Is my 13-month-old RBR50 bricked?

[pbarham]

Last night we had a brief power outage - for a couple of seconds.  I lost internet connectivity and expected things to come back as normal after everything rebooted.

However - my RBR50 did not.  The wireless network never came back up.   After a while I noticed that *one* computer on the wired LAN had network connetivity, but none of the wireless devices could see my SSID.  I also noticed that the IP address that computer had looked very much like the WAN addresss my ISP hands out.   Not good.

I pulled out an old WiFI router and swapped that in - things worked perfectly.  So it's not my ISP/cablemodm or any of the rest of my network infrastructure.

Anyway - since the ORBI app is useless in this situation, and the router is not accessible on either wired or wirelss interface,  I decided that my only option was a factory reset.  

I tried the usual reset ....  10 seconds ... power LED went from solid green to solid amber to flashing amber.  Released reset.  Boots up to soild green but with the same symptoms - namely no visible SSID (either my original, or the factory SSID on the router's label)

Tried this several times, with several variants (holding reset while powering on, leaving the router unplugged for a few minutes, etc) No difference.

Treid the supposedly "harder reset" of  hold down resert; wait 30, power-off, wait 30; power-on; wait 30; release reset.

The power LEDs went through the same sequence as for a regular reset - twice.  But the router still behaves the same

After it boots, it just has a slowly pulsing white ring for several minutes

According to this https://kb.netgear.com/31030/What-do-the-LEDs-on-my-Orbi-router-and-satellite-mean 

it could be either:

Pulsing white. Your Orbi router and satellite are applying a configuration or updating their firmware.

Pulsing white. Your Orbi router is in factory default mode.  

Then it goes solid magenta indicating no WAN connection

However it still advertises no SSID, it does not hand out an IP address on the wiired ports.  The app obviously cannot find the router (since it doesn't have a wireless network)

I tried going down the 'TFTP'' route - but I have a Mac and couldn't get anything to behave as described in the various posts. 

I also tried the nmrpflash utility from here: https://github.com/jclehner/nmrpflash   It appears to see some kind of boot request but fails to update the flash.  Verbose output jgives me:

Pauls-MacBook-Air-2020:~ pbar$ sudo ~/Downloads/nmrpflash -vvv -i en5 -f ~/Downloads/RBR50-V2.7.1.60/RBR50-V2.7.1.60.img

Adding 10.164.183.253 to interface en5.

Advertising NMRP server on en5 ... |

Received configuration request from 00:00:00:00:00:00.

Sending configuration: 10.164.183.252/24.

delete: cannot locate 10.164.183.252

Received upload request: filename 'firmware'.

Using remote filename 'firmware'.

Uploading RBR50-V2.7.1.60.img ... << WRQ(firmware, octet)

<< WRQ(firmware, octet)

<< WRQ(firmware, octet)

<< WRQ(firmware, octet)

<< WRQ(firmware, octet)

<< WRQ(firmware, octet)

<< WRQ(firmware, octet)

<< WRQ(firmware, octet)

<< WRQ(firmware, octet)

Timeout while waiting for ACK(0)/OACK.

10.164.183.252 (10.164.183.252) deleted

I'm now at a total loss.  This appears to be a very expensive brick, and my satellites are also now useless.

Netgear customer support won't respond since the router is (just) over 12 months old.   (I am *SO* unimpressed by this experience, by the way, that I will never purchase another Netgear product)

I have 30 years experience working in computer systems and networtking, but all I can do is pray that somebody on this list may have a magic bullet!    

[pbarham · Accepted solution]

Well, after connecting to the internal serial console and fiddling around with the U-Boot loader for an hour I managed to unbrick my router and upload the latest RBR50-V2.7.1.60 firmware.  Yay!!! 

Serial port fun

The router had lost almost all of its configuration state - including it's MAC addresses, hardware id, model id, etc.

I needed to set these to back sensible values be able to bring up the TFTP loader and load/flash an image. (luckily the error message saying that the image file didn't macth the hardware ID told me what values I needed to configure!)

