User Tools

Site Tools



The Asus RT-N16 is a middle class router from 2010 with gigabit ethernet and 802.11n draft. It is based on the Broadcom BCM47xx SoC platform.

Supported Versions


The Barrier Breaker release have almost full support of Asus RT-N16. The following is a list of everything that needs polish in order to update this device's status to 'fully supported'.

  • Like for most wireless solutions based on BCM4718, it uses the reverse engineered b43 driver by default. With this driver only 802.11g is supported, but you can easily get wireless 802.11n working by installing the Broadcom open source brcmsmac driver. Alternatively, for more functionality like 40MHz bandwidth you can use the closed source STA drivers, broadcom-wl. Advanced WiFi configurations have to be done via the wl utility however. For installation, refer to the bcm47xx platform's page.
  • There are reports that the generic firmware is not accepted by the ASUS web interface, but it may work with TFTP. Thus a build is required that is tagged with a header such that it is accepted. A patch should be created for OpenWrt, adding support for generating a proper Asus firmware.
  • The reset button works only to take you to Asus's failsafe mode. Clearing NVRAM is done with the button labelled by WPS. The 'real' reset button can also put the router in OpenWrt recovery mode, see failsafe_mode.

Hardware Highlights

ModelVersionSoCCPU MHzFlash MBRAM MBWLAN HardwareWLAN2.4WLAN5.0100M portsGbit portsModemUSB
RT-N16Broadcom BCM471848032128Broadcom BCM4718b/g/n--5-2x 2.0


Install from Tomato

Install from ddwrt

Below instructions install bleeding edge.

this is how i installed it from ddwrt ssh session:

cat /proc/mtd
cd /tmp wget mtd -r write openwrt-15.05.1-brcm47xx-mips74k-asus-rt-n16-squashfs.trx linux

after router reboots, you should be able to telnet to and go from there.

be sure to reset to default settings using :


otherwise things will be missing and misconfigured.

Flash Layout

flash.layout for a detailed explanations.

  • ASUS has 4 partitions:
    • 0x 0000 0000-0x 0004 0000 : “boot”
    • 0x 0004 0000-0x 01fe 0000 : “linux”
    • 0x 001d ff88-0x 01fe 0000 : “rootfs”
    • 0x 01fe 0000-0x 0200 0000 : “nvram”

OEM easy installation

Note that (at least for some version of the Asus firmware) the generic OpenWrt builds are not accepted by the ASUS web interface. Hence, there is a need for a special build for initial flashing. A patch still needs to be made for this but it is not worked on as of yet. Until then, you can either use the methods below, or use the DD-WRT file for initial flashing and then flash OpenWrt through the DD-WRT web interface. The page at wl500gp has detailed backup, flash, & recovery information which should largely apply to the RT-N16 as well.

OEM installation using the TFTP method

From Windows

Flash from a Windows PC using the Firmware Restoration utility. (Download or install the Firmware Restoration Utility to your PC.)

The Asus RT-N16 has a failover mode, like the DIR-600 Bx (X=1,2).

To launch the recovery mode disconnect power from the router first.

Hold the WPS button while plugging in the power to the router to reset nvram, router will restart 2x. Hold the RESET button while plugging in the power to the router to get into recovery mode in which tftpd will be listening. The power LED should start to blink (low frequency, ~1 time every 3 seconds). Retry if that doesn't work for you.

The router IP in the recovery mode is

Configure your PC (don't use

netsh interface ip set address name=“Local Area Connection” static

Ping should give a response.

Launch the Firmware Restoration utility, select the firmware and press the Upload button.

Ignore the warning, we want to be on OpenWrt!

It may now take several minutes. Be patient and enjoy a cup of tea or coffee.

Reconfigure your PC back to DHCP

netsh interface ip set address name=“Local Area Connection” source=dhcp

Connect to http://openwrt.lan and proceed with the basic configuration.

This may work with other tftp utilities, too.

From Linux

The Asus RT-N16 has a failover mode, like the DIR-600 Bx (X=1,2).

Get a tftp client, Since Ubuntu is a popular choice snag it :

sudo apt-get install tftp

Now to modify the router … To launch the recovery mode disconnect power from the router first.

Hold the WPS button while plugging in the power to the router to reset nvram, router will restart 2x. Hold the RESET button while plugging in the power to the router to get into recovery mode in which tftpd will be listening. The power LED should start to blink (low frequency, ~1 time every 3 seconds). Retry if that doesn't work for you.

