User Tools

Site Tools


toh:netgear:wnr2200

Netgear WNR2200

Supported Versions

Version/Model Launch Date S/N OpenWrt Version Supported Model Specific Notes
v1 - - Barrier Breaker (14.07) and newer -

Hardware Highlights

Ver CPU Ram Flash Network Wireless USB Serial JTag Wiki FCC
v1 Atheros AR7241 360 MHz 64MiB 8MiB 1 WAN + 4x LAN (100 Mbit) AR9287 [bgn 2x2:2] 1x USB 2.0 Yes Yes(EJTAG, Not soldered) here here

Manufacturer's site

Installation

OpenWrt provides official, nearly working (USB missing) Barrier Breaker images. USB works in images created after r47236.

Selecting a Firmware Image

Always use the one with factory in its name. Note, however, that there are two factory images created for the WNR2200. One has 'NA' on the end, and the other doesn't. From my research, the 'NA' stands for 'North America'. However, it also seems that Netgear did not make a different firmware for North Americans. Not being from North America, I didn't care about this and just flashed the one without 'NA' in its name. If you are from North America, then you should probably contact someone on IRC, the mailing lists or the forums to get a more definite answer. I also saw that Netgear listed on their website that there are firmware differences between the worldwide versions and the Russian and Chinese versions, so if you're from Russia or China, you might want to ask someone before flashing as well.

If you are unsure of which version to flash, do not flash. You could end up bricking your router if you flash the wrong version.

Flashing from factory firmware

To flash OpenWrt from factory firmware, you just connect to your router over LAN and select the openwrt-ar71xx-generic-wnr2200-squashfs-factory.img firmware under Advanced → Firmware upgrade → Manual (or similar) and confirm that you want to flash OpenWrt.

Flashing from OpenWrt

The OpenWrt web interface has an option to flash new firmware over it, but I did not get it working yet. So to flash OpenWrt manually over tftp (without a serial console), you'll have to boot into recovery mode. So, let's get started.

  1. Turn the router off
  2. Use a long, thin object (e.g. a toothpick) to hold down the button marked "Restore Factory Settings" (or something similar).
  3. Turn the router on, while still holding down the button with the long, thin object
  4. The 'power' LED will start to flash. Wait for it to stay lit green. Then release the button.
  5. Set your computer a static IP of 192.168.1.2 and connect to the router to you computer using the LAN1 port on the WNR2200.
  6. Follow the OS-specific tftp instructions to flash the image onto the router.

tftp instructions on Linux:

  1. Open a terminal in the directory where you have downloaded the firmware
  2. Type 'tftp'. (If you don't have tftp installed, install it.)
  3. Type the following commands:
connect 192.168.1.1
binary
rexmt 1
timeout 60
put "path_to/openwrt-ar71xx-generic-wnr2200-squashfs-factory.img"

tftp instructions on Windows:

First, you need to download a special tftp client, that has more options than the one built into Windows has. You can download it here. Then execute tftp.exe using the following commandline:

tftp.exe -v -i -b8192 -t255 192.168.1.1 PUT "path_to\openwrt-ar71xx-generic-wnr2200-squashfs-factory.img"

Make sure, that tftp.exe doesn't throws any errors. If so, retry the command until tftp executes successfully.

Final steps

Once you've done all of this, wait around 3 to 7 minutes (you can see that the update is in progress, when a pairs of yellow leds goes on; its finished, when the power led turns solid green) and then reconnect to your router. If all goes well, you should be able to access your router using telnet on 192.168.1.1:23.

Do NOT touch the router during the update or you could possibly render it unusable.

