ORBI RBR50 firmware appears corrupted after circuit breaker was flipped

lpr1024 · ‎2023-02-01

This is a new thread, but appears to echo issues in the following closed discussion:

"https://community.netgear.com/t5/Orbi-Wi-Fi-5-AC-and-Orbi-with/Orbi-RBR50-Non-responsive-won-t-facto... and titled "Orbi RBR50 non responsive, won't factory reset".

I will summarize my troubleshooting, and hope someone can take me to the next steps.

Issue: The ORBI router (RBR50) did not properly reset after a circuit breaker was flipped off and back on in my house.

Troubleshooting attempted: I have tried several ways to factory reset the device, but the device power button always ends in green, and the light on top of the box eventually goes magenta (no connection to internet). The google fiber is plugged into the "internet" port on the router.

While running (power light is green, top light is slow white pulse or magenta):

Method 1: Press and hold in the reset button for 10 seconds. It flashes red, then when I release, it goes back to green. Eventually, the light on top goes to magenta (no internet connection).

Method 2. Press and hold in the reset button (keep it pressed throughout). Unplug the router for 10 seconds. Plug the router back in and wait 10 seconds. Release the reset button. Same result as #1.

Method 3. Same as method 2, but wait 30 seconds. Same result as #1.

I then attempted the manual upload of firmware to the router with tftp, using the method in

https://community.netgear.com/t5/Orbi-Wi-Fi-5-AC-and-Orbi-with/Orbi-RBR50-Non-responsive-won-t-facto.... This fails with "Connect request failed".

I use nmap (a network mapping program) on my own LAN from time to time, so I thought I'd disconnect the router completely and examine it with an isolated computer directly connected to it. Just my Windows box connected to a LAN port on the ORBI RBR50. No wireless. NMAP gave me these insights:

1. The RBR50 is booting to address 192.168.1.250 (which is the default satellite address).

2. The RBR50 will give my Windows box an address after booting of 192.168.1.128, so DHCP is functioning.

3. There are no other active addresses on this isolated private network.

4. There are two TCP ports that respond: 80 (http) and 443 (https). When I attempt to connect to http://192.168.1.128/ (or https://192.168.1.128/) I get a "404" Not found. So web services are really there, but there are no web pages to load.

5. The UDP ports that appear to be active are the following. Sadly tftp (UDP 69) is not listed. When I attempt SSH, I get "connection refused"; and when I attempt telnet, I get "connection failed."

22/udp open|filtered ssh

23/udp open|filtered telnet

53/udp open domain

67/udp open|filtered dhcps

1900/udp open|filtered upnp

So now I'm stumped. Any ideas anyone?

lpr1024 · ‎2023-02-18

The commands below are particular for my Orbi RBR50. Adjust to your model, firmware level, and sticker information from your device.

PUTTY and NMRPFLASH to FIX RBR50 ROUTER (Feb 2023)

Summary: RBR50 failed after power reset. Load is corrupted, and no factory reset trick restored it. No router, no wireless, no ethernet LAN communication, and no IP address. Last resort was to connect a PC to the RBR50 serial line, manually set a few parameters in the boot loader (UBOOT), then use NMRPFLASH to upload a new image to the router through a router LAN port. You have to open the RBR50 case (two T10 screws) and remove the RBR50 interior (4 more T10 screws) and flip it over to get to the serial line. Do NOT mess with the antenna or take anything else apart! You need a $12 serial cable (Amazon worked for me).

PUTTY CONNECTION:

I purchased a serial cable from Amazon to connect to the RBR50 serial input. I downloaded and installed Putty for Windows. Plug in the USB side of the serial line to PC, and use your Windows device manager to determine the COM line to use. (Mine was COM5).

Next, open a Putty Session to the Configuration Page, and configure it to talk to the RBR50. I ultimately saved these settings in “RBR50RBR50” so I could bring it up a lot quicker.

Session:

Serial line: COM5

Speed: 115200

Connection type: Serial (Telnet)

Logging: (optional)

Printable output

Configured log file name with date and time in the name.

Connection:

SSH:

Serial:

COM5, 115200, 8 data bits, 1 stop bit, no Parity

Start the real work:

Break open the router carefully and expose the serial input and connect your serial cable to the PC and the unplugged or turned off RBR50.
Launch putty session by clicking OPEN
Boot the router. You should start to see output in the Putty session. It will boot for a few seconds and then pause with “Hit any key to stop autoboot”. You have 2 seconds to press any keyboard key to stop the rest of the boot process. Just reboot if you miss the 2 sec window and try again.
I set the following parameters. You should not have to do this more than once. I do not know if all of these were necessary except for the HW and Board ID, which I needed to read from the first firmware upload attempt, but they didn’t hurt.
1. macset wan 14:59:c0:4c:57:62 (use the MAC on the bottom tag of the router)
2. macset lan 14:59:c0:4c:57:63 (added 1 to wan MAC; I think it’s needed, since this is the interface I’m going to load the firmware to)
3. board_model_id_set RBR50 (this one is necessary)
4. set SSID ORBI58 (from bottom sticker)
5. set passphrase (network key on bottom of RBR50)
6. board_data_set 1201 (this appeared to reset to 120101 on reboot, even if I changed it; I don’t know what this number is.)
7. board_hw_id_set LONG STRING OF DIGITS – BUT YOU HAVE TO ATTEMPT LOAD OF THE FIRMWARE FIRST (keep reading)

Configure and use NMRPFLASH to upload firmware

Download and extract NMRPFLASH.exe to an easy place to run it GitHub - jclehner/nmrpflash: Netgear Unbrick Utility. There are good instructions on that site for use (scroll down).

