NETGEAR Orbi Pro WiFi 6 Satellite: SXS80

Netgear Orbi Pro Wifi 6 Satellite device SXS80.

Part of the 'NETGEAR Orbi Pro WiFi 6 Tri-band Mesh System (SXK80)', which consists of:

• a Router device (SXR80)
• optionally one or more Satellite devices (SXS80)

The SXS80 has:

• 5 Ethernet ports
• a 5 GHz radio that supports the lower 5 GHz channels
• a 2.4 GHz radio
• a 5 GHz radio that supports both lower and upper 5 GHz channels

With OpenWrt installed, it is functionally equivalent to an SXR80 device, and can be used as standalone router if so desired.

The SXS80 Satellite looks exactly like the SXR80 Router, except:

• The SXS80 has 'Satellite' written on the back above the power connector, and has 5 LAN ports, numbered 1 to 5.
• The SXR80 has 'Router' printed on the back above the power connector, and has 1 yellow WAN port, numbered 1, and 4 LAN ports, numbered 2 to 5.

None at this time.

→ Install OpenWrt (generic explanation)

• Netgear Orbi Pro Wifi 6 SXR80 router
  • (On the back, above the power connector, it says 'Router', and it has a yellow Ethernet port 'WAN')
• Netgear Orbi Pro Wifi 6 SXS80 satellite(s)
  • (On the back, above the power connector, it says 'Satellite', and it does NOT have a yellow Ethernet port).
• A PC, or Laptop, or other device you want to install OpenWrt from, with an Ethernet port.
• An Ethernet cable.

First make sure you have an alternative router for internet access, and don't depend on the Orbi Pro 6 setup, in any way, because installing OpenWrt and configuring it takes a while.

The aim is to install by attaching an Ethernet cable, and to avoid having to open the devices and attach a serial connector to their main boards.

With the original Netgear firmware, the SXS80 satellites get their IP address assigned from the SXR80 router via DHCP. This means that they only have an IP address while connected to the router. Therefore, first install OpenWrt on all satellites, and last on the router.

1. Make sure that the router and all satellites are connected and operational.
   • If necessary (lost password, ...), factory reset them with the 'Reset' button in a small hole next to the power connector at the back.
2. Make sure that the router and all satellites have original Netgear firmware version V4.3.3.200 installed. It may also work with other firmware versions, but this has not been tested and is not recommended.
3. Disconnect the WAN port of the router, and keep it disconnected until the installation of OpenWrt on all satellites and the router itself is completed.
   • The reason that the WAN port needs to remain disconnected is that the original firmware of the router is smart: it uses a DHCP client to get an IP address for itself on the WAN port, and if that IP address conflicts with the IP range defined for its own LAN1, it changes the range for its own LAN1 automatically. This changes the IP addresses of the router itself and the satellites. The installation procedure requires that its LAN1 range remains 192.168.1.0.
4. Make sure that the router and satellites have IP address range 192.168.1.0 for LAN1. Be sure to reboot the router and satellites after changing the IP address range to 192.168.1.0.

• See also netgear_orbi_pro_sxs80
• Browse to “https://downloads.openwrt.org/releases/24.10.5/targets/qualcommax/ipq807x/”.
• Below, make sure that you download the '*sxs80*' files, not the '*sxr80*' files.
• Download “netgear_sxs80-initramfs-uImage.itb”, and make a note of the the SHA256sum next to the link.
  • The file you download as a result should be named “openwrt-24.10.5-qualcommax-ipq807x-netgear_sxs80-initramfs-uImage.itb”.
  • This is the kernel image to boot the SXS80 from.
  • Check the sha256sum of the file. If it does not match, your device could become bricked.
  • You will need to check the sha256sum again later.
• Download “netgear_sxs80-initramfs-uImage.itb”, and make a note of the the SHA256sum next to the link.
  • The file you download as a result should be named “openwrt-24.10.5-qualcommax-ipq807x-netgear_sxs80-squashfs-sysupgrade.bin”
  • This is the upgrade image to flash on the SXS80 after the initial kernel image boots.
  • Check the sha256sum of the file. If it does not match, your device could become bricked.
  • You will need to check the sha256sum again later.
• The “*.ubi” file on the same webpage is not required. It is used for a different method of installation that is not suited for Orbi Pro Wifi 6 devices.
• Keep the downloaded files in your Download folder, even after you copy them to your TFTP server below.

The installation procedure requires that you set up a TFTP server on the PC you connect to the SXS80 to install OpenWrt from.

