WNDR4700 New Install


I have a very satisfactory dual wan set up on Netgear R6100 where one of the WAN is actually a Wireless client into neighbors Guest WiFi.

I have a spare WNDR4700 and I decided to install the latest OpenWRT 18.06.1 on it.

I first installed openwrt-18.06.1-apm821xx-nand-netgear_wndr4700-squashfs-factory.img using netgear firmware upgrade page.

Then I logged into Netgear4700/OPenWRT, changed password, assigned port 22 to lan for ssh and then using openwrt firware upgrade page, updated this to:

To my surprise they both report:
OpenWrt 18.06.1 r7258-5eb055306f / LuCI openwrt-18.06 branch (git-18.228.31946-f64b152)

For now it appears that everything looks normal but I have three issues:

  1. When I connect the USB device like my phone to the USB3 port, the blue USB light on the router comes up and the phone starts to charge as well. Does that mean that no firmware package need to be installed for the USB ports to work?

  2. On my software page, it reports only a fraction of NAND memory as ==>>>Free space: 99% ( 11.52 MB ). We know that this puppy has 128MB of flash. So what happened. Perhaps someone can point me in the right direction.

  3. On the download page there is a file netgear_wndr4700-squashfs-kernel.dtb and I have no idea what use this is of. What are we supposed to use this for.

Many thanks for taking your valuable time in reading this note and I appreciate your volunteering to help.

Anil Garg

From SSH session try following commands to see how the NAND is used.

# cat /proc/mtd
# df -h

Note: the /overlay mount is what you are referring too.

I am not sure what you mean by /overlay
In my Netgear R6100 also there is 128MB of Flash and it shows Free space: 95% ( 94.59 MB )
This is when I go to SYSTEM >> SOFTWARE in the LUCI menu..
The output from cat /proc/mtd and from df -h and also from top is attached below:

agarg@E7440:~$ ssh -l root
root@'s password: 

BusyBox v1.28.3 () built-in shell (ash)