Serial output while flashing openwrt

  1. Serial connection: on the top, right corner there is already a serial connector. When holding the device with the LAN/Power connectors down, the pinout is like this: <Ground> <RX> <TX> <3,3V> (Hint: You do not need to connect 3,3V when turning the device with the original power supply)
  2. the 3,3V pin have a white dot next to it
  3. port settings: Speed:115200, Data bits:8, Stop bits:1, Parity:none, Flow control:none

U-Boot 1.1.4-gab090933 (Sep 19 2011 - 12:51:47) WNR2200 (ar7241) U-boot dni25 V1.5 DRAM: sri ar7240_ddr_initial_config(139): virian ddr1 init #### TAP VALUE 1 = 0x2, 2 = 0x2 [0x0: 0x0] 64 MB Top of RAM usable for U-Boot at: 84000000 Reserving 281k for U-Boot at: 83fb8000 Reserving 192k for malloc() at: 83f88000 Reserving 44 Bytes for Board Info at: 83f87fd4 Reserving 36 Bytes for Global Data at: 83f87fb0 Reserving 128k for boot params() at: 83f67fb0 Stack Pointer at: 83f67f98 Now running in RAM - U-Boot at: 83fb8000 id read 0x100000ff sector count = 128 Flash: 8 MB In: serial Out: serial Err: serial Net: ag7240_enet_initialize... Fetching MAC Address from 0x83fe9d50 Fetching MAC Address from 0x83fe9d50 Virian MDC CFG Value ==> 4 : XXXXXXXXXXXX eth0: XXXXXXXXXXXXXX eth0 up Virian MDC CFG Value ==> 4 : XXXXXXXXXXXXX eth1: XXXXXXXXXXXXX ATHRS26: resetting s26 ATHRS26: s26 reset done eth1 up eth0, eth1 Trying eth1et Mode dup 1 speed 1000 The Router is in TFTP Server Firmware Recovery mode NOW! Listening on Port : 69, IP Address: 192.168.1.1... Upgrade Mode Rcv: ................................................................. ................................................................. ................................................................. ................................................................. ................................................................. ................................................................. ................................................................. ................................................................. ................................................................. ................................................................. .......................................... Done! Bytes transferred = 3539077 (360085 hex) Erase Flash from 0x9f050000 to 0x9f05ffff in Bank # 1 First 0x5 last 0x5 sector size 0x10000 5 Erased 1 sectors Alive-timer 0 Erase Flash from 0x9f060000 to 0x9f06ffff in Bank # 1 First 0x6 last 0x6 sector size 0x10000 6 Erased 1 sectors Alive-timer 0 Erase Flash from 0x9f070000 to 0x9f07ffff in Bank # 1 First 0x7 last 0x7 sector size 0x10000 7 Erased 1 sectors Alive-timer 0 Erase Flash from 0x9f080000 to 0x9f08ffff in Bank # 1 First 0x8 last 0x8 sector size 0x10000 8 Erased 1 sectors Alive-timer 0 Erase Flash from 0x9f090000 to 0x9f09ffff in Bank # 1 First 0x9 last 0x9 sector size 0x10000 9 Erased 1 sectors Alive-timer 0 Erase Flash from 0x9f0a0000 to 0x9f0affff in Bank # 1 First 0xa last 0xa sector size 0x10000 10 Erased 1 sectors Alive-timer 0 Erase Flash from 0x9f0b0000 to 0x9f0bffff in Bank # 1 First 0xb last 0xb sector size 0x10000 11 Erased 1 sectors Alive-timer 0 Erase Flash from 0x9f0c0000 to 0x9f0cffff in Bank # 1 First 0xc last 0xc sector size 0x10000 12 Erased 1 sectors Alive-timer 0 Erase Flash from 0x9f0d0000 to 0x9f0dffff in Bank # 1 First 0xd last 0xd sector size 0x10000 13 Erased 1 sectors Alive-timer 0 Erase Flash from 0x9f0e0000 to 0x9f0effff in Bank # 1 First 0xe last 0xe sector size 0x10000 14 Erased 1 sectors Alive-timer 0 Erase Flash from 0x9f0f0000 to 0x9f0fffff in Bank # 1 First 0xf last 0xf sector size 0x10000 15 Erased 1 sectors Alive-timer 0 Erase Flash from 0x9f100000 to 0x9f10ffff in Bank # 1 First 0x10 last 0x10 sector size 0x10000 16 Erased 1 sectors Alive-timer 0 Erase Flash from 0x9f110000 to 0x9f11ffff in Bank # 1 First 0x11 last 0x11 sector size 0x10000 17 Erased 1 sectors Alive-timer 0 Erase Flash from 0x9f120000 to 0x9f12ffff in Bank # 1 First 0x12 last 0x12 sector size 0x10000 18 Erased 1 sectors Alive-timer 0 Erase Flash from 0x9f130000 to 0x9f13ffff in Bank # 1 First 0x13 last 0x13 sector size 0x10000 19 Erased 1 sectors Alive-timer 0 Erase Flash from 0x9f140000 to 0x9f14ffff in Bank # 1 First 0x14 last 0x14 sector size 0x10000 20 Erased 1 sectors Alive-timer 0 Erase Flash from 0x9f150000 to 0x9f15ffff in Bank # 1 First 0x15 last 0x15 sector size 0x10000 21 Erased 1 sectors Alive-timer 0 Erase Flash from 0x9f160000 to 0x9f16ffff in Bank # 1 First 0x16 last 0x16 sector size 0x10000 22 Erased 1 sectors Alive-timer 0 Erase Flash from 0x9f170000 to 0x9f17ffff in Bank # 1 First 0x17 last 0x17 sector size 0x10000 23 Erased 1 sectors Alive-timer 0 Erase Flash from 0x9f180000 to 0x9f18ffff in Bank # 1 First 0x18 last 0x18 sector size 0x10000 24 Erased 1 sectors Alive-timer 0 Erase Flash from 0x9f190000 to 0x9f19ffff in Bank # 1 First 0x19 last 0x19 sector size 0x10000 25 Erased 1 sectors Alive-timer 0 Erase Flash from 0x9f1a0000 to 0x9f1affff in Bank # 1 First 0x1a last 0x1a sector size 0x10000 26 Erased 1 sectors Alive-timer 0 Erase Flash from 0x9f1b0000 to 0x9f1bffff in Bank # 1 First 0x1b last 0x1b sector size 0x10000 27 Erased 1 sectors Alive-timer 0 Erase Flash from 0x9f1c0000 to 0x9f1cffff in Bank # 1 First 0x1c last 0x1c sector size 0x10000 28 Erased 1 sectors Alive-timer 0 Erase Flash from 0x9f1d0000 to 0x9f1dffff in Bank # 1 First 0x1d last 0x1d sector size 0x10000 29 Erased 1 sectors Alive-timer 0 Erase Flash from 0x9f1e0000 to 0x9f1effff in Bank # 1 First 0x1e last 0x1e sector size 0x10000 30 Erased 1 sectors Alive-timer 0 Erase Flash from 0x9f1f0000 to 0x9f1fffff in Bank # 1 First 0x1f last 