Asuswrt-Merlin on Netgear R7000

Discussion in 'Other Firmware Projects' started by XVortex, Mar 27, 2015.

  1. peyton

    peyton Network Guru Member

    Seems that i can't connect to wireless since 2 days even if it's OK on router GUI side. Does anyone can give me the command lines to check if all is OK ? I start my config from scratch after upgrading to 384 FW. Thanks.
    Ps : I already reboot
  2. slidermike

    slidermike Addicted to LI Member

    have you
    1) cleared your browser cache or tried a new browser?
    2) verified the Wifi settings (is it both bands or one?) such as broadcast ssid?
    3) having verified the wifi settings are correct (channels etc..) have you hit apply again to see if you can force it to take?
    4) You can ssh into the router, grab the config to a file using notepad++, reset to factory default. ssh back into it and grab the config to a 2nd file in notepad++ and use the "diffserve" plugin to see what is different between a stock config and how you have it now.
  3. Kjartan bj

    Kjartan bj Network Newbie Member

    Web access from Wan was off, SSH was off completely as I don't need any access from outside, but AI Cloud might have been on, not sure tough, I at least have it closed down better now and had my IP address changed
  4. sn2018

    sn2018 Network Newbie Member

    How do you read the current MAC & SN?
  5. Daedelus

    Daedelus Network Guru Member

    ssh into the router and issue
    nvram show | grep "serial_no"
    nvram show | grep "et0macaddr"

    from a windows client you can issue
    arp -a
    to see the routers mac as well
  6. peyton

    peyton Network Guru Member

    In fact it's working again. I had to tick BWDPI and reboot.. Previously in 380 FW i was not forced to enable it to have WiFi. Thanks for you reply.

    I discover another small bug. in when i chose a device for time scheduling and click "apply" it enable "block internet access" instead. I have to come back again to change correctly and access the time schedule page. Can anyone confirm ?
  7. subzerosv

    subzerosv Network Newbie Member

    Hi, I need some help.

    Some time ago I was using 380.64 build and load balance was working fine.
    After sometime updated to 389.69_2 and started to notice some unauthorized devices on my network, so I decided to try 384.4 but load balance didn't work anymore.

    The router seemed unable to use the second WAN, using the routing table made them work individually but I need it to switch automatically.

    So I'm trying to go back to 380.64, and after using back to stock v1.0.9.26_10.2.31 for NG builds, I'm stuck in stock Netgear firmware and get "This firmware file is incorrect! Please get the firmware file again and make sure it is the correct firmware for this product." when I try to upload 380.64.chk firmware.

    Thank you in advance.
  8. slidermike

    slidermike Addicted to LI Member

    Read the thread.
    You usually find your answer yourself.
    XVortexNetworkin' NutMember
    unfortunately I have not yet figured out the nature of problems with downgrade. who likes to tinkering with firmwares please stay away from upgrading to ng.
  9. subzerosv

    subzerosv Network Newbie Member

    Thanks man, I read the thread backwards and quickly find that we are stuck in stock firmware... for now. (I hope XVortex will find a solution).
  10. slidermike

    slidermike Addicted to LI Member

    As xVortex said in that post. For now, anyone who thinks they may want to revert backwards, do NOT upgrade to the NG firmware.
  11. XVortex

    XVortex Addicted to LI Member

    - CHANGED: Added visual warning when manually enabling webui
    access on WAN. Doing so carries serious potential
    security risks, as Asuswrt's web server code should
    not be considered hardened enough for this.
    - FIXED: Security issue in httpd (CVE-2018-8879).
    - FIXED: Potential security issue in httpd related to QiS.
    - FIXED: Minor webui issue in the QoS overhead menu.
    Stimpy88, edusodanos, KingP1n and 5 others like this.
  12. Almighty1

    Almighty1 Networkin' Nut Member

    I can verify that the MAC and SN has been changed. Is the MAC supposed to match what is on the box or bottom of the R7000?

    This is what mines shows:
    # nvram show | grep "serial_no"
    size: 53758 bytes (11778 left)

    admin@NETGEAR-R7000:/tmp/home/root# nvram show | grep "macaddr"
    size: 53759 bytes (11777 left)

    Wonder what is needed to fix this since I remember the MAC address is not exactly the same on the box for the different interfaces so it would help if someone who has the correct info actually provide what the differences are between what is listed on the box/bottom of the router versus what is configured in firmware.
    Last edited: Mar 26, 2018
  13. Almighty1

    Almighty1 Networkin' Nut Member

    Updated and working so far from 384.4 with existing config.
  14. Gresko

    Gresko New Member Member

    Has anyone that has upgraded to 384 experienced problem with 5ghz ? i can only see it if i set the transmission channel to the lowest.
    Moreover using R7000-V1.0.9.26_10.2.31 is now possible to go back to NG fw from merlin 384?
  15. wallyg8r

    wallyg8r Reformed Router Member

    My serial no. and MAC address is identical to yours since upgrading to NG firmware.
  16. Makaveli

    Makaveli Networkin' Nut Member

    i'm still on 380.69_2

    for 2 reasons i'm at 54+ days of up time and secondly I never jump on new firmware's as soon as they are released.