See setting_up_a_tftp_server_for_tftp_recovery to learn how to set up a TFTP server.

It is possible to use a TFTP server on a different computer than the one you connect to the SXS80 with, but that is outside the scope of this procedure.

In the root directory of the TFP server, you should place the OpenWrt firmware image files:

• “openwrt-24.10.5-qualcommax-ipq807x-netgear_sxs80-initramfs-uImage.itb”
• “openwrt-24.10.5-qualcommax-ipq807x-netgear_sxs80-squashfs-sysupgrade.bin”

Again, make sure that you have the '*sxs80*' files, not the '*sxr80*' files.

This procedure requires that you can log in to the router Web UI, and that the satellite is operational and connected to the router.

One way to be sure that you have the correct SXS80 device, is to power off all other SXS80 devices.

Determine the IP address of the SXS80 device:

1. Log in to the Web UI of the SXR80 router.
2. Go to ADVANCED → Administration → Attached Devices → Wireless Devices.
3. Find the IP address of the SXS80 device you wish to install OpenWrt on.

More information about the installation procedure can be found here:

• ?p=openwrt/openwrt.git;a=commit;h=0f5c28b96b4e04332b6e9f31280c57b03c672cfd
• https://forum.openwrt.org/t/support-for-netgear-orbi-sxk80/97797

1. Find an Ethernet port on the back of the SXS80 that allows access to the SXS80's own Web UI.
   • Connect a cable from your PC to Ethernet port 2 on the back of the SXS80.
   • Configure the network interface of the Ethernet port of the PC that has the cable to the SXS80 connected to it to use DHCP to get an IP address.
   • See which IP address your PC gets. It should be in IP address 192.168.1.0. If not, you'll need to connect to a different Ethernet port on the back of the SXS80.
   • Open a browser and browse to "http://" followed by the IP address of the SXS80, followed by "/debug.htm". For example: "http://192.168.1.x/debug.htm".
   • Log in and check the box to enable telnet: [v] Enable Telnet. This takes effect immediately. After reboot of the SXS80, it is disabled again, so you will have to enable it again.
     
     
2. Reconfigure the network interface of the Ethernet port of the PC that has the cable to the SXS80 connected to it and set the IP address 192.168.1.10. The SXS80 will look for the TFTP server on 192.168.1.10 to download the OpenWrt image.
   
   
3. Telnet to the SXS80. Use the same login and password as for its Web UI.
   
   
4. You should now see a command prompt, typically:

   root@SXS80:~#

   Execute the following command:

   fw_setenv bootcmd 'env default -a; saveenv; reset'

   The first time you execute this command, you may get the warning:

   Warning: Bad CRC, using default environment

   If you get this warning, DO NOT CONTINUE. To be sure, repeat the command until it no longer produces this warning.
   Execute the following command:

   fw_printenv

   This command should not produce a warning, and should output something similar to:

   bootdelay=5
   baudrate=115200
   bootcmd=env default -a; saveenv; reset

   The bootcmd output by fw_printenv should match exactly

   env default -a; saveenv; reset

   • Details: The bootcmd 'env default -a; saveenv; reset' will be executed during the next boot of the SXS80. It will make the boot loader reveal information that is required to boot from the OpenWrt firmware on the TFTP server at 192.168.1.10 in a next step. The SXS80 will still boot into the original Netgear formware as before.
     
     
5. Execute the following command to reboot the SXS80:

   reboot

   and wait for the SXS80 to reboot.
   Enable telnet again like before:

   • Browse to http://192.168.1.x/debug.htm. It may take a while for the Web UI to become available again after reboot. Retry if it's not ready yet.
   • Log in and check the box to enable telnet: [v] Enable Telnet.
   • Telnet to the SXS80. Use the same login and password as for its Web UI.
     
     
6. Execute the following command:

   fw_printenv

   The output should look similar to this:

   baudrate=115200
   bootargs=console=ttyMSM0,115200n8
   bootcmd=mii write 0x0 0x0 0x800; sleep 1; nmrp; bootdni; boot_DNI_secureboot
   bootdelay=2
   ipaddr=192.168.1.x
   netmask=255.255.255.0
   serverip=192.168.1.10
   soc_version_major=2
   soc_version_minor=0

   WARNING: If fw_printenv produces

   Warning: Bad CRC, using default environment

   DO NOT CONTINUE, YOU WILL BRICK YOUR DEVICE. Ask for help on the OpenWrt forum.
   WARNING: if the value of 'bootcmd' is not exactly equal to

   mii write 0x0 0x0 0x800; sleep 1; nmrp; bootdni; boot_DNI_secureboot

   DO NOT CONTINE, YOU WILL BRICK YOUR DEVICE. Ask for help on the OpenWrt forum.