0x1f sector size 0x10000 31 Erased 1 sectors Alive-timer 0 Erase Flash from 0x9f200000 to 0x9f20ffff in Bank # 1 First 0x20 last 0x20 sector size 0x10000 32 Erased 1 sectors Alive-timer 0 Erase Flash from 0x9f210000 to 0x9f21ffff in Bank # 1 First 0x21 last 0x21 sector size 0x10000 33 Erased 1 sectors Alive-timer 0 Erase Flash from 0x9f220000 to 0x9f22ffff in Bank # 1 First 0x22 last 0x22 sector size 0x10000 34 Erased 1 sectors Alive-timer 0 Erase Flash from 0x9f230000 to 0x9f23ffff in Bank # 1 First 0x23 last 0x23 sector size 0x10000 35 Erased 1 sectors Alive-timer 0 Erase Flash from 0x9f240000 to 0x9f24ffff in Bank # 1 First 0x24 last 0x24 sector size 0x10000 36 Erased 1 sectors Alive-timer 0 Erase Flash from 0x9f250000 to 0x9f25ffff in Bank # 1 First 0x25 last 0x25 sector size 0x10000 37 Erased 1 sectors Alive-timer 0 Erase Flash from 0x9f260000 to 0x9f26ffff in Bank # 1 First 0x26 last 0x26 sector size 0x10000 38 Erased 1 sectors Alive-timer 0 Erase Flash from 0x9f270000 to 0x9f27ffff in Bank # 1 First 0x27 last 0x27 sector size 0x10000 39 Erased 1 sectors Alive-timer 0 Erase Flash from 0x9f280000 to 0x9f28ffff in Bank # 1 First 0x28 last 0x28 sector size 0x10000 40 Erased 1 sectors Alive-timer 0 Erase Flash from 0x9f290000 to 0x9f29ffff in Bank # 1 First 0x29 last 0x29 sector size 0x10000 41 Erased 1 sectors Alive-timer 0 Erase Flash from 0x9f2a0000 to 0x9f2affff in Bank # 1 First 0x2a last 0x2a sector size 0x10000 42 Erased 1 sectors Alive-timer 0 Erase Flash from 0x9f2b0000 to 0x9f2bffff in Bank # 1 First 0x2b last 0x2b sector size 0x10000 43 Erased 1 sectors Alive-timer 0 Erase Flash from 0x9f2c0000 to 0x9f2cffff in Bank # 1 First 0x2c last 0x2c sector size 0x10000 44 Erased 1 sectors Alive-timer 0 Erase Flash from 0x9f2d0000 to 0x9f2dffff in Bank # 1 First 0x2d last 0x2d sector size 0x10000 45 Erased 1 sectors Alive-timer 0 Erase Flash from 0x9f2e0000 to 0x9f2effff in Bank # 1 First 0x2e last 0x2e sector size 0x10000 46 Erased 1 sectors Alive-timer 0 Erase Flash from 0x9f2f0000 to 0x9f2fffff in Bank # 1 First 0x2f last 0x2f sector size 0x10000 47 Erased 1 sectors Alive-timer 0 Erase Flash from 0x9f300000 to 0x9f30ffff in Bank # 1 First 0x30 last 0x30 sector size 0x10000 48 Erased 1 sectors Alive-timer 0 Erase Flash from 0x9f310000 to 0x9f31ffff in Bank # 1 First 0x31 last 0x31 sector size 0x10000 49 Erased 1 sectors Alive-timer 0 Erase Flash from 0x9f320000 to 0x9f32ffff in Bank # 1 First 0x32 last 0x32 sector size 0x10000 50 Erased 1 sectors Alive-timer 0 Erase Flash from 0x9f330000 to 0x9f33ffff in Bank # 1 First 0x33 last 0x33 sector size 0x10000 51 Erased 1 sectors Alive-timer 0 Erase Flash from 0x9f340000 to 0x9f34ffff in Bank # 1 First 0x34 last 0x34 sector size 0x10000 52 Erased 1 sectors Alive-timer 0 Erase Flash from 0x9f350000 to 0x9f35ffff in Bank # 1 First 0x35 last 0x35 sector