  _______                     ________        __
 |       |.-----.-----.-----.|  |  |  |.----.|  |_
 |   -   ||  _  |  -__|     ||  |  |  ||   _||   _|
 |_______||   __|_____|__|__||________||__|  |____|
          |__| W I R E L E S S   F R E E D O M
 OpenWrt 18.06.1, r7258-5eb055306f
root@OpenWrt:~# cat /proc/mtd
dev:    size   erasesize  name
mtd0: 08000000 00020000 "NAND 128MiB 3,3V 8-bit"
mtd1: 00180000 00020000 "uboot"
mtd2: 00020000 00020000 "device-tree"
mtd3: 00380000 00020000 "kernel"
mtd4: 014e0000 00020000 "ubi"
mtd5: 00080000 00020000 "config"
mtd6: 00080000 00020000 "pot"
mtd7: 00300000 00020000 "traffic_meter"
mtd8: 001c0000 00020000 "language"
mtd9: 06020000 00020000 "ecos"
mtd10: 00040000 00020000 "wifi_data"
mtd11: 01860000 00020000 "firmware"
root@OpenWrt:~# df -h
Filesystem                Size      Used Available Use% Mounted on
/dev/root                 3.3M      3.3M         0 100% /rom
tmpfs                   124.1M     76.0K    124.1M   0% /tmp
/dev/ubi0_1              11.7M     52.0K     11.0M   0% /overlay
overlayfs:/overlay       11.7M     52.0K     11.0M   0% /
tmpfs                   512.0K         0    512.0K   0% /dev
Mem: 31088K used, 223152K free, 76K shrd, 2676K buff, 10264K cached
CPU:   0% usr   1% sys   0% nic  96% idle   0% io   0% irq   1% sirq
Mem: 31096K used, 223144K free, 76K shrd, 2676K buff, 10264K cached
CPU:   0% usr   0% sys   0% nic  90% idle   0% io   0% irq   9% sirq
Load average: 0.00 0.10 0.08 1/44 2626
 1499     1 root     S     1948   1%   0% /usr/sbin/hostapd -s -P /var/run/wifi-phy0.pid -B /var/run/hostapd-phy0.conf
 1117     1 root     S     1864   1%   0% /sbin/netifd
 1005     1 root     S     1732   1%   0% /sbin/rpcd
    1     0 root     S     1712   1%   0% /sbin/procd
 1154     1 root     S     1524   1%   0% /usr/sbin/odhcpd
 1461     1 root     S     1416   1%   0% /usr/sbin/uhttpd -f -h /www -r OpenWrt -x /cgi-bin -t 60 -T 30 -k 20 -A 1 -n 3 -N 100 -R -p -p [::]:80
 1725     1 dnsmasq  S     1388   1%   0% /usr/sbin/dnsmasq -C /var/etc/dnsmasq.conf.cfg01411c -k -x /var/run/dnsmasq/dnsmasq.cfg01411c.pid
 1289  1117 root     S     1264   0%   0% udhcpc -p /var/run/udhcpc-eth0.2.pid -s /lib/netifd/dhcp.script -f -t 0 -i eth0.2 -x hostname:OpenWrt -C -O 121
 1664     1 root     S<    1264   0%   0% /usr/sbin/ntpd -n -N -l -S /usr/sbin/ntpd-hotplug -p 0.openwrt.pool.ntp.org -p 1.openwrt.pool.ntp.org -p 2.openwrt.pool.ntp.o
 2197  2183 root     S     1264   0%   0% -ash
 2626  2197 root     R     1264   0%   0% top
  733     1 root     S     1252   0%   0% /sbin/ubusd
  988     1 root     S     1240   0%   0% /sbin/logd -S 64
 2183  1345 root     S     1060   0%   0% /usr/sbin/dropbear -F -P /var/run/dropbear.1.pid -p -p fd71:2a4e:8e8a::1:22 -K 300 -T 3
 1296  1117 root     S     1000   0%   0% odhcp6c -s /lib/netifd/dhcpv6.script -P0 -t120 eth0.2
 1345     1 root     S      996   0%   0% /usr/sbin/dropbear -F -P /var/run/dropbear.1.pid -p -p fd71:2a4e:8e8a::1:22 -K 300 -T 3
  735     1 root     S      832   0%   0% /sbin/askfirst /usr/libexec/login.sh
  495     2 root     IW       0   0%   0% [kworker/0:2]
  322     2 root     IW       0   0%   0% [kworker/0:1]
    7     2 root     SW       0   0%   0% [ksoftirqd/0]
  384     2 root     IW       0   0%   0% [kworker/u2:3]
    8     2 root     IW       0   0%   0% [kworker/u2:1]
  552     2 root     SW       0   0%   0% [scsi_eh_1]
  553     2 root     IW<      0   0%   0% [scsi_tmf_1]
  452     2 root     SW       0   0%   0% [ubi_bgt0d]
  323     2 root     IW<      0   0%   0% [scsi_tmf_0]
  440     2 root     IW<      0   0%   0% [ipv6_addrconf]
  457     2 root     IW<      0   0%   0% [kworker/0:1H]
  554     2 root     SW       0   0%   0% [usb-storage]
  179     2 root     SW       0   0%   0% [kswapd0]
  112     2 root     IW<      0   0%   0% [ata_sff]
  106     2 root     IW<      0   0%   0% [kblockd]
  127     2 root     IW<      0   0%   0% [watchdogd]
  321     2 root     SW       0   0%   0% [scsi_eh_0]
   96     2 root     SW       0   0%   0% [oom_reaper]
  102     2 root     IW<      0   0%   0% [writeback]
    6     2 root     IW<      0   0%   0% [mm_percpu_wq]
    2     0 root     SW       0   0%   0% [kthreadd]
^C825     2 root     IW<      0   0%   0% [cfg80211]

Yes I do mean /overlay because all the packages are installed there. I just figured that out. Thanks.

