OpenWRT on Mikrotik Routerboard 411/750

Introduction

The Mikrotik Routerboards are cheap and versatile embedded platforms that can be used for routers, WiFi APs and the like. In a rather wide range of products, I happen to have access to the RB411 and the RB750 two devices of very different properties. While the RB750 is effectively a 5 port 10/100 Mbit Ethernet switch with an Atheros AR71xx CPU on it, the RB411 has the same CPU with one Ethernet port and a Mini PCI slot as well as a serial port (and a beeper ;)). Because of their price (around 40 €), both are very interesting targets to do some experiments with them. Unfortunately, they come with Mikrotiks RouterOS which seems to be a modified Linux that officially cannot be modified. Interestingly, the RB do not ship with a GPL and as far as I have heard, Mikrotik does not publish the source code as required by the GPL. So, who wants RouterOS anyway? 😉

Although I do not have other Mikrotik products, I assume that the OpenWRT flash procedure is similar for products using RouterBOOT as bootloader and the Atheros AR71xx CPU. However, this guide comes without warranty, everything you do is at your full risk. Although I was unable to do so, there is a certain risk of permanently bricking your device.

The process of flashing the Routerboard has 5 major steps:

  1. Prepare an OpenWRT Ramdisk Image
  2. Prepare the OpenWRT target Image
  3. Configure the TFTP and DHCP Server
  4. Boot the Routerboard using the Ramdisk Image
  5. Flash the Target Image

Preparation Procedure

Prepare an OpenWRT Ramdisk Image

Compiling OpenWRT from the SVN is actually more straight forward than you might imagine. Take your favorite Linux Distribution (Ubuntu in my case), check our the SVN, configure it and hit make. There you go.

  1. Get the source code
    Check out the latest and greatest version of OpenWRT:

    svn co svn://svn.openwrt.org/openwrt/trunk/
    

    I have used revision 27019.

  2. Configure OpenWRT according to your needs
      cd trunk
      make menuconfig
    

    While you are of course free to select all the packages you need and deselect those you do not need, you have to set the following options to make it work in the Routerboards:

      Target System: Atheros AR71xx
      Subtarget: Devices with NAND flash (mostly Mikrotik)
      Target Images: ramdisk
    
  3. Build it
    The build process of OpenWRT takes a long time, but is very simple:

      make
    

    The result image is located in the bin/ar71xx directory and is called openwrt-ar71xx-nand-vmlinux-initramfs.elf.

Prepare the OpenWRT target Image

  1. Configure OpenWRT according to your needs
      cd trunk
      make menuconfig
    

    This time, you have to change the Target Images to tar.gz as follows:

      Target System: Atheros AR71xx
      Subtarget: Devices with NAND flash (mostly Mikrotik)
      Target Images: tar.gz
    
  2. Build it
      make
    

    The target image consists of two files in the bin/ar71xx directory:

    • Kernel Image: openwrt-ar71xx-nand-vmlinux.elf
    • Root File System: openwrt-ar71xx-nand-rootfs.tar.gz

Configure the TFTP and DHCP Server

  1. Configure your network Interface
    The network interface to which the Routerboard is connected must have a unique IP with a DHCP running on it. To make debugging easier, it is usually a good idea to directly connect the Routerboard to your NIC without other devices involved.
    Configure the Interface within the subnet 192.168.1.0/24 (OpenWRTs default subnet) but try to avoid 192.168.1.1 (OpenWRTs default IP). I have used 192.168.1.2.
  2. Install DHCP and TFTP Servers
    You will need a DHCP Server to assign an IP address to the Routerboard for the flash process. Also, the DHCP server tells the board which file to use as image. Frankly, the tftp Server is responsible to provide the image file to the RB.
    On Ubuntu Linux, I have used these packages:

      apt-get install dhcp3-server atftpd
    
  3. Configure the DHCP Server
    The DHCP Server does not need much configuration. I use the following as /etc/dhcp3/dhcpd.conf:

    allow booting;
    allow bootp;
    
    subnet 192.168.1.0 netmask 255.255.255.0 {
      range 192.168.1.10 192.168.1.200;
    }
    
    host routerboard {
      hardware ethernet 00:0c:42:XX:YY:ZZ;
      fixed-address 192.168.1.100;
      next-server 192.168.1.2;
      filename "openwrt-ar71xx-nand-vmlinux-initramfs.elf";
    }
    

    You may want to modify the IP range to match your subnet, the hardware ethernet MAC address of your router board, the next-server address of your tftp server and the filename of the ramdisk image that should be booted over the network.

  4. Configure the TFTP Server
    Edit /etc/default/atftps to avoid running the daemon over inetd. My file looks like this:

      USE_INETD=false
      OPTIONS="--tftpd-timeout 300 --retry-timeout 5 --mcast-port 1758 --mcast-addr 239.239.239.0-255 --mcast-ttl 1 --maxthread 100 --verbose=5 /tftpboot"
    

    You can see, that the tftp server will look for image files in /tftpboot. Either change this directory or copy the OpenWRT ramdisk image (openwrt-ar71xx-nand-vmlinux-initramfs.elf) to /tftpboot.

      cp bin/ar71xx/openwrt-ar71xx-nand-vmlinux-initramfs.elf /tftpboot
    
  5. Apply the changed configuration
      /etc/init.d/dhcp3-server reload
      /etc/init.d/atftpd reload
    

Flash process for Routerboard 750

Booting the Ramdisk Image

The purpose of this step is to have a ramdisk version of OpenWRT running on the routerboard. This is a good basis for our flashing process and can also be used to test images without flashing them. This involves the following steps:

  1. Connecting the Routerboard
    Connect port 1 of the Routerboard with the Ethernet port that your DHCP and TFTP server listens on.
  2. Boot the Routerboard
    Now press and hold the “RES” button of the router board and connect power. Both LEDs (PWR and ACT) will be constantly on, keep pressing the button. After some seconds the “ACT” LED starts flashing, keep pressing. After some more seconds, the “ACT” LED turns off, now you can stop pressing the button. The board will now try to obtain an IP address via DHCP/BOOTP and then download and boot the Ramdisk image. You can see this activity by looking at the appropriate log files:

      tail -f /var/log/daemon.log /var/log/messages
    

    You should see something like this:

    May 27 13:21:26 tk dhcpd: BOOTREQUEST from 00:0c:42:XX:YY:ZZ via eth1
    May 27 13:21:26 tk dhcpd: BOOTREPLY for 192.168.1.101 to routerboard (00:0c:42:XX:YY:ZZ) via eth1
    May 27 13:21:26 tk atftpd[26400]: Serving openwrt-ar71xx-nand-vmlinux-initramfs.elf to 192.168.1.101:33321
    

    Sit and wait until 192.168.1.1 starts replying to pings. Now you can log into the board using telnet (ssh login is not possible, since no password is set as of yet).

      telnet 192.168.1.1
    
  3. Flash the target Image

  4. Erase the flash memory
    You can look at the existing flash partitions by looking at /proc/mtd.

      root@OpenWrt:~# cat /proc/mtd
      dev:    size   erasesize  name
      mtd0: 00040000 00004000 "booter"
      mtd1: 003c0000 00004000 "kernel"
      mtd2: 03c00000 00004000 "rootfs"
    

    Now, erase the content of “kernel” and “rootfs”:

      mtd erase kernel
      mtd erase rootfs
    
  5. Create new file systems
    After erasing the content of the flash, we now need to create new yaffs2 partitions. In principle, we could also make the rootfs ext2/3/4, but I have not tried this. The kernel partition has to be yaffs2 as far as I know to be compatible with the bootloader.

      mkdir /mnt/kernel /mnt/rootfs
      mount -t yaffs2 /dev/mtdblock1 /mnt/kernel
      mount -t yaffs2 /dev/mtdblock2 /mnt/rootfs
    
  6. Copy the images onto the Routerboard
    Copying the images onto the routerboard can be done in multiple ways, I have used secure file copy (scp). First, we have to create a password for the root user. On the routerboard, execute

      passwd
    

    and set a password. On the linux PC, you can now copy the images onto the Routerboard:

      scp bin/ar71xx/openwrt-ar71xx-nand-rootfs.tar.gz bin/ar71xx/openwrt-ar71xx-nand-vmlinux.elf root@192.168.1.1:/tmp
    
  7. Flash the images onto the Routerboard
    Flashing the images is simple, once you have them on the Routerboard. First, the kernel:

      mv /tmp/openwrt-ar71xx-nand-vmlinux.elf /mnt/kernel/kernel
      chmod +x /mnt/kernel/kernel
      umount /mnt/kernel
    

    Now the root filesystem:

      cd /mnt/rootfs
      tar -xvzf /tmp/openwrt-ar71xx-nand-rootfs.tar.gz
      cd /
      umount /mnt/rootfs
    
  8. That’s it, you are done
    Finally, reboot the routerboard.

      reboot
    

    After some while, you should be able to ping the board at 192.168.1.1.