size 0x10000 53 Erased 1 sectors Alive-timer 0 Erase Flash from 0x9f360000 to 0x9f36ffff in Bank # 1 First 0x36 last 0x36 sector size 0x10000 54 Erased 1 sectors Alive-timer 0 Erase Flash from 0x9f370000 to 0x9f37ffff in Bank # 1 First 0x37 last 0x37 sector size 0x10000 55 Erased 1 sectors Alive-timer 0 Erase Flash from 0x9f380000 to 0x9f38ffff in Bank # 1 First 0x38 last 0x38 sector size 0x10000 56 Erased 1 sectors Alive-timer 0 Erase Flash from 0x9f390000 to 0x9f39ffff in Bank # 1 First 0x39 last 0x39 sector size 0x10000 57 Erased 1 sectors Alive-timer 0 Erase Flash from 0x9f3a0000 to 0x9f3affff in Bank # 1 First 0x3a last 0x3a sector size 0x10000 58 Erased 1 sectors timestamp overflows Alive-timer 23 Active-timer expires Erase Flash from 0x9f3b0000 to 0x9f3bffff in Bank # 1 First 0x3b last 0x3b sector size 0x10000 59 Erased 1 sectors Alive-timer 0 Copy image to Flash... write addr: 9f050000 Alive-timer 0 write addr: 9f060000 Alive-timer 0 write addr: 9f070000 Alive-timer 0 write addr: 9f080000 Alive-timer 0 write addr: 9f090000 Alive-timer 0 write addr: 9f0a0000 Alive-timer 0 write addr: 9f0b0000 Alive-timer 0 write addr: 9f0c0000 Alive-timer 0 write addr: 9f0d0000 Alive-timer 0 write addr: 9f0e0000 Alive-timer 0 write addr: 9f0f0000 Alive-timer 0 write addr: 9f100000 Alive-timer 0 write addr: 9f110000 Alive-timer 0 write addr: 9f120000 Alive-timer 0 write addr: 9f130000 Alive-timer 0 write addr: 9f140000 Alive-timer 0 write addr: 9f150000 Alive-timer 0 write addr: 9f160000 Alive-timer 0 write addr: 9f170000 Alive-timer 0 write addr: 9f180000 Alive-timer 0 write addr: 9f190000 Alive-timer 0 write addr: 9f1a0000 Alive-timer 0 write addr: 9f1b0000 Alive-timer 0 write addr: 9f1c0000 Alive-timer 0 write addr: 9f1d0000 Alive-timer 0 write addr: 9f1e0000 Alive-timer 0 write addr: 9f1f0000 Alive-timer 0 write addr: 9f200000 Alive-timer 0 write addr: 9f210000 Alive-timer 0 write addr: 9f220000 Alive-timer 0 write addr: 9f230000 Alive-timer 0 write addr: 9f240000 Alive-timer 0 write addr: 9f250000 Alive-timer 0 write addr: 9f260000 Alive-timer 0 write addr: 9f270000 Alive-timer 0 write addr: 9f280000 Alive-timer 0 write addr: 9f290000 Alive-timer 0 write addr: 9f2a0000 Alive-timer 0 write addr: 9f2b0000 Alive-timer 0 write addr: 9f2c0000 Alive-timer 0 write addr: 9f2d0000 Alive-timer 0 write addr: 9f2e0000 Alive-timer 0 write addr: 9f2f0000 Alive-timer 0 write addr: 9f300000 Alive-timer 0 write addr: 9f310000 Alive-timer 0 write addr: 9f320000 Alive-timer 0 write addr: 9f330000 Alive-timer 0 write addr: 9f340000 Alive-timer 0 write addr: 9f350000 Alive-timer 0 write addr: 9f360000 Alive-timer 0 write addr: 9f370000 Alive-timer 0 write addr: 9f380000 Alive-timer 0 write addr: 9f390000 Alive-timer 0 write addr: 9f3a0000 Alive-timer 0 write addr: 9f3b0000 Alive-timer 0 Done Rebooting... Resetting...


