Netgear WN3000RP V1 low cost repeater - failsafe?

Hi LEDE community,

I saw that this cheap repeater became recently supported by LEDE 17.01.0-rc1 (https://lede-project.org/toh/hwdata/netgear/netgear_wn3000rp_v1) and couldn't resist buying one to start building a low-cost batman-adv home mesh network.

Updating stock firmware to LEDE was easy and I get ICMP connectivity on the ethernet port but soon I realized it is configured by default as a WAN port! So, no ssh access.

Anyone here knows how to put this device in failsafe mode?
It has 3 buttons (on/off - wps - factory reset), I tried pressing wps multiple times during boot but to no avail, the same happened with reset.

Also, I invite the discussion if it wouldn't be better to default configure devices that only have one ethernet interface as a LAN port, or to start those devices with a working access point by default.

Best regards,

For the record, I was able to debrick the router using nmrplash (https://github.com/jclehner/nmrpflash) and reverting it to OEM firmware.

Still not sure what the problem is, but it appears upgrade was not successfull as the result is to be able to ping ethernet port on 192.168.1.1 but nmap shows all ports filtered, also green led slowly blinking, giving signs of a failed boot.

Model is WN3000RP V1H2 and I wonder if this really means version 2 with it's not supported by LEDE; both V1 and V2 are physically identical.

Anyone figure this out? I have the same model and am having the same issue. However, I am unable to recover the OEM firmware. After it uploads using nmrpflash, it reads:

Received configuration request from MAC_ADDRESS
Sending configuration: 192.168.1.1, netmask 255.255.255.0
Timeout while waiting for TFTP_UL_REQ

Have you tried this method using the reset button?

Hi there,
I didn't record the exact steps at the time, but I was able to revert using a Linux workstation with nmrpflash configured with an IP on the subnet 192.168.1.0/24 and it was not terribly difficult.
Your error message implies that your computer is unable to upload via TFTP. I would check ping connectivity to the router first and then disable the computer firewall temporarily, I can't remember now but you also have to set a directory with Netgear original firmware for nmpflash to upload to the device. Good luck!

Hi folks,
I have same device and issue with LEDE firmware: after flashing within LEDE 17 or LEDE 18 and rebooting, it slowly flashes with green light and nothing more.
Than I start discover what's wrong since start:

  1. my device has exact name as WN3000RP without any additional endings
  2. there are other versions of WN3000RP "v1" is
    a. WN3000RP V1H1
    b. WN3000RP V1H2
    Than i soldered UART, to look what's wrong, and i founded out that:
    for LEDE 17
    Checksum mismatch:
    Image chksum: 0x8E7E8A20
    Calc chksum: 0x5D868420
    Boot program checksum is invalid
    and for LEDE 18
    Checksum mismatch:
    Image chksum: 0x50DEE50C
    Calc chksum: 0x990DE392
    Boot program checksum is invalid

Even don't know how to fix it, but I try to find correct place on github.
Created issue here https://bugs.openwrt.org/index.php?do=details&task_id=2049

boot logs

===================================lede17==========================================

Device eth0:  hwaddr 84-1B-5E-3B-A9-5C, ipaddr 10.164.183.252, mask 255.255.255.0
        gateway not set, nameserver not set
TFTP-UL-REQ sent...Waiting for TFTP-WRQ...
Reading :: Done. 3280954 bytes read
Programming...done. 1048576 bytes written
KEEP-ALIVE-REQ sent...Waiting for KEEP-ALIVE-ACK...
done. 1048576 bytes written
KEEP-ALIVE-REQ sent...Waiting for KEEP-ALIVE-ACK...
done. 1048576 bytes written
KEEP-ALIVE-REQ sent...Waiting for KEEP-ALIVE-ACK...
done. 135226 bytes written
done. 3280954 bytes written
Write len/chksum offset @ 0x002EFFF8...done.
Device eth0:  hwaddr 84-1B-5E-3B-A9-5C, ipaddr 10.164.183.252, mask 255.255.255.0
        gateway not set, nameserver not set
CLOSE-REQ sent...Waiting for CLOSE-ACK...
CFE> reboot

Decompressing..........done


CFE for WN3000RPT version: v1.0.3
Build Date: Tue Mar 15 12:30:52 CST 2011 
Init Arena
Init Devs.
Boot partition size = 262144(0x40000)
Found a 4MB ST compatible serial flash
et0: Broadcom BCM47XX 10/100/1000 Mbps Ethernet Controller 5.60.69 
CPU type 0x19749: 300MHz
Tot mem: 32768 KBytes

