Zyxel NBG6817 flashing from OEM


Hi everybody.
I need help with installation LEDE for router Zyxel NBG6817. I downloaded lede-ipq806x-NBG6817-squashfs-mmcblk0p4-kernel.bin, lede-ipq806x-NBG6817-squashfs-mmcblk0p5-rootfs.bin. I did telnet login according

I coppied files to /tmp, next

cat lede-ipq806x-NBG6817-squashfs-mmcblk0p4-kernel.bin > /dev/mmc0blk0p4
cat lede-ipq806x-NBG6817-squashfs-mmcblk0p5-rootfs.bin > /dev/mmc0blk0p5

with error message (cat: write error: No space left on device).

Next I tried

cat lede-ipq806x-NBG6817-squashfs-mmcblk0p4-kernel.bin > /dev/mmcblk0p4
cat lede-ipq806x-NBG6817-squashfs-mmcblk0p5-rootfs.bin > /dev/mmcblk0p5

I looks OK, but after reboot (reboot -f) is OEM firmware here. What I do wrong.
I installed LEDE to NBG6616 with no problem, it was easy, only 1 istallation file.

What I do wrong ?


First… You should be check the partition with this command cat /proc/mtd


Disclaimer: I don’t know the device in question, so I might very well be wrong!

While I haven’t personally worked with eMMC before, I really doubt that the eMMC partitions are exposed via “cat /proc/mtd”.

Keep in mind that, according to wikidevi, the nbg6817 contains two flash chips, a small 128 MiB (really? I’d much rather assume it would be 128 Mbit == 16 MiB) spi-nor flash (probably just containing bootloader and rescue environment and a 4 GiB eMMC (NAND) flash, which contains the actual firmware. According to the commit message, you only change the contents of this eMMC chip.


any progress here?I am thinking between this router and wrt3200acm.
But i found NBG6817 for a VERY good price, so now I am thinking how to flash lede there :slight_smile:


I was not succesfull, maybe I do something wrong.


I am in touch with developer right now. He is nice so far. :slight_smile: (it would be nice to get him to this thread as well) he is very helpful. But I still do not have my router. Store has delayed my delivery till Monday evening. So I cannot try anything yet. Meanwhile I am making builds based on @hnyman r7800 builds. If everything goes smooth and nobody minds and still helpful I will then try to keep up with this :innocent:


Use this approach:
(confirmed working on OEM ABCS.2 from ftp.zyxel.com)

root@NBG6817:/dev# dd if=/tmp/storage/usb1/usb1_3-1_1/lede-ipq806x-NBG6817-squas
hfs-mmcblk0p4-kernel.bin of=/dev/mmcblk0p4
8192+0 records in
8192+0 records out
root@NBG6817:/dev# dd if=/tmp/storage/usb1/usb1_3-1_1/lede-ipq806x-NBG6817-squas
hfs-mmcblk0p5-rootfs.bin of=/dev/mmcblk0p5
5760+0 records in
5760+0 records out
root@NBG6817:/dev# reboot -f
[ 642.282005] Restarting system.


Also, you need to build your own image to get overlay to work since overlay defaults to ram because the writable partition is on the 4GB eMMC. Here is my diff from the default config.



Trying to install LEDE release 17.01.1 on NBG6817 V1.00(ABCS.5)C0 without success.
Everything is as topic starter described both firmware bins flashes OK using “cat” or “dd” as suggested in the topic, but after reboot -f I’m still on stock firmware.

I cannot downgrade to V1.00(ABCS.2)C0 to try flashing LEDE from it, because zyxel ftp seems down.

Any advices?


I did flashing from OEM ABCS.3 to 17.01.0 r3205-59508e3 from 20.02, according to Marron and after reboot I had still OEM.
After comment of Kostja I did downgrade from OEM ABCS.3 to OEM ABCS.2 and repeate flashing according to Marron:

root@NBG6817:~# dd if=/tmp/storage/usb1/usb1_3-1_1/lede-ipq806x-NBG6817-squashfs
-mmcblk0p4-kernel.bin of=/dev/mmcblk0p4
8192+0 records in
8192+0 records out
root@NBG6817:~# dd if=/tmp/storage/usb1/usb1_3-1_1/lede-ipq806x-NBG6817-squashfs
-mmcblk0p5-rootfs.bin of=/dev/mmcblk0p5
6912+0 records in
6912+0 records out
root@NBG6817:~# reboot -f

After reboot I found LEDE !!! Next I did system upgrade to 17.01.1 r3316-7eb58cf109 from 18.04.2017 successful.

