ASUS RT-N16

The Asus RT-N16 is a middle class router from 2010 with gigabit ethernet and 802.11n draft. It is based on the Broadcom BCM47xx SoC platform.

Since the Barrier Breaker release, OpenWrt has had almost full support for the Asus RT-N16. The following areas need further development in order to update this device's status to 'fully supported'.

• Like for most wireless solutions based on BCM4718, it uses the reverse engineered b43 driver by default. With this driver only 802.11g is supported, but you can easily get wireless 802.11n working by installing the Broadcom open source brcmsmac driver. Alternatively, for more functionality like 40MHz bandwidth you can use the closed source STA drivers, broadcom-wl. Advanced WiFi configurations have to be done via the wl utility however. For installation, refer to the bcm47xx platform's page.
• There are reports that the generic firmware is not accepted by the ASUS web interface, but it may work with TFTP. Thus a build is required that is tagged with a header such that it is accepted. A patch should be created for OpenWrt, adding support for generating a proper Asus firmware.
• The RESTORE button does not wipe the NVRAM, which can be done with the WPS button or in software. The RESTORE button can put the router into Asus rescue mode, or into OpenWrt recovery mode, see Failsafe Mode.

→ Install OpenWrt (generic explanation)

Just go to Administration→Upgrade and select your https://downloads.openwrt.org/chaos_calmer/15.05.1/brcm47xx/mips74k/openwrt-15.05.1-brcm47xx-mips74k-asus-rt-n16-squashfs.trx (tested for Tomato 1.28)

Below instructions install bleeding edge.

this is how i installed it from ddwrt ssh session:

cat /proc/mtd
cd /tmp

# Choose the version of OpenWRT you need. Below is an example:
wget https://downloads.openwrt.org/chaos_calmer/15.05/brcm47xx/mips74k/openwrt-15.05.1-brcm47xx-mips74k-asus-rt-n16-squashfs.trx
mtd -r write openwrt-15.05.1-brcm47xx-mips74k-asus-rt-n16-squashfs.trx linux

after router reboots, you should be able to telnet to 192.168.1.1 and go from there.

be sure to reset to default settings using :

otherwise things will be missing and misconfigured.

→flash.layout for a detailed explanations.

• ASUS has 4 partitions:
  • 0x 0000 0000-0x 0004 0000 : “boot”
  • 0x 0004 0000-0x 01fe 0000 : “linux”
  • 0x 001d ff88-0x 01fe 0000 : “rootfs”
  • 0x 01fe 0000-0x 0200 0000 : “nvram”

Note that (at least for some versions of the Asus firmware) the generic OpenWrt builds are not accepted by the ASUS web interface. Hence, there is a need for a special build for initial flashing, but it is not available yet. Until then, you can either use the methods below, or use the DD-WRT file for initial flashing and then flash OpenWrt through the DD-WRT web interface. The page at wl-500gp has detailed backup, flash, & recovery information which should largely apply to the RT-N16 as well.

The Asus RT-N16 has a mode that Asus calls “rescue mode”, which runs a TFTP server on the router. This is a failsafe or recovery mode that is built into the bootloader on various Asus routers (See here).

To enter rescue mode, disconnect power from the router first.

To reset the nvram, hold the WPS button while plugging in the power to the router. The router will restart twice.

Hold the RESTORE button while plugging in the power to the router. The power LED should start to blink (low frequency, ~1 time every 3 seconds) to show the router is in rescue mode, which runs the TFTP server.

If the light doesn't flash slowly, retry a few times, check you are holding the RESTORE button and not the WPS, and that you hold it for a little while after you plug in the power until it starts flashing.

Download the Asus Firmware Restoration Utility from their support website and install it on your PC.

When in rescue mode, the router's IP is 192.168.1.1, with a net mask of 255.255.255.0 and you need to use a static IP in the 192.168.1.x subnet to connect to it.

To configure your PC's ethernet interface from the command prompt, run a command prompt as Administrator. Use the following command to list the name of all interfaces:

Or run PowerShell as Administrator, then this command will return connected interfaces:

Note the relevant interface name (e.g. “Local Area Connection”, or “Ethernet 3”) and insert into the following command in place of “Local Area Connection”, but don't use 192.168.1.1 as this is the router's address in rescue mode:

Or in PowerShell, run this command (substituting the interface name):

Use the command ping 192.168.1.1, which should get a response from the router, including “TTL=100” to indicate it is in recovery mode.

Launch the Firmware Restoration utility, select the firmware and press the Upload button.

