NETGEAR R6400 v2

NETGEAR AC1750 dual band router on the Broadcom Northstar ARM platform: the R6400 v1 board on the newer SoC die (BCM4708C0, BCM47094 family, 1 GHz). Same board layout, GPIOs, LEDs, buttons and switch as the v1, but it needs its own images, and there are two of them (see below).

The stock firmware and the bootloader only accept a factory image with the router's own board ID. The board ID is not on the label: check it before flashing (see Installation). Once OpenWrt runs, sysupgrade accepts either v2 image (T20 and T30 are the same board) and refuses v1 images.

→ Install OpenWrt (generic explanation)

• Under stock firmware: enable telnet (debug page http://192.168.1.1/debug.htm on older firmware, otherwise a telnetenable tool) and run nvram get board_id.
• Under DD-WRT: run nvram get board_id.
• If in doubt: the stock firmware refuses a factory image with the wrong board ID, so trying the other v2 image is safe.

1. Connect a computer to a LAN port, open http://192.168.1.1 and log in.
2. Optional but recommended: ADVANCED > Administration > Backup Settings > Erase (factory defaults).
3. ADVANCED > Administration > Router Update, select the .chk for your board ID, Upload. Do not enable any reset option during the upload.
4. The router restarts into OpenWrt (power LED amber, then blinking white, then white). LuCI is at http://192.168.1.1, user root, no password.

Newer stock firmware may refuse third-party images; then use nmrpflash (see Recovery) with the OpenWrt .chk.

1. Reset the third-party firmware to defaults.
2. Go back to stock with nmrpflash and the stock NETGEAR firmware for the R6400v2 (see Recovery).
3. Reset the stock firmware to defaults, then follow “From stock firmware”.

Going through stock removes the third-party partitions and nvram leftovers.

→ generic.sysupgrade

Use the same .chk image with sysupgrade (LuCI: System > Backup / Flash Firmware, or sysupgrade on the command line).

nmrpflash (works when nothing else does):

1. Connect the computer directly to a LAN port.
2. Run nmrpflash -L to find the interface, then nmrpflash -i <interface> -f <image>.chk and power on the router.
3. The first attempt often ends in “Timeout while waiting for TFTP_UL_REQ”; run it again right away.
4. The image can be stock NETGEAR firmware (back to stock) or the OpenWrt .chk for your board ID.

TFTP (from the DD-WRT guides, not tested with OpenWrt): hold Reset while powering on until the power LED blinks, then tftp -i 192.168.1.1 put <image>.chk (the bootloader checks the board ID, so use the matching image). With a serial console, interrupt CFE with Ctrl-C and run tftpd.

→ Basic configuration After flashing, proceed with this.
Set up your Internet connection, configure wireless, configure USB port, etc.

The switch uses DSA; each port is its own interface:

Measured on a v2: LAN to WAN routing about 550 Mbit/s, WireGuard about 190 Mbit/s.

MAC addresses (from NVRAM): LAN et0macaddr, WAN et0macaddr + 1, 2.4 GHz pci/1/1/macaddr, 5 GHz pci/2/1/macaddr.

LEDs: power (white/amber), Internet (white/amber), 2.4 GHz, 5 GHz, USB 1, USB 2, WPS, WiFi. The power LED is amber while booting, blinks white while OpenWrt starts and is white when it is up. The Internet LED shows the WAN link; the LAN port LEDs are driven by the switch.

Buttons: Reset, WPS, WiFi on/off (rfkill event).

→ failsafe_and_factory_reset

→ Serial port

4-pin header J252 on the main board, marked V G T R on the silkscreen (V = 3.3 V, do not connect; G = ground; T = router TX; R = router RX), 3.3 V TTL, 115200 8N1. Location and pinout are from the DD-WRT unbricking guide for the R6400v2 (photo of a U12H332T20 board); not yet verified with an OpenWrt console. The CFE prompt (Ctrl-C at power-on) offers tftpd for recovery.

How to add tags