7. Execute the following command:

   fw_setenv originalboot 'mii write 0x0 0x0 0x800; sleep 1; nmrp; bootdni; boot_DNI_secureboot'

   This should match exactly what's after 'bootcmd=' displayed on your SXS80 in step 6.

8. Execute the following commands:

   fw_setenv wrttftp 'mii write 0x0 0x0 0x800; sleep 1; nmrp; if tftpboot openwrt-24.10.5-qualcommax-ipq807x-netgear_sxs80-initramfs-uImage.itb; then bootm; fi; bootdni; boot_DNI_secureboot'
   fw_setenv wrtboot 'mii write 0x0 0x0 0x800; sleep 1; nmrp; nand read 0x40000000 0x1980000 0x06d00000; bootm 0x40000000'
   fw_setenv bootcmd 'run wrttftp'

   Verify the result by executing:

   fw_printenv

   The output should look like:

   baudrate=115200
   bootargs=console=ttyMSM0,115200n8
   bootdelay=2
   ipaddr=192.168.1.1
   netmask=255.255.255.0
   serverip=192.168.1.10
   soc_version_major=2
   soc_version_minor=0
   originalboot=mii write 0x0 0x0 0x800; sleep 1; nmrp; bootdni; boot_DNI_secureboot
   wrttftp=mii write 0x0 0x0 0x800; sleep 1; nmrp; if tftpboot openwrt-24.10.5-qualcommax-ipq807x-netgear_sxs80-initramfs-uImage.itb; then bootm; fi; bootdni; boot_DNI_secureboot
   wrtboot=mii write 0x0 0x0 0x800; sleep 1; nmrp; nand read 0x40000000 0x1980000 0x06d00000; bootm 0x40000000
   bootcmd=run wrttftp

   • Details: The first fw_setenv command defines a command sequence named 'wrttftp' for execution during boot of the SXS80. The command sequence attempts to download the initial OpenWrt image from the TFTP server you set up at 192.168.1.10. If successful, it boots into OpenWrt. If unsuccessful, it boots into the original Netgear firmware. This command sequence makes no permanent changes. The OpenWrt image is downloaded into temporary memory only, then booted. The original Netgear firmware is still present in the persistent flash memory of the SXS80.
     
     
   • Details: The second fw_setenv command defines a command sequence named 'wrtboot' for execution during boot of the SXS80. It is for use after the OpenWrt firmware upgrade has been flashed, and the original Netgear firmware has been overwritten. This is the command sequence that can boot the OpenWrt firmware from flash memory.
     
     
   • Details: The third fw_setenv command sets the 'wrttftp' command sequence to be executed during the next boot.
     
     
9. Ensure that the cable from your PC to the SXS80 is connected and remains connected during the next step.
10. Execute the following command to reboot the SXS80:

    reboot

    and wait for the SXS80 to reboot.
    
    If the SXS80 boots into OpenWrt successfully, During boot you should see the LED light on the front panel blinking white slowly, then blinking blue rapidly, then blinking blue less rapidly, then turning a steady green.
    
    The SXS80 downloads the OpenWrt image into temporary memory only. The original Netgear firmware is still present in the persistent flash memory of the SXS80. If necessary, you can still boot into the Netgear firmware by disconnecting the Ethernet cable from your PC to make the TFTP server unavailable, and powercycling the SXS80.
    
    If the SXS80 does not successfully boot into OpenWrt, check the log of the TFTP server to see what's wrong, fix it, and reboot the SXS80 again (no need to do it via telnet, you can powercycle it).
    
    A few notes about the OpenWrt image that has booted:

    • OpenWrt uses Ethernet port 1 on the back of the SXS80 as the WAN port.
    • OpenWrt uses IP address 192.168.1.1.
    • OpenWrt runs an SSH server instead of a Telnet server.
    • OpenWrt uses user 'root' for login, and will accept any password.
      