The router IP in the recovery mode is

Configure your box to use an ip; this specific IP is required in order to transfer via tftp.

sudo ifconfig eth0

Ping the interface to be sure it's up :


Ctrl+C to break.

If you get ping responses then it's up and ready to flash.


Set it to binary mode transfer :

mode binary

upload the firmware :

put openwrt-brcm47xx-squashfs.trx

When it's complete the router will be writing the firmware and may not automatically reboot. Wait up to 5 minutes, then power off the router and plug it back in.

Upgrading OpenWrt

LuCI Web Upgrade Process

Terminal Upgrade Process

Failsafe mode

If you forgot your password, broken one of the startup scripts, firewalled yourself or corrupted the JFFS2 partition, you can get back in by using OpenWrt's failsafe mode. If you are unsuccesful solving the problem with OpenWrt's failsafe mode, i.e. you have bricked the device, you can use Asus's failsafe mode to flash a new image.

OpenWrt Failsafe Mode

Follow these steps to boot into the OpenWrt failsafe mode:

  • Unplug the router's power cord.
  • Connect the router's LAN1 port directly to your PC.
  • Configure your PC with a static IP address between and E. g. (gateway and DNS is not required).
  • Plug the power on and wait for the DMZ LED to light up.
  • While the DMZ LED is on immediately press any button (Reset and Secure Easy Setup will work) a few times .
  • If done right the DMZ LED will quickly flash 3 times every second.
  • You should be able to telnet to the router at now (no username and password)

What to do in failsafe mode?

NOTE: The root file system in failsafe mode is the SquashFS partition mounted in readonly mode. To switch to the normal writable root file system run mount_root and make any changes. Run mount_root now.

  • Forgot/lost your password and you like to set a new one by running:
  • Forgot the routers IP address. Retrieve it by running:
    uci get network.lan.ipaddr
  • You accidentally ran ipkg upgrade or filled up the flash by installing packages that are too big. In the latter case clean the JFFS2 partition and start over by running:
    mtd -r erase rootfs_data

If you are done with failsafe mode power cycle the router to boot in normal mode.

Asus Recovery Mode

Since this is an Asus product you can also use the failsafe mode (included in the boot loader). Press and hold the “Reset” button on the back of the device, then plug it in. When the 'PWR' light blinks slowly then it is listening in TFTP mode (~ once every 3 seconds). The default address is If this is not pingable, do the NVRAM reset first, described as follows.

To reset the NVRAM, hold the “WPS” button and plug in the router. When the 'PWR' light is blinking quickly, then when you let go of the WPS button, the router will perform a reboot, wipe and reboot again. Note that clearing NVRAM does not clear much of OpenWrt's configuration, unlike other router software which keep configuration data in NVRAM. Since OpenWrt's configuration is kept in the main JFFS file system, using UCI configuration files, if you cannot boot normally you can reset or change this with OpenWrt's failsafe mode. See also flash.layout.

Basic configuration

Since this part is identical for all devices, see Basic configuration.

Specific Configuration


Switch Ports (for VLANs)

Switch ports 1-4 are for the LAN, and 0 is for the Internet (WAN) port. Note that the switch ports are the opposite of what is labeled on the device; thus switch port 1 is labeled LAN4, etc. Switch port 8 is the internal connection to the CPU. Not sure what happened to 5-7 but it's assumed they're just not wired out to anything.

Port Switch port
CPU (Internal) 8
Internet (WAN) 0
LAN 1 4
LAN 2 3
LAN 3 2
LAN 4 1


The wireless should work with both the b43 and brcmsmac kernel modules. By default b43 module is used. If you plan to use 802.11-n capable brcmsmac module instead you should:

  • remove kmod-b43 package,
  • install kmod-brcmsmac package,
  • delete /etc/config/wireless file
  • reboot

In some circumstances the b43 will not be stable. Symptoms include the router rebooting semi-randomly (from 10 mins to 4 hours between reboots), this may be associated with heavy wifi-traffic. In this case use the brcmsmac drive, the same hardware works fine. (Tested on 15.05.1)

As an alternative the proprietary Broadcom module broadcom-wl can be used instead, it is contained in the package kmod-brcm-wl.

Installing process

# removing previous modules 
opkg remove kmod-b43 kmod-b43legacy kmod-mac80211 kmod-cfg80211 kmod-brcmsmac
# installing proprietary module and supported packages
opkg update; opkg install kmod-brcm-wl nas wlc wl 
# cleaning up wireless configuration and rebooting device
rm -f /etc/config/wireless; reboot 

On Chaos Calmer 15.05.1 with kmod-brcm-wl enabling 802.11n and 40MHz may cause all wireless functionality to be stop. The solution is manually editing config /etc/config/wireless, and setting option hwmode to '11ng' instead '11g'.

