available.

https://forum.openwrt.org/t/wnr1000v2-builds-for-netgear/39360

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment