User Tools

Site Tools


Netgear DGN1000B

Netgear DGN1000B is currently unsupported!

A little work has been done (2016-05) in getting DGN1000SP variants to boot trunk kernels, but it's not useful yet. See the forum thread for details. This work is resurrection of a neglected device; support for most of the platform was added inbetween Attitude Adjustment and Barrier Breaker, but it fell unmaintained before Barrier Breaker froze.

Even if this effort bears fruit, only the 32/8 (e.g. DGN1000SP) variants stand a chance of being supported. 16/4 variants are too small, and the Attitude Adjustment images that would fit on them have some undiagnosed failures in the flash driver.

Supported Versions

This router has the following versions/models.

Version/Model S/N Release Date OpenWrt Version Supported Model Specific Notes

The 'B' probably denotes the ADSL Annex B variant distributed in Germany.

Hardware Highlights

Netgear N150 Wireless ADSL2+ Modem/Router

Variant CPU Ram Flash Network USB Serial JTag
DGN1000B Amazon SE@266MHz 16MB 4MB 4x 100M No (Yes) Yes No
DGN1000SP Amazon SE@266MHz 32MB 8MB 4x 100M No (Yes) Yes No

See Hardware or Tags for more details.

Manufacture advertised features:

Specific configuration


The default network configuration is:

Interface Name Description Default configuration
br0 LAN & WiFi
eth0 LAN ports (1 to 4) None
ath0 WiFi Enabled (WPA2 PSK)

Recovery via serial console

You will see something like this:

ROM VER: 1.2.0
CFG 04

U-Boot 1.1.5-2.2 (Sep 25 2009 - 22:20:42)

DRAM:  16 MB

 relocate_code start
 relocate_code finish.
Now running in RAM - U-Boot at: 80fc0000
Flash:  4 MB
using default environment

In:    serial
Out:   serial
Err:   serial
Net:   External Clock
Selected EPHY_MODE
mac = e0:46:9a:ba:5b:64
AMAZON_SE_GPIO_P0_IN = 0xa9ef..
AMAZON_SE_GPIO_P1_IN = 0x2908..

Type "run flash_nfs" to mount root filesystem over NFS

Input Ctrl-c to stop autoboot:  0

Ctrl and C keys during this 1 second period. Then continue with OEM installation using the TFTP and RS232 method



Architecture: MIPS
Vendor: Qualcomm Atheros
Bootloader: U-Boot
System-On-Chip: R0416_BSP_EPHY_SPI_HOST_A4 (MIPS 4KEc V6.12)
CPU/Speed 4KEc V6.12 266 Mhz
Flash-Chip: ST 25P64V6P
Flash size: 8 MiB (DGN1000SP)
4 MiB (DGN1000)
RAM: 32 MiB (DGN1000SP)
16 MiB (DGN1000)
Wireless: Atheros AR9271 2.4ghz 802.11bgn
Ethernet: Atheros AR8216
Internet: Lantiq Amazon-SE
USB: No 1)
Power: 12V DC 1.0A
Serial: Yes
JTAG: No 2)


PSU (power supply)

My Netgear DGN1000B came bundled with the following PSU:


Brand/Model Netgear / T012HE1209
Input 220-240V~ (50/60Hz, 0.25A)
Output 12.0V 1.0A


Opening/closing the case

Note: This will void your warranty! The case of the DGN1000B is composed of 4 pieces:

  • Top cover (black)
  • Bottom cover (gray)
  • Front cover (transparent)
  • Black cover (black)

There are 4 screws at the back of the device, under the rubber feet.

  1. Remove the rubber feet in the back and undo the screws.
  2. Now the top cover can be remove.


port.serial general information about the serial port, serial port cable, etc. How to connect to Serial Port:

J1 [GND] [TX] [VCC] [RX]

Cratch gently the pads with a little screw driver and connect 3 wires to the pads.

Don’t forget that the TX pin of the serial port must linked to the RX pin of the router and the RX to TX!

Speed: 115200 baud


How to configure LEDs in general, see the LED section in the system.

LED name LED print Internal name Trigger
Power PWR dgn1000b:green:power N/A
LAN Port 1 1 unknown N/A
LAN Port 2 2 unknown N/A
LAN Port 3 3 unknown N/A
LAN Port 4 4 unknown N/A
Wireless LAN WLAN dgn1000b:green:wlan N/A
Wide Area Network WAN dgn1000b:green:wlan N/A


hardware.button. For custom action on pressing button the easy way with 00-button script works nicely.

The Netgear DGN1000B has 3 buttons:

BUTTON Event Backfire ID Attitude Adjustment ID
Reset reset
Quick Security Setup QSS BTN_1 wps

The WLAN and QSS buttons are located at the front and can be easily pressed with a finger. The Reset button is located at the bottom and cannot be pressed with a finger, you need a small item (pen typically) to push it in.


See also generic.debrick.

Since this device is Lantiq-based, its mask ROM can boot a payload over the serial port such as a U-Boot image.


The JTAG pins of the SoC are known from the TG585v8. They're probably available on resistors R23/R26 (topside), R36/R34/R24/R25 (underside) but resistors haven't been paired to signals yet. JTAG is a poor choice for recovery on this unit; UART mode and direct SPI access to the flash are easier. There's no flash support for this SoC in common JTAG tools anyway. Debugging of this SoC has been done though, on the TG585v8 with OpenOCD.


1) The SoC has USB but uses it internally to talk to the WiFi.
2) JTAG pins are known but no headers/through-holes are present.
toh/netgear/dgn1000b.txt · Last modified: 2016/05/22 17:50 by zx82