|v1||Backfire||或 WNDR37AV-100PES, WNDR3700-100PES|
|v2||2011-01||Backfire 10.03.1||包装和侧面标签为 WNDR3700v2，或 WNDRMAC-100PES，WNDR3700-100prs|
|-||2011-03||Backfire 10.03.1||WNDR3800 是实际上的后继型号|
|v3||2011-09?||?||WNDR3700v3 基于Broadcom芯片, 因此 完全不同于v1或者v2的架构|
dmesg | grep m25p80然后看一下硬件配置 (ver1 是 8 MB , ver2 是 16 MB).
无法通过查看修订编号（Revision Number）来区分路由器的版本，因为这毫无规律。甚至于不同版本的路由器会在包装盒侧面具有相同的EAN条码。唯一能够通过包装盒来区分版本的办法是查看侧面的印刷内容，在“Package Contents”的下方，如果是v2版，会写着"N600 Wireless Dual Band Gigabit Router (WNDR3700v2)", 而v1版只会简单写着WNDR3700。
注：目前中国大陆的行货以带有100PRS后缀的居多。根据网件官网客服的解释，NETGEAR WNDR3700-100PRS 10周年纪念版为近期NETGEAR市场部门与部分网站合作推出的十周年推广活动，系WNDR3700v2版本，其中-100RPS为订货号，表示中文包装，因此100PRS后缀并不代表硬件有差别。 — Yuchen Xie 2012/08/06 16:00
请注意： 传说某一批v1版本的路由器存在2.4GHz无线会突然丢失的问题，具体是指包装盒上标记 -01R14 或者 -01R1的一批。也有人说 -01R21 或者 -02R01 不存在这个问题，可以稳定工作。而也有人说根据“Board Verion”查看，v4版本也值得信赖。仔细看一下图片，至少可以发现3处都涉及“版本号”。这个问题具体参见http://spreadsheets.google.com/pub?key=0AjNDNODfzgytdEJvZ0N0SkFLejFJZzBHcnFaaUg4OGc&hl=en&output=html.
请查看 →安装OpenWrt（通用） 并在下面阅读有关WNDR3700的特殊之处：
推荐 SquashFS 版！这里是两个版本的区别：filesystems。如果感兴趣，你可以从这里了解 img 和 bin 格式的区别： .
在原生的WNDR3700路由器固件的GUI界面中上传OpenWrt的固件镜像即可安装。非北美的用户可能会收到一个关于“OpenWrt总是认为路由器处于北美地区”的警告。但是无须担心，忽略即可。 Netgear WNDR3700 - OpenWrt New User(s)
Hold the 'System Restore' button on the underside of the router while powering it on, and hold the button until the power led blinks green. Then, upload the .img firmware as described in Installing OpenWrt via TFTP (see the section titled Bootloader contains TFTP server). However, note that the router will not accept the firmware when the filename is too long! Using firmware.img as filename should work. After upload, the power led is turned off and flashing starts, after that is finished the router will restart and the power led will eventually become stable green (it will be stable orange for quite some time first).
tftp 192.168.1.1 mode binary put openwrt-ar71xx-generic-wndr3700XXX-squashfs-factory.img quit
至少 Backfire 10.03 的镜像 (openwrt-ar71xx-wndr3700-squashfs-factory.img 06-Apr-2010 2424965) 默认没有开启无线功能，这是由于缺少无线芯片所需的某些内核模块，但这很容易修复。用SSH登陆到你的路由器（你可能首先需要使用Telnet连接到路由器并设置一个密码，请参考 首次登陆 ），然后运行以下指令（假设路由器已经有Internet的连接）：
# opkg update # opkg install kmod-ath9k wpad-mini
除非你在美国，否则在 OpenWrt 10.03 Backfire 中，2.4GHz 和 5GHz 可能都无法充分发挥其功能。（你会发现无法使用信道 12, 13 和 14，即使这些信道在你的地区是可以使用的，5GHz 信道也可能无法正确使用。功率等级也可能不符合你所在国家的要求。）
Personally, I think this is a ridiculous situation, but there seem to be issues with fixing it. You can do the job yourself as follows:
You may partially fix this by compiling a custom image with CONFIG_ATH_USER_REGD set in the Ath9k driver. This will, however, take a significant time to compile and result in a restriction to 20dBm max power output across all channels (this is apparently due to a bug according to my reading, but it's not fixed yet as far as I can tell). A much better option that will allow you to use the full legal power output in your country would be to follow the instructions here:
They're a little complex, so I've uploaded my fixed regulatory.bin to RapidShare to save you all the hassle of learning to compile one yourself. Hopefully someone will move it somewhere more permanent and update this. Anyhow, this is me doing my bit to make this whole process better and usable for more people…what you need to do is as follows:
cd /etc/config vi wireless
Add the following to each radio for your router (this will prevent you exceeding the regulatory limits in your country when you do the next bits):
(Where XX is the two letter country code for your country. For example, Australia is AU).