      
11. If the Ethernet cable from your PC was connected to Ethernet port 1 on the SXS80, change it to any of Ethernet ports 2, 3, 4, or 5.
    Log into the SXS80 via SSH, as user 'root'.
    Execute the following command:

    fw_printenv

    The output should still look like:

    baudrate=115200
    bootargs=console=ttyMSM0,115200n8
    bootdelay=2
    ipaddr=192.168.1.1
    netmask=255.255.255.0
    serverip=192.168.1.10
    soc_version_major=2
    soc_version_minor=0
    originalboot=mii write 0x0 0x0 0x800; sleep 1; nmrp; bootdni; boot_DNI_secureboot
    wrttftp=mii write 0x0 0x0 0x800; sleep 1; nmrp; if tftpboot openwrt-24.10.5-qualcommax-ipq807x-netgear_sxs80-initramfs-uImage.itb; then bootm; fi; bootdni; boot_DNI_secureboot
    wrtboot=mii write 0x0 0x0 0x800; sleep 1; nmrp; nand read 0x40000000 0x1980000 0x06d00000; bootm 0x40000000
    bootcmd=run wrttftp

    WARNING: From here, do not reboot or powercycle the SXS80 until after OpenWrt has been flashed successfully and you reach step 13.
    The next command sets the bootcmd to boot from the OpenWrt image that has not been flashed yet. It can't boot the original Netgear firmware.
    If you reboot or powercycle after this command, and before a successful flash, YOU WILL BRICK THE DEVICE, and the only way to recover is by opening the device and connecting a serial cable. This may require soldering.
    Execute the following command:

    fw_setenv bootcmd 'run wrtboot'

    Execute the following command: <codefw_printenv</code> The output should look like:

    baudrate=115200
    bootargs=console=ttyMSM0,115200n8
    bootdelay=2
    ipaddr=192.168.1.1
    netmask=255.255.255.0
    serverip=192.168.1.10
    soc_version_major=2
    soc_version_minor=0
    originalboot=mii write 0x0 0x0 0x800; sleep 1; nmrp; bootdni; boot_DNI_secureboot
    wrtboot=mii write 0x0 0x0 0x800; sleep 1; nmrp; nand read 0x40000000 0x1980000 0x06d00000; bootm 0x40000000
    wrttftp=mii write 0x0 0x0 0x800; sleep 1; nmrp; if tftpboot openwrt-24.10.5-qualcommax-ipq807x-netgear_sxs80-initramfs-uImage.itb; then bootm; fi; bootdni; boot_DNI_secureboot
    bootcmd=run wrtboot

    Verify that bootcmd=run wrtboot.
    
    

12. WARNING: If for some reason you need to power down your SXS80 device without having flashed OpenWrt, execute command fw_setenv bootcmd 'run wrttftp' first. Otherwise you WILL BRICK YOUR DEVICE.
    • Open in your browser: https://192.168.1.1. User: root, password: root.
    • You should see:

      System running in recovery (initramfs) mode.
      No changes to settings will be stored and are lost after rebooting. This mode should only be used to install a firmware upgrade
                                                                                         Go to firmware upgrade...

    • Click on 'Go to firmware upgrade...'
    • Click 'Flash Image...'
    • You should see 'Uploading file...' 'Please select the file to upload.'
    • Click 'Browse...'
    • Select “openwrt-24.10.5-qualcommax-ipq807x-netgear_sxs80-squashfs-sysupgrade.bin” from the Download folder on your PC.
    • Click Upload
    • Check the SHA256SUM that the Web UI shows you.
      If this does not match, DO NOT CONTINUE OR YOU WILL BRICK YOUR SXS80. Check the sha256sum of the file in the Download folder on your PC, and download a new copy if necessary, then try the firmware upgrade again.
    • Disable [ ] Keep settings...
    • Disable [ ] Include in backup ...
    • Click continue
    • OpenWrt will flash the OpenWrt firmware image, then reboot.
      
      
13. As before, you should see the LED light on the front panel blinking white slowly, then blinking blue rapidly, then blinking blue less rapidly, then turning a steady green.
    
    The Web UI should no longer show “System running in recovery (initramfs) mode.”.
    
    Now you have OpenWrt on your device permanently. It's available at 192.168.1.1 via SSH and the Web UI.

Remember: Install OpenWrt on the other SXS80 satellites before installing it on the SXR80 Router.