    My serial # is the same as yours.

    My eto mac is different
    1:macaddr is the same as yours
    0:macaddr is different.
    Almighty1, slidermike and KingP1n like this.
  17. KingP1n

    KingP1n Reformed Router Member

    Is it safe upgrade? I dont intend to ever gng back to stock so i guess ill take my chances..., im on 380.69_2 as well
  18. Makaveli

    Makaveli Networkin' Nut Member

    If you don't need to downgrade its safe.
    KingP1n likes this.
  19. SignedAdam

    SignedAdam Serious Server Member

    @XVortex - Are we all meant to be moving to this (NG Branch) now ? or is it still in beta, looking at the website im not to sure what im meant to be updating to ?

    right now im on 380.69.2 am i meant to be updating to 380.70_0 and 384.4_2 is for beta testing
  20. Almighty1

    Almighty1 Networkin' Nut Member

    Thanks for confirming. It seems in mines, 0 and eto mac is the same.
    In any case, can you give a idea what numbers are different for eto, 0 and 1 compared to what's on the router's sticker so I can figure out how to fix it, you can leave out the identical parts since there are 6 sets of numbers, are the first 5 the same for both the eto and 0:macaddr? Im just trying to figure out how Netgear did the assignment since I think only the 6th set of numbers is different and how much does it differ from the sticker itself.

    As the issue is that since my router gets it's IP address from the Cable company based on DHCP, there will be a issue if someone else in the area uses the same MAC address on the WAN side. Thanks!
  21. KingP1n

    KingP1n Reformed Router Member

    Updating to the new NG 384 is optional , some folks wait before installing the new firmware. As stated earlier , if u plan on gng back to original FW i wouldn't update at this time
  22. sn2018

    sn2018 Network Newbie Member

    But what about for the people that moved to 384.4 and got the MAC & SN changed without warning?
  23. KingP1n

    KingP1n Reformed Router Member

    At this time, i wld wait for a fix if any and hopefully folks can downgrade without any issues. Not sure how xVortex will find a way to identify the root cause ,
  24. Almighty1

    Almighty1 Networkin' Nut Member

    I don't think there will be a fix since if what was in the nvram was erased, it has to be fixed manually since where else will it get the correct info from as the serial number is easy but the correct MAC address is not.
  25. sn2018

    sn2018 Network Newbie Member

    I think XVortex should clarify why MAC & SN are changed with 384.4.
  26. Almighty1

    Almighty1 Networkin' Nut Member

    The SN according to Makaveli in post #5316 above seems to indicate the SN was already that way even with 380.69_2. The SN is the least of our concerns and can easily be copied from the box or product sticker while the MAC address for the WAN side are more important as it can result in losing Internet connectivity from the ISP. The issue with the MAC address is that what is assigned originally is not a exact match to the MAC specified on the box and product sticker as the last number is different but not sure how much different it really is.
  27. XVortex

    XVortex Addicted to LI Member

    For those who stuck in R7000's firmware please try this solution:
    Do not pay attention to the model, just follow the instructions...
    Stimpy88, Makaveli and slidermike like this.
  28. juched

    juched Serious Server Member

    I had done a CFE backup way back in 2016 when I first installed Tomato and Advanced Tomato (which I ran for 18 months).

    I had tried dd-wrt way back and used factory Netgear firmware for a month and a half around Dec 2017 (lots of issues, mainly with circle and poorly secured VPN).

    I now took a copy of the CFE after going from 380.69 to 380.69_2 to 380.70 to 384.4 and today to 384.4_2.

    I doing a binary diff they are almost identical but not 100%. The changes are in the beginning configuration settings where the ctf_fa_cap=1 was added and a couple other bytes.

    I can confirm that et0macaddr has not changed.

    I believe the netgear firmware updates at one point added the ctf item. But I do not believe XVortex made any changes on my install.

    Not saying other people didn’t see a change. But it didn’t happen for me, so this is likely not across the board an issue.

    I have not tried to revert to stock.


    Sent from my iPhone using Tapatalk
    phalkon30 likes this.
  29. User0815

    User0815 Network Newbie Member

    should work this with windows? my r7000 dont accept its own firmware before 31 state. No downgrade itself. No Upgrade to Merlin.. I think i will give that linux thing a try.

