• NETGEAR WNDR3800 ¹⁾
• OpenWrt ^{2) 3)}

• Using sysupgrade with factory images will soft-brick the router ⁴⁾

• Latest known version: 19.07.1

• https://downloads.openwrt.org/releases/

• 19.07.1
• ath79

ssh 'root'@'192.168.1.1'

rm -f '/tmp/openwrt-stable-ath79-wndr3800-sysupgrade.bin' && wget -O '/tmp/openwrt-stable-ath79-wndr3800-sysupgrade.bin' 'https://downloads.openwrt.org/releases/19.07.1/targets/ath79/generic/openwrt-19.07.1-ath79-generic-netgear_wndr3800-squashfs-sysupgrade.bin'

• -n doesn't save old config
• --force forces the flash
• -v more verbose

ssh 'root'@'192.168.1.1'

sysupgrade --force -n -v '/tmp/openwrt-stable-ath79-wndr3800-sysupgrade.bin'

• https://192.168.1.1

• https://my.nextdns.io

• http://192.168.1.1/cgi-bin/luci/admin/network/firewall/rules
• Network → Firewall → Traffic Rules

• Some devices hard-code Google DNS, and this bypasses NextDNS and the blocklists set there
• So the solution to this is to block any requests to Google DNS

• Name: Google DNS
• Protocol: Any
• Source zone: lan
• Source address: -- Add IP -- (leave at default)
• Destination zone: wan wan6
• Action: reject

• Destination address

8.8.8.8

8.8.4.4

2001:4860:4860::8888

2001:4860:4860::8844

• https://downloads.openwrt.org/snapshots/targets/ath79/generic/

• ath79

rm -f '/tmp/openwrt-snapshot-ath79-wndr3800-sysupgrade.bin' && wget -O '/tmp/openwrt-snapshot-ath79-wndr3800-sysupgrade.bin' 'https://downloads.openwrt.org/snapshots/targets/ath79/generic/openwrt-ath79-generic-netgear_wndr3800-squashfs-sysupgrade.bin'

• ath79
• May be necessary if wget complains about lack-of SSL support

rm -f '/tmp/openwrt-snapshot-ath79-wndr3800-sysupgrade.bin' && wget -O '/tmp/openwrt-snapshot-ath79-wndr3800-sysupgrade.bin' 'http://downloads.openwrt.org/snapshots/targets/ath79/generic/openwrt-ath79-generic-netgear_wndr3800-squashfs-sysupgrade.bin'

• -n doesn't save old config
• --force forces the flash
• -v more verbose

ssh 'root'@'192.168.1.1'

sysupgrade --force -n -v '/tmp/openwrt-snapshot-ath79-wndr3800-sysupgrade.bin'

• https://openwrt.org/docs/guide-user/luci/luci.essentials
• Snapshot images don't include LuCI, and need it to be installed seemingly after every snapshot install/update

ssh 'root'@'192.168.1.1'

opkg update && opkg install 'luci' && opkg install 'luci-ssl-nginx'

• https://192.168.1.1

• https://blog.uncensoreddns.org/

• Can seemingly still use tftp even if you can't ping the router

• Pick one
• The stable image URL will need updated if there's a newer version available

wget -O ~/'f.img' 'https://downloads.openwrt.org/releases/18.06.4/targets/ar71xx/generic/openwrt-18.06.4-ar71xx-generic-wndr3800-squashfs-factory.img'

wget -O ~/'f.img' 'https://downloads.openwrt.org/snapshots/targets/ath79/generic/openwrt-ath79-generic-netgear_wndr3800-squashfs-factory.img'

sudo dnf install 'tftp' -y && sync

tftp

verbose

trace

rexmt 1

binary

connect 192.168.1.1

put f.img

sudo dnf remove 'tftp' -y && sync