Device eth0:  hwaddr 84-1B-5E-3B-A9-5C, ipaddr 192.168.1.1, mask 255.255.255.0
        gateway not set, nameserver not set
Checksum mismatch: 
Image chksum: 0x8E7E8A20
Calc  chksum: 0x5D868420
Boot program checksum is invalid
Device eth0 has been deactivated.
Device eth0:  hwaddr 84-1B-5E-3B-A9-5C, ipaddr 192.168.1.1, mask 255.255.255.0
        gateway not set, nameserver not set
Start TFTP server
Reading ::

===================================lede18==========================================

TFTP-UL-REQ sent...Waiting for TFTP-WRQ...
Reading :: Done. 3674170 bytes read
Programming...done. 1048576 bytes written
KEEP-ALIVE-REQ sent...Waiting for KEEP-ALIVE-ACK...
done. 1048576 bytes written
KEEP-ALIVE-REQ sent...Waiting for KEEP-ALIVE-ACK...
done. 1048576 bytes written
KEEP-ALIVE-REQ sent...Waiting for KEEP-ALIVE-ACK...
done. 528442 bytes written
done. 3674170 bytes written
Write len/chksum offset @ 0x002EFFF8...done.
Device eth0:  hwaddr 84-1B-5E-3B-A9-5C, ipaddr 10.164.183.252, mask 255.255.255.0
        gateway not set, nameserver not set
CLOSE-REQ sent...Waiting for CLOSE-ACK...
CFE> reboot
Decompressing..........done


CFE for WN3000RPT version: v1.0.3
Build Date: Tue Mar 15 12:30:52 CST 2011 
Init Arena
Init Devs.
Boot partition size = 262144(0x40000)
Found a 4MB ST compatible serial flash
et0: Broadcom BCM47XX 10/100/1000 Mbps Ethernet Controller 5.60.69 
CPU type 0x19749: 300MHz
Tot mem: 32768 KBytes

Device eth0:  hwaddr 84-1B-5E-3B-A9-5C, ipaddr 192.168.1.1, mask 255.255.255.0
        gateway not set, nameserver not set
Checksum mismatch: 
Image chksum: 0x50DEE50C
Calc  chksum: 0x990DE392
Boot program checksum is invalid
Device eth0 has been deactivated.
Device eth0:  hwaddr 84-1B-5E-3B-A9-5C, ipaddr 192.168.1.1, mask 255.255.255.0
        gateway not set, nameserver not set
Start TFTP server
Reading ::

===================================factory WN3000RP-V1.0.2.64_1.1.86.chk ==========================================

TFTP-UL-REQ sent...Waiting for TFTP-WRQ...
Reading :: Done. 2969658 bytes read
Programming...done. 1048576 bytes written
KEEP-ALIVE-REQ sent...Waiting for KEEP-ALIVE-ACK...
done. 1048576 bytes written
KEEP-ALIVE-REQ sent...Waiting for KEEP-ALIVE-ACK...
KEEP-ALIVE-REQ sent...Waiting for KEEP-ALIVE-ACK...
done. 872506 bytes written
done. 2969658 bytes written
Write len/chksum offset @ 0x002EFFF8...done.
Device eth0:  hwaddr 84-1B-5E-3B-A9-5C, ipaddr 10.164.183.252, mask 255.255.255.0
        gateway not set, nameserver not set
CLOSE-REQ sent...Waiting for CLOSE-ACK...
CFE> reboot
Decompressing..........done


CFE for WN3000RPT version: v1.0.3
Build Date: Tue Mar 15 12:30:52 CST 2011 
Init Arena
Init Devs.
Boot partition size = 262144(0x40000)
Found a 4MB ST compatible serial flash
et0: Broadcom BCM47XX 10/100/1000 Mbps Ethernet Controller 5.60.69 
CPU type 0x19749: 300MHz
Tot mem: 32768 KBytes

