User Tools

Site Tools


Netgear WNR3500L

Supported Versions

Version/Model Launch Date S/N OpenWrt Version Supported Model Specific Notes
WNR3500U ? - Barrier Breaker 14.07 and later partial support based on OpenWrt claimed here
WNR3500L ? - Barrier Breaker 14.07 and later -

Hardware Highlights

Model CPU Ram Flash Network USB Serial JTag
WNR3500U Broadcom BCM4718A@480MHz 64MiB 8MiB 4 x 1 Yes Yes ?
WNR3500L Broadcom BCM4718A@453MHz ?
Broadcom BCM4716A@457MHz ?
WNR3500Lv2 Broadcom BCM47186B0@480MHz 128MiB 128MiB NAND 4 x 1 yes yes ?


wnr3500L V2 is not supported by OpenWrt!

wnr3500L V1 partially work in trunk since 2013-01-11 (bug 7198).

  1. Prepare firmware
    1. Get and unpack ImageBulder, more info
    2. Build firmware
      • make image PROFILE=Broadcom-bgmac-b43 for the open source b43 wireless driver (wireless-G only)
      • make image PROFILE=Broadcom-bgmac-wl for the proprietary wl wireless driver(needed for wireless-N)
    3. Your firmware will be bin/brcm47xx/openwrt-brcm47xx-squashfs.trx
  2. If your current firmware don't allow write arbitrary files to mtd, use dd-wrt image
    1. dd-wrt image can be used for flash device after pin-short debricking/reseting
    2. Configure network on your machine (lan,
    3. Set login over web and telnet to router
    4. Copy firmware to router
      1. scp username@192.168.1.X:path/to/openwrt-brcm47xx-squashfs.trx /tmp/
    5. Write firmware
      1. mtd -r write /tmp/openwrt-brcm47xx-squashfs.trx linux
  3. Now you should have access to openwrt by telnet and start configure it.

USB has no power

Using stock firmware (including Barrier Breaker) the USB socket is powered down during shutdown. (see ticket) The following solution is confirmed to work with b53 wifi driver and official barrier breaker build:

nvram set board_id=U12H136T99_NETGEAR nvram set boardflags=0x00000710 nvram commit

Followed by a cold reboot (power cycle).

Debricking with Serial Terminal

Note: The router's serial port uses 3.3v logic, do not connect a regular 12v serial cable to it.

  1. Assign your computer a static IP address(i.e. and connect to port 4 on the router
  2. Open serial terminal. See Serial for pinout and specs.
  3. Reboot router and press Ctrl+C as soon as you see CFE messages
  4. At the CFE> prompt, enter 'tfptd' to start the tftp server
  5. The router is now waiting for a tfpt connection, follow the tftp guide for more information
    • Note: the router is expecting a .chk file. You must use the stock firmware or the dd-wrt initial flashing image.
  6. The router will reboot automatically when the process is complete



  • SoC: Broadcom BCM4718A
  • Switch : Broadcom BCM53115s


To open the box, remove the screw on the right side (when standing up), then push and slide the right cover to the bottom (where the screw is)…

Netgear 3500Lv2 board:
3500Lv2 board


This device has 2 programmable buttons (classic reset button and WPS on the front). There is also an on/off switch on the rear side.


A 1x6 pin header (JP1) is already soldered in this router.

[VCC] [RX] [ ] [ ] [TX] [GND]

Serial port settings are 115200@8n1. USB to TTL modules are self powered and only need 3 wires (RX, TX and GND).

Connect first GND, then TX to the RX pin of USB Module. It also works with these 2 pins only for readonly. VCC +3,3V pin is used for powering non USB RS232-TTL cables.

v2 Filesystem Layout

dev: size erasesize name
mtd0: 00080000 00020000 "boot"
mtd1: 00180000 00020000 "nvram"
mtd2: 00040000 00020000 "board_data"
mtd3: 00040000 00020000 "POT1"
mtd4: 00040000 00020000 "POT2"
mtd5: 00040000 00020000 "T_Meter1"
mtd6: 00040000 00020000 "T_Meter2"
mtd7: 00040000 00020000 "ML1"
mtd8: 00040000 00020000 "ML2"
mtd9: 00040000 00020000 "ML3"
mtd10: 00040000 00020000 "ML4"
mtd11: 00040000 00020000 "ML5"
mtd12: 00040000 00020000 "ML6"
mtd13: 00040000 00020000 "ML7"
mtd14: 01b00000 00020000 "linux"
mtd15: 019d7b6c 00020000 "rootfs"

Other Info


toh/netgear/wnr3500l.txt · Last modified: 2016/04/24 21:50 by crothamugo