Then it took a couple of reboots to come up happy.  Still had a bogus SSID and unknown passphrase (so the iPhone app was useless) - but at least I could log in on the LAN port and manually set thing up.  

Now it seems to be happy I will see if I can find my configuration backup file 😉   (you know, the one you always make but have never tried restoring!)

Time for a beer!

[FURRYe38]

Try a different power adapter, say one from the RBS if you have one. Use same voltage and amps adapter. 

If this and TFTP fails, then the RBR needs to be replaced. 

[pbarham]

Thanks for the suggesition....  I just tried all that again, uising the PSU from my satellite... 

Same initial symptoms (no broadcast SSID, no DHCP response on wired ports);

neither the regular factory reset, nor the 30-30 harder reset worked.

The router powers up to a blinking white ring (one fllash every two seconds). Adter a minute or so this changes to a pulsing/throbbing white (once every 3s).  It is broadcasting no SSID that I can see.   After 5 minutes or so, the ring goes magenta.  (This is at least expected -- it's not connected to my cable modem since I'm still using my backup wifi router for internet access)

The symptoms seem similar to other people's reports of failed firmware updates.  But the behavior of the power LEDs seems normal - it's just the router doesn't respond on either the WIFI or wired interfaces.  

[FURRYe38]

The top ring indication is based on the WAN port connection, router or AP mode. Doesn't give inidiation of wifi problems. 

No SSID name of ORBI### seen on any wireless device?

Sounds like the RBR is bad and needs replaced. 

[pbarham]

That is correct - there is no SSID with ORBIxxxx.  

The router label says it should be ORBI77 ... I tried manually associating to that SSID using the password on the label but that didn't work.

There also doesn't appear to be any other SSID that comes and goes when the router is powered on and off.

I'm not sure whether I would expect to get a DCHP address assigned on the LAN ports in the factory reset state. (assuming at least one of those dozens of factory resets wiorked of course!)

[pbarham]

Some small progress... I connected my laptop to the wired LAN port of the router and ran Wireshark.  I noticed that after a few minutes the router started *sending* DHCP diiscover messages where the "Host Name" option 12 was set to "Invalid HW ID, use default Orbi"

This seems pretty strange to me?  (maybe it's checking for another DHCP server on the same subnet... but that hostname is disturbing!)

So - I put my wired ethernet config back to DHCP and, for the first time in ages I got assigned a DHCP address  ... on a 192.168.1.0/24 subnet iwth a router of 192.168.1.250  (not an IP address I've ever used!)

So.. I tried hitting that with a web browser.  Got a login prompt.  Tried the default netgear credentials of  admin/password and got a very broken looking management page:

Note the bogus hardware version string matching the DHCP messages!  Also, the configured SSID is NETGEAR75 and the wireless access point is Off.

I poked around some of the missing menu options and found there was actually an invisible link to a firmware update page  (http://192.168.1.250/fwUpdate.htm) .... again with missing button images/text.

Guessed which was the 'choose filename' box and got a file selection dialog.

Selected a firmware image from my laptop, clicked what looked like 'Upload this' and got a  "Please wait a moment" popup and my status bar showed "Upliading (15%)" 

Then after a while I got the following error:

404 Not Found

This server does not support the operation requested by your client.

and my web browser address bar showed: http://192.168.1.250/upgrade_check.cgi?/fwUpdateCheck.htm%20timestamp=81087512679

SOOOO CLOSE!

Looks like it's trying to validate the image in some way and I don't know how to bypass that.  

This is too expensive to just toss in the garbage, and I'm not prepared to throw good money after bad.  Surely there is a firmware disaster recovery mechanism? 

[pbarham]

[Sorry, no idea why the images I uploaded in this post keep just showing up as triangles.  They look fine when I edit the post, and then they disappear 😞 ]

[FURRYe38]

The RBR needs replacing. Check with NG if this is under warranty. 

Good Luck. 

[pbarham]

It's not.  They only have 12 months warranty and this is 13 months old.  They won't even respond to email.

Hence they will not be getting any more money from me.

[pbarham · Accepted solution]

Well, after connecting to the internal serial console and fiddling around with the U-Boot loader for an hour I managed to unbrick my router and upload the latest RBR50-V2.7.1.60 firmware.  Yay!!! 