What if the Routerboard does not boot?

Do not panic. If the board is not reachable at 192.168.1.1 after some minutes, something must have gone wrong. You can always recover the boards using Mikrotiks Netinstall. Also, you can start again at the point where the ramdisk image should have booted. Unfortunately, the RB750 does not have a serial port, debugging problems with the linux boot process is probably *very* annoying.

Flash process for Routerboard 411

The flash process for the Routerboard 411 is almost similar to the process for the RB750 – only the flash layout is a bit different and hence the number of the target partitions have to be changed. Apart from that, you can use the exact same procedure. However, since the RB411 offers a serial port, debugging is much more convenient.

Booting the Ramdisk Image

The purpose of this step is to have a ramdisk version of OpenWRT running on the routerboard. This is a good basis for our flashing process and can also be used to test images without flashing them. This involves the following steps:

  1. Connecting the Routerboard
    Connect the Ethernet port of the Routerboard with the Ethernet port that your DHCP and TFTP server listens on.
  2. Configure the Bootloader
    Connect a serial cable to the serial port of the routerboard using the settings 115200 8n1. The boot process should look similar to this:

    RouterBOOT booter 2.27
    
    RouterBoard 411
    
    CPU frequency: 300 MHz
      Memory size:  32 MB
    
    Press any key within 2 seconds to enter setup
    

    Press any key and you will end up here:

    RouterBOOT-2.27
    What do you want to configure?
       d - boot delay
       k - boot key
       s - serial console
       n - silent boot
       o - boot device
       u - cpu mode
       f - cpu frequency
       r - reset booter configuration
       e - format nand
       g - upgrade firmware
       i - board info
       p - boot protocol
       b - booter options
       t - do memory testing
       x - exit setup
    your choice:
    

    Change the “boot device” (o) to “boot over Ethernet” (e). Reboot with x.

  3. Boot the Routerboard
    While looking at the serial terminal, you should see something like:

    RouterBOOT booter 2.27
    
    RouterBoard 411
    
    CPU frequency: 300 MHz
    Memory size:  32 MB
    
    Press any key within 2 seconds to enter setup..
    trying bootp protocol... OK
    Got IP address: 192.168.1.100
    resolved mac address 00:E0:4C:XX:YY:ZZ
    transfer started ..........................
    
  4. Flash the target Image

  5. Erase the flash memory
    You can look at the existing flash partitions by looking at /proc/mtd.

      root@OpenWrt:~# cat /proc/mtd
      root@OpenWrt:/# cat /proc/mtd
      dev:    size   erasesize  name
      mtd0: 0000b000 00001000 "routerboot"
      mtd1: 00001000 00001000 "hard_config"
      mtd2: 00002000 00001000 "bios"
      mtd3: 00001000 00001000 "soft_config"
      mtd4: 00040000 00004000 "booter"
      mtd5: 005c0000 00004000 "kernel"
      mtd6: 03a00000 00004000 "rootfs"
    

    Now, erase the content of “kernel” and “rootfs”:

      mtd erase kernel
      mtd erase rootfs
    
  6. Create new file systems
    After erasing the content of the flash, we now need to create new yaffs2 partitions. In principle, we could also make the rootfs ext2/3/4, but I have not tried this. The kernel partition has to be yaffs2 as far as I know to be compatible with the bootloader.

      mkdir /mnt/kernel /mnt/rootfs
      mount -t yaffs2 /dev/mtdblock5 /mnt/kernel
      mount -t yaffs2 /dev/mtdblock6 /mnt/rootfs
    
  7. Copy the images onto the Routerboard
    Copying the images onto the routerboard can be done in multiple ways, I have used secure file copy (scp). First, we have to create a password for the root user. On the routerboard, execute

      passwd
    

    and set a password. On the linux PC, you can now copy the images onto the Routerboard:

      scp bin/ar71xx/openwrt-ar71xx-nand-rootfs.tar.gz bin/ar71xx/openwrt-ar71xx-nand-vmlinux.elf root@192.168.1.1:/tmp
    
  8. Flash the images onto the Routerboard
    Flashing the images is simple, once you have them on the Routerboard. First, the kernel:

      mv /tmp/openwrt-ar71xx-nand-vmlinux.elf /mnt/kernel/kernel
      chmod +x /mnt/kernel/kernel
      umount /mnt/kernel
    

    Now the root filesystem:

      cd /mnt/rootfs
      tar -xvzf /tmp/openwrt-ar71xx-nand-rootfs.tar.gz
      cd /
      umount /mnt/rootfs
    
  9. Reconfigure the Bootloader
    Reboot the board and enter the bootloader. Now change the boot device (o) to “boot from NAND, if fail then Ethernet” (n). Save settings with x.
  10. That’s it, you are done
    After some while, you should be able to ping the board at 192.168.1.1.