Corresponding data from Netgear R6100 is as follows:

BusyBox v1.25.1 () built-in shell (ash)

    /        /\      _    ___ ___  ___
   /  LE    /  \    | |  | __|   \| __|
  /    DE  /    \   | |__| _|| |) | _|
 /________/  LE  \  |____|___|___/|___|                      lede-project.org
 \        \   DE /
  \    LE  \    /  -----------------------------------------------------------
   \  DE    \  /    Reboot (17.01.4, r3560-79f57e422d)
    \________\/    -----------------------------------------------------------

root@R6100:~# cat /proc/mtd
dev:    size   erasesize  name
mtd0: 00020000 00020000 "u-boot"
mtd1: 00040000 00020000 "caldata"
mtd2: 00040000 00020000 "caldata-backup"
mtd3: 00080000 00020000 "config"
mtd4: 00080000 00020000 "pot"
mtd5: 00200000 00020000 "kernel"
mtd6: 07760000 00020000 "ubi"
mtd7: 01900000 00020000 "firmware"
mtd8: 00200000 00020000 "language"
mtd9: 00300000 00020000 "traffic_meter"
root@R6100:~# df -h
Filesystem                Size      Used Available Use% Mounted on
/dev/root                 2.8M      2.8M         0 100% /rom
tmpfs                    61.2M    608.0K     60.6M   1% /tmp
/dev/ubi0_1              99.8M      5.2M     89.9M   5% /overlay
overlayfs:/overlay       99.8M      5.2M     89.9M   5% /
tmpfs                   512.0K         0    512.0K   0% /dev

The USB3 ports on the WNDR4700 require firmware that doesn't come with the default OpenWRT install. There was an .ipk file to install it at https://github.com/chunkeey but it looks like it's gone now.

1 Like

The firmware in the USB3 chip can sometimes survive a reboot just fine. If you installed the image through the netgear's web-ui, then there's a good chance that it survived the following reboot. However, if you unplug the now-flashed router and turn it back on later and you don't have the usb3 firmware installed, it won't work anymore.

(and if you then manually install the firmware by placing the firmware file into /lib/firmware, you either have to reboot or reload the kernel driver module to get it working)

Yes, problem here is that the vendor firmware has placed important stuff after its "rootfs" partition, so if the partition is extended it will overwrite other partitions and this makes it difficult to return to the stock firmware easily.

But if you really want to use more of the provided flash and you are not afraid of making and maintaining your own images: you can just change the size (it's the second hexadecimal value in the reg pair) in the netgear-wndr4700.dts from 0x014e0000 to 0x7ac0000.

(It's a good idea to make a backup of partitions your are overwriting though and safe them on a PC or somewhere... - and also for the wifi_data partition!)

Note: it might also be possible to use the "ecos" partition (~96 MiB) as an extroot in the future. The partition is currently set to "read-only". But it was empty on my WNDR4700 and I have no idea what Netgear was planning there. If it turns out that this space can be safely used, then sure: let's do something with it.

It was used at some point in the past:

But it became redundant when the partitions had to be reorganized due to ever increasing kernel size:

I guess I'll axe it at some point... Unless someone else is "looking for an easy PR" and wants to do it?

I can put it back up, once someone from Renesas gives the go-ahead to send it to the linux-firmware@kernel.org ML with a compatible license.

Ah the God has spoken! Thanks Christian, I appreciate your help:

  1. Yes the USB 3 drivers are gone. I just fired up and it no longer charges or recognizes connected device.
    Any idea where I can download the firmware and how do I manually place it in /lib/firmware? RCP/SCP/RSYNC??

  2. I am not confident enough to change the size myself and or backup partitions on an embedded device. If it can't be changed by you or someone expert then I think I should consider using the exroot on a flash drive. I have used that recipe from Openwrt website in the past. But for that too I will need USB drivers.

