User Tools

Site Tools


Netgear WNR3500L

WARNING: Installing OpenWrt 18.06 on WNR3500Lv2 will brick the router, due to unsupported NAND flash driver.

Supported Versions

Version/Model OpenWrt Version Supported Model Specific Notes
WNR3500U Barrier Breaker 14.07 and later partial support based on OpenWrt claimed here
WNR3500L Barrier Breaker 14.07 and later -

Hardware Highlights

ModelVersionSoCCPU MHzFlash MBRAM MBWLAN HardwareWLAN2.4WLAN5.0100M portsGbit portsModemUSB
WNR3500Lv1Broadcom BCM4718480864Broadcom BCM4718b/g/n--5-1x 2.0
WNR3500Lv2Broadcom BCM47186480128NAND128Broadcom BCM47186B0b/g/n--5-1x 2.0
Model CPU Ram Flash Network USB Serial JTag
WNR3500U Broadcom BCM4718A@480MHz 64MiB 8MiB 4 x 1 Yes Yes ?
WNR3500L Broadcom BCM4718A@453MHz (mipsel) ?
Broadcom BCM4716A@457MHz ?
WNR3500Lv2 Broadcom BCM47186B0@480MHz 128MiB DDR2, Winbond W971GG6J8 128MiB NAND, Samsung K9F1G08U0D 4 x 1 yes yes ?



WNR3500Lv2 does not work. Installing OpenWrt (tested with 18.06 series) will brick the router.

wnr3500L V1 partially work in trunk since 2013-01-11 (bug 7198).

  1. Prepare firmware
    1. Get and unpack ImageBulder, more info
    2. Build firmware
      • make image PROFILE=Broadcom-mips74k-b43 for the open source b43 wireless driver (wireless-G only)
      • make image PROFILE=Broadcom-mips74k-wl for the proprietary wl wireless driver(needed for wireless-N)
      • make image PROFILE=Broadcom-mips74k-brcmsmac for the open source brcmsmac wireless driver (a mac80211-based SoftMAC driver - wireless-N capable)
    3. Your firmware will be bin/targets/brcm47xx/mips74k/openwrt-18.06.1-brcm47xx-mips74k-netgear-wnr3500l-*-squashfs.chk
  2. If your current firmware don't allow write arbitrary files to mtd, use dd-wrt image
    1. dd-wrt image can be used for flash device after pin-short debricking/reseting
    2. Configure network on your machine (lan,
    3. Set login over web and telnet to router
    4. Copy firmware to router
      1. scp username@192.168.1.X:path/to/openwrt-brcm47xx-squashfs.trx /tmp/
    5. Write firmware
      1. mtd -r write /tmp/openwrt-brcm47xx-squashfs.trx linux
  3. Now you should have access to openwrt by telnet and start configure it.

USB has no power

Using stock firmware (including Barrier Breaker) the USB socket is powered down during shutdown. (see ticket) The following solution is confirmed to work with b53 wifi driver and official barrier breaker build:

nvram set board_id=U12H136T99_NETGEAR nvram set boardflags=0x00000710 nvram commit

Followed by a cold reboot (power cycle).

Debricking with Serial Terminal

Note: The router's serial port uses 3.3v logic, do not connect a regular 12v serial cable to it.

  1. Assign your computer a static IP address (i.e. and connect to port 4 on the router
  2. Open serial terminal. See Serial for pinout and specs.
  3. Reboot router and press Ctrl+C as soon as you see CFE messages
  4. At the CFE> prompt, enter tfptd to start the tftp server
  5. The router is now waiting for a tfpt connection, follow the tftp guide for more information
    • Note: the router is expecting a .chk file. You must use the stock firmware or the dd-wrt initial flashing image.
  6. The router will reboot automatically when the process is complete



  • SoC: Broadcom BCM4718A
  • Switch : Broadcom BCM53115s


To open the box, remove the screw on the right side (when standing up), then push and slide the right cover to the bottom (where the screw is)…

Netgear 3500Lv2 board:
3500Lv2 board


This device has 2 programmable buttons (classic reset button and WPS on the front). There is also an on/off switch on the rear side.


A 1×6 pin header (JP1) is already soldered in this router.

[VCC] [RX] [ ] [ ] [TX] [GND]
[1 ] [2 ] [3 ] [4 ] [5 ] [6 ]

Serial port settings are 115200@8n1. USB to TTL modules are self powered and only need 3 wires (RX, TX and GND).

Connect first GND, then TX to the RX pin of USB Module. It also works with these 2 pins only for readonly. VCC +3,3V pin is used for powering non USB RS232-TTL cables.

v2 Filesystem Layout

dev: size erasesize name
mtd0: 00080000 00020000 “boot”
mtd1: 00180000 00020000 “nvram”
mtd2: 00040000 00020000 “board_data”
mtd3: 00040000 00020000 “POT1”
mtd4: 00040000 00020000 “POT2”
mtd5: 00040000 00020000 “T_Meter1”
mtd6: 00040000 00020000 “T_Meter2”
mtd7: 00040000 00020000 “ML1”
mtd8: 00040000 00020000 “ML2”
mtd9: 00040000 00020000 “ML3”
mtd10: 00040000 00020000 “ML4”
mtd11: 00040000 00020000 “ML5”
mtd12: 00040000 00020000 “ML6”
mtd13: 00040000 00020000 “ML7”
mtd14: 01b00000 00020000 “linux”
mtd15: 019d7b6c 00020000 “rootfs”

Other Info


This website uses cookies. By using the website, you agree with storing cookies on your computer. Also you acknowledge that you have read and understand our Privacy Policy. If you do not agree leave the website.More information about cookies
toh/netgear/wnr3500l.txt · Last modified: 2019/02/24 00:24 by bobafetthotmail