What if the Routerboard does not boot?

Do not panic. Look onto the serial terminal to see, at which state the Routerboard is stuck. You can always recover the boards using Mikrotiks Netinstall.

Helpful resources

32 Comments

  1. joe

    Hi Wolf,
    i’ve successfully flashed 433 and 411 with openwrt weeks ago using tftp32.
    When i’m tryin it with 750 the device got an adress 192.168.1.150, but the tftp upload is not workin. Any idea?
    Joe

    Reply
  2. awen

    Just successfully flashed my RB411. THANK YOU !
    PS: if you have more then 1 cpu or core, you can speed up building the firmware with ‘make’ option ‘-j’. Use number of your cores + 1, e.g. “make -j 3” for dual core systems, or “make -j 5” for quadcore..

    Reply
  3. Brett Charbeneau

    Hey Wolf!

    Thanks for the great blog post! Very useful.

    Do you know if the same routine will work on the Routerboard 750GL?

    Reply
    1. bastian

      Hi Brett,

      thanks for your feedback!

      I do not have a 750GL at my disposal, so I can only speculate. However, based on the specs of the RB 750GL and the commits in the OpenWRT repositories, I think that there is a pretty good chance. I assume that the bootloader works much the same way, so the procedure for the RB 750 should apply to the RB 750GL.
      However, as said, this is pure speculation and has not been tested by me. If however you are successful in flashing your RB 750GL, please tell me!

      Always happy to help!

      Bastian

      Reply
  4. Brett Charbeneau

    Hey Bastian, I have a 750GL in hand and have been able to telnet into it, but NONE of the commands you list work. They all resulte in “bad command name”. The unit is running Mikrotik 5.2 – it appears to have a totally different shell…

    Reply
  5. Andrea

    very useful guide!
    I have only a problem with usb support, did you test it?
    thank you

    Reply
    1. bastian

      Hi!

      Actually, all of my RouterBoards do not have a USB Host connector populated on the board. Maybe I could solder them in, but I did not do it – therefore, I cannot say anything about USB, sorry.

      Bastian

      Reply
  6. adi

    Thanks for that guide! I noticed two things:
    * After booting from tftp I have to plug the network cable into the second port to be able to reach the RB750.
    * The kernel images I get are too big to be saved on the kernel partition. Is there any known way to strip them down?

    Reply
  7. VoicesX

    How revision your used?¿

    Reply
  8. nop

    Thanks for the article, i succesfully flashed my 411, but i’ve met some difficults. Maybe just missed something obvious hah, but still. It just says that kernel was not found during boot process, while it lays at /kernel and executable.

    Booting process log: http://pastebin.com/NRfXjq8g
    Technical details: http://pastebin.com/uE0Qrctb

    Thanks and sorry for my english if matters.

    Reply
    1. bastian

      Hi!

      I believe that your problem is the kernel size that is exceeding 4MB. RouterBOOT cannot handle kernels larger than 4MB.

      Try compiling some of the features you need as kernel modules.

      Bastian

      Reply
  9. hades

    Hi Brett,

    what if the RB750 does not have enough space on the mtd partition for the kernel? How may I increase it without console access? The default size is 0x3c0000 and the kernel is about 6MB in size.

    Thanks!

    Reply
    1. bastian

      Hi!

      As far as I know, RouterBOOT will only boot the kernel from the first 4MB of the NAND. Increasing the partition size should be possible using the ram disk image but the RB will probably not boot afterwards. I have to confess through, that I did not try this myself.

      Using more kernel functionality should be possible anyway by building some options as kernel modules and loading them at runtime. Have you tried this?

      Bastian

      Reply
  10. hades

    Thanks!

    Yes, I removed several features and compiled most of the things as modules. The kernel dropped from 6.5 MB to 6.3 MB (elf). The lzma one is almost under 4 MB. Do lzma images work with RouterBOOT?

    Hades

    Reply
  11. hades

    Hi! Nevermind. Apparently the bleeding edge source has some issues with kernel size. I just checked backfire and the kernels are way smaller. Thanks!

