How to Debrick or Recover NETGEAR R7000, R6300v2, or R6250 Wi-Fi Routers

 

In case you have bricked your unit, or in case you need more debugging info from your router you can setup a serial console.

Prerequisites for this procedure:

  • 1 x Router either R7000/R6300v2/R6250 which have the same serial connection pins on board
  • 1 x Ethernet cable if you want to flash a new firmware in recovery mode
  • 1 x USB-TTL 3.3 V adapter cable e.g. FTDI TTL-232R-3V3
  • 1 x appropriate Screewdrivers
  • Windows or Linux with installed TFTP client
  • Windows or Linux with installed serial client e.g. Putty,Minicom

This article does not cover taking apart the routers, this is fairly easy and should not cause any trouble even for beginners. The guide applies to the R7000, R6300v2 and R6250 from NETGEAR, although pictures from the R7000 are shown.

After you open up the case you can start connecting your USB-TTL Adapter. The picture below displays the pins and how you connect them to the serial adapter. In my case, I added a 3.5" stereo jack for easier connecting. This way it can be connected without the need to open it up again. Make sure you read the documentation of your serial adapter; it will tell you which pin needs to be connected to GND/TX/RX.

Once you hook up the serial adapter you can install and setup your serial communication program.. If you are using PuTTY, you can just use the guide from the older debricking guide for the WNR3500L:

http://myopenrouter.com/article/how-debrick-your-wnr3500lv2-using-window...

If you are on Linux, you might want to use minicom. See minicom guide:

http://mstempin.free.fr/linux-ipaq/html/minicom-setup.html

Serial line: /dev/ttyUSB0

Speed: 115200

Stopbits: 8-N-1

Once your serial communication program is set up, start hooking up your TTL adapter. In order to flash a new firmware to the router you need to attach an ethernet cable to one of the switch ports. See picture below.

The default IP of you router is 192.168.1.1, thus you need to setup your computer's ethernet adapter to use an IP in the same network e.g. 192.168.1.2. If you have attached your ethernet cable and setup your computers IP you are now ready to power on your router.

You should see the following messages when you router starts booting:

 

Once you see these messages start pressing CTRL-C. If everything works out the boot process should stop at the CFE> prompt. Now type tftpd followed by enter. The routers power led will be flashing which signals it is ready for a fw upload via tftp client.

If you are on Windows, just follow this guide to flash a new image via tftp client:
http://myopenrouter.com/article/how-debrick-your-netgear-wnr3500l-using-...

 

On Linux you can use the following command:

tftp -m binary 192.168.1.1 -c put

e.g.:

tftp -m binary 192.168.1.1 -c put dd-wrt.K3_R7000.chk

After the new firmware is transferred, the router will start flashing and rebooting the unit automatically. You will be able to follow the whole boot process in your serial communication program.

Tags: 

neighbor
neighbor's picture
After buying a different

After buying a different cable I can confirm that was the reason for my distorted bootlog, i believe.  I do suggest not buying a cheap cable. Also, make sure it is FTDI TTL-232R-3V3, and not FTDI TTL-232RL-3V3

WiKing
WiKing's picture
I successfully managed to

I successfully managed to reinstall the firmware and remove the settings ("nvram erase").

Useful tips I wish I had found online:

  • You must connect both RX to both TX (sends from once device, receives on the other, seems logical).
  • With the GROUND (GND) cable connected to the USB-TTL adapter the router wasn't booting, all the leds were on. Without the GNG I would get gibberish show up in Putty. The solution was to boot without GND and to connect GND immediately after the lights went off. The gibberish turned into normal text and I managed to enter CTL+C to interrupt the boot process and launch "tfpd".
  • Uploading a new firmware using TFP2 on Windows didn't work. I installed Windows' native ftp client and this worked, don't forget to use the '-i' flag to send as binary.
  • I used Silabs' "6Pin USB 2.0 to UART TTL Serial Converter CP2102", you can find it on ebay and it's quite cheap.

Good luck!

WiKing
WiKing's picture
I meant "GND", not "GNG"

I meant "GND", not "GNG"

phireak
phireak's picture
Wow your tips is working on

Wow your tips is working on my Netgear EX6200

Thanks.

