Netgear dm200, missing download link, and failed tftp flash

Hello comrades, the link to download the netgear dm200 is not working.

I searched for mirrors and downloaded it from other mirror, but when I make the tftp flash, appears as succesful, but then the router dont get any ip, and in the computer i tried to do static ip has standard or (router stock) or with no response, and if i take windows to get one ip by dhcp gets a 169.x.x.x weird one with and no gateway.

I did other tftp flash to stock fw and works correctly, but I'm looking to make it work because already got lede in my edgerouter x and my tplink1043, and works like a charm, soo any thoughts or guidance my fellow router friends?

Kind regards and merry xmas for all

There has been some renaming of image files going on lately, and the ToH hasn't been updated accordingly yet.
I've done this now for the DM200 (other affected devices to follow shortly).


This sounds about right to me. After the initial install the modem should act as a DHCP server and be accessible by SSH at, as with any other LEDE device.

This is a snapshot release, so LUCI (the web interface) isn't included and therefore you would need to configure it over SSH.

The configuration can be a bit tricky (it does nothing by default); the information is online but it's a bit spread out; I'll try to write something on the wiki about this soon.

Hi, finally was a problem with the firmware file that i was using. (i dont know why)
I tried with an older one from a .de mirror repository and it worked doing it using tftp in ip (default ip for this router is

Then i configued it as modem router for bt adsl (uk), i put here the config for anyone wanting to configure a modem router lantiq to work with adsl because there is not a lot of documentation about this topic.
Kind regards.


cat /etc/config/network

config interface 'loopback'
        option ifname 'lo'
        option proto 'static'
        option ipaddr ''
        option netmask ''

config globals 'globals'
        option ula_prefix 'xxxx:xxxx:xxxx::/48'

config atm-bridge 'atm'
        option vpi '0'
        option vci '38'
        option encaps 'llc'
        option payload 'bridged'

config dsl 'dsl'
        option annex 'a'
        option xfer_mode 'atm'
        option line_mode 'adsl'

config interface 'lan'
        option type 'bridge'
        option ifname 'eth0'
        option proto 'static'
        option ipaddr ''
        option netmask ''
        option dns     ''
        option ip6assign '60'

config device 'lan_dev'
        option name 'eth0'
        option macaddr 'xx:xx:xx:xx:xx:xx'

config interface 'wan'
        option ifname 'dsl0' #dsl0 original
        option proto 'pppoe'
        option username 'usebtusername'
        option password 'btpassworddontmatter'
        option ipv6 'auto'

config device 'wan_dev'
        option name 'dsl0' #dsl0 original
        option macaddr 'xx:xx:xx:xx:xx:xx'

config interface 'wan6'
        option ifname '@wan'  #@wan original
        option proto 'dhcpv6'

@darkheart46 Are you able to reproduce/are you affected by a similar issue as reported in

You seem to have the same type of line as the reporter in the linked ticket (adsl via atm with pppoe).


can someone assist with the command that is required to install this firmware onto the DM200 ?

