R7000 bricked? Flashed DD-WRT to Tomato - cannot login: user/pw denied

65 posts / 0 new
Last post
hippy's picture
that will work as long as the

that will work as long as the driver is OK and you get the right pins on the R7000

pictures in this thread


Mex's picture
cable came i setup exactly

cable came i setup exactly and tried,
hangs forever at where its trying to pull the dev.
tried all kinds of techniques, read some more on ppl with same issue as mine
next step was jtag,
didn't wanna deal with jtag as usb to ttl took my whole after work time, so i stripped it of the antennas and the antenna sockets.
switching to powerline ethernet.
my backup wndr3800(red) i use as backup will be sufficient for the powerline ethernet setup.
most likely the boot-loader got corrupted, so jtag was most likely the last step, but if it would not have worked(jtag) than all time would be wasted.

hippy's picture
not sure the cable you got

not sure the cable you got was no good?

Should have got one with an FTDI chip


discussion on it here. Did you actually make the terminal connection and see the router boot?

I've done mine 3 times now and can have it done in under 15 minutes so doesn't take long

ArtemR's picture
Hi Guys,

Hi Guys,

I got the same issue with R6300v2, but can't enable the backdoor with method.

Tried to push all buttons WPS, Wi-Fi On/Off and Reset and it can't enable telnet on port 233. But I can use Telnet on port 23 and it requires login and password.

Have you any other ideas how to debrick it?

baikan4ik's picture
Method via telnet helped me.

Method via telnet helped me. Otherwise, 30/30/30 not... Thanks for help!!!

cyberdiver's picture

this worked also on my R6300v2 !

bill1228's picture
Girlpopup said: Hi Shibby,

Girlpopup said: Hi Shibby, Ok, I've tried your last post. Here what I got: --- JUNO:~ mariela$ telnet 233 Trying Connected to rt-c404155bb20c. Escape character is '^]'. /tmp # nvram get http_password /tmp # nvram get http_username $1$ItDUMpXa$NGb89HxhW8hZMKRWs4LNw. /tmp # --- Username is really crazy value, but trying to get password returns nothing. Any idea? I have window on my mac, i could try putty if it really could make any difference. Thanks a lot!

I had this same issue. One thing is Shibby enables login as root in the gui. I took the encripted password and instead of admin used root plus the DD-WRT encripted password. That got me in. Was then able to set the password, etc without any issues. 


Romek's picture
Hey Guys,

Hey Guys,
I just got my new R7000 and wanted to flash it according to the video.
what happened id that the laptop i was using decided to restart himself just around 10 - 15 sec after the initial firmware update.

Right now, i cannot connect to the router via putty according to the guide. the router does not show ip address when i check with ipconfig

Do you guys have any info how i can restore it to the initial state or get it working in order to flash to use tomato?

Many Thanks

eych's picture

I've got a Netgear R7000, flashed it to DD-WRT and then to Tomato which led me to the same problem of not being able to login to the router!

The problem is that, pressing and holding the wifi on/off button does not open the backdoor to the port 223 ! Is there any other solution to get into the device?

Thnx in advance :)

aamjohns's picture


I want to thank Shibby, and the rest of you - I was worried there for a bit.  I did watch the video instructions but I guess I did not realize that going back to the Netgear firmware was a step.  I did this, like many others, from DD-WRT and ran into this problem.  

Shibby's instructions worked, but I didn't quite understand by the way they were written (once at the telnet prompt).

I ended up using the command: nvram show

and then I looked through the list for http_username and http_password.  I copy/pasted each into a text document and then used those to log into the router interface.

When I tried nvram get http_password I just got blank.

Anyway, just sharing that Shibby saved my butt too.

Definitely be sending a donation.  Not just because I am not bricked, but for the hard work that goes into this firmware.



se7six's picture
Thank you for that

Thank you for that information, Shibby. I had that happen to me today and the PuTTY method worked on my first attempt. It saved my R7000 and should again if that were to happen again.

Zaphodbblx's picture
Is this why we should reset

Is this why we should reset to stock/ factory before reflashing?

Jackfrost6022's picture
Hey all,

Hey all,


  Don't know if anyone is still paying attention to this thread but I've found myself somewhat in this predicament. I forgot my password on a Netgear Nighthawk R7000 router after installing Shibby's tomatousb on it. I attempted to reset but apparently that's an endeavor in vain. I then read Shibby's instructions to use the backdoor.


Do this:
1) run router and wait 2-3
2) push and hold wifi on/off button for 25 secs - this will enable a "backdoor" access to the router.
3) use putty and connect via telnet on port 233 and log in to router without password
4) run command: nvram get http_password (login`s value: nvram get http_username)
5) use result as password
6) when you log in to tomato remember to erase nvram
7) do other steps from INSTRUCTIONS file.