Serial port fun

The router had lost almost all of its configuration state - including it's MAC addresses, hardware id, model id, etc.

I needed to set these to back sensible values be able to bring up the TFTP loader and load/flash an image. (luckily the error message saying that the image file didn't macth the hardware ID told me what values I needed to configure!)

Then it took a couple of reboots to come up happy.  Still had a bogus SSID and unknown passphrase (so the iPhone app was useless) - but at least I could log in on the LAN port and manually set thing up.  

Now it seems to be happy I will see if I can find my configuration backup file 😉   (you know, the one you always make but have never tried restoring!)

Time for a beer!

[FURRYe38]

There a process that you found that works for this?

[pbarham]

Yes - I found some info in other threads about how to connect a serial line to the device and cause it to stop in the bootloader.

https://community.netgear.com/t5/Orbi/Orbi-RBR50-seems-stuck-in-boot-loop/m-p/1948614/highlight/true...

https://community.netgear.com/t5/Orbi/Force-RBR50-to-TFTP-for-un-brick/m-p/2010123#M107369 

You need to open up the router (2 Torx T10 screws behind the label that surrounds the network ports

Then you need top remove the board from the case (the serial line is on the underside)

You connect up 3 wires to a a header on the board (using a $12 USB serial port adapter from amazon as per the PDF file here: https://www.snbforums.com/attachments/orbi-serial-port-pdf.23898/

You connect to your router using a terminal program on your laptop/pc. (see https://pbxbook.com/other/mac-tty.html)

Then when you power on the router you should see some log messages ...and after a few secons it will say :

Hit any key to stop autoboot: 2

You have 2 seconds to press a key and then it drops into the U-Boot command line.

Type 'help' to see a list of commands like:

(IPQ40xx) # help
?       - alias for 'help'
base    - print or set address offset
board_backhaul_passphrase_set- Set backhaul passphrase on board
board_backhaul_passphrase_show- Show board_backhaul_passphrase
board_backhaul_ssid_set- Set backhaul ssid on board
board_backhaul_ssid_show- Show board_backhaul_ssid
board_data_set- Set board data on board
board_data_show- Show board_data
board_hw_id_set- Set board_hw_id
board_hw_id_show- Show board_hw_id
board_model_id_set- Set board_model_id
board_model_id_show- Show board_model_id
board_parameters_set- Set WPS PIN code, Serial number, SSID, Passphrase, Board data, MAC address
board_parameters_show- Show WPS PIN code, Serial number, SSID, Passphrase, MAC address.
board_passphrase_set- Set passphrase on board
board_passphrase_show- Show board_passphrase
board_ssid_set- Set ssid on board
board_ssid_show- Show board_ssid
boot_partition_set- Set boot partition data on board
boot_partition_show- Show boot partition
bootdni - Check DNI image file.
bootipq - bootipq from flash device
bootipq2- bootipq from flash device
bootm   - boot application image from memory
bootp   - boot image via network using BOOTP/TFTP protocol
button_test- Test buttons
calculate_address- Calculate the address of rootfs.
check_dni_image- Check DNI image file.
chpart  - change active partition
cmp     - memory compare
cp      - memory copy
crc32   - checksum calculation
dhcp    - boot image via network using DHCP/TFTP protocol
dnisetenvmem- set environment variable from memory
echo    - echo args to console
env     - environment handling commands
exit    - exit script
false   - do nothing, unsuccessfully
fdt     - flattened device tree utility commands
fuseipq - fuse QFPROM registers from memory
fw_recovery- start tftp server to recovery dni firmware image.
fw_recovery_second- start tftp server to recovery dni firmware image.
go      - start application at address 'addr'
help    - print command description/usage
i2c     - I2C sub-system
iminfo  - print header information for application image
imxtract- extract a part of a multi-image
incenv  - increment environment variable
ledctl  - ledctl - Test LEDs
loop    - infinite loop on address range
macset  - Set ethernet MAC address
macshow - Show ethernet MAC addresses
md      - memory display
mii     - MII utility commands
mm      - memory modify (auto-incrementing address)
mmc     - MMC sub system
mmc_loadn_dniimg- load dni firmware image from EMMC.
mmcinfo - display MMC info
mtdparts- define flash/nand partitions
mtest   - simple RAM read/write test
mw      - memory write (fill)
nand    - NAND sub-system
nboot   - boot from NAND device
nm      - memory modify (constant address)
nmrp    - start nmrp mechanism to upgrade firmware-image or string-table.
pci     - list and access PCI Configuration Space
ping    - send ICMP ECHO_REQUEST to network host
printenv- print environment variables
reset   - Perform RESET of the CPU
reset_i2c- Reset I2C
reset_i2c_to_blink- Reset I2C to blink
reset_i2c_to_zero- Reset I2C
rnset   - set region number
rnshow  - Show Region Number on Board
run     - run commands in an environment variable
saveenv - save environment variables to persistent storage
setenv  - set environment variables
sf      - SPI flash sub-system
showvar - print local hushshell variables
sleep   - delay execution for some time
smeminfo- print SMEM FLASH information
snset   - Set serial number
source  - run script from memory
test    - minimal test like /bin/sh
tftpboot- boot image via network using TFTP protocol
true    - do nothing, successfully
uartrd  - uartrd read from second UART
uartwr  - uartwr to second UART
usb     - USB sub-system
usbboot - boot from USB device
version - print monitor, compiler and linker version
wpspinset- Set wpspin number