Device eth0:  hwaddr 84-1B-5E-3B-A9-5C, ipaddr 192.168.1.1, mask 255.255.255.0
        gateway not set, nameserver not set
Linux version 2.6.22 (allen@cpe2server186) (gcc version 4.2.3) #8 Tue Feb 25 10:04:48 CST 2014
CPU revision is: 00019749
Found an ST compatible serial flash with 64 64KB blocks; total size 4MB
Determined physical RAM map:
 memory: 02000000 @ 00000000 (usable)
Built 1 zonelists.  Total pages: 8128
Kernel command line: root=/dev/mtdblock2 console=ttyS0,115200 init=/sbin/preinit
Primary instruction cache 32kB, physically tagged, 4-way, linesize 32 bytes.
Primary data cache 32kB, 4-way, linesize 32 bytes.
Synthesized TLB refill handler (20 instructions).
Synthesized TLB load handler fastpath (32 instructions).
Synthesized TLB store handler fastpath (32 instructions).
Synthesized TLB modify handler fastpath (31 instructions).
PID hash table entries: 128 (order: 7, 512 bytes)
CPU: BCM5357 rev 2 at 300 MHz
Using 150.000 MHz high precision timer.
Dentry cache hash table entries: 4096 (order: 2, 16384 bytes)
Inode-cache hash table entries: 2048 (order: 1, 8192 bytes)
Memory: 30048k/32768k available (1800k kernel code, 2720k reserved, 267k data, 172k init, 0k highmem)
Mount-cache hash table entries: 512
NET: Registered protocol family 16
PCI: no core
PCI: no core
PCI: Fixing up bus 0
NET: Registered protocol family 2
Time: MIPS clocksource has been installed.
IP route cache hash table entries: 1024 (order: 0, 4096 bytes)
TCP established hash table entries: 1024 (order: 1, 8192 bytes)
TCP bind hash table entries: 1024 (order: 0, 4096 bytes)
TCP: Hash tables configured (established 1024 bind 1024)
TCP reno registered
squashfs: version 3.2-r2 (2007/01/15) Phillip Lougher
io scheduler noop registered (default)
Serial: 8250/16550 driver $Revision: 1.1.1.1 $ 4 ports, IRQ sharing disabled
serial8250: ttyS0 at MMIO 0x0 (irq = 8) is a 16550A
sflash: squash filesystem with lzma found at block 15
Creating 16 MTD partitions on "sflash":
0x00000000-0x00040000 : "boot"
0x00040000-0x00330000 : "linux"
0x000fd91c-0x00330000 : "rootfs"
0x00330000-0x00340000 : "ML1"
0x00340000-0x00350000 : "ML2"
0x00350000-0x00360000 : "ML3"
0x00360000-0x00370000 : "ML4"
0x00370000-0x00380000 : "ML5"
0x00380000-0x00390000 : "ML6"
0x00390000-0x003a0000 : "ML7"
0x003a0000-0x003b0000 : "ML8"
0x003b0000-0x003c0000 : "T_Meter1"
0x003c0000-0x003d0000 : "T_Meter2"
0x003d0000-0x003e0000 : "POT"
0x003e0000-0x003f0000 : "board_data"
0x003f0000-0x00400000 : "nvram"
TCP cubic registered
NET: Registered protocol family 1
NET: Registered protocol family 17
802.1Q VLAN Support v1.8 Ben Greear <greearb@candelatech.com>
All bugs added by David S. Miller <davem@redhat.com>
VFS: Mounted root (squashfs filesystem) readonly.
Freeing unused kernel memory: 172k freed
Warning: unable to open an initial console.
Failed to execute /init
[sighandler]: No more events to be processed, quitting.
[cleanup]: Waiting for children.
[cleanup]: All children terminated.
Restoring defaults...Reading board data...
WSC UUID: 0x5f20b5f85787b7ff39d3007399dabb44
NTP synchronized date/time: Sun Dec 30 19:52:19 2018
MAC address of 1st STA connected: 00-23-F8-AC-F4-EA
--> In none security, turn off WPS led.
No RF parameters! Use default.
done
Reading board data...
WSC UUID: 0x5f20b5f85787b7ff39d3007399dabb44
NTP synchronized date/time: Sun Dec 30 19:52:19 2018
MAC address of 1st STA connected: 00-23-F8-AC-F4-EA
--> In none security, turn off WPS led.
No RF parameters! Use default.
insmod: emf.ko: no module by that name found
insmod: igs.ko: no module by that name found