However I ran into an issue. I get the router up and booted (step 1) and then hold the wifi button as required (step 2). During this time the button flashes while I hold it and goes off when I finish. I then attempt to login on port 233. Everything hangs. I tried logging in without a user, logging in as root and admin. I just wait indefinitely. Is there something I'm doing wrong? Help Shibby, your my only hope!

Roy2001's picture
I was too excited and lazy

I was too excited and lazy that I flashed R8000 with Kong build to Tomato directly and running into the same issue. Fortunately I found this thread. I debricked the R8000. Thanks Shibby/Kong and everyone in this thread.

Sleepy_Eyez's picture
Hi everyone,

Hi everyone,
You know why I'm here lol..

I have many questions.
I downloaded putty.exe
Before I start what do I use to connect computer to router? USB/Ethernet? If Ethernet, WAN/LAN?

I tried to go from DD-WRT to stock.

Antioch's picture
Do this:1) run router and

Do this:
1) run router and wait 2-3
2) push and hold wifi on/off button for 25 secs - this will enable a "backdoor" access to the router.
3) use putty and connect via telnet on port 233 and log in to router without password
4) run command: nvram get http_password (login`s value: nvram get http_username)
5) use result as password
6) when you log in to tomato remember to erase nvram
7) do other steps from INSTRUCTIONS file.


This might be a dumb question, but what is the wifi on/off button? I only have a on/off button and as far as I can tell from pictures on the router online there never has been anything other than an on/off button for the R7000. I tried holding the On/off button for a really long time and it doesn't seem to do anything, I only ever get connection refused on telnet port 233, no matter how long I hold the button. Also if I do this with the Router on, all that does is turn it off again after releasing the button. I am just retarded? What am I doing wrong here?

Antioch's picture
Nevermind, I got it. In case

Nevermind, I got it. In case anyone else runs into this, I never realized that there are buttons on the end of the LED strip. The WiFi button is closest to the LED strip. 

Squiddley's picture
Thank you so much for this

Thank you so much for this and wonder if anyone can advise me... Like others I rushed in and flashed a Tomato built over DD-WRT today and am now locked out. I have tried the Putty method and obtained the encrypted username & password

Username : $1$MPQQ.4Xs$AFd4hOL5GpgdcXt8.lNg10
Password :  $1$MPQQ.4Xs$QlIYohWICjYaUkIpc1IO./
I have tried many many times, cross checking each time that I have entered the date, but CANNOT login.
Any advice gratefully received... this is killing my sanity !
Squiddley's picture
Problem [simply] resolved ! I

Problem [simply] resolved ! I switched to Chrome and lo & behold, instant access. Can even copy & paste from notepad. All good and thank you agian to all contributors... I really like Tomato over DD-WRT.

Anonikat's picture
Thank You!! shibby :) that

Thank You!! shibby :) that work for my Netgear R6300v2CH heartyes

RomanST's picture
Got a R6300v2 CH from Amazon

Got a R6300v2 CH from Amazon for $37 shipped. I wanted to try those out since they appear abundant as used on Amazon and way cheaper than EA6500 but essentialy the same hardware and they run cooler (70C vs 95C... much better ventilation holes)!!! They also dont appear to have the nvram bug the EA's have. I currently have 5x E3200 and 8x EA6500 Shibby powered Tinc routers around the state and US for family backup and media sharing.

I dont know if Shibby can make an initial flash for the CH variant or if someone can document how and what to change the board ID to, but I followed the following steps and its repeatable...

Kong initial flash for DDWrt for R6300v2 CH
<Wait 5 min>
Full NVRam reset
Flash to Tomato shibby R6300v2 with Reset defaults selected from DD-Wrt (I dont think the reset does anything...)
<Wait 10 min>
Curse for 10 min that I cant login (only the first time), Google the issue for 5 min, read steps from this thread...
Reboot router again, wait until you get prompted for login again...
Press and hold the WIFI button for 30 seconds (5 sec more just incase)
Putty to port 223 Telnet prot.
nvram show|grep http
copy what is listed for http password

Goto login prompt in browser...
User: root
Password: paste what you copied
Immediately do a NVRam reset and reboot.


Thank you Shibby for all your hard work, and a greater thanks for integrating Tinc into your firmware!
Tinc has been a life saver...

I'll send a donation come the morning.

Pere's picture

At first with tomato 1.8 and then with DD-WRT, I could not configure my Netgear R7000 correctly with my VPN, and decided to go back to tomato, going through the original firmware. It was then that I left without user / password, and in this forum, I learned that the access data in DD-WRT are encrypted, which is why they don’t work after the restoration.