    And i recognized new MAC
  30. juched

    juched Serious Server Member

    You may be able to avoid the special command to enable telnet if this link has the enable telnet checkbox:


    Sent from my iPhone using Tapatalk
  31. David1

    David1 Serious Server Member

    link for latest firmware is not working

    Thanks, Seems to be working again
    Last edited: Mar 27, 2018
  32. David1

    David1 Serious Server Member

    Underneath your router there is your SN and MAC,(which i think is for ur WAN), so if you got problems connecting to your ISP u can just spoof your MAC in the WEB GUI under WAN. It looks like the CFE has set everyones 5Ghz Mac to the same, so if you have 2 R7000's on the same network you could have problems
  33. User0815

    User0815 Network Newbie Member

    another problem on V1.0.9.26_10.2.31 , i cant choose the 5 GhZ Wifi Channels. In Genie App i can edit them to channel 161 . no problem. In the Browser App (ipad, iphone and galaxy S8 cant choose them too) Speed is on V1.0.9.26_10.2.31 superp. At least the Performance is good. Fast transfers over Jdownloader at Max Speed. But i dont want this . because i cant choose the Version for my own, im trapped in this Stock Version.... i need a version like return to ofw like for the newest Firmware.
  34. GDT78

    GDT78 Serious Server Member

    Flashed 384.4_2 from 384.4_0 retaining settings. My stealth on from Tools menu is back to off on both my R7000. My second R7000 configured as media bridge doesn't mount correctly the opt folder. I'm investigating.

    edit: seems like my jffs is not available anymore. I disabled/enabled and formatted through webgui, installed entware again, restored entware backup and rebooted. Now seems to be ok.
    Last edited: Mar 27, 2018
  35. GDT78

    GDT78 Serious Server Member

    It's exactly my case, but It's not clear to me. I didn't flashed customCFE, I'm on stock netgear CFE.
  36. gaselar

    gaselar Network Newbie Member

    So... i purchased a usb ttl cable and trying to tftp ANY firmware my CFE give me this :
    Device eth0: hwaddr 00-70-C2-7A-44-85, ipaddr, mask
    gateway not set, nameserver not set
    Startup canceled
    CFE> ^C
    CFE> ^C
    CFE> tftpd
    Start TFTP server
    Reading :: Done. 31924282 bytes read
    Board ID : ▒
    Image ID : U12H270T00_NETGEAR
    Reading ::"

    Please notice "Board ID : ▒"
    The CFE won't program R7000 even from serial.
    And this is why it will not accept ANY firmware (aka "invalid...") from web interface.

    It is clear that either XWRT for Netgear R7000 v384.4 (NG) or "back to stock" firmware (v1.0.3.80_1.1.38) completely erase board id from CFE.
    Any suggestions how to restore stock Netgear CFE (i could use some backup) and reprogram MAC and serial no are welcome...
    Terijan01 likes this.
  37. SignedAdam

    SignedAdam Serious Server Member

    That doesn’t answer my question, I’m wanting to know if the new firmware is a beta or not
  38. GDT78

    GDT78 Serious Server Member

    No it's not beta, but those firmwares are always a sort of betas.
    Surely there are some issues like duplicate mac addresses, etc. It's your choice, If you're ok with your current setup I suggest you to keep your version, maybe some of those issues will be resolved with newer revision and then you could update with a safer scenario.
  39. XVortex

    XVortex Addicted to LI Member

    burnboardid U12H270T00_NETGEAR
    other commands are:
    burnethermac burnsn burnsku burnpin burnssid burnpass burn5gssid burn5gpass
  40. gaselar

    gaselar Network Newbie Member

    YES ! with "burnboardid U12H270T00_NETGEAR" i manage to flash latest stock R7000-V1.0.9.26_10.2.31.chk !
    I will try to restore others settings.
    The first problem i found is that i can't change wifi region.
    It seems locked to US.
    How can i fix this ?
    Can you give the default burn command settings ?

    Upd, confirmed ! mac address restored ! trying the rest burn commands ...
    Last edited: Mar 27, 2018
  41. Daedelus

    Daedelus Network Guru Member

    With 384.4_2 in addition to serial_no, et0macaddr, 1:macaddr, & 0:macaddr looking not quite correct board_id looks strange as well.

    nvram get board_id

    returns 640 bytes of binary data
  42. Terijan01

    Terijan01 Connected Client Member

    It is 384.4 NG (and 384.4_2 NG) erases board_id. (I tried 384.4 NG).
    I did not changed to stock FW, and from putty (XWRT 380.70 FW) I checked board_id:

    ASUSWRT-Merlin R7000 380.70-0 Sat Mar 17 04:52:31 UTC 2018
    <My username>@R7000:/tmp/home/root# nvram get board_id

    It is possible to set correct board_id:
    <My username>@R7000:/tmp/home/root# nvram set board_id=U12H270T00_NETGEAR
    <My username>@R7000:/tmp/home/root# nvram get board_id
    <My username>@R7000:/tmp/home/root# nvram commit
    <My username>@R7000:/tmp/home/root#

    SN is erased as well:
    <My username>@R7000:/tmp/home/root# nvram get serial_no
    <My username>@R7000:/tmp/home/root#
  43. gaselar

    gaselar Network Newbie Member

    Yes, they are erased but using a usb-ttl cable it is easy to restore.
    Only problem (as of now) is wifi region is locked to US and Wifi Tx power settings (from stock Fw) are not there.
    (probably because region is locked to US)
    How can i set EU region ? (wifi region as well ?).
  44. Terijan01

    Terijan01 Connected Client Member

    Wifi regions. To set settings I use putty /ssh.
    *SSH do not works from stock FW*.
    Don't have usb-ttl cable, but maybe I will get one later.
    I hope this might help you (check attachment).

