Netgear WGT634U

A router that was end-of-lifed by Netgear on October 1, 2005, it remains a useful and versatile device. It includes the typical 4+1 ethernet ports, plus a USB host port (you might have to install package kmod-usb2 to get certain USB hardware working) and a mini-PCI slot holding an Atheros b/g radio (though it might happen that the necessary wifi kernel modules are not included in the firmware-image, which means you have to install either the package kmod-madwifi or (the more recent) kmod-ath5k, while it's safe to remove the unneeded packages kmod-b43 and kmod-b43legacy; cf. ). It was designed with the idea that you could host data on an attached USB drive and access it from your wireless devices. However, apparently consumers didn't want to do that in sufficient numbers to support a price premium.

Note: A lot of good information is on the OldWiki page:

Supported Versions

There are two versions of the WGT634U, but they are not labelled in a distinguishing manner. The first version is very rare and appears to represent the first production run, almost all extant versions are the latter. The difference between the two is principally in that the first lacks a heatsink on the CPU and populates both serial ports and the JTAG interface with headers. The early version also populates some resistors for the JTAG. Later models, presumably, can enable JTAG by installing the 0603 SMD resistors, though this has not been known to be tested yet.

Hardware Highlights

CPU Ram Flash Network USB Serial JTag
Broadcom BCM3302@200MHz 32MiB 8MiB 4 x 1 Yes Yes Yes*

Also notable are the mini-PCI slot and Atheros b/g radio.

The JTAG is not confirmed to work, but differences between the early versions and later ones show missing resistors on what looks almost certainly to be a JTAG interface.


There are numerous ways to install OpenWrt on the WGT634U. Unlike many other devices, the WGT634U does not automatically try to fetch an image via TFTP or automatically accept one that is sent. TFTP can only be initiated from a serial console. Images can also be flashed from a running system, either the stock firmware or using the mtd utility from a previous version of OpenWrt.

OEM easy installation


TFTP from CFE and serial console

Unless you manage to overwrite the CFE bootloader, you can flash any image using this method from any state, even semi-bricked, non-booting ones:

* Setup a TFTP server on the local network, place a .bin image in the TFTP server space.

  • Note, if your image is larger than 4194304 bytes, you will need to flash it in two steps. This appears to be a limitation of CFE. You will need to cut the image into parts using /bin/dd or a similar tool.

* Attach a serial console (115200 baud, N-8-1, no flow control)

* Attach a network cable to the WAN port.

* While holding down Ctrl-C in the serial console, apply power to the WGT634U and the boot should abort at the CFE> prompt

* Configure the network interface:

CFE> ifconfig eth0 -auto

* Flash the binary file (the first part if there are two):

CFE> flash -noheader <ipaddr-of-TFTP-server>:<path-to-your-image>.bin flash0.os

* If there is a second part:

CFE> flash -noheader -offset=<size-of-part1-in-bytes> <ipaddr-of-TFTP-server>:<path-to-part2>.bin flash0.os

* Reboot:

CFE> reboot

Upgrading OpenWrt

LuCI Web Upgrade Process


Terminal Upgrade Process

  • Login as root via SSH
  • Use the following commands to upgrade:

cd /tmp/
wget http://<hostname>/openwrt-brcm47xx-squashfs.trx
mtd -r write /tmp/openwrt-brcm47xx-squashfs.trx linux



Architecture: MIPS
Vendor: Broadcom
Bootloader: CFE
System-On-Chip: Broadcom BCM3302 V0.7 (from /proc/cpuinfo)
CPU Speed: 200 Mhz
Flash-Chip: Intel te28f640
Flash size: 8 MiB
RAM: 32 MiB
Wireless: Atheros b/g with soldered antenna pigtail
Ethernet: Switch in CPU
USB: Yes
Serial: Yes


Model Number


Photo of front


Photo of back

Opening the case

There are four screws on the bottom. They are either phillips head or T-8 Torx. Refurbs tend to have phillips, the originals from Netgear tend to have torx. In the absence of a T-8, a small flathead screwdriver can be used in a pinch. I recommend a Torx if you are going to be opening it more than once.