Next, go ahead and connect your PC to the second ethernet port from the leftmost port (it’s the first LAN port). Then, run the following command on your PC, which will tell you which device to use. It was “Ethernet 3” connection and is called “net17” on my computer.

C:\Windows\System32> nmrpflash.exe" -L

net11 192.168.1.6 ac:12:03:25:85:f0 (Wi-Fi)

net17 169.254.70.43 00:c0:ca:a9:17:9c (Ethernet 3)

Next, use this sequence to attempt the upload to RBR50. You should already have gone to NETGEAR support and downloaded the latest firmware for your router.

Turn off the RBR50
Run this command (Replace “RBR50-V2.7.4.24” below with the path and name of the file you need to upload):

nmrpflash.exe -i net17 -f RBR50-V2.7.4.24.img

Turn the router back on as soon as you see NMRPFLASH write “waiting for Ethernet connection”.
Come back and repeat this sequence after correcting the HW ID error (and any others, if they appear). Once the errors have been corrected – the router should boot and should be functional.

The first time you upload, you will get at least one error message:

Firmware Image HW ID do not match Board HW ID

In your Putty session (snippet below), look near the bottom for the HW ID in the image, and set the HW ID on board to that string, in my case:

board_hw_id_set 29765352+0+4000+512+2x2+2x2+4x4

Putty log file from first attempt at upload:

[lots of dots ..................]

Done!

Bytes transferred = 49285249 (2f00881 hex)

TFTP upload done

Ignore Magic number checking when upgrade via NMRP,Magic number is 27051956!

mmc_read will run command: mmc read 0x871cf488 0x2a22 0x100

MMC read: dev # 0, block # 10786, count 256 ... 256 blocks read: OK

HW ID on board:

HW ID on image: 29765352+0+4000+512+2x2+2x2+4x4

Firmware Image HW ID do not match Board HW ID

Board HW ID mismatch,it is forbidden to be written to flash!!

Finally, repeat the sequence above (keep the Putty session open as you cycle power to the router; more convenient).

View solution in original post

FURRYe38 · ‎2023-02-01

Did you try a 15 second reset button press with the RBR disconnected from the ISP modem and only one ethernet connected PC? If the top ring led starts to slowly pulsate white, you may be able to access the RBRs web page at 192.168.1.1

Last resort that could help is a 30-30-30 reset.

@SLK-Purdue

SLK-Purdue · ‎2023-02-01

Best bet at this point would be to reload firmware with nmrpflash.

Scott

lpr1024 · ‎2023-02-12

Thanks for the reply. Yes, I tried both Netgear suggested "reset to factory settings" method and 30-30-30 both offline (just my isolated windows box connected to LAN port on ORBI router) and online (google fiber connected to ORBI internet port.) Same result: the factory settings I want are not loading.

lpr1024 · ‎2023-02-12

Thanks, I think a forced reload of factory settings is what I'm trying for. Netgear, in its wisdom, has archived the discussion of how to use nmprflash for orbi. I can understand how easy it would be to brick your own router, but my router is already bricked. Adding a little mortar to it doesn't scare me, and the thing is out of warranty anyway.

My solution: an eBay seller offered an "almost new" ORBI rtr50 for $50, so I bought it, it booted up perfectly, and I reloaded a saved configuration file, bringing my old network back like it never was gone. (3 satellites included).

I'll research nmprflash (from the open router group, I'm sure) and give it a try. If I'm successful, I'll post about it. Thanks folks, for trying to help me out!

michaelkenward · ‎2023-02-13

@lpr1024 wrote:

Netgear, in its wisdom, has archived the discussion of how to use nmprflash for orbi.

There are plenty of messages on this. You just have to use the correct spelling.

Search - NETGEAR Communities – nmrpflash

A router is a router is a router.

lpr1024 · ‎2023-02-17

Fixed. There was another thread that got me most of the way there, but that thread used tftp directly upload to an IP address (which my router wasn't booting far enough to supply), so I DID have to use NMRPFLASH (thanks for the spellcheck michaelkenward). I will post my effort, and point to the relevant other thread.

michaelkenward · ‎2023-02-18

@lpr1024 wrote:

I DID have to use NMRPFLASH (thanks for the spellcheck michaelkenward).

The tech world likes to make things interesting with sets of meaningless initials.

lpr1024 · ‎2023-02-18

The commands below are particular for my Orbi RBR50. Adjust to your model, firmware level, and sticker information from your device.