    Attached Files:

  45. User0815

    User0815 Network Newbie Member

    you can try to get to install china trx , there is possible to change Region under the Power settings.
  46. juched

    juched Serious Server Member

    My 1:macaddr is also the same. I don’t know when it changed, as I didn’t look at this earlier.

    My 0:macaddr and et0addr are not the same as yours but at equal to each other.

    Would this be saved in a restore file? I have plenty of those so maybe I can see when it changed.

    Edit: Hex editor doesn’t show anything readable in cfg files.

    Sent from my iPhone using Tapatalk
    Last edited: Mar 27, 2018
  47. GDT78

    GDT78 Serious Server Member

    Let me understand... So my serial, mac address, etc were deleted from nvram? Those informations are only there or they are in CFE too? Note that, as I previously said, I didn't changed CFE with the custom one.
    I got a nvram backup (taken by nvram-save script) for my main R7000, I search inside and I found the settings were lost so I can restore them with nvram set command.
    Unfortunately, I don't have the same nvram backup for the second R7000 (the media bridge one). I only have the original box with serial. How can I recover the lost settings?
    In the case that those settings are stored in CFE too, I need a TTL cable to fix this?
  48. Ubimoo

    Ubimoo Reformed Router Member

    What are the guys above me talking about?
    deleted board id? same mac adress? Can someone explain to me what's happening like I'm 12?
    I'm on 384.4_2 and did a factory reset.
    Is this a big problem?
  49. Terijan01

    Terijan01 Connected Client Member

    No, it is not a problem. As long as you stay on XWRT FW.
    !!! Do not change to stock FW/ DD-WRT/ Tomato etc. !!!

    Settings are stored in nvram:
    LAN MAC address: et0macaddr
    Wifi 2.4GHz MAC address: 0:macaddr
    Wifi 5GHz MAC address: 1:macaddr
    Board ID: board_id
    Serial No: serial_no
    Username: <Your_username>
    Password: <Your_password>
    CPU frequency: 1000 MHz (default) (on Netgear R7000)
    RAM frequency: 800 MHz (default) (on Netgear R7000)
    Wifi region.

    In CFE (bootloader) settings are stored different than nvram. I would advice not modify / change CFE.
    Last edited: Mar 27, 2018
    Ubimoo likes this.
  50. slidermike

    slidermike Addicted to LI Member

    Not to sound like I am splitting hairs but your talking about the CFE, not CEF.
    The CFE is the hard-coded router specs like mac's/SN/Board ID.
    CEF is a way of speeding up routing. It is short for Cisco Express Forwarding.
    dd-wrt uses its own hybrid called SFE.
    Basically your bypassing the stack to speed up packet processing.
    The first packet is processed the usual way and the all follow up packets in that stream are express passed the stack.
    Its also been referred to as fast nat.
  51. Terijan01

    Terijan01 Connected Client Member

    Yes, It is CFE. I stand corrected, thanks :)
  52. cybrnook

    cybrnook Addicted to LI Member

    In actuality, when you make a backup of your CFE, it's a generic CFE. I would bet that if you compared the values of your backed up CFE with the values of another users backed up CFE , they would look the same. So yes, those values are from nvram. Too little too late I'm sure, but it's always good practice to backup not only your CFE, but to also dump your nvram variables (for things like this).

    At least on the Linksys it was this way

    For some of those values, you can likely just get them from the bottom of your router (Mac and serial).
    Last edited: Mar 27, 2018
    slidermike likes this.
  53. emer1

    emer1 Networkin' Nut Member

    I understand, that it's slowly known why we fell in "back to stock" ...
    After the factory reset, I have a strange (not the routers oryginal) MAC router address every time ... (00:33:xxxxxxxxx)
    Can there be a chance to rescue the R7000 without USB-TTL?
  54. juched

    juched Serious Server Member

    It was my understanding that MAC address was driven by the CFE and that the various numbers are added to the base CFE value to generate the other two.

    Everyone should have their own unique MAC inside their own CFE. Which is why xvortex custom CFE you need to hex edit with your MAC.

    Perhaps the Merlin software has a hard coded value when it cannot read from the CFE?

    I verified that my base MAC in my CFE has not changed. So it must be in the code.

    Now the board_id I do not understand why that changed.