(if those are ISO 2 letter country codes, a list is available here: http://en.wikipedia.org/wiki/ISO_3166-1_alpha-2 If not, then someone please clarify what codes are those.)
2. Download the following file: https://rapidshare.com/files/458836427/regulatory.bin. Put it on a web server (sorry I can't give you a direct link, or you'd be able to do without this step (RapidShare doesn't allow direct downloads without looking at their page, so don't try to skip putting it on a web server or server on your network - hopefully someone can improve this process using their private server as the file's only tiny)). NEW: Instead of your own webserver, you can also use http://datatomb.de/mirror/stuff/regulatory.bin
Enter the following:
cd /usr/lib/crda/ rm regulatory.bin wget <web server URL>/regulatory.bin reboot
3. When your router comes up again, log in with SSH as you did before. Check the available channels and power outputs are as desired by entering:
4. If you want to see what settings I put in the regulatory DB (they're as per the article I linked at the beginning) you can get them here: https://rapidshare.com/files/458836748/db.txt . If for some reason you want to use this to set the proper regulatory settings for the USA, you need to use UX as the country code…otherwise all country codes are still correct.
The default network configuration is:
|Interface Name||Description||Default configuration|
|br-lan||LAN & WiFi||192.168.1.1/24|
|eth0||LAN ports (1 to 4)||None|
Numbers 0-3 are Ports 4 to 1 as labeled on the unit, 5 is the internal connection to the router itself. Don't be fooled: Port 1 on the unit is number 3 when configuring VLANs. vlan0 = eth0.0, vlan1 = eth0.1 and so on.
WAN port is a gigabit port. VLANs can be configured to work on both LAN and WAN.
To create a VLANx on WAN port (eth1) declare an interface as "eth1.x". It can be further bridged with one of the switch ports if necessary.
For the LAN interface two actions are needed:
When vlans are defined on the switch ports VLAN0 cannot be used on eth0 any more. So the default router configuration must be changed, otherwise traffic stops on the switch ports and hard reset is needed.
Here is an example. WAN port is trunked on VLAN6 and VLAN4. VLAN6 has dhcp protocol defined. VLAN4 is bridged with one of the switch ports. LAN ports 1-3 are assigned to default VLAN1 (VLAN0 is not possible for some reason). LAN port 4 is assigned to VLAN4 and bridged with WAN.
So all the traffic that goes to switch port 4 will also pass to WAN's vlan4. Switch port numbering is other way around from physical ports.
Note: The switch ports are not properly shown in the Backfire 10.03.1-rc4 Luci-interface, unless you add the chip name to the 'config switch' line: like 'config switch rtl8366s'. After making that addition, Luci shows the VLANs properly at the Network/Switch page. (Reference: https://dev.openwrt.org/ticket/7830 )
一个简单的配置是：橘色LED指示10/100 Mb/s连接，绿色指示1000 Mb/s连接，且在链路活动时闪烁：
swconfig dev rtl8366s port 1 set led 6 swconfig dev rtl8366s port 2 set led 9
你还可以通过这些值来控制LED闪烁的速率: 0 = 43ms, 1 = 84ms, 2 = 120ms, 3 = 170ms, 4 = 340ms, 5 = 670ms.