Schoelje
Schoelje's picture
I succesfully finished this

I succesfully finished this tutorial for my bricked R7000 only to find that I can only boot the router with the USB-TTL cable attached and connected to my PC. I've tried dd-wrt, tomato and even netgear's firmware.

With the cable detached the power led stays red (not flashing) and never proceeds.

When booting with the cable attached I saw that the WAN Modem device was set to /dev/ttyUSB0 which seemed odd. However, I cannot change this value.

Has anybody seen this before?

Juanjekla
Juanjekla's picture
Hi guys! I'm stuck with my
Hi guys! I'm stuck with my R7000 and it turns out that when I'm in the CFE and I try to access TFTPD, he says:

CFE> tftpd
Invalid command: "tftpd"
Available commands: nvram, reboot, flash, batch, go, boot, load, save, ping, arp, ifconfig, show, help

*** command status = -1

and all this I do because it does not let me update medienate web because it tells me that the firmware file is invalid. I ran before: Xwrt Vortex.
chri
chri's picture
Hi,

Hi,

i have bricked my R7000. It seems to be alive (some short ping responses soon after power up), but i do not get any output on the serial port. In addition it behaves like WiKing's in regards to the "GND". I also tried the tftp method suggested by Netgear without an succsess.

Hope some out here might have any  additional input?

chri
chri's picture
Hi,
Hi,
 
I recently bricked my good old R7000 while flashing from merlin via factory to shibby. In addition to the "GND" behaviour of WiKing I also get no output on the serial console. I still hope my router is recoverable, as it respons to pings for serveral seconds during the boot. Sadly the Netgear tftp re-flash does not work either. So I figured someone might have another trick up his sleeves how to force tftp without a serial console or what knows else I could do?
chri
chri's picture
Hi,
Hi,
 
I recently bricked my good old R7000 while flashing from merlin via factory to shibby. In addition to the "GND" behaviour of WiKing I also get no output on the serial console. I still hope my router is recoverable, as it respons to pings for serveral seconds during the boot. Sadly the Netgear tftp re-flash does not work either. So I figured someone might have another trick up his sleeves how to force tftp without a serial console or what knows else I could do?
Ackman999
Ackman999's picture
I have R7000P that I am

I have R7000P that I am trying to fix using minicom for OSX. I am not sure which pins to connect my USB serial cable to. I have done some extensive searches to no avail. There are 4 pins on the board, similar to the R7000, but I am getting no response when I follow the above instructions. I have tried swapping the TX RX wires and that doesn't work either. 

Ackman999
Ackman999's picture
So, I got the pin config

So, I got the pin config sorted out, and am able to get to the CFE prompt. Now when I run tftpd, it tries to start the server, but never finishes.

ciscojunkie
ciscojunkie's picture
Try this... worked for me:

Try this... worked for me:

https://forum.dd-wrt.com/phpBB2/viewtopic.php?p=1135950&sid=fbef6f2fa9c1...

This is not correct for this R7000P, which tested out as 

[RxD] [TxD] [GND] [3.3] 

as viewed from the front of the router

ciscojunkie
ciscojunkie's picture
I was trying to debirck my

I was trying to debirck my R7000P and couln't get any output from the console. Finally found this article that explains that the pinout on the R7000P connecter is backwards from the R7000 (viewed from the front):

https://forum.dd-wrt.com/phpBB2/viewtopic.php?p=1135950&sid=fbef6f2fa9c1...

This is not correct for this R7000P, which tested out as 

[RxD] [TxD] [GND] [3.3] 

as viewed from the front of the router

craiga62
craiga62's picture
I have a problem I wanted to

I have a problem I wanted to know if anyone else has had. I bricked my R700P after DL DD_WRT. I was do a flash when my power was interrupted. Instant brick. NOW It is running in a boot loop. Is it worth fooling with? I just got a Serial Cbale for a Raspberry Pi & have been messing with it all afternoon with no success at all. Any suggestions or words of wisdom ????