Many thanks to Marron (and Kostja for idea to downgrade)


Yep, yesterday I have managed to flash 17.01.1 LEDE too, after downgrade to OEM ABCS.2.

But now there are few more proplems:

  1. My usermade settings resets after every router restart. May be it is related to packages marron mentioned before. Will try to include them into the image.
  2. WAN Mac override option in LUCI is not working for me. It is critical for my ISP. Investigating now.


@Kostja_V you need to build your own image to preserve settings after reboot (as marron stated earlier).
You can build image with ImageBuilder (https://lede-project.org/docs/user-guide/imagebuilder - can be downloaded here : https://downloads.lede-project.org/releases/17.01.1/targets/ipq806x/generic/). I use standard Debian 8 distro for my builds and I’m in no way developer.
Try to change your mac for “wan_dev” in /etc/config/network . Then restart router.


Yes, you need to add kmod-fs* packages as I wrote earlier. I can send you a working firmware if you don’t want to build the image yourself.


Thanks, but I managed to build working firmware myself, using Image Builder and your package list.
It is working ok, changes are preserved now.
Also I have managed to override mac by manually editing /etc/config/network file.
But now I am quite dissapointed with WiFi perfomance. Using OEM firmware I achieved ~300Mbps with notebooks Intel Dual Band Wireless-AC 3160. But on lede 140-150 is the maximum I have seen.
Also I have tried to tweak WiFi settings using settings from OEM /etc/config/wireless but results were even worse.


That’s weird. I have very consistent performance at around 750Mbps on Macbook AIR and Macbook PRO. (On 5Ghz 11ac) I have never really benchmarked the 2.4Ghz wifi but since it’s also QCA9984 the performance should be excellent. (for 11n) What channel are you using? Auto? Something is wrong for sure.


Shouldn’t the following basically take care of it by default (untested, you’d need to check which of those are actually a hard requirement):

`diff --git a/target/linux/ipq806x/image/Makefile b/target/linux/ipq806x/image/Makefile
index de6ddb6a93…0d7330309b 100644
— a/target/linux/ipq806x/image/Makefile
+++ b/target/linux/ipq806x/image/Makefile
@@ -229,7 +229,7 @@ define Device/NBG6817
BOARD_NAME := nbg6817

  • DEVICE_PACKAGES := ath10k-firmware-qca9984 e2fsprogs losetup
  • DEVICE_PACKAGES := ath10k-firmware-qca9984 block-mount blockd kmod-fs-ext4 kmod-fs-f2fs e2fsprogs losetup
    $(call Device/ZyXELImage)


Marron, could you send me working firmware ? Thanks


I am using Intel Dual Band Wireless-AC 3160 in 5Ghz 11ac, its theoretical maximum is 433Mbps. If I remember it correctly, it was 36 channel by default on LEDE.


The firmware version itself is not a problem, installing LEDE from the stock vendor firmware V1.00(ABCS.5)C0 works just fine, the actual problem lies elsewhere. The ZyXEL NBG6817 provides a dual firmware setup, using mmcblk0p4/ mmcblk0p5 as default firmware location and mmcblk0p7/ mmcblk0p8 as alternate firmware location.

Whenever you upgrade the OEM firmware, the OEM updater writes the new firmware image to the other, currently unused, partitions and toggles the bootflag - LEDE however only knows about mmcblk0p4/ mmcblk0p5, so you need to make sure to run the OEM firmware from mmcblk0p4/ mmcblk0p5 for the documented install procedure to work (I’m not sure how to toggle the bootflag explicity, neither from OEM nor LEDE, but installing any OEM firmware (regardless of the version) implicitly switches the boot order around).


I am trying to use image builder to create my own image (the one from https://downloads.lede-project.org/releases/17.01.2/targets/ipq806x/generic/ built on June 10, 2017 still doesn’t keep settings after reboot). I downloaded lede-imagebuilder-17.01.2-ipq806x.Linux-x86_64.tar.xz and use the following command:

make image PROFILE="NBG6817" PACKAGES="block-mount blockd kmod-crypto-crc32 kmod-crypto-crc32c kmod-crypto-hash kmod-fs-autofs4 kmod-fs-ext4 kmod-fs-f2fs kmod-lib-cr16"

But the build fails with the following:

Collected errors:

  • opkg_install_cmd: Cannot install package blockd.
  • opkg_install_cmd: Cannot install package kmod-crypto-crc32.
  • opkg_install_cmd: Cannot install package kmod-lib-cr16.

Scrolling up I found:

Unknown package ‘blockd’.
Unknown package ‘kmod-crypto-crc32’.

I used the package list provided by @marron