insmod: bcm57xx.ko: no module by that name found
insmod: dpsta.ko: no module by that name found
Hit enter to continue...mevent start...
opened loopback socket 3
Reading board data...
WSC UUID: 0x5f20b5f85787b7ff39d3007399dabb44
rmmod: br_dhcp_filter
NF_BR_LOCAL_OUT registered.
dnsRedirectReplyd: No such file or directory
Can't find handler for ASP command: fw_cgi_get_inbound_param("lanIP");
Can't find handler for ASP command: is_jp_region("jp_js_start");
Can't find handler for ASP command: is_jp_region("jp_js_end");
Can't find handler for ASP command: tra_get_param("button_grayed");
Can't find handler for ASP command: fw_cgi_pt_get_policy_param("fwpt_timeout");
Can't find handler for ASP command: fw_cgi_pt_get_policy_table();
Can't find handler for ASP command: fw_cgi_pt_get_policy_table("policyCount");
Can't find handler for ASP command: fw_cgi_pt_get_policy_param("df_sel");
Can't find handler for ASP command: fw_cgi_pt_get_policy_param("fwpt_action");
Can't find handler for ASP command: fw_cgi_pt_get_policy_param("src_ip_type");
Can't find handler for ASP command: fw_cgi_pt_get_policy_param("pt_type");
Can't find handler for ASP command: fw_cgi_pt_get_policy_param("pt_port");
Can't find handler for ASP command: fw_cgi_pt_get_policy_param("in_port_type");
Can't find handler for ASP command: fw_cgi_pt_get_policy_param("in_port_start");
Can't find handler for ASP command: fw_cgi_pt_get_policy_param("in_port_end");
Can't find handler for ASP command: fw_cgi_pt_get_policy_param("pt_name");
Can't find handler for ASP command: fw_cgi_pt_get_policy_param("src_ip");
Can't find handler for ASP command: genie_cgi_get_firmware_ver();
Can't find handler for ASP command: genie_cgi_show_firmware_ver(0);
Can't find handler for ASP command: genie_cgi_show_firmware_ver(1);
Debug: the path is /dev/mtd3
[a]the file size is 1014987101
Debug: the path is /dev/mtd4
[a]the file size is 2422952386
Debug: the path is /dev/mtd5
[a]the file size is 1124094206
dnsmasq: No such file or directory
Debug: the path is /dev/mtd6
[a]the file size is 2587639685
Debug: the path is /dev/mtd7
[a]the file size is 577306880
Debug: the path is /dev/mtd8
[a]the file size is 3737169374
Debug: the path is /dev/mtd9
[a]the file size is 3737169374
Debug: the path is /dev/mtd10
[a]the file size is 3737169374
[multiLangugeReadLangTblMTD] lang name: English
[multiLangugeReadLangTblMTD] No correspondent string table in MTD, Load FS string table.
[Create_Hashtable] Ready to load string table from FS.
info, udhcp server (v0.9.8) started
error, unable to parse 'option wins '
error, unable to parse 'option domain '
ddnsd: No such file or directory
kill nsmpd.....
killall: nsmpd: no process killed
upnpd: No such file or directory
POT integrity check OK.
POT time is up.
sh: /usr/sbin/email: not found
sh: /usr/sbin/acl_logd: not found
set_ntgr_vendor_ie:693 command (wl del_ie 3 6 00:14:6C 000000)
wl: Not Found
set_ntgr_vendor_ie:714 command (wl add_ie 3 6 00:14:6C 000001)
set_ntgr_vendor_ie:722 command (wl -i wl0.1 del_ie 3 6 00:14:6C 000000)
wl: Not Found
set_ntgr_vendor_ie:743 command (wl -i wl0.1 add_ie 3 6 00:14:6C 000001)
Start DHCP client daemon
info, udhcp client (v0.9.8) started
br0: No such process
Hit enter to continue...Hit enter to continue...kill smart_mesh daemon.....
killall: dnsmasq: no process killed
new a xid:367b06b0 .
killall: smart_mesh: no process killed
insmod: MultiSsidCntl.ko: no module by that name found
ioctl(BRCTL_SET_MSSIDPROFILE): Operation not supported
httpd: socket bound in 0.0.0.0:80.
PCB