 

Thx

phireak
phireak's picture
Netgear EX6200

Netgear EX6200

Pin 2 = GND
Pin 3 = RXD
Pin 4 = TXD

I successfully reinstall the official firmware after bricked with DD-WRT firmware

*After follow this tutural and follow WiKing tips https://www.myopenrouter.com/comment/41385#comment-41385

My ROUTER IP is assign to 192.168.1.250, not 192.168.1.1

#PuTTY log#

Device eth0:  hwaddr 6C-B0-CE-00-00-00, ipaddr 192.168.1.250, mask 255.255.255.0
        gateway not set, nameserver not set
Startup canceled
CFE> tftpd
Start TFTP server
Reading ::

#WINDOWS CMD#
C:\>tftp -i 192.168.1.250 put EX6200-V1.0.3.90_1.1.125.chk
Transfer successful: 7036986 bytes in 13 second(s), 541306 bytes/s

DONE!!

Thanks ALL

Kurtman68
Kurtman68's picture
R7000  AC1900 Netgear

R7000  AC1900 Netgear Nighthawk -Bricked

Upgraded fw to latest from Netgear site. Changed Router to use as a WAP on an existing Wifi Network. This worked for a few days. Then I tried to change the network that the router should access (different SSID). At some point, I had to do a factory reset (hold reset for many seconds until power light flashes). While this did work in the past, this last time, the router never recovered. When I power it on, the lights go through what appears to be a boot sequence then settle with a steady orange power LED and a flashing activity LED on the ethernet port that my PC is connected to.

On the PC i cannot obtain an IP address from the router (DHCP) if i set a manual IP address of 192.168.1.106 then i show no connectivity but in windows network connections, the ethernet connection does show (know) that it is a "NETGEAR09" so it seems like the connection is getting some limited information from the router.

I have connected to the onboard serial pins of the router mainboard according to this article. I can establish some limited communication to the serial port. THE PROBLEM IS THIS: I only see garbage characters in the terminal window. Here is a portion of the Putty Terminal window :

5▒▒Y=▒w59▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒Y_^뺺▒5▒!3▒▒▒YW}▒9!##5957▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒[▒Q▒4▒▒▒W-%5▒7=5▒-%5▒▒Y#▒e=▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒=%55▒U5▒753='▒▒빹▒▒%=-#▒▒▒▒▒Y5▒c!'▒_!5▒▒R▒▒▒{▒▒▒▒▒▒▒E▒m#--='-5▒9!##▒=;'5▒▒▒▒▒▒5#▒▒K▒T
▒/=▒#=%5▒3!#7▒▒K▒T                                           ▒Z▒
▒/=▒#=%5▒3!#7▒▒K▒T▒Z▒;9!▒)!▒▒#!▒%!7'5▒;
▒/=▒#=%5▒3!#7▒▒M▒)▒▒9%7▒▒▒▒▒c!▒9/▒75-95▒▒'▒▒#!▒▒-#▒▒▒59▒▒^▒S▒-#1▒75-95▒#!75▒▒▒▒[▒T▒▒mw_▒5#1-#5▒▒▒▒▒▒▒j▒▒▒'5▒=15#▒!▒5▒-1#=▒3-'5▒▒%▒#7▒▒▒▒▒▒▒I%=-#▒▒▒▒▒E▒▒)=Y=▒▒▒9955757▒▒I%=-#▒▒▒▒▒E▒▒Y-1#=▒5▒%=+!▒▒▒▒▒%-#!▒▒▒▒▒▒▒I%=-#▒▒▒▒▒E▒▒u#=;'5▒m_Y▒▒▒I%-#▒▒▒▒▒E▒▒m_Y▒5#=;'5▒▒▒▒▒▒I%=-#▒▒▒▒▒E▒▒m_Y▒▒▒▒▒▒▒▒▒RIOK▒-▒▒▒+-▒)=Y/w!#▒▒▒▒m#5Uw▒▒▒▒▒▒[▒T▒▒3!▒%!7'5▒▒%▒#7▒7A7;3▒)!▒-/▒=%▒▒▒75A=#▒5/▒▒▒▒▒▒U▒R▒▒A%!7▒▒▒▒▒U▒R▒▒7;A!7▒▒▒▒▒U▒R▒▒k▒▒A%!7▒▒▒▒▒▒SR▒5▒75-95▒#!75▒▒▒▒▒▒▒▒▒5!▒

-continuing....

No amount of ^c ^c ^c will stop this. I CANNOT access the CFE command. I can not read any legible words in the window. 

I have tried a Win10 PC, Win 7 PC, and 2 different "known working" USB to serial adapters. One for sure is FTDI.