    Sent from my iPhone using Tapatalk
    slidermike likes this.
  55. cybrnook

    cybrnook Addicted to LI Member

    No, the base is not the CFE (The CFE if the bootloader). The base is your et0macaddr (nvram) which then calculates an offset for 0:macaddr and 1:macaddr.

    But, with Asus new code, and much of it is back box closed source, who knows what they are doing. The "traditional" patterns may not hold true anymore.
  56. juched

    juched Serious Server Member

    Eth0macaddr is specified inside my CFE.

    XVortex in his custom CFE steps mentions to hex edit your starting address.

    Sent from my iPhone using Tapatalk
  57. juched

    juched Serious Server Member

    Here are the steps for customizing your CFE with your MAC.

    Sent from my iPhone using Tapatalk
  58. cybrnook

    cybrnook Addicted to LI Member

    Correct, as are other values for the system. But once you get your custom CFE for example, the values are loaded once. From your initial flash. If you change the value after that, I have not seen them come back without having to reload. Perhaps the steps that are being used are not complete when backing up.

    This lists two steps:

    Extracting default values
    Telnet/ssh to your router running your favorite firmware and type the following

    dd if=/dev/mtdblock/0 bs=1 skip=4116 count=2048 | strings > /tmp/cfe.txt
    dd if=/dev/mtdblock/0 of=/tmp/cfe.bin

    Either way, you can always manually nvram set your values back, and reboot.
  59. cybrnook

    cybrnook Addicted to LI Member

    Trust me, im fully aware of this fork and all the little steps posted around.
    Makaveli likes this.
  60. juched

    juched Serious Server Member

    I believe you. I was just sharing what I saw to understand.

    If I understand correctly what you are saying, when a firmware is loaded it uses the CFE for the MAC and then puts it into NVRAM and uses it from that point in there?

    If that is the case then changing the CFE would not change your MAC, but it doesn’t explain why my (and others) are not seeing the correct eth0addr value in nvram and why all are using the same 1:macaddr.

    Perhaps the algorithm described for custom CFE isn’t correct anymore? Or the asus merlin code for reading the CFE during flash isn’t working with netgear CFE and uses a default value?

    I am not planning to change my Mac addresses currently. I am working fine on 384.4_2 with the MAC addresses it currently has. Just trying to figure out why these are wrong to hopefully address this for others.

    Sent from my iPhone using Tapatalk
  61. cybrnook

    cybrnook Addicted to LI Member

    I understand there is a CFE upgrade that's happening in the step to ng. I would look closer at what's happening in that intermediate upgrade firmware you need before hopping to the 384 build. Voodoo :)

    So from that point, I have seen that for years the 2.4 radio using the same Mac as your primary et0macaddr. That really isn't strange, and to me is more there normal behavior.

    There were many guidelines thrown out on with how the Mac values are being calculated. +2, ,+3 , +4 Netgear vs Linksys vs Asus. None of them to me ever really seemed to be consistent. I even used to see with users where the 2.4 or 5.0 radio either wouldn't work when this happened or we got the received packet on same interface type message on the log.

    I got tired of dealing with it, but what we normally would do is when this happened we would manually change the values. I'm not sure if you still have the ability to do that with this build, or if the values are now protected by an encrypted bootloader. But if you can ssh in, try setting by hand your three main values.

    nvram set et0macaddr= Mac on bottom of router
    nvram set 0:macaddr= Mac +1
    nvram set 1:macaddr= Mac +2
    nvram commit

    I'm not even sure if those are even the right values, Asus could be using different vars now. But the idea should be the same.

    Either way, that's my two cents. Maybe the maintainer will drop some comments.
    Last edited: Mar 28, 2018
    Vlolwut likes this.
  62. User0815

    User0815 Network Newbie Member


    BusyBox v1.7.2 (2018-01-22 22:59:25 CST) built-in shell (ash)
    Enter 'help' for a list of built-in commands.


    This should be a good sign. How can i recover my router now?
  63. User0815

    User0815 Network Newbie Member


    What happened here???

    nvram get board id
  64. Almighty1

    Almighty1 Networkin' Nut Member

    That is where the problem is.... there are 3 MAC addresses used on the router.
    1) The one from the sticker and the box which you mentioned
    2) The WAN side
    3) The LAN side

    #2 and #3 are not the same as #1 as it is based on it but I think the last set of codes is different and I am trying to figure out how they generate the numbers for #2 and #3 from #1 so it doesn't take someone else's WAN IP.

    I mean for me, it's not hard as all I have to do is order another R7000 to see how it's done but just the hassle of doing it.
  65. User0815

    User0815 Network Newbie Member

    YES :
    R7000_380.61_1.chk worked.... i will write a tutorial for recovery soon

    Warning! The firmware version you are trying to upload is older than the one you had.
    Do you still want to continue?