PUTTY and NMRPFLASH to FIX RBR50 ROUTER (Feb 2023)

Summary: RBR50 failed after power reset. Load is corrupted, and no factory reset trick restored it. No router, no wireless, no ethernet LAN communication, and no IP address. Last resort was to connect a PC to the RBR50 serial line, manually set a few parameters in the boot loader (UBOOT), then use NMRPFLASH to upload a new image to the router through a router LAN port. You have to open the RBR50 case (two T10 screws) and remove the RBR50 interior (4 more T10 screws) and flip it over to get to the serial line. Do NOT mess with the antenna or take anything else apart! You need a $12 serial cable (Amazon worked for me).

PUTTY CONNECTION:

I purchased a serial cable from Amazon to connect to the RBR50 serial input. I downloaded and installed Putty for Windows. Plug in the USB side of the serial line to PC, and use your Windows device manager to determine the COM line to use. (Mine was COM5).

Next, open a Putty Session to the Configuration Page, and configure it to talk to the RBR50. I ultimately saved these settings in “RBR50RBR50” so I could bring it up a lot quicker.

Session:

Serial line: COM5

Speed: 115200

Connection type: Serial (Telnet)

Logging: (optional)

Printable output

Configured log file name with date and time in the name.

Connection:

SSH:

Serial:

COM5, 115200, 8 data bits, 1 stop bit, no Parity

Start the real work:

Break open the router carefully and expose the serial input and connect your serial cable to the PC and the unplugged or turned off RBR50.
Launch putty session by clicking OPEN
Boot the router. You should start to see output in the Putty session. It will boot for a few seconds and then pause with “Hit any key to stop autoboot”. You have 2 seconds to press any keyboard key to stop the rest of the boot process. Just reboot if you miss the 2 sec window and try again.
I set the following parameters. You should not have to do this more than once. I do not know if all of these were necessary except for the HW and Board ID, which I needed to read from the first firmware upload attempt, but they didn’t hurt.
1. macset wan 14:59:c0:4c:57:62 (use the MAC on the bottom tag of the router)
2. macset lan 14:59:c0:4c:57:63 (added 1 to wan MAC; I think it’s needed, since this is the interface I’m going to load the firmware to)
3. board_model_id_set RBR50 (this one is necessary)
4. set SSID ORBI58 (from bottom sticker)
5. set passphrase (network key on bottom of RBR50)
6. board_data_set 1201 (this appeared to reset to 120101 on reboot, even if I changed it; I don’t know what this number is.)
7. board_hw_id_set LONG STRING OF DIGITS – BUT YOU HAVE TO ATTEMPT LOAD OF THE FIRMWARE FIRST (keep reading)

Configure and use NMRPFLASH to upload firmware

Download and extract NMRPFLASH.exe to an easy place to run it GitHub - jclehner/nmrpflash: Netgear Unbrick Utility. There are good instructions on that site for use (scroll down).

Next, go ahead and connect your PC to the second ethernet port from the leftmost port (it’s the first LAN port). Then, run the following command on your PC, which will tell you which device to use. It was “Ethernet 3” connection and is called “net17” on my computer.

C:\Windows\System32> nmrpflash.exe" -L

net11 192.168.1.6 ac:12:03:25:85:f0 (Wi-Fi)

net17 169.254.70.43 00:c0:ca:a9:17:9c (Ethernet 3)

Next, use this sequence to attempt the upload to RBR50. You should already have gone to NETGEAR support and downloaded the latest firmware for your router.

Turn off the RBR50
Run this command (Replace “RBR50-V2.7.4.24” below with the path and name of the file you need to upload):

nmrpflash.exe -i net17 -f RBR50-V2.7.4.24.img

Turn the router back on as soon as you see NMRPFLASH write “waiting for Ethernet connection”.
Come back and repeat this sequence after correcting the HW ID error (and any others, if they appear). Once the errors have been corrected – the router should boot and should be functional.

The first time you upload, you will get at least one error message:

Firmware Image HW ID do not match Board HW ID

In your Putty session (snippet below), look near the bottom for the HW ID in the image, and set the HW ID on board to that string, in my case:

board_hw_id_set 29765352+0+4000+512+2x2+2x2+4x4

Putty log file from first attempt at upload:

[lots of dots ..................]

Done!

Bytes transferred = 49285249 (2f00881 hex)

TFTP upload done

Ignore Magic number checking when upgrade via NMRP,Magic number is 27051956!

mmc_read will run command: mmc read 0x871cf488 0x2a22 0x100

MMC read: dev # 0, block # 10786, count 256 ... 256 blocks read: OK

HW ID on board:

HW ID on image: 29765352+0+4000+512+2x2+2x2+4x4

Firmware Image HW ID do not match Board HW ID

Board HW ID mismatch,it is forbidden to be written to flash!!

Finally, repeat the sequence above (keep the Putty session open as you cycle power to the router; more convenient).

ORBI RBR50 firmware appears corrupted after circuit breaker was flipped