For example for the TL-WR841ND we do the following

Erase the flash:
erase 0x9f020000 +0x3c0000

Copy RAM content to flash:
cp.b 0x80000000 0x9f020000 0x3c0000

Set up the boot
bootm 0x9f020000

But I dont know which are the boundries for the DM200

I am attaching the printenv

VR9 # printenv
bootcmd=sleep 1;nmrp;sf probe 0:3;sf read $loadaddr 0x30000 0x710000;if chk_dniimg $loadaddr; then bootm $loadaddr;else fw_recovery; fi
preboot=echo;echo Type \"run flash_nfs\" to mount root filesystem over NFS;echo
ramargs=setenv bootargs root=/dev/ram rw
addip=setenv bootargs $(bootargs) ip=$(ipaddr):$(serverip):$(gatewayip):$(netmask):$(hostname):$(netdev):on
addmisc=setenv bootargs $(bootargs) console=$(console),$(baudrate) ethaddr=$(ethaddr) mem=$(mem) panic=1 mtdparts=$(mtdparts) init=/etc/preinit vpe1_load_addr=0x83f00000 vpe1_mem=1M ubootver=$(ver)
net_ram=tftp $(loadaddr) $(tftppath)$(bootfile);run ramargs addip addmisc;bootm
load=tftp $(loadaddr) $(u-boot)
update=protect off 1:0-2;era 1:0-2;cp.b $(loadaddr) B0000000 $(filesize)
flashargs=setenv bootargs root=$(rootfsmtd) ro rootfstype=squashfs quiet
flash_flash=sf probe 3;sf read $(loadaddr) $(f_kernel_addr) $(f_kernel_size);runflashargs addip addmisc;bootm $(loadaddr); run update_fullimage; reset
update_uboot=tftpboot $(loadaddr) $(tftppath)$(u-boot);sf probe 0:3;sf erase 0 10000;sf write $(loadaddr) 0 $(filesize);run reset_sysconfig;reset
update_kernel=tftpboot $(loadaddr) $(tftppath)$(bootfile);upgrade $(loadaddr) $(filesize)
update_bootloader=run update_uboot;run update_gphyfirmware
update_rootfs=tftpboot $(loadaddr) $(tftppath)$(rootfs);upgrade $(loadaddr) $(filesize)
update_firmware=tftpboot $(loadaddr) $(tftppath)$(firmware);upgrade $(loadaddr) $(filesize)
update_fullimage=tftpboot $(loadaddr) $(tftppath)$(fullimage);upgrade $(loadaddr) $(filesize)
update_totalimage=tftpboot $(loadaddr) $(tftppath)$(totalimage);upgrade $(loadaddr) $(filesize)
reset_uboot_config=sf probe 3; sf write 80400000 $(f_ubootconfig_addr) $(f_ubootconfig_size)
reset_ddr_config=sf probe 3; sf write 80400000 $(f_ddrconfig_addr) $(f_ddrconfig_size)
reset_sysconfig=sf probe 3;sf erase $(f_sysconfig_addr) 10000
f_wlanconfig_addr= 0x007F3000
dni_tftp_uboot=tftpboot $loadaddr u-boot.ltq;crc32 $loadaddr $filesize
dni_burn_uboot=sf probe 0:3;sf write $loadaddr 0 $filesize;sf erase 0x007e0000 10000;sf erase 0x007f0000 0x02000
ethact=vr9 Switch


See this OpenWrt wiki page...


I have seen that page, could you kindly point out where on that page is an answer to my question ?

I could not see any clear directions on how to flash the firmware onto the DM200 from the Netgear DM200 wiki.

That the information I require can be deduced from the wiki is probably likely, but I do not have the technical knowledge to determine this, hence the reason for my post asking for assistance.

Would have been nice for the OP to post how he achieved the flash.

I have tried two ways, by flashing via the Netgear GUI and by flashing via tftp method. Both methods result in a "bad magic number" error message.

Have tried with the latest Netgear firmware and the oldest Netgear firmware installed on the device prior to me attempting to flash the lede firmware.


You should be able to get that from the OEM log in the OpenWrt wiki.

Hi again,

yes as I said, the info is probably somewhere on that page, just would like someone more knowledgeable to point out what I should be looking at!

I could probably work out what is needed but the amount of hours I would need to determine this i.e. reading/researching/trial-error etc is not something I have copulous amounts of, hence the reason for me posting here !

There are knowledgeable people here who in a number of minutes could tell me what the boundaries are and what the command is to flash, I hope to hear from one of them.


Nobody can assist ??

So much for community support


If you bothered to check the wiki you would have discovered this in OEM boot log as suggested earlier.

   Booting kernel from Legacy Image at 80800000 ...
   Image Name:   MIPS LTQCPE Linux-3.10.12
   Created:      2016-08-22  15:34:27 UTC
   Image Type:   MIPS Linux Kernel Image (lzma compressed)
   Data Size:    1633552 Bytes = 1.6 MiB
   Load Address: 80002000
   Entry Point:  8000a970
   Verifying Checksum ... OK
   Uncompressing Kernel Image ... OK

Loads OK from my location (Ayia Napa, Cyprus)

As I already pointed out.........