  3. I could use the SD Card slot to exroot the /overlay as I have many sd cards not in use and spare with me. But I wonder if that requires another set of drivers.

I can be a happy tester for you, if you'd like .... for wndr4700 and I can document my journey and put it into the forum for common cause.

Many thanks again.


(Don't forget to leave a like there)

The sdcard could be the better choice there. It is supported by the SoC's own usb 2.0 controller, so no firmware will be required. But it should also be possible to put the extroot on the HDD (provided you have one installed).

Further update: My SATA plans are in future but I decided to give a go to SDCARD. I put a ext4 formatted (mbr partition) into the slot and tried the 18.06.1 to recognize it. I tried the fdisk -l to see if there is any way to mount this partition. Then I loaded kmod ext4 and even then I wasn't able to see. So I decided to externally format this to fat32 and opkg added fs kmods as well. No luck still.

I used to have this puppy running fine on 17.01.4 and so decided to roll back the 18x to 17x using the LuCi firmware upgrade. There it refused to recognize and accept the openwrt image. After repeated try, I decided why not I restore to Netgear Factory condition using tftp and the netgear firmware from their site. Then just like the last time, I could move to 17.01.4 just like I did in the past. Picture of actual set up from that time is attached.

So my tftp to netgear factory went successful I left it on for 30 minutes to knock itself out updating and updating to its hearts delight....

NOW... This machine is partially functional. It boots and goes into first log in screen and displays netgear URL pointed to http://www.routerlogin.net/BRS_index.htm and then the ethernet connection disconnects. Moments later it comes up again and then it fails again. This it is doing in a perpetual do-loop.

Any advice? What I thought was an easy solution appears to have become obsession (wife thinks that) but we engineers don't give up. Do we?

Any guidance will be helpful.

Anil Garg

Clear your browser cache if you have been accessing different firmware on the same IP address.

Kmod-usb-storage must be installed to mount filesystems on USB. It is a stack of drivers like

kmod-usb2 (or usb3)

Mike: I was clearing cache because I use private modes. Which clear cache as soon as I close browser.

However, using tftp, I have loaded the Netgear original WNDR4700_V1.0.0.28.img firmware.

However now the LAN ethernet is unstable. I have made thie tftp flash twice already and each time it said 19.2 seconds and loaded successfully but when it boots the the Netgear OEM, it goes into unstable perpetual connect disconnect of LAN connection. And this renders it useless.


I am not using USB and I was going to use Chris's pointer for USB and I have in past made exroot successfully several times.

RIght now I am trying to recover this wndr4700 so that I can step up to 17.1.4 / 17.1.6 that may be more stable...I could retry the 18x too...but how do I get there...


I know that when the Netgear OEM firmware is loaded, for some strange reasons, it keeps connecting and disconnecting LAN ports.

What if the built-in TFTP server is used to flash a openwrt 17.1.4 image? Perhaps it might give us a stable LAN connection after booting. But this is truly a strange behavior for me to understand.

Boot up the Netgear firmware then hold down the reset button to make sure it is running default settings.

Thanks. Solved... Now I am on 17.1.06
Will keep you guys posted..and I am making a recipe

Looks like I'm late to the party.

Netgear went for an off-the-shelf GL827L SD/MMC/MS Flash Card Reader chip, which is soldered to the PCB and hardwired to the SoC's USB pins. The device should get announced during boot:

[    8.862031] dwc2 4bff80000.usbotg: DWC OTG Controller
[    8.867118] dwc2 4bff80000.usbotg: new USB bus registered, assigned bus number 1
[    8.874527] dwc2 4bff80000.usbotg: irq 37, io mem 0x4bff80000
[    8.880828] hub 1-0:1.0: USB hub found
[    8.884761] hub 1-0:1.0: 1 port detected
[    8.971348] usb 1-1: new high-speed USB device number 2 using dwc2

and once userspace is ready and loaded (kmod-) usb-storage, it should detect a device