With OpenWrt installed:

cat /proc/mtd
dev:    size   erasesize  name
mtd0: 00100000 00020000 "0:sbl1"
mtd1: 00100000 00020000 "0:mibib"
mtd2: 00080000 00020000 "0:bootconfig"
mtd3: 00080000 00020000 "0:bootconfig_1"
mtd4: 00300000 00020000 "0:qsee"
mtd5: 00300000 00020000 "0:qsee_1"
mtd6: 00080000 00020000 "0:devcfg"
mtd7: 00080000 00020000 "0:devcfg_1"
mtd8: 00080000 00020000 "0:apdp"
mtd9: 00080000 00020000 "0:apdp_1"
mtd10: 00080000 00020000 "0:rpm"
mtd11: 00080000 00020000 "0:rpm_1"
mtd12: 00080000 00020000 "0:cdt"
mtd13: 00080000 00020000 "0:cdt_1"
mtd14: 00080000 00020000 "0:appsblenv"
mtd15: 00100000 00020000 "0:appsbl"
mtd16: 00100000 00020000 "0:appsbl_1"
mtd17: 00080000 00020000 "0:art"
mtd18: 00080000 00020000 "0:art.bak"
mtd19: 00100000 00020000 "config"
mtd20: 00100000 00020000 "boarddata1"
mtd21: 00100000 00020000 "boarddata2"
mtd22: 00100000 00020000 "pot"
mtd23: 00500000 00020000 "dnidata"
mtd24: 00620000 00020000 "kernel"
mtd25: 066e0000 00020000 "rootfs"
mtd26: 00620000 00020000 "kernel2"
mtd27: 066e0000 00020000 "rootfs2"

→ generic.flashing.tftp

This does not apply to the SXS80.

→ generic.sysupgrade

• Browse to http://192.168.1.1/cgi-bin/luci/mini/system/upgrade/ LuCI Upgrade URL
• Upload image file for sysupgrade to LuCI
• Wait for reboot

If you don't have a GUI (LuCI) available, you can alternatively upgrade via the command line. There are two command line methods for upgrading:

• sysupgrade
• mtd

Note: It is important that you put the firmware image into the ramdisk (/tmp) before you start flashing.

• Login as root via SSH on 192.168.1.1, then enter the following commands:

cd /tmp
wget http://downloads.openwrt.org/snapshots/trunk/XXX/xxx.abc
sysupgrade /tmp/xxx.abc

If sysupgrade does not support this router, use mtd.

• Login as root via SSH on 192.168.1.1, then enter the following commands:

cd /tmp
wget http://downloads.openwrt.org/snapshots/trunk/XXX/xxx.abc
mtd write /tmp/xxx.abc linux && reboot

→ generic.debrick

See https://forum.openwrt.org/t/support-for-netgear-orbi-sxk80/97797/182

→ failsafe_and_factory_reset

For the SXS80, pressing the Sync button on the back during boot seems to have no effect.

Try a Factory Reset:

• Boot the SXS80 device until the light is green.
• With a pin, press the Reset button in the small hole next to the power connector at the back of the device, until the LED light on the front flashes red repeatedly, then release the Reset button.
• Wait until the device reboots and the LED light on the front becomes green again.
• The device reverts to IP address 192.168.1.1, and its wifi will be disabled.
• Connect a cable to Ethernet port 2-5 (not to ethernet port 1 = wan).
• Browsing to https://192.168.1.1 should work.
• ssh root@192.168.1.1 should work.
• You will need to restore a backup of your settings via the Web UI, or configure it from scratch.

→ Basic configuration After flashing, proceed with this.
Set up your Internet connection, configure wireless, configure USB port, etc.

The default network configuration is:

By default, all incoming connections to Ethernet port 1 are rejected. Masquerading is enabled for Ethernet port 1.

All Ethernet ports are freely configurable.

By default, LAN port 1 configured as the WAN port to connect to the internet.

By default, LAN ports 2, 3, 4 and 5 are configured for local network 192.168.1.0, with the dnsmasq DHCP server listening.

→ hardware.button on howto use and configure the hardware button(s). Here, we merely name the buttons, so we can use them in the above Howto.

Please fill in real values for this device, then remove the EXAMPLEs

The Netgear SXS80 has the following buttons:

BUTTON	Event
Reset
Sync

With OpenWrt installed, the front status LED is green and always on after boot.

It is very bright in a dark environment.

You can turn it off via LuCI on the System > LED Configuration page.

Front:
Insert photo of front of the casing

Back:
Insert photo of back of the casing

Backside label:
Insert photo of backside label

→ Warranty

The device is End of Life: https://www.netgear.com/support/product/sxs80

To remove the cover and open the device, you need to remove the rubber feet. Additional steps.

Main PCB:
Insert photo of PCB

→ port.serial general information about the serial port, serial port cable, etc.

How to connect to the Serial Port of this specific device:
Insert photo of PCB with markings for serial port

→ port.jtag general information about the JTAG port, JTAG cable, etc.

How to connect to the JTAG Port of this specific device:
Insert photo of PCB with markings for JTAG port

→ bootloader

None so far.

Space for additional notes, links to forum threads or other resources.

• ...

How to add tags