Hello. New here and new to OpenWrt. I was looking at various devices to try OpenWrt on and coincidentally came into possession of an unused Sophos XG86. It seems perfect for my test and I have all the relevant pages up that I can find. But the firmware installation instructions seem a little vague. It says "Installation method(s):
x86_installation" but when I go there it doesn't show the XG86 and doesn't seem to explain the process. I have the firmware but can someone point me to some instructions on how to proceed? Any help is appreciated.
It's pretty much the same as any other x86 install. Generally speaking, you need to get the OpenWrt image written to the internal disk.
Since the XG86 has a non-removable emmc, the easier method of removing the disk and write it from another host is not an option for you.
Which means you need to make a bootable USB stick containing any flavor of Linux (this can absolutely be OpenWrt itself!), boot from it, transfer the (uncompressed) OpenWrt image to the running system and then wholesale dd the image to /dev/mmcblk0
Thanks! Full speed ahead!
I found the OpenWrt already suggested by @takimata definitely an easier option, because it has networking enabled by default, so spin up OpenWrt from a USB drive, scp the image to /tmp and then use dd to write it to the storage.
This is going to be a little complicated for a new user (unlike higher-up-the-line models, XG 86 doesn't have a traditional video output), but I am sure you can manage. You will need a USB stick, a computer to control the installation process from, at least one Ethernet cable, and either a console cable or a regular USB cable (one end should be something you can plug into your computer, the other should be micro-USB).
On the computer, you will need a program capable of maintaining console connections. The most common one on Windows is Putty (it's free, you can get it directly from the developer); on Linux, multiple options exist; I prefer screen.
Do you have all of this in place?
Small Linux-side detail if you go the serial route: after plugging in the micro-USB console, check dmesg or ls /dev/ttyACM* /dev/ttyUSB* and then connect with something like screen /dev/ttyACM0 115200. From there I would first identify the eMMC name with lsblk before running any dd, so you do not write the image to the USB stick you booted from.
Wow. What a truly helpful forum. To all that responded, my heartfelt thanks. Some really useful suggestions. Yes, I do have a Micro USB cable, buried in a drawer. A cable format I haven't used in a while. The other suggestions are very useful as I was wondering about the lack of the screen to see what I was doing. I have the USB stick formatted with Linux and the correct firmware file is on it. Possibly later this afternoon (it is morning now) I may have a chance to try this. But to all, THANK YOU!!!!!
Keep in mind some of those cables are only wired for power delivery.
If that's what you've got (can't probably see it from the outside), console will stay dead.
Good point. But I have dozens in a box if that one doesn't work. Hopefully I won't have to pull that out!
Before writing to the eMMC I’d also make a backup image of the original Sophos storage if you have somewhere to put it. Checking the device list first, then copying the eMMC off the box, gives you a way back if the first install attempt goes sideways. And as frollic said, test the micro-USB cable early so you know the console works before doing the risky part.
Great. Now, test it with your device. I can tell you exactly how to do it, but you didn't say what software you would be using. But in generalities, here's how it's done.
First, with the Sophos device turned off, you connect your computer to the Sophos device. The device has a chip made by a company called FTDI, so you might get a quick message on your computer saying something to the extent that an FTDI device has been detected. Note that even though the Sophos device is off, the FTDI chip is accessible, because it receives power over USB from your computer.
Next, use whatever console software you have to initiate a console connection at 38400 bps. Once you do that, turn on the Sophos device and ensure you can see the output it sends to the console.
Next (optionally), turn the device off, wait a few seconds, turn is on again, and immediately start pressing the Del key (if that fails, try Esc or Tab). This will get you into the device's BIOS. Once you're in, you can go to (working from memory here, so may be off) Advanced >> Console Redirection Settings and set Bits per second to 115200 (this is the OpenWrt default).
[To be continued...]
Continuing now...
On your computer, download the latest OpenWrt image (I would use x86_64, ext4, non-UEFI).
Use your favorite image writing program (I like Rufus for Windows; on Linux, I use dd) to expand the image onto a USB stick.