[   80.959801] usb-storage 1-1:1.0: USB Mass Storage device detected
[   80.966680] scsi host1: usb-storage 1-1:1.0
[   81.982703] scsi 1:0:0:0: Direct-Access     Generic  STORAGE DEVICE   9454 PQ: 0 ANSI: 0
[   82.275151] sd 1:0:0:0: [sda] 2012160 512-byte logical blocks: (1.03 GB/983 MiB)
[   82.283673] sd 1:0:0:0: [sda] Write Protect is off
[   82.288570] sd 1:0:0:0: [sda] Mode Sense: 03 00 00 00
[   82.289488] sd 1:0:0:0: [sda] No Caching mode page found
[   82.294877] sd 1:0:0:0: [sda] Assuming drive cache: write through
[   82.305560]  sda: sda1 sda2
[   82.312894] sd 1:0:0:0: [sda] Attached SCSI removable disk

Switching between 17.01.x and 18.06 is a pain because the NAND partition layout has changed because the kernel got too big. That's why the the patch:

included the recommendation to go with the tftp method.

Hm, is the LAN unstable in u-boot, the stock netgear firmware or just now in OpenWrt 18.06/-master?

the LAN and WAN ports are all handled by an AR8327N switch. The ethernet "eth0" doesn't directly receive any actual link information so it should never get into a DOWN state on its own, so a daemon or scripts needs to put it there.

Hi Chris: Here is the update

I tried but none of my sd cards (tried both mbr and gpt) were accepted and I did not see them in /dev or fdisk .. I should have checked dmesg and I still will next time I start to monkey with it. Right now its on a mission critical role (serve internet at my home!).
To make it silent, I opened the box and unhooked the 3 pin fan connector and used a double sided 3M take to stick in a 2.5 in SSD drive inside it. The kmod-fs-ext4 was addded along with samba and now I have an additional 500MB swap file in it and a share directory for sharing files.

I would love to put a LAMP in it some day to run local drupal / wp off it but that I will do when I can comprehend how to enlarge the /overlay that may be leaving bunch of wasted flash. It does have 128MB and 256MB RAM.

Totally understood the 3.5 MB challenge. I think I will take a back up of config. Roll back to Netgear Factory and then go straight to 18x and then upload config bundle.

I wish I was technical enough to do that. I will upgrade to 18.x when you have lifted your proverbial axe! In the meanwhile I will clean up the recipe for dual wan set up that I want to share for this machine.

I will test the usb ports out in the next couple of days and report back and WILL leave a like there. Its a great help.

I have not done a detailed RCA but I am confident that the problem would have been one of my retractable Ethernet cable that I junked and did not see the problem since.

If you do, you should check if the sdcard "suddendly" pops up, if you reload the dwc2 or usb-storage kernel module. The sdcard media change detection is handled by a "virtual" button event BTN_1, is triggered if you insert/remove a sdcard from the slot.

The usb-storage module has no way of monitoring sdcard presence on its own. On full desktop linux distributions this isn't much of a problem for those cardreader chips, since daemons like udisks do the media polling there. But OpenWrt doesn't have the udisks daemon so the WNDR4700 currently has a "hack":

that does trigger the media change detection be unloading and reloading the dwc2 module (usb driver) based on virtual BTN_1 state.

The fan is software controllable. From what I remember (haven't touched the WNDR4700 in a long time), you should be able to control it through the /sys/class/hwmon inteface. Just note: There are two hwmon instances, one is the lm87-like temperature sensors, the other the tc654 fan controller.

I checked on my install and it appears that the code is already similar. Code on my 17.1.06 is:

root@WNDR4700:/etc/rc.button# cat BTN_1 

. /lib/functions.sh
. /lib/apm821xx.sh


if [ $BOARD == "wndr4700" ]; then
	case "$ACTION" in
		rmmod dwc2
		modprobe dwc2

return 0

This is way above my current skill level. I will try and read about this a little and then figure out..