    Reply
  12. Hanno Schupp

    Hi,

    thank you for the information on how to connect to the RB750, that was new and useful infroamtion to me.

    On actually loading a new firmware onto the router you can make yourself your life A LOT easier by using the wget2nand utility. All of steps 3 – 6 for the rb750 and 4-7 for the rb411 (and other mikrotik routers) are handled by that tool. All you have to do is host the two files, openwrt-ar71xx-nand-rootfs.tar.gz and openwrt-ar71xx-nand-vmlinux.elf in one directory on a webserver, and type
    wget2nand http://www.yourdomain.com/upload-directory
    and the tool will do ALL of the above tasks. Once finished, all you have to do is reboot the router (and switch to nand boot on device with serial access like the rb411 or rb450x devices like in step 8 above). Done

    Reply
  13. Meshpoint

    Is the RB711 series also supported?

    Reply
  14. VDIAS

    Need some help doing this with a windows 7/tftpd and a rb751g…

    Really don’t understand why they removed the serial port on this one… gggrrrrr!

    Reply
  15. Vladimir

    Hi Wolf!
    You wrote good manual. I’m successfully flashed Mikrotik Routerboard 750GL !
    Thank You !

    Reply
  16. Loris

    Hi! I applied this guide to a routerboard omnitik U-5HnD, I got the following lines. I can ping 192.168.1.1 but telnet 192.168.1.1 command advertise me: “Unable to connect to remote host: Connection timed out”.
    Why?

    “Jul 4 09:20:08 loris-desktop dhcpd: BOOTREQUEST from 00:0c:42:cd:5b:72 via eth0
    Jul 4 09:20:08 loris-desktop dhcpd: BOOTREPLY for 192.168.1.1 to routerboard (00:0c:42:cd:5b:72) via eth0
    Jul 4 09:20:08 loris-desktop atftpd[781]: Serving openwrt-ar71xx-nand-vmlinux-initramfs.elf to 192.168.1.1:50817

    Thanks for your help

    Reply
  17. testuser0

    Hey, i tried this with Mikrotik RB711UA-2HnD.

    My Problem is now that the Mikrotik wont boot. It hangs every boot.

    Reply
  18. mszerg

    I ran to buy Mikrotik 750))

    Reply
  19. Valent

    Added RB750 to OpenWrt WIKI, but plese make this page into really useful OpenWrt page:
    http://wiki.openwrt.org/toh/mikrotik/rb750

    Reply
  20. bgeci

    Hi to all

    I used RB750UP virtual machine to run OpenWrt. You can try this.

    Branko

    Reply
  21. adriasole

    Hi, how can I Reconfigure the Bootloader for mikrotik 750/750GL?

    Reply
    1. admin

      I have not tried this – however, most bootloaders are opening telnet ports for a short amount of time. RouterBOOT on the routerBoards waits 2 seconds before booting. It is very well possible, that you can access the prompt via telnet during this period. However, I do not know if and on which port RouterBOOT is reachable.

      Reply
  22. AB

    Hello.

    I installed OpenWRT on RB 750GL, but he recognizes all interfaces as if virtual (eth0.1 eth0.2 …). How to do that each port is detected as an interface (with different MACs)?

    Reply
    1. admin

      I have not done this but I assume that you have to reconfigure the switch that is contained in the RB750GL to make each port a separate VLAN. Then you can create a separate eth0 interface for each VLAN.

      Reply
  23. Rafael

    Hi man, can you help me? i followed your steps and all goes good until the time i need to save the new kernel into router, after telnet into the new system, scp the files into tmp folder.

    then when i go save it refuses and info me low space, i saw that 411 is a little bit diference of 750 at this point (the mtdblock is diferent), maybe in my case (rb951) is diferent too, but i dont know how to do, can you help me?

    Reply
    1. admin

      If the flash layout of your router differs, please be very careful and do not overwrite the flash without knowing what you are doing. If your device is still booting, please log into it via ssh/telnet and execute “cat /proc/mtd” to figure out the flash layout. Post it here and I may be able to help you.

      Reply
  24. grenouille

    any one .. can install LEDE/OpenWRT on mikrotik LHG5nD ??

    Reply
  25. Pingback: Installing OpenWRT on a RouterBOARD 750GL – TECH NEWS | THOMAS WILLNER

Leave a Reply to adriasole Cancel reply

Your email address will not be published. Required fields are marked *

This site uses Akismet to reduce spam. Learn how your comment data is processed.