swconfig dev rtl8366s set blinkrate 2
请注意: 被编译到Backfire 10.03.1-rc4 (或更早版本)中的LED设置和路由器底部的说明不相符。为了使LED状态和标签一致，（绿色LED指示1000Mb/s)，可以对port1使用模式6，对port2使用模式9，对port5使用模式2。在后来的trunk和Backfire版本中均已修复这一情况。你可以使用swconfig命令行工具或者直接编辑文件'/etc/config/network'请参考：https://dev.openwrt.org/ticket/8103
向 /etc/config/system 增加USB LED 配置入口(你可以手动编辑文件或者使用Luci界面的“/System/LED_Configuration”配置页面)
应该在此增加一个入口 '/etc/hotplug.d/usb/10-usb'，然后你的USB LED就可以工作了。不要有其他幻想(比如磁盘活动时将闪烁)，但是这可以实现USB磁盘插入时点亮，卸载时熄灭。
文件 /etc/hotplug.d/usb/10-usb 的代码:
wifitoggle 软件包中自动配置了。只需要在 '/sbin/wifi' 脚本中创建按钮的hotplug事件。
opkg update opkg install wifitoggle
uci set wifitoggle.@wifitoggle.button=BTN_2 uci set wifitoggle.@wifitoggle.timer=0 uci commit wifitoggle
There is support for the WPS button removing the
wpad-mini package and installing the full version of
If you have a WPS enabled network device (like a 模式rn USB dongle), you can negotiate joining the routers wireless network without manually entering SSID & passkey. You just initiate "WPS authentication" by pushing the similar WPS button on the device (or launching the process by its driver/control software). After the device has initiated the authentication process, you can accept the transaction by using the WPS button on WNDR3700. The connection should then get negotiated, and in most cases in future your PC should remember the received network settings from then on.
After finding the information and browsing the hostapd package sourcecode, the needed actions for enabling the WPS button are pretty simple:
hostapd-utils. The reason is that the tool "hostapd_cli" and some needed support functions are not included in 'wpad-mini'. WPS authentication itself is launched with a command:
hostapd_cli -p /var/run/hostapd-phy0 wps_pbcIt tells the running hostapd daemon to participate in ongoing WPS authentication sequence. It needs to be run separately for each radio (= each existing hostapd process).
root@OpenWrt:~# wifi [..] root@OpenWrt:~# hostapd_cli -p /var/run/hostapd-phy0 wps_pbc Selected interface 'wlan0' OK root@OpenWrt:~#
/etc/hotplug.d/button/50-wpswith the package. See below.
wpsin trunk. /etc/hotplug.d/button/50-wps
if [ "$ACTION" = "pressed" -a "$BUTTON" = "BTN_1" ]; then for dir in /var/run/hostapd-*; do [ -d "$dir" ] || continue logger "WPS button active: $dir" hostapd_cli -p "$dir" wps_pbc done fi/etc/config/wireless
config 'wifi-iface' option 'device' 'radio0' option 'network' 'lan' option '模式' 'ap' option 'ssid' 'public' option 'encryption' 'psk2' option 'key' 'SecretKey' option 'wps_pushbutton' '1'If everything goes ok, you should see in Syslog not only the button events, but also succesful WPS authentication.
opkg update opkg install restorefactory
至少应为复位按钮设置正确的值。复位按钮在trunk中被称为 'reset' ，在Backfire final中被称为 'BTN_0' 。
uci set system.@restorefactory.button=reset uci commit system
利用USB转串口适配器很容易创建一个USB转串口的控制台。参考 usb.enabled.routers 来设置。
可以使用你喜欢的软件来连接控制台 - 我用的是miniterm，并使用了默认的9600波特率:
miniterm -b9600 -d/dev/ttyS0
|CPU/Speed||24Kc V7.4 680 MHz|
|Flash芯片:||v1: Spansion S25FL064P (FL064PIF) or Macronix MX25L6405DMI-12G, v2: Macronix MX25L12845EWI-10G|
|Flash容量:||v1 8192 KB；v2 16384KB|
|RAM芯片:||2 X Nanya NT5DS16M16CS-5T|
|无线模块:||Atheros AR9223 802.11bgn / Atheros AR9220 802.11an|
|USB:||有 1 x 2.0|
Internal J1 4-pin connector
3.3V serial port voltage !!!
COM port settings: Speed:115200, Data bits:8, Stop bits:1, Parity:none, Flow control:none
Internal J3 connector
14 Pin header
See port.jtag for more JTAG details.