  1. Supported serial commands

ar7240> help autoscr - run script from memory ? - alias for 'help' base - print or set address offset bdinfo - print Board Info structure board_hw_id_set - set board_hw_id board_hw_id_show - Show board_hw_id board_model_id_set - set board_model_id board_model_id_show - Show board_model_id board_passphrase_set - set passphrase on board board_passphrase_show - Show board_passphrase board_ssid_set - set ssid on board board_ssid_show - Show board_ssid boot - boot default, i.e., run 'bootcmd' bootd - boot default, i.e., run 'bootcmd' bootelf - Boot from an ELF image in memory bootm - boot application image from memory bootp - boot image via network using BootP/TFTP protocol bootvx - Boot vxWorks from an ELF image cmp - memory compare coninfo - print console devices and information cp - memory copy crc32 - checksum calculation fls - Set to change DDR settings on reboot dhcp - invoke DHCP client to obtain IP/boot params echo - echo args to console erase - erase FLASH memory ethreg - S26 PHY Reg rd/wr utility exit - exit script flinfo - print FLASH memory information fls - Set to change Flash size on reboot fsinfo - print information about filesystems fsload - load binary file from a filesystem image go - start application at address 'addr' help - print online help iminfo - print header information for application image imls - list all images found in flash itest - return true/false on integer compare loadb - load binary file over serial line (kermit mode) loads - load S-Record file over serial line loady - load binary file over serial line (ymodem mode) loop - infinite loop on address range ls - list files in a directory (default /) macset - Set ethernet MAC address macshow - Show ethernet MAC addresses md - memory display mii - MII utility commands mm - memory modify (auto-incrementing) mtest - simple RAM test mw - memory write (fill) nfs - boot image via network using NFS protocol nm - memory modify (constant address) pci - list and access PCI Configuration Space ping - send ICMP ECHO_REQUEST to network host pll - Set to change CPU/AHB/DDR speeds printenv- print environment variables progmac - Set ethernet MAC addresses protect - enable or disable FLASH write protection rarpboot- boot image via network using RARP/TFTP protocol reset - Perform RESET of the CPU rnset - set region number rnshow - Show Region Number on Board run - run commands in an environment variable saveenv - save environment variables to persistent storage setenv - set environment variables sleep - delay execution for some time snset - set serial number test - minimal test like /bin/sh tftpboot- boot image via network using TFTP protocol version - print monitor version wmacset - Set wlan MAC address wpspinset - set wpspin number ar7240> board_hw_id_show board_hw_id : �������������� ar7240> rnshow region on board: 0x0003 ar7240> coninfo List of available devices: serial 80000003 SIO stdin stdout stderr


User-provided images

Warning! Third party software! Unknown user! Dont use for regular work!

Images by Muessigb (no official developer!)

Compilation Date OpenWrt Base Version Notes and Changes Repository Download
15/05/15-a Chaos Calmer (trunk) Initial release. Note that USB is supported, LuCI is enabled by default and that it contains drivers for FAT and ext4 formatted usb sticks. It also contains alot of tools to use over SSH or telnet. The hardware buttons are not supported. here Worldwide North America
15/05/15-b Chaos Calmer (trunk) Same as above version, but with slightly more fs tools, HID and GPIO drivers. here Worldwide North America

Note, that as always the images come with no warranty. You can't make the contributors to OpenWrt nor Muessigb (the builder and patcher of the build above) liable if it doesn't work for you or you break your router.

Trivia

The router's stock firmware from Netgear is an old OpenWrt(Kamikaze) which you can access over Telnet after using the old TCP telnetenable.exe. The username and password is Gearguy:Geardog. Here's the telnet output from a telnet unlocked stock WNR2200:

   === IMPORTANT ============================
    Use 'passwd' to set your login password
    this will disable telnet and enable SSH
   ------------------------------------------
   
   
  BusyBox v1.4.2 (2013-12-23 15:48:24 CST) Built-in shell (ash)
  Enter 'help' for a list of built-in commands.
   
    _______                     ________        __
   |       |.-----.-----.-----.|  |  |  |.----.|  |_
   |   -   ||  _  |  -__|     ||  |  |  ||   _||   _|
   |_______||   __|_____|__|__||________||__|  |____|
            |__| W I R E L E S S   F R E E D O M
   KAMIKAZE (7.09) -----------------------------------
    * 10 oz Vodka       Shake well with ice and strain
    * 10 oz Triple sec  mixture into 10 shot glasses.
    * 10 oz lime juice  Salute!
   ---------------------------------------------------
  root@WNR2200:/#
toh/netgear/wnr2200.txt · Last modified: 2015/12/09 23:38 by tmomas