Main PCB

Photo of PCB


The serial console is available on J7. Numbered from the ethernet port side of the board, they are:

  1. VCC (3.3V)
  2. TX
  3. RX

The serial port is the typical 3.3V TTL serial commonly found on router and router-like devices, NOT a PC-style RS-232 serial, with it's different signaling voltages. It's 115200 8-N-1 without hardware or software control.


There is a JTAG looking port (2 x 7 holes) on the board. Except for the very early versions of the board, however, needed surface mount resistors are missing. On the bottom of the board, early versions are populated with 0603 SMD resistors:

  • R66 = 10k ohms
  • R65 = 33 ohms
  • R67 = 10k ohms
  • R68 = 10k ohms
  • R73 = 0 ohms (shunt)

The pinout is *probably* standard 14-pin, but check and report back. For more information on reflashing the device, see these JTAG tools

See port.jtag for more JTAG details.

Specific Configuration


The default network configuration is:

Interface Name Description Default configuration
br-lan LAN & WiFi
vlan0 (eth0.0) LAN ports (1 to 4) None
vlan1 (eth0.1) WAN port DHCP
ath0 WiFi Disabled

Switch Ports (for VLANs)


NOTE: By default, the physical WAN port lands on the LAN and the last physical LAN port (identified as #4 on the device) is the WAN port.

Failsafe mode

Failsafe mode does not work on the WGT634U. If you discover different, report back here.

Basic configuration

Hardware mods

Replacing the radio

Because the radio comes in a mini-PCI slot, it is possible to replace it with a different radio. The principal obstacle to this is that the stock antenna is soldered on, and the coax pigtail must be cut or desoldered to remove it. With minor case modifications, it is possible to replace the radio with a Wistron CM-9 or similar and a u.fl to RP-SMA pigtail using the original antenna hole. The stock radio has a cut-out to accomodate a plastic internal screw peg, so a little delicate dremel work is needed to make room for the CM-9.

The mini-PCI slot is reported to have limited power, making the use of higher powered radios like the Ubiquiti SR2 problematic.

Other notes

Host USB port uses

The USB host port was unique at the time the WGT634U was introduced. Diverse device driver availability allow the USB port to connect any number of various hardware. For example, by connecting a 4-port hub, a WGT634U with a connected USB GPS, USB Storage and USB sound was used as a kismet wireless stumbling device, playing MP3 audio clips for feedback.

Note however, that although the USB port is advertised as USB2 and indeed it is detected as such, it is limited to 12Mbps data rates.

Another use employed a zd1211 usb radio as a way of implementing a two-radio repeater. Separating the two radios with a USB extension (up to 5 meters) is probably wise.

Avoid 8.09.1!

See the following section for an explanation what happens if you flash 8.09.1 on these devices and how to recover if you do.

Recovering from Board Information Overwrites

Despite the amazing functionality of these devices, they do not get as much love and attention from OpenWrt developers as they once did. At various stages of history, the board detection logic has become messed up, and distributed versions of the OpenWrt image (see in particular 8.09.1, and Kamikaze Trunk mid-July 2010 to the end of 2010) have overwritten crucial parts of the board configuration information on flash, which renders the device unbootable thereafter. Recovery is not terribly difficult however, with a serial console. Attach the console, boot up to a CFE prompt, and type the following commands:

CFE> setenv -p STARTUP "ifconfig eth0 -addr= -mask=; boot -elf flash0.os:"
CFE> setenv -p kernel_args "console=ttyS1,115200 root=/dev/ram0 init=/linuxrc rw syst_size=8M"
CFE> setenv -p et0phyaddr 254
CFE> setenv -p et0mdcport 0
CFE> setenv -p configvlan 0x1
CFE> setenv -p et0macaddr 00-0f-b5-3d-58-b6
CFE> setenv -p et1macaddr 00-0f-b5-3d-58-b7
CFE> reboot

(substituting your own macaddrs, which are printed on the case.)

Back to top

toh/netgear/wgt634u.txt · Last modified: 2013/02/25 23:12 by reubenk