如果你不幸将路由器刷成砖了，别害怕，你还可以使用 TFTP 协议来刷入一个新的固件。
务必注意：TFTP 传送固件很快（因为文件被存储到RAM中）。但是，路由器刷新固件将需要几分钟时间，之后会自动重启。一定保持耐心 – 参考: https://forum.openwrt.org/viewtopic.php?pid=103295#p103295
Forum user ole.h previously posted a method for unbricking the router easily with a TFTP client. Further to his post, if you use the factory reset button method, you don't need to worry about building a serial cable, trying to tap into any crazy boot timing sequence, or do anything else particularly tricky. It is simple and the following step-by-step process (cribbed from the ole.h's earlier notes, as well as from http://cyberstorm.altervista.org/wag354g/guides/howto_unbricking_wag354g_en.txt) will get you going. This assumes that you have a copy of the stock NETGEAR firmware in the current directory.
verbose trace rexmt 1 binary connect 192.168.1.1 put WNDR3700-V220.127.116.11NA.img (or whatever the filename is that you are trying to flash)
Once done, the router will flash itself to the stock NETGEAR firmware file that you provided and reboot automatically.
If you have a basic familiarity with RS232 signals and putting together basic electronic components, you should be able to follow these instructions to create a cable to attach to the WNDR3700's serial port.
The author of this section prefers a two-step process, that of using a USB-to-9-pin-serial (DB9) connector for the computer, and then building a separate 9-pin-serial-to-board interface. This allows you to leave the connector plugged into the board all of the time (and close the plastic case of the router!), without having a USB dongle hanging around when not using it. If you use a ribbon cable to connect to the header on the router, you can actually snake it out between the 4-port LAN jack and the WAN jack and still get the router's case back on (albeit a bit snugly), so the system looks pretty clean and polished even after adding the serial port connector.
For the computer-to-9-pin-serial part, you probably have two options:
Never ever connect RS232 directly to your router board !!! The +/- 12V RS232 will be frying your board. You need a 3V-TTL to RS232 level shifter like MAX3223 in between.
For step 1:
If you buy a premade USB-to-DB9 RS232 cable, this step is already done. (Whichever method you use, make sure that your OS has drivers for the USB converter that you are planning to use!)
If you go the CA-42 cable route, follow the "Determining the wiring assignment of your cable" steps listed in this page: http://buffalo.nas-central.org/index.php/Use_a_Nokia_Serial_Cable_on_an_ARM9_Linkstation. This page refers to a different router product, but the CA-42 cable being used is the same and your goal is to determine the pin/color assignments. You have to chop off the fancy Nokia connector and then strip wires to test wire colors with your multimeter to figure out which color corresponds to which Nokia pin number. Once you've figured that out:
Pin 6 of the Nokia connector should be wired to pin 3 on the DB9. Pin 7 of the Nokia connector should be wired to pin 2 on the DB9. Pin 8 of the Nokia connector should be wired to pin 5 on the DB9.
You should wire this cable with a male DB9 connector, which will connect to the female connector that you put on the board side of things.
For step 2:
For connecting to the WNDR3700 itself, forum user whiskas previously posted the pinout of the connector at http://img387.imageshack.us/i/26102009417.jpg/. The four pins on the board (reading from left to right in whiskas's photo) correspond to DB9 pin numbers 5, 3, 2 and no connection. You'll probably want to buy a crimp-style socket (I used a "IDC 10-pin dual row socket", which has more pins than we need but which works fine) and a ribbon cable that connects to it. Buy a 9-pin female DB9, carefully sort out which pins in the ribbon cable need to be connected to what, and crimp them into the right place. If you use crimp-style connectors, you can do this with no tools other than steady hands, and the IDC socket will slide right onto the board without having to solder anything.
According to the release notes in the NETGEAR-supplied GPL firmware, U-Boot can be upgraded using the following procedure. Note that you do not need to update U-Boot in order to install OpenWrt. Additionally, this has not yet been tested by the author of this wiki page, and you can permanently brick your router (with little hope of recovery, other than possibly finding a JTAG interface) if your U-boot image becomes corrupted:
Please burn u-boot-wndr3700-dni6-V1.7.bin Set up a tftp server on your PC, its ip address is 192.168.1.12. Entering into boot loader ag7100> set serverip 192.168.1.12 ag7100> tftp 0x80010000 u-boot-wndr3700-dni6-V1.7.bin ag7100> erase 0xbf000000 +0x70000 ag7100> cp.b 0x80010000 0xbf000000 0x50000 ag7100> reset Entering into boot loader again ag7100>bootm Then the device should be in tftp recovery 模式. Please run the command "tftp -i 192.168.1.1 put WNDR3700U-V18.104.22.168.img" on MS-DOS of your PC.