I am waiting for the cable I need to solve the problem as explained here.

But I want to comment on a possibility here in case you believe it is a possible solution. If the user / password encryption DD-WRT uses is known, then from a web online encrypt tool (such as https://www.tools4noobs.com/online_tools/), can it be encrypted in the same way DD-WRT does and will we get the appropriate username / password to enter our router?
Is it a useless idea?
Or does anyone know how to do it?

stuccoman's picture
thank you Shibby for the how

thank you Shibby for the how to. I managed to brick mine writing tomato to it before resetting back to factory. I found my way in the back door and got the encrypted key.  Just bought this router and I am not the most computer suave. I had kids bitching and moaning at the same time that they had no wifi and I had the wife looking at me with a stern look thinking she just threw $200 plus away yesterday buying this router....

Thank you again for saving my hyde :)



Pere's picture


I have had the same problem and I want to explain that I bought an GearMo USB to 3.v TTL cable, which has not been necessary to solve the problem.

I followed your instructions from points 1 and 2, and the router no longer asked me for the username and password. The following steps have not been necessary. I had plugged a USB-USB cable between router and PC, but I think this was not important.
Finally, I could set up my Netgear R7000 by Tomato Firmware 1.28.0000 -138 K26ARM USB AIO-64K, for NordVPN.

Thank you very much for your help.
I am not an expert, but in my spare time following good instructions from time to time I am solving small domestic problems.

Glenn_k9's picture
I read somewhere that if you

I read somewhere that if you erase the nvram as the last step that problem won't appear. I cannot confirm however I read it severall occassions in differerent tech sites and most of them say this....good luck


aaronrz's picture
campbeln's picture
Shibby's [updated] notes

Shibby's [updated] notes below (now that I just fought through this myself):

1) run router and wait 2-3 [minutes. The router must be fully booted up!]
2) push and hold wifi on/off button for 25 secs - this will enable a "backdoor" access to the router. [Some user's needed to hold the button for longer than 25 seconds. Also, the Wifi button is the second button/light from the right on the front/top of the router (the one with the Wifi logo, NOT the one with the lock on the far right!)]
3) use putty and connect via telnet on port 233 and log in to router without password [e.g. `telnet 912.168.1.1 233`]
4) run command: nvram get http_password (login`s value: nvram get http_username) [You need both the encrypted username AND password. Some users got nothing back from the `nvram get http_password` call, but using `nvram show` shows EVERYTHING, so copy and paste the results into a text editor and search for "http_password" and "http_username" to get the encrypted values you will need to login.]
5) use result[s] as [username/]password [That is, you need BOTH the encrypted username AND password!]
6) when you log in to tomato remember to erase nvram [Use the encrypted username/password collected above to login. Some users had issues with Chrome, but Firefox seems to work fine. Go to "Administration > Configuration", then set "Restore Default Configuration" to "Erase all data in NVRAM memory (thorough)" and click "OK" to reset the NVRAM. On reboot, Tomato's default username/password: admin/admin]

7) do other steps from INSTRUCTIONS file.


And that is the process that worked for me after I flashed Tomato via DD-WRT's fireware upgrade feature.

darkjoy's picture



I just got a new Netgear R7000 and bricked it right away.

I did uplad the initial package and after that the router become unresponsive. 

I tried all of the suggested methods (including the Shibby's [updated] notes), apart of getting a usb to ttl cable.

I did set my local IP to / / with Gateway The only time when the router responds to the pings is few seconds after I turn it on, and it lasts for couple of seconds, in which time I can't do anything like uploading a new flash through tftp or connecting to it through Telnet.

Even after trying to reset the router using 30-30-30 and 60-60-60 and 90-90-90, I can still see the WiFi networks that I configured previously when I scan the available networks with my phone or laptop, but I can't connect to them (2.4 or 5 Ghz) with or without GHCP client active on the client adapter. This means to me that the reset was not successful.

I also tried holding the WiFi button for 25, 30, 90 seconds but this didn't allow me to connect to the router into any debugging mode.

I also tried holding the reset button for more than 5 but less than 8 second, and this didn't do anyhitn. No light blinked or anything happened noticeable.


If anyone have any other idea apart of trying the usb to ttl cable option I would really like to try it out.

Having a firmware available that actually bricked so many routers is a shameful thing. I'm so pissed of that I didn't read all of the complains before I followed the video instruction. angry


Thanks for any help 

ismaelgokufox's picture
Is there a way to install

Is there a way to install this Tomato firmware on AC1450?

badboy416's picture
I almost gave up. Nothing was

I almost gave up. Nothing was working. I spent better part of 2 days including all day today. 2:45 am here. I forgot to default before flash. Get http_username/passwd. OMG thanks everyone.