    Current Firmware Version V1.0.9.26_10.2.31
    Uploaded Version V1.0.4.18_208.0.0
    KingP1n likes this.
  66. User0815

    User0815 Network Newbie Member

    Tutorial for recovery from Netgear Stock R7000 to reset ofw or another down upgrade. Brick will be repaired and you will be able to recover it via Webinterface

    NO USB TTL OR FTDI NEEDED. Only if the R7000 will not start you need to bridge the gnd and rx PINS to let the router restart. strange behavior but i hope that is over after reflash merlin.


    Get in router debug mode must choose first dev instead prod click.... restart

    routerlogin net debug.htm

    First get Telnetenable2. zip <---- google for it
    Get Putty. exe
    extract into folder and open CMD window as admin.

    These are my Steps for succesful recovery

    cd "C:\Users\ User0815\ Downloads\ telnetenable2\te2"

    C:\ Users\ User0815\ Downloads\ telnetenable2\te2>

    telnetenable2.exe CEC6NVD37F9D admin password (CEC6NVD37F9D is your mac without : )

    creating pkt...
    sending pkt...

    restart and enter your fresh telnet enabled Putty interface

    open Putty telnet port 23 Ip:

    This or something like this Text should be arrive in Putty then:

    BusyBox v1.7.2 (2018-01-22 22:59:25 CST) built-in shell (ash)
    Enter 'help' for a list of built-in commands.

    enter these Commands in opened Putty Telnet:

    nvram get_board_id (check id)
    burnboardid U12H270T00 NETGEAR (repair damaged Boardid to be able flash firmware again)

    This should be display there : (I entered this command 6 times or so, worked;)
    Board ID - U12H270T00_NETGEAR
    BurnBoardId OK

    enter the last Putty command
    nvram erase && reboot

    the R7000 will reboot. Telnet is closed but firmware flash enabled in web interface. No you can flash Merlin firmware.

    maybe i could help a few people with that. no usb ttl needed. MAC SN i need to investigate further.

    Good luck! :)
    Last edited: Mar 28, 2018
  67. User0815

    User0815 Network Newbie Member

    [​IMG] if someone wants to add cool features like region change on the fly to AUS/CN/US/CAN/ like that in Web interface from Merlin try that R7000_380.69_2-X7.8-ks.trx

    Thats the Chinese Merlin, a lot better as normal Merlin. English and Chinese Interface
    i cant add links here. but you need to enter koolshare forum.
    Last edited: Mar 28, 2018
    KingP1n likes this.
  68. Almighty1

    Almighty1 Networkin' Nut Member

    Yep, that worked for me.

    This was what I did which includes fixing the serial # and the board_id so going back to stock firmware + upgrading works:

    nvram set et0macaddr=from box but used : between 6 sets of numbers
    nvram set 0:macaddr=above + 1
    nvram set 1:macaddr=above + 2
    nvram set serial_no=serial# from box
    nvram set board_id=U12H270T00_NETGEAR
    nvram commit

    As far as how the 0 and 1 is calculated, wouldn't it be easily determined if someone who is still running a pre-384 build to just see what the last two digits are for each of the 3 madaddr's is and also at the same time, are the letters actually lower case or is it upper case for the macaddr's as well as the serial as far as how it came from the factory.
    Last edited: Mar 28, 2018
  69. wallyg8r

    wallyg8r Reformed Router Member

    With the USB-ttl cable where do you enter the "burnboardid U12H270T00_NETGEAR" command? At the CFE> prompt? And does this restore the board_id permanently? Thanks in advance.
  70. thasvinxd

    thasvinxd New Member Member

    stock firmware sucks and this NG firmware rules everything single performance in r7000! @XVortex Keep up the good job! Because of you this r7000 is still alive! Those who prefer to downgrade ,don't upgrade to NG firmare, stay in 380.69.
  71. gaselar

    gaselar Network Newbie Member

    No CFE ! it seems CFE remain intact.
    Let the router complete boot, pressing "enter" will bring Busybox prompt (#)
    You can enter command there.
    And yes the change is permanent.
    If someone can send (or attach) a "nvram show" output it would help setting the correct wifi parameters for a European R7000 (region EU).
    Either way i will try solution mentioned above and post results.
    wallyg8r likes this.
  72. gaselar

    gaselar Network Newbie Member

    Unfortunately script does not affect wifi region.
    Seems locked to US.
    I can't even change "Transmit Power Control".
    It shows 50% or 25% etc but output wifi power seems always maximum.
    (this was the reason i decided to use "back to stock" fw)
    Any suggestions are welcome...

    Well it seems although the mentioned script seems to be needed anyway the command that fixed wifi problems was burnsku.
    Remaining from NG or "back to stock" fw burnsku had a value of 0x0670 which had no reference everywhere i searched and it aparently locked my wifi-router region to US and TX power to maximum.
    So using burnsku 0x0002 initialize my R7000 at a WW (world wide) region so i was now able to select EU region.
    Even the power regulator (TX) seems to working as i check it with my mobile phone wifi signal meter.
    Further test are to be done but at this point my R7000 seems at last completely "back to stock" condition.
    Last edited: Mar 28, 2018
  73. GDT78

    GDT78 Serious Server Member

    @cybrnook :
    I searched in my previous working (from 380.69_2) dump of nvram obtained with nvram-save script and I'm in this scenario:


    Should I restore my settings following this backup or should I use the guidelines posted by you?