If, for whatever reason, you would prefer to avoid tftp flashing, it's possible to load a new image with y模式m (loady) or kermit (loadb). It's a good idea to use iminfo to verify the image's checksum before copying it to flash with cp.b. Remember to use the sysupgrade .bin file even if this is your initial flash from the factory firmware; the extra header in the factory .img is NOT required when flashing from U-Boot.
ar7100> loady 80800000 ## Ready for binary (y模式m) download to 0x80800000 at 115200 bps...(Begin the y模式m or kermit transfer)
## Total Size = 0x004d0004 = 5046276 Bytes ar7100> iminfo 80800000 ## Checking Image at 80800000 ... Image Name: MIPS OpenWrt Linux-3.3.8 Created: 2012-07-01 17:49:09 UTC Image Type: MIPS Linux Unknown Image (uncompressed) Data Size: 914224 Bytes = 892.8 kB Load Address: bf070000 Entry Point: bf070000 Verifying Checksum ... OK ar7100> erase 0xbf070000 +0x004d0004 Erase Flash from 0xbf070000 to 0xbf54ffff in Bank # 1 First 0x7 last 0x54 sector size 0x10000 84 Erased 78 sectors ar7100> cp.b 0x80800000 0xbf070000 0x004d0004 Copy to Flash... write addr: bf070000 done ar7100> boot
Note that the size value (0x004d0004 in this case) will vary from one image to another. Don't omit the "+" in the erase command as it's part of the command's syntax.
NEW: More and More people reports serious issues after correctly replace ram chips on WNDR3700V2. For now users are advised to stay away from extending RAM on WNDR 3700V2 untill we will have positive feedback on this procedure.
Warning: There are reports (User batu at http://eko.one.pl/forum/viewtopic.php?id=2454) that 333Mhz chips dont work with wndr3700v2. Use 400Mhz chips if available.
I used two Samsung K4H511638D-UCCC. You can use chips from other manufacturers, but they should be DDR400 32Mx16 organization in the package TSOP-II 66pin. Chips with other organizations, such as 64Mx8, do not fit.
A list of compatible chips:
|Samsung||K4H511638D-UCCC||400Mhz - definitely not working with wndr3700v2|
|Samsung||K4H511638B-TCB3||333Mhz - not working with wndr3700v2|
|Samsung||K4H511638D-UCB3||333Mhz - definitely not working with wndr3700v2|
|Hynix||HY5DU121622CTP-J||333Mhz - definitely not working with wndr3700v2|
|Hynix||HY5DU121622CTP-D43||333/400Mhz mixed reports. Propably not working with wndr3700v2|
U-Boot report after adding memory
U-Boot 1.1.4DNI1.6 (May 22 2009 - 16:37:44)
WNDR3700U (ar7100) U-boot 0.0.12
DRAM: b8050000: 0xc0140180
Top of RAM usable for U-Boot at: 88000000
Reserving 315k for U-Boot at: 87fb0000
Reserving 192k for malloc() at: 87f80000
Reserving 44 Bytes for Board Info at: 87f7ffd4
Reserving 36 Bytes for Global Data at: 87f7ffb0
Reserving 128k for boot params() at: 87f5ffb0
Stack Pointer at: 87f5ff98
Now running in RAM - U-Boot at: 87fb0000
id read 0x100000ff
flash size 8MB, sector count = 128
Flash: 8 MB
Need 4 U.FL connector, 4 cable UFL-F/RPSMA-F 13 centimeters long, 4 Antenna Level One (OAN-0501).
On board removes:
In place of the connector solder in U. FL connectors.
Solder shorts instead of capacitors AC77, AC113, AC148, AC186.
Solder shorts between 3 and 5-pin AS6 and AS8.
Solder shorts between 3 and 6 pin AS8 and AS10.
Drill four drill holes 6.5mm in the left side of the upper lid.
In a hole fasten cables UFL-F/RPSMA-F.
Insert the connector into the board as in the photo, and assemble the router.
Fasten to the connectors RPSMA-F antenna and turn on.