If you get a warning, ignore it, because we want OpenWRT. If it won't let you install at all, you may have to install using a TFTP program, or install DD-DRT first as mentioned here

• On Windows 10, go to PC Settings → Apps → Programs and Features. In the Programs and Features screen, select Turn Windows features on or off. Tick “TFTP Client”.
• On Windows 7 go to Start–> Control Panel–> Programs and Features. In the Programs and Features screen, select Turn Windows features on or off. Tick “TFTP Client”.
• From a command line do tftp -i 192.168.1.1 [filename to install]

It may now take several minutes. Be patient and enjoy a cup of tea or coffee.

Reconfigure your PC back to DHCP.

From a Command Prompt run as Administrator:

From PowerShell run as Administrator:

Connect to LuCI and proceed with the basic configuration.

Put the router into rescue mode (see above)

Get a TFTP client. For example to install from CLI on Ubuntu, you would use the following command;

When in rescue mode, the router's IP is 192.168.1.1, with a net mask of 255.255.255.0

Configure your PC's ethernet interface

Use the following command from a command line to list the name of all interfaces.

Note the relevant interface name (e.g. “eth0”, or “eth1”) and insert into the following command, but don't use 192.168.1.1 as this is the router's address in rescue mode.

Issue this command to ping the interface 4 times to be sure it's up:

(or just ping 192.168.1.1 then press Ctrl+C to break when ready)

If you get ping responses with “TTL=100” then it's in rescue mode and ready to flash.

Connect to the TFTP server :

Set it to binary mode transfer :

upload the firmware :

When it's complete the router will write the firmware and may not automatically reboot. Wait up to 5 minutes, then power off the router and restart it.

Put the router into rescue mode (see above).

MacOS has a built-in TFTP client that you can access via the command line/terminal. You can use this and follow the Linux instructions.

Alternately, search for Asus on the App Store and download their Firmware Restoration Utility, which will be somewhat similar to Windows, and somewhat similar to Linux for the interface configuration.

If you have forgotten your password, broken one of the startup scripts, firewalled yourself or corrupted the JFFS2 partition, you can get back in by using OpenWrt's failsafe mode. If you are unsuccesful solving the problem with OpenWrt's failsafe mode, i.e. you have bricked the device, you can use the built-in Asus rescue mode to flash a new image.

Follow these steps to boot into the OpenWrt failsafe mode:

• Unplug the router's power cord.
• Connect the router's LAN1 port directly to your PC.
• Configure your PC with a static IP address between 192.168.1.2 and 192.168.1.254. E. g. 192.168.1.2 (gateway and DNS is not required).
• Plug the power on and wait for the DMZ LED to light up.
• While the DMZ LED is on immediately press any button (Reset and Secure Easy Setup will work) a few times .
• If done right the DMZ LED will quickly flash 3 times every second.
• You should be able to telnet to the router at 192.168.1.1 now (no username and password)

NOTE: The root file system in failsafe mode is the SquashFS partition mounted in readonly mode. To switch to the normal writable root file system run mount_root and make any changes. Run mount_root now.

• Forgot/lost your password and you like to set a new one by running:
  passwd
• Forgot the routers IP address. Retrieve it by running:
  uci get network.lan.ipaddr
• You accidentally ran ipkg upgrade or filled up the flash by installing packages that are too big. In the latter case clean the JFFS2 partition and start over by running:
  mtd -r erase rootfs_data

If you are done with failsafe mode power cycle the router to boot in normal mode.

Since this is an Asus product you can also use the rescue mode, which is a failsafe included in the boot loader. This is the same procedure as OEM install using TFTP. If you cannot get the router into rescue mode (responding to pings with TTL=100), do the NVRAM reset first, described as follows, then attempt to enter rescue mode again.

To reset the NVRAM, hold the “WPS” button and plug in the router. When the 'PWR' light is blinking quickly, then when you let go of the WPS button, the router will perform a reboot, wipe and reboot again. Note that clearing NVRAM does not clear much of OpenWrt's configuration, unlike other router software which keep configuration data in NVRAM. Since OpenWrt's configuration is kept in the main JFFS file system, using UCI configuration files, if you cannot boot normally you can reset or change this with OpenWrt's failsafe mode. See also flash.layout.

Since this part is identical for all devices, see Basic configuration.

Switch ports 1-4 are for the LAN, and 0 is for the Internet (WAN) port. Note that the switch ports are the opposite of what is labeled on the device; thus switch port 1 is labeled LAN4, etc. Switch port 8 is the internal connection to the CPU. Not sure what happened to 5-7 but it's assumed they're just not wired out to anything.

The wireless should work with both the b43 and brcmsmac kernel modules. By default b43 module is used. If you plan to use 802.11-n capable brcmsmac module instead you should:

• remove kmod-b43 package,
• install kmod-brcmsmac package,
• delete /etc/config/wireless file
• reboot

In some circumstances the b43 will not be stable. Symptoms include the router rebooting semi-randomly (from 10 mins to 4 hours between reboots), this may be associated with heavy wifi-traffic. In this case use the brcmsmac drive, the same hardware works fine. (Tested on 15.05.1)

As an alternative the proprietary Broadcom module broadcom-wl can be used instead, it is contained in the package kmod-brcm-wl.