Since my router has lost all its config, including the ethernet MAC address, I needed to use `macset` before it would talk on the network.  It came up with the IP address 192.168.1.250  (not 192.168.1.1 as every other article mentions!)

Then I tried to use `fw_recover` which starts a TFTP server that you can send a firmware image to.

From my Mac I started `tftp  192.168.1.250 69`

Then you need to select binary mode by using the `binary` command

Then you can try 'put firmware.img`

This failed the first two time - I got the folliwing errors:

HW ID on board:
HW ID on image: 29765352+0+4000+512+2x2+2x2+4x4

and

MODEL ID on board:
MODEL ID on image: RBR50
Firmware Image MODEL ID do not match Board model ID

I fixed these using the `board_hw_id_set` command and the `board_model_id_set` command.

I also set the serial number, SSID and passphrase to the values on the label on the bottom of the router - but it appears to ignore these! 

Then the new firmware uploded and the router rebooted itself.

At this point I could point a web browser at http://192.168.1.250 (using the *wired* LAN interface) and it gave me the option to setup the router manually with a new SSID, password etc.

Note that the wireless interface came up with a bogus SSID of NETGEAR75 that I couldn't connect to .  You need to use wired ethernet for the recovery process.

Let me know if you have any questions!

P/

[FURRYe38]

NICE. Thank you for this detailed process. I know for some it may not work for users that are not experienced, however for those that are, will be good. 

Thank you. 

[tg65]

How do you open the RBR50 without destroying it?  Mine appears to have brick'd and Netgear said it needs to be replaced.  Of course it is out of warranty.  The unit was replaced once during warranty already.  Currently, the power LED lights up, but nothing else.  Tried different power supplies from satellites and different outlets in the house with no change in the router.

[pbarham]

---

@tg65 wrote:

How do you open the RBR50 without destroying it?  Mine appears to have brick'd and Netgear said it needs to be replaced.  Of course it is out of warranty.  The unit was replaced once during warranty already.  Currently, the power LED lights up, but nothing else.  Tried different power supplies from satellites and different outlets in the house with no change in the router.

---

The plastic label surrounding the ethernet ports and power connectors needs to be lifted up.  There are two Torx T10 screws underneath - one at each side.   When you take these out, the two halves of the case will slide relative to each other (top to bottom) by about half an inch. (probably need to also remove the label on the base with the serial number).   Then they will come apart.

[tg65]

Thanks!  Got it open.

[PrideKnight]

@pbarham you absolute legend. Thanks to your detailed post, especially about the image and model errors, I was able to recover my bricked Orbi. I'd buy you a beer if you were in Australia, but take my kudos and ongoing gratitude instead!!!