    I finally used your guidelines because I got a lot of "kernel: br0: received packet on eth2 with own address as source address" error in media bridge router with previous backup macaddresses.

    So I entered (xx values substitute my real MAC address):
    (main router)
    nvram set et0macaddr=xx:xx:xx:xx:xx:73
    nvram set 0:macaddr=xx:xx:xx:xx:xx:74
    nvram set 1:macaddr=xx:xx:xx:xx:xx:75

    (media brigde)
    nvram set et0macaddr=xx:xx:xx:xx:xx:85
    nvram set 0:macaddr=xx:xx:xx:xx:xx:86
    nvram set 1:macaddr=xx:xx:xx:xx:xx:87

    But if I do a nvram get command I obtain these:
    (main router)
    admin@R7000:/tmp/home/root# nvram get et0macaddr
    admin@R7000:/tmp/home/root# nvram get 0:macaddr
    admin@R7000:/tmp/home/root# nvram get 1:macaddr

    (media bridge)
    admin@R7000-2:/tmp/home/root# nvram get et0macaddr
    admin@R7000-2:/tmp/home/root# nvram get 0:macaddr
    admin@R7000-2:/tmp/home/root# nvram get 1:macaddr

    And I expected :74 and :86 value for 0:macaddr...
    Is this normal?
    Last edited: Mar 28, 2018
  74. SignedAdam

    SignedAdam Serious Server Member

    Could I please have some official word on the following questions to help my self and others work out what exactly we are meant to be updating to, and what we are not,

    Is the NG Branch pre beta, (alpha) 384.4_2

    Is 380.70_0 beta ?

    If 380.70_0 isn’t beta, are users running 380.69.2 meant to be upgrading to it ?

    If users are wanting to upgrade to NG Branch do they need to have flashed a custom boot loader (also known as CFE) ?

    If users wish to upgrade to NG branch, have I got it right in thinking users can’t jump from 380.69.2, to 384.4_2, they have to upgrade to 380.70_0 then 384.4_2 ?
  75. GDT78

    GDT78 Serious Server Member

    maybe a small bug with 384.4_2, stealth option keeps resetting to on after reboot. I don't remember this on 384.4_0.
  76. gaselar

    gaselar Network Newbie Member

    Can someone using 384.4_2 verify that wifi power (TX) slider is working properly ?
    It didn't is the first 384.4. (wifi power always maximum regardless setting power percentage)
  77. XVortex

    XVortex Addicted to LI Member

    NG Branch v384.4_2 is release (+ bugfixes). and it is pretty stable now.
    380.70_0 is actually alpha1 and supposed only for upgrade to NG branch (due to flash layout changes). When it goes to release it will compiled for EA6900 and WS880 as well.

    To upgrade to NG, you do not need to update the CFE. But if you are planning to stay with XWRT, I still recommend to flash the custom boot because of more XWRT compatibility and the ease of recovery. (but anyway if you are going to return to the stock you MUST be on the stock CFE before flashing the stock firmware).
  78. GDT78

    GDT78 Serious Server Member

    Can I dump my stock CFE for eventually restore it? How?
  79. SignedAdam

    SignedAdam Serious Server Member

    Thanks you for the fast reply @XVortex
    Maybe more users like my self will understand better what’s going on, looks very problematic at the moment
    I have a custom CFE
  80. slidermike

    slidermike Addicted to LI Member

  81. GDT78

    GDT78 Serious Server Member

    I alredy found it but don't have /dev/mtd/0, i have
    mtd0 mtd1 mtd2 mtd3 mtd4 mtd5 mtd6 mtdblock0 mtdblock2 mtdblock4 mtdblock6 mtd0ro mtd1ro mtd2ro mtd3ro mtd4ro mtd5ro mtd6ro mtdblock1 mtdblock3 mtdblock5

    which one?
  82. slidermike

    slidermike Addicted to LI Member

    Stimpy88 likes this.
  83. wallyg8r

    wallyg8r Reformed Router Member

    in putty:
    dd if=/dev/mtd0 of=stock-cfe.bin

    Then use winscp to copy it to your hard drive.
  84. GDT78

    GDT78 Serious Server Member

    If I flash custom CFE do I need to reset all my settings again?
  85. wallyg8r

    wallyg8r Reformed Router Member

    You should read through post #57 for flashing custom CFE. But to answer your question you will need to reboot and reset to factory defaults.
  86. User0815

    User0815 Network Newbie Member

    The standard setting for the driver can be attained by setting the transmit power for both radios like this:
    wl -i eth2 txpwr1 -1
    wl -i eth3 txpwr1 -1
    Checking the power then looks like this:
    < wl -i eth2 txpwr1
    > TxPower is 127 qdbm, 31.75 dbm, 1496 mW Override is Off

    < wl -i eth3 txpwr1
    > TxPower is 127 qdbm, 31.75 dbm, 1496 mW Override is Off
  87. KingP1n

    KingP1n Reformed Router Member

    So is there a way to verify if Custom CFE went thru? My CFE bootloader now shows however when i flashed it i never saw a 'done' message and only took less than 10 seconds. I ran the flash a few times to see if wld get a completed or done message . I resetted router and it does show vs also how can i enable ssh in 384?