Installing process

# removing previous modules 
opkg remove kmod-b43 kmod-b43legacy kmod-mac80211 kmod-cfg80211 kmod-brcmsmac
# installing proprietary module and supported packages
opkg update; opkg install kmod-brcm-wl nas wlc wl 
# cleaning up wireless configuration and rebooting device
rm -f /etc/config/wireless; reboot 

On Chaos Calmer 15.05.1 with kmod-brcm-wl enabling 802.11n and 40MHz may cause all wireless functionality to be stop. The solution is manually editing config /etc/config/wireless, and setting option hwmode to '11ng' instead '11g'.

Working config

config wifi-device 'wl0'
        option type 'broadcom'
        option txantenna '3'
        option rxantenna '3'
        option hwmode '11ng'
        option channel '6'
        option htmode 'HT40'
        option txpower '24'

More about modules comparison can be read here, here, configuring example found on OpenWrt and 802.11n on Asus WL-500W (same wireless SoC).

If you want to compile Target System (Broadcom BCM947xx/953xx) Target Profile (Broadcom SoC, all Ethernet, BCM43xx WiFi (wl, proprietary))

For Barrier Breaker: Target System (Broadcom BCM47xx/53xx (MIPS)), Subtarget (MIPS 74K), Target Profile (Broadcom SoC, BCM43xx WiFi (wl, proprietary)).

Initially WLAN LED is not triggered by Wi-Fi driver. Edit /etc/config/system to enable it (tested with brcmsmac):

config led wlan_led
        option name 'WLAN'
        option sysfs 'bcm47xx:blue:wlan'
        option trigger 'netdev'
        option dev 'wlan0'
        option mode 'link tx rx'

The Asus RT-N16 has 2 buttons. They are Restore and WPS. The buttons can be used with hotplug events. E. g. [#wifitoggle WiFi toggle]. However they have different system namings, then those given on actually panel.

As default function of WPS something strange happens, after what only physical reboot helps. Above it is written that it clears NVRAM. And I was not as lucky to set ip up.

• Note the serial header on the board at at J2, you can see on the front of the board between the usb ports and the asus logo. It even came with pins and markings. Gnd, Vcc, Rx, Tx are clearly marked. They fit with a 4pin cd-rom audio or 4pin fan plug. I was able to get a serial terminal up using a CA-42 nokia usb-ttl serial adapter (found some ~$3.50 plus shipping on amazon), similar to the instructions on nslu2-linux.org. Using a usb-ttl serial adapter it is only necessary to have the Gnd, Tx, and Rx connected, not the Vcc.

Note: This will void your warranty!

How to connect to Serial Port :

You will need a TTL device to connect. These are available cheaply online from many different retailers. I picked up mine here :

http://www.ebay.com/itm/251082091781?ssPageName=STRK:MEWNX:IT

a PL2303 USB To RS232 TTL Converter Adapter Module.

This exposes a serial device to OS via USB. Connection should be made to the header on the RT-N16 matching RX→TX and TX→RX. Connect GND to GND. Then open up a terminal application, like PuTTY, and connect with 115200 baud, with 8 bits of data, no parity (8N1). Connecting VCC doesn't hurt.

This is recognized in WinXP, Win 7 and Linux (Ubuntu 11.10 checked). Drivers here : http://www.prolific.com.tw/US/ShowProduct.aspx?p_id=225&pcid=41

For connection in windows, use PuTTY. Find the COM port by using Device Manager to see where it has been assigned.

For connection in Linux : review serial pages for the connection.

There have been attempts to use the PCIe interface. See http://linux-mips-org.10913.n7.nabble.com/Re-brcm4716-and-PCIe-td56191.html

After unplugging and replugging the router's power it became unresponsive, even the LEDs were not lightning up. I opened the router to find a capacitor near the power supply (most likely a filter cap) which seemed slightly popped. The capacitor was a 680µF 16V. I didn't have any capacitor with the same specs at hand, so I replaced it with a capacitor with higher voltage/capacity ratings (1000µF 25V). After replacing the capacitor the router started working and the router configurations were still intact.

• ASUS factory firmware and sources available from ASUS support (choose OS “Others”)
• RT-N16 DebWrt wiki page
• Tech Info Depot Wiki
• WikiDevi
• Getting 802.11n working using closed source broadcom-wl driver http://blog.tklee.org/2014/11/use-80211n-on-asus-rt-n16-with-openwrt.html

Development information:

• Forum thread for the latest info
• George Kashperko's patches which were used to get the N16 working

How to add tags