1 Like

Hi @metsys,

My guess is that all current Lede/OpenWrt images are to large and therefor fail Image checksum of the bootloader the fix is not changing the checksum but creating a smaller image readon.

Having the exact same model/version and PCB, I used the telnet backdoor in the original firmware to find out the size of the firmware partition which must be smaller than 3080192 bytes.

./telnetenable 192.168.1.250 AABBCCDDEEFF Gearguy Geardog
telnet 192.168.1.250
Trying 192.168.1.250...
Connected to 192.168.1.250.
Escape character is '^]'.

BusyBox v0.60.0 (2011.03.31-19:56+0000) Built-in shell (msh)
Enter 'help' for a list of built-in commands.

# cat /proc/mtd 
dev:    size   erasesize  name
mtd0: 00040000 00010000 "boot"
mtd1: 002f0000 00010000 "linux"
mtd2: 002658bc 00010000 "rootfs"
mtd3: 00010000 00010000 "ML1"
mtd4: 00010000 00010000 "ML2"
mtd5: 00010000 00010000 "ML3"
mtd6: 00010000 00010000 "ML4"
mtd7: 00010000 00010000 "ML5"
mtd8: 00010000 00010000 "ML6"
mtd9: 00010000 00010000 "ML7"
mtd10: 00010000 00010000 "ML8"
mtd11: 00010000 00010000 "T_Meter1"
mtd12: 00010000 00010000 "T_Meter2"
mtd13: 00010000 00010000 "POT"
mtd14: 00010000 00010000 "board_data"
mtd15: 00010000 00010000 "nvram"

# cat /dev/mtd/1 > /tmp/mtd1.img
# cat /dev/mtd/2 > /tmp/mtd2.img
# ls -la /tmp/mtd*
-rw-r--r--    1 0        0         2513084 Dec 27 16:34 /tmp/mtd2.img
-rw-r--r--    1 0        0         3080192 Dec 27 16:34 /tmp/mtd1.img

Followed by making a very tiny custom Lede 17.01.7 image around ~3MB insize which does flash correctly by using the following image builder command:

#imagebuilder very tiny without wifi
make image PROFILE="netgear-wn3000rp" PACKAGES="-wpad-mini -hostapd-common uhttpd uhttpd-mod-ubus libiwinfo-lua luci-base luci-app-firewall luci-mod-admin-full luci-theme-bootstrap -ppp -ppp-mod-pppoe -ip6tables -odhcp6c -kmod-ipv6 -kmod-ip6tables -odhcpd-ipv6only -odhcpd"

After the very tiny custom Lede image you may flash a larger Lede/OpenWrt image max 3735552 (look up the mtd size in Lede/Openwt) with drivers for wifi, however the 'b43' and 'wl' did not work in Lede 17.01.7.

#imagebuilder b43 wifi
make image PROFILE="netgear-wn3000rp" PACKAGES="kmod-b43 wpad-mini hostapd-common uhttpd uhttpd-mod-ubus libiwinfo-lua luci-base luci-app-firewall luci-mod-admin-full luci-theme-bootstrap -ppp -ppp-mod-pppoe"

DMESG b43 error

[   15.899842] b43-phy0: Broadcom 5357 WLAN found (core revision 28)
[   15.907361] b43-phy0: Found PHY: Analog 9, Type 4 (N), Revision 9
[   15.913595] b43-phy0 ERROR: FOUND UNSUPPORTED RADIO (Manuf 0x17F, ID 0x2057, Revision 5, Version 2) 

WL driver example

#imagebuilder wl wifi
make image PROFILE="netgear-wn3000rp" PACKAGES="-wpad-mini -hostapd-common kmod-brcm-wl wl wlc nas uhttpd uhttpd-mod-ubus libiwinfo-lua luci-base luci-app-firewall luci-mod-admin-full luci-theme-bootstrap -ppp -ppp-mod-pppoe" #not working/detecting

Maybe others would like to test b43 without luci in OpenWrt 19.07.x and or the brcm f/s mac drivers. Remember that for current OpenWrt you have to drop luci webinterface and maybe more packages before you may get an image smaller than 3735552 bytes.

Interesting fact about this device is that both with stock firmware and with lede/openwrt there is a eth0 switch configured with 2 ports although there is only one physical port!

I might add a wiki page for this device but will not continue effort.

I have created the skeleton of a devicepage for the WN3000RP v1:
https://openwrt.org/toh/netgear/netgear_wn3000rp_v1

Feel free to add useful information regarding this device.

Thanks, OFFTOPIC is copy pasting that wiki skeleton code template the same as create_new_device_page or does it do more?

Thanks for OFFTOPIC answer, however the current correct wiki template is incorrect and dangerous for the wn3000rp it must be Unsupported! OpenWrt will lead to brick in current state with current wiki! I cannot correct so much incorrect dynamic/linked/table generated info myself.

Is it better to fill in a git Pull request to make "wn3000rp v1" and "wnr3500 v2" default image creation disabled for 19.07.x 18.06.x and 17.01.x versions? Both models suffer the same image size problem.

Yes, please go ahead.

A post was split to a new topic: Installation of 19.07.2 on WN3000RP