Trying to "put" the Netgear firmware .CHK file onto the router via command promtp and tftp command, I just get "connect request failed".

I suspect that even my CFE file is corrupted. Where do i obtain the CFE file and how is it installed?

Any other advice is apreciated.

Kurtman.

 

Kurtman68
Kurtman68's picture
R7000  AC1900 Netgear

R7000  AC1900 Netgear Nighthawk -Bricked

Upgraded fw to latest from Netgear site. Changed Router to use as a WAP on an existing Wifi Network. This worked for a few days. Then I tried to change the network that the router should access (different SSID). At some point, I had to do a factory reset (hold reset for many seconds until power light flashes). While this did work in the past, this last time, the router never recovered. When I power it on, the lights go through what appears to be a boot sequence then settle with a steady orange power LED and a flashing activity LED on the ethernet port that my PC is connected to.

On the PC i cannot obtain an IP address from the router (DHCP) if i set a manual IP address of 192.168.1.106 then i show no connectivity but in windows network connections, the ethernet connection does show (know) that it is a "NETGEAR09" so it seems like the connection is getting some limited information from the router.

I have connected to the onboard serial pins of the router mainboard according to this article. I can establish some limited communication to the serial port. THE PROBLEM IS THIS: I only see garbage characters in the terminal window. Here is a portion of the Putty Terminal window :

5▒▒Y=▒w59▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒Y_^뺺▒5▒!3▒▒▒YW}▒9!##5957▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒[▒Q▒4▒▒▒W-%5▒7=5▒-%5▒▒Y#▒e=▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒=%55▒U5▒753='▒▒빹▒▒%=-#▒▒▒▒▒Y5▒c!'▒_!5▒▒R▒▒▒{▒▒▒▒▒▒▒E▒m#--='-5▒9!##▒=;'5▒▒▒▒▒▒5#▒▒K▒T
▒/=▒#=%5▒3!#7▒▒K▒T                                           ▒Z▒
▒/=▒#=%5▒3!#7▒▒K▒T▒Z▒;9!▒)!▒▒#!▒%!7'5▒;
▒/=▒#=%5▒3!#7▒▒M▒)▒▒9%7▒▒▒▒▒c!▒9/▒75-95▒▒'▒▒#!▒▒-#▒▒▒59▒▒^▒S▒-#1▒75-95▒#!75▒▒▒▒[▒T▒▒mw_▒5#1-#5▒▒▒▒▒▒▒j▒▒▒'5▒=15#▒!▒5▒-1#=▒3-'5▒▒%▒#7▒▒▒▒▒▒▒I%=-#▒▒▒▒▒E▒▒)=Y=▒▒▒9955757▒▒I%=-#▒▒▒▒▒E▒▒Y-1#=▒5▒%=+!▒▒▒▒▒%-#!▒▒▒▒▒▒▒I%=-#▒▒▒▒▒E▒▒u#=;'5▒m_Y▒▒▒I%-#▒▒▒▒▒E▒▒m_Y▒5#=;'5▒▒▒▒▒▒I%=-#▒▒▒▒▒E▒▒m_Y▒▒▒▒▒▒▒▒▒RIOK▒-▒▒▒+-▒)=Y/w!#▒▒▒▒m#5Uw▒▒▒▒▒▒[▒T▒▒3!▒%!7'5▒▒%▒#7▒7A7;3▒)!▒-/▒=%▒▒▒75A=#▒5/▒▒▒▒▒▒U▒R▒▒A%!7▒▒▒▒▒U▒R▒▒7;A!7▒▒▒▒▒U▒R▒▒k▒▒A%!7▒▒▒▒▒▒SR▒5▒75-95▒#!75▒▒▒▒▒▒▒▒▒5!▒

-continuing....

No amount of ^c ^c ^c will stop this. I CANNOT access the CFE command. I can not read any legible words in the window. 

I have tried a Win10 PC, Win 7 PC, and 2 different "known working" USB to serial adapters. One for sure is FTDI.

Trying to "put" the Netgear firmware .CHK file onto the router via command prompt and tftp command, I just get "connect request failed".

I suspect that even my CFE file is corrupted. Where do i obtain the CFE file and how is it installed?

Any other advice is apreciated that will further direct me to "un-brick" this beauty.

Kurtman.

 

Pages