If I knew what to be looking for I wouldnt be asking questions here!

From what I have understood from all the things i have read, this firmware should work by being flashed via the Netgear GUI and using the squash-factory.img file.

But it does not, it bricks the device.

So I came here for 'support' but the only thing I am hearing is people pointing out to me that the information is available, but no one telling me what to do with it!


Continuing from your post "If you bothered to check" remark (I could also have said to you "if you bothered to read what I wro............" to your response)

Does the "Load Address" or the "Entry Point" signify where we start the "erase" command as per below ??

erase 0xbf020000 +0x3c0000 (this is from the wiki for TL-WR841ND v3)



touche, im no expert either :slight_smile:

I have oh so many pieces of the puzzle, actually I have more pieces than the actual puzzle!

1/ Never assume anything, lol
2/ My device is bricked in that to an 'average' user it would be completely disfuntional
3/ The device is in recovery mode so obviously no DHCP works

FYI, I have a serial ttl console that I am using to access and recover the DM200

You are doing exactly what I was doing and that is making educated guesses. Unfortunately it will be me who totally bricks the device if I erase the wrong area of the RAM, hence the reason I was asking for assistance from someone who knew what they were doing, LOL

The erase command is not recognized in this version of uboot that is on this Netgear.

It seems to me that something has been broken in the snapshots, as other peeps have been successfully flashing there DM200's.

I have two here and both get bricked when flashing through the Netgear interface with a "bad magic number" error message.

Have to recover with tftp method...............

So as things stand, no expert is willing to provide any assistance


Hi again!

After flashing from the Netgear GUI the device goes into 'recovery mode'

Exact message below

** check the 1 image **
Verifying Checksum ... OK
** check the 2 image **
** Bad Magic Number ** 0xc5a65360 **

The router is in TFTP Server Firmware Recovery mode NOW!
Listening on Port : 69, IP Address:
Upgrade Mode (This part is flashing)

Thats as far as the boot process goes.

In this state the device will accept firmware pushed to it via tftp transfer.

Will post in next post the uboot commands that are available..............

uboot commands:

?       - alias for 'help'
base    - print or set address offset
bootm   - boot application image from memory
bootp   - boot image via network using BOOTP/TFTP protocol
chk_dniimg- check integrity of dni firmware image.
cmp     - memory compare
cp      - memory copy
crc32   - checksum calculation
echo    - echo args to console
exit    - exit script
false   - do nothing, unsuccessfully
fw_recovery- fw_recovery - start tftp server to recovery dni firmware image.
go      - start application at address 'addr'
help    - print command description/usage
loadb   - load binary file over serial line (kermit mode)
loady   - load binary file over serial line (ymodem mode)
loop    - infinite loop on address range
md      - memory display
mm      - memory modify (auto-incrementing address)
mtest   - simple RAM read/write test
mw      - memory write (fill)
nm      - memory modify (constant address)
nmrp    - nmrp - start nmrp mechanism to upgrade firmware-image or string-table.
ping    - send ICMP ECHO_REQUEST to network host
printenv- print environment variables
rarpboot- boot image via network using RARP/TFTP protocol
reset   - Perform RESET of the CPU
run     - run commands in an environment variable
saveenv - save environment variables to persistent storage
set_hw_id- Set hw_id
set_mac - Set ethernet MAC address
set_model_id- Set model_id
set_parameters- Set <serial number>, <lan mac>, <wan mac>,
set_region- Set region number
set_serial- Set serial number
setenv  - set environment variables
sf      - SPI flash sub-system
show_hw_id- Show hw_id
show_mac- Show ethernet MAC addresses
show_model_id- Show model_id
show_parameters- Show hw_id, model_id, region number, serial number, MAC address.
show_region- Show <region number> on Board
show_serial- Show <serial number> on Board
showvar - print local hushshell variables
test    - minimal test like /bin/sh
tftpboot- boot image via network using TFTP protocol
true    - do nothing, successfully
upgrade - upgrade - forward/backward copy memory to pre-defined flash location
version - print monitor version