Help with installing LEDE on Linksys RE6500

I need some assistance with installing LEDE on a Linksys RE6500. I saw this guide on the Openwrt forums:

According to M.Bastion:

A long overdue update: Simply compile a initramfs image and copy it as "um_factory_fw.bin" into a properly configured tftp server. Sorry, I have no time to update the Wiki page, only for a quick and dirty braindump:
Get the CC Sources
Configure with: Target System (Ralink RT288x/RT3xxx), Subtarget (MT7621 based boards), Target Profile (Linksys RE6500), Target Images ([*] ramdisk)
Compile and copy: cp <PATH_TO_OPENWRT_SRC>/bin/ramips/openwrt-ramips-mt7621-re6500-initramfs-kernel.bin <PATH_TO_TFTPBOOT_DIR>/um_factory_fw.bin
Boot your RE6500, wait, telnet to, set a password to enable ssh/scp. Copy a sysupgrade image to and do a sysupgrade on the console. Enjoy.
IMPORTANT: Due to a faulty default config do NOT use Port 1 on the RE6500 or you won't be able to login after the tftp boot.
Btw.: The original firmware image will also boot over tftp.

So for anyone who has flashed this to RE6500 are these steps correct?

  1. Get re6500-squashfs-sysupgrade.bin and re6500-initramfs-kernel.bin
  2. Rename re6500-initramfs-kernel.bin to um_factory_fw.bin
  3. Setup a tftp server ready to upload um_factory_fw.bin
  4. Put re6500 in tftp mode (this is where I'm unclear on how to do this)
  5. Telnet in to the router after flashed to set password
  6. Upload sysupgrade
  7. Profit

What reset combo do I use to put the re6500 into tftp mode? Or is this only possible through soldering a serial header?

Any help would be appreciated!

For anyone finding this thread and who wants to flash a RE6500 or RE6500HG, the steps are slightly different now. Step 1 through 4 are still correct but there is nothing special you have to do to put the device into TFPT mode. It just always makes the TFPT request when booting and continues normally when there's no response.

Also telnet is not necessary anymore. So leave that out and use the web interface to perform step 6. Enjoy step 7 :slight_smile: I have updated the wiki so you can also just follow the steps there.

Hi Tubeliar, thanks for clarifying the current instructions. I was excited to see your help and I dug out my re6500 but I think I'm still doing something wrong. I setup my tftp server with the um_factory_fw.bin and follow your instructions on the wiki but every time I power on the extender it doesn't seem to be transferring the firmware. I never get the orange and white lights and I can see it starts up the regular linksys extender setup.

I checked my tftp server, initramfs file, and even tried setting the tftp server address to as stated by M.Bastion (initially I followed your instruction and set it to

Do I have to solder pins for the serial console to enable tftp?

Well, that's interesting, I know I did it without soldering. I also flashed some official images just to see how it should go before I figured out how to flash OpenWrt. Maybe that's the key? I updated to official version before I even learned about TFTP. So maybe earlier versions don't make the query?

Other than that, I used tftpd64 on Windows along with its built in dhcp server to assign my machine an address. I don't remember what ip my windows machine had at the time, could have been .100. I also remember trying to load the initramfs a couple of times and it wouldn't work about 50% of the time.

1 Like

My re6500 was on v1.0.0.0 firmware. I upgraded to to try to replicate your success but it still doesn't seem to be pulling the initramfs bin. On the wiki you wrote to assign a static ip to your Windows machine. Are you saying that the re6500 needs to have a dhcp server for it's tftp client for this to work?

Maybe my re6500 is a lemon. Haha.

It was my tftp server. I was trying to tftp from OSX but I switched to Linux and it worked. Setting ip address of the tftp server of with factory firmware pulled the initramfs file and loaded openwrt! The leds turned white/orange and I was able to login and sysupgrade. Thank you for the help!!!!

Nice! I just tried it again and I can confirm that my DHCP server was bound to too. In case it helps i'll post my tftp log here. If nothing else it will give you an idea of the timing:

[22/10 12:47:26.854] Rcvd DHCP Rqst Msg for IP, Mac *my-dhcp-host-mac*
[22/10 12:47:33.870] Rcvd DHCP Rqst Msg for IP, Mac *my-dhcp-host-mac*
[22/10 12:47:35.923] Connection received from on port 2757
[22/10 12:47:35.923] Read request for file <um_factory_fw.bin>. Mode octet
[22/10 12:47:35.930] OACK: <timeout=2,>
[22/10 12:47:35.930] Using local port 49614
[22/10 12:47:37.414] <um_factory_fw.bin>: sent 6698 blks, 3428892 bytes in 2 s. 0 blk resent
[22/10 12:47:38.847] Rcvd DHCP Rqst Msg for IP, Mac *my-dhcp-host-mac*
[22/10 12:47:43.316] Rcvd DHCP Rqst Msg for IP, Mac *my-dhcp-host-mac*
[22/10 12:47:49.796] Rcvd DHCP Rqst Msg for IP, Mac *my-dhcp-host-mac*
[22/10 12:47:54.277] Rcvd DHCP Rqst Msg for IP, Mac *my-dhcp-host-mac*
[22/10 12:47:57.626] Rcvd DHCP Rqst Msg for IP, Mac *my-dhcp-host-mac*
[22/10 12:48:00.534] Rcvd DHCP Discover Msg for IP, Mac *re6500-ethernet-mac*
[22/10 12:48:03.651] DHCP: proposed address
[22/10 12:48:05.342] Rcvd DHCP Rqst Msg for IP, Mac *my-dhcp-host-mac*

The DHCP request are the first thing the RE6500 sends, so it's about 10 seconds after receiving power that the um_factory_fw.bin will be transferred. Also, the RE6500 ignores the dhcp server's suggestion and takes anyway, but by that time it's already running the image :slight_smile:

This topic was automatically closed 10 days after the last reply. New replies are no longer allowed.