With Sophos device turned off and no network cables connected, connect the USB cable as discussed previously and initiate a console connection at 115200 bps. Even if you didn't adjust console speed in BIOS, OpenWrt will force this speed once it starts running. The reason you may want to enable it in BIOS is, you want to see BIOS messages that appear before OpenWrt starts. If you didn't adjust the speed, those messages will come out at 38400, garbled. (But, in the grand scheme of things, this is not very important.)
Anyway, with console connection established, connect the USB stick to the Sophos device and turn it on. With USB stick inserted, it should boot from it. (If it doesn't, you can force it from BIOS, but it usually does.)
It should take about 20 seconds for the device to boot. Once messages on the console stop coming in, hit Enter. You should see the OpenWrt greeting; it will look like this:
BusyBox v1.37.0 (2026-06-19 10:52:34 UTC) built-in shell (ash)
_______ ________ __
| |.-----.-----.-----.| | | |.----.| |_
| - || _ | -__| || | | || _|| _|
|_______|| __|_____|__|__||________||__| |____|
|__| W I R E L E S S F R E E D O M
-----------------------------------------------------
OpenWrt 25.12.4, r32933-4ccb782af7 Dave's Guitar
-----------------------------------------------------
Now let's do some thinking. The reason we have the device disconnected from any networking is, we want to avoid IP address space collision. By default, OpenWrt assigns the 192.168.1.1 IP address to itself and spins up DHCP service for the 192.168.1.* range. If your existing network operates in the same range, you need to change those settings before you connect the device to your network. For now, let's assume that you don't have the collision. If you do, yell for help.
[I think there's just one more installment to come...]
Let's see if I can fit it into one post...
Now, assuming we concluded that there is no danger of IP address space collision, you can connect the WAN port on your device to your current router. You should see a message like this on the console:
[XXX] r8169 0000:03:00.0 eth1: Link is Up - 1Gbps/Full - flow control off
Next, try accessing the outside world by running this on the command line:
ping -c 3 google.com
This should bring back three responses to your pings.
Now we're ready to do the installation proper. Because this device has eMMC storage, I suggest using squashfs firmware; it's somewhat more resistant to the vagaries of life, such as sudden power loss (though ext4 is not exactly a wilting flower, either). Anyway, run these commands, one at a time:
cd /tmp
wget -O fw.img.gz https://downloads.openwrt.org/releases/25.12.4/targets/x86/64/openwrt-25.12.4-x86-64-generic-squashfs-combined.img.gz
zcat fw.img.gz > /dev/mmcblk0
poweroff
The first (cd) will change the working directory to temporary storage (which resides in memory and thus is very fast).
The second (wget) will download firmware to be installed and give the downloaded file a short name, easy to work with.
The third (zcat) will unpack and expand the image onto the device's eMMC storage in one go (the alternative is to first unpack with gunzip and then expand with dd, but who has the time, right?).
The fourth (poweroff), as the name suggests, will power the device off.
When the device powers off, disconnect the power for a second, remove the USB stick, and reconnect the power. If the ON button doesn't turn from red to blue by itself, press it. The device will boot into a brand-new installation of OpenWrt. You can still access it on the console or connect to the LAN port. The default IP address for the device is 192.168.1.1, login name is root, there's no password (just press Enter when asked for the password on the command line).
Now you can configure the device to your liking.
Wow. To all again, thanks. But especially to Nick. Your clear instructions made this VERY EASY. OpenWrt is INSTALLED and working. Now to explore! But thanks so very much for all the help. We can mark this as closed!
No need. It's end-of-life effective March 31, 2025. If the OP ever needs anything Sophos, there's the Firewall Home Edition, which is free and maintained:
The only trick to it is to write the installation image to a USB stick in the DD mode...
Oh, and by the way. I am getting EXCELLENT speeds. I have a 300 Mbps connection and I was getting 300-340 on my first test. Nice to see!
With stock OS, the XG 86 was rated for the firewall throughput of 3,100 Mbps and IMIX throughput of 850 Mbps. So the 300 you're getting is far from the limit...
I like OpenWRT .. have converted a lot of Sophos AP55/AP55C/AP100C access points.
But on a Sophos XG I would go for PFsense, OPNsense, IPFire what ever ...