Working config

config wifi-device 'wl0'
        option type 'broadcom'
        option txantenna '3'
        option rxantenna '3'
        option hwmode '11ng'
        option channel '6'
        option htmode 'HT40'
        option txpower '24'

More about modules comparison can be read here, here, configuring example found on OpenWrt and 802.11n on Asus WL-500W (same wireless SoC).

Compiling From Source

If you want to compile Target System (Broadcom BCM947xx/953xx) Target Profile (Broadcom SoC, all Ethernet, BCM43xx WiFi (wl, proprietary))

For Barrier Breaker: Target System (Broadcom BCM47xx/53xx (MIPS)), Subtarget (MIPS 74K), Target Profile (Broadcom SoC, BCM43xx WiFi (wl, proprietary)).



Initially WLAN LED is not triggered by Wi-Fi driver. Edit /etc/config/system to enable it (tested with brcmsmac):

config led wlan_led
        option name 'WLAN'
        option sysfs 'bcm47xx:blue:wlan'
        option trigger 'netdev'
        option dev 'wlan0'
        option mode 'link tx rx'


The Asus RT-N16 has 2 buttons. They are Restore and WPS. The buttons can be used with hotplug events. E. g. [#wifitoggle WiFi toggle]. However they have different system namings, then those given on actually panel.

BUTTON System naming Event
RESTORE reset reset
WPS wps ???

As default function of WPS something strange happens, after what only physical reboot helps. Above it is written that it clears NVRAM. And I was not as lucky to set ip up.



Architecture MIPS
Vendor Broadcom
Bootloader CFE
System-On-Chip Broadcom BCM4718 (MIPS 74KTM )
CPU Broadcom BCM4716 chip rev 1 (MIPS 74K V4.0 480 MHz)
Flash size 32 MiB
RAM 128 MiB
Wireless Broadcom BCM43xx 802.11b/g (integrated)
Ethernet Broadcom bcm53115skfbg
USB Yes 2 x 2.0
Serial Yes


circuit board top circuit board top circuit board bottom

  • Note the serial header on the board at at J2, you can see on the front of the board between the usb ports and the asus logo. It even came with pins and markings. Gnd, Vcc, Rx, Tx are clearly marked. They fit with a 4pin cd-rom audio or 4pin fan plug. I was able to get a serial terminal up using a CA-42 nokia usb-ttl serial adapter (found some ~$3.50 plus shipping on amazon), similar to the instructions on Using a usb-ttl serial adapter it is only necessary to have the Gnd, Tx, and Rx connected, not the Vcc.

Opening the case

Note: This will void your warranty!


How to connect to Serial Port :

You will need a TTL device to connect. These are available cheaply online from many different retailers. I picked up mine here :

a PL2303 USB To RS232 TTL Converter Adapter Module.

This exposes a serial device to OS via USB. Connection should be made to the header on the RT-N16 matching RX→TX and TX→RX. Connect GND to GND. Then open up a terminal application, like PuTTY, and connect with 115200 baud, with 8 bits of data, no parity (8N1). Connecting VCC doesn't hurt.

This is recognized in WinXP, Win 7 and Linux (Ubuntu 11.10 checked). Drivers here :

For connection in windows, use PuTTY. Find the COM port by using Device Manager to see where it has been assigned.

For connection in Linux : review serial pages for the connection.


Hardware mods

There have been attempts to use the PCIe interface. See rt-n16_back_hires.jpg

Fixing Bad Capacitors

After unplugging and replugging the router's power it became unresponsive, even the LEDs were not lightning up. I opened the router to find a capacitor near the power supply (most likely a filter cap) which seemed slightly popped. The capacitor was a 680µF 16V. I didn't have any capacitor with the same specs at hand, so I replaced it with a capacitor with higher voltage/capacity ratings (1000µF 25V). After replacing the capacitor the router started working and the router configurations were still intact.

Bad Cap New Cap

Other Info

Development information:


This website uses cookies. By using the website, you agree with storing cookies on your computer. Also you acknowledge that you have read and understand our Privacy Policy. If you do not agree leave the website.More information about cookies
toh/asus/rt-n16.txt · Last modified: 2019/09/30 16:42 by tmomas