    Update: found ssh under admin-->system-->service
    Last edited: Mar 29, 2018
  88. juanjekla

    juanjekla Reformed Router Member

    I have noticed that the QOS system does not work correctly in 384.4_2. can be? or I'm wrong?
  89. User0815

    User0815 Network Newbie Member

    How did you update the cfe exactly? Which one you choose
  90. SirSwede

    SirSwede New Member Member

    What does "NTFS Sparse Files Support" mean?

    And do I want it Enabled or Disabled if I use my disks primarily for mkv and mp4 files?

    Thanks in advance! :)
  91. cybrnook

    cybrnook Addicted to LI Member

    Makaveli and slidermike like this.
  92. SirSwede

    SirSwede New Member Member

    "Bro"; there is no info whether it is advantageous for the specific file types I asked about or not.

    I am none the wiser. Maybe - with the attitude here - I should apologize, and in the future refrain from, asking questions.

    I am very sorry for taking up your time. :(
  93. slidermike

    slidermike Addicted to LI Member

    this thread is meant to deal with the specifics of the fork of rMerlins Asus firmware.
    You can find and figure out about NTFS by using any of the many search engines.
    There are many folks in the community who are happy to help but there is an expectation that prior to asking questions that the asker did. #1 Search the thread for the question being asked/answered previously. #2 Made a reasonable effort by searching the web on their own.

    Based on the question you posted, you cant have possibly have done a search and any reasonable amount of reading on your own.
    Thus cybrnooks "bro"

    Please don't get mad at the community responses to questions that haven't been researched or shouldn't have been asked in the first place.
    Were all here to help each other but don't expect to be spoon fed.
    Makaveli and Guso. like this.
  94. SirSwede

    SirSwede New Member Member

    I did number 2 and I did not understand it, whereafter I came here and asked, just because I did not understand the information. I did a lot of reading and still did not understand if it is advantageous or disadvantageous for the router firmware to use it for my files or not. Please try and not jump to conclusions.

    I have no expectations in the world "to be spoon fed"; again I feel that you are jumping to conclusions about me. Again: I googled and I read, but did not understand the information provided. I am sorry if that makes you mad.
  95. KingP1n

    KingP1n Reformed Router Member

    I used the instructions in post 57 pg.1 and useful info in pg7. I used winscp to put the files in the proper location and made sure i coud execute the files. I run the ./mrt command 1st and the flash cfe.bin second. Once i hit that am i supposed to see a 'Done' message?
  96. slidermike

    slidermike Addicted to LI Member

    I flashed my cfe once years ago on the r7000 because I wanted to hardcode the cpu/memory speed after one of the 3rd party firmwares removed the ability to change those speeds along with adjust the mac addresses.
    I don't recall having seen a message indicating it was done.
    I do seem to think it was a short process and simple. Simple for the flashing/updating. It wouldn't have been simple if I had messed the cfe up in the hexeditor. :)
  97. Ballgirl

    Ballgirl New Member Member

    Can anyone help me? I restored the NG version 384.4_2 to stock Netgear using Vortex file in post 1 (R7000-V1.0.9.26_10.2.31) Now I'm stuck on stock and getting error when I try any firmware:

    This firmware file is incorrect! Please get the firmware file again and make sure it is the correct firmware for this product.

    Any suggestions to resolve?
  98. wallyg8r

    wallyg8r Reformed Router Member

    See post #5366 above.
    slidermike likes this.
  99. Ballgirl

    Ballgirl New Member Member

    I've tried doing that, but step 3 says restart. What do I restart? router?
    Putty doesnt connect so I'm going wrong somewhere.
  100. Almighty1

    Almighty1 Networkin' Nut Member

    I just checked mines and I noticed something more interesting:
    nvram get et0macaddr
    nvram get 0:macaddr
    nvram get 1:macaddr

    so in my case, it didn't set the 0 and 1 to what I specified but instead:
    0 = et0macaddr+2
    1 = et0macaddr

    Now I have a question:

    Is LAN_MAC_Address the same as what's on the sticker/box or is it + a certain #? If the later, what is the certain #?

    And just out of curiousity, where is the WAN MAC Address stored?
  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.
    Dismiss Notice