Here’s the simplest method I know of for flashing a TM-AC1900 to a RT-AC68U or RT-AC68P. As this is a free resource please write questions in the comments below – do not call or email my business or use contact form regarding this subject.
LEGAL DISCLAIMER:
Your warranty is now void. Bay Area Tech Pros does not provide any warranty of this item whatsoever, whether express, implied, or statutory, including, but not limited to, any warranty of merchantability or fitness for a particular purpose or any warranty that the contents of this item will be error-free. In no respect shall Bay Area Tech Pros incur any liability for any damages, including, but not limited to, direct, indirect, special, or consequential damages arising out of, resulting from, or any way connected to the use of this item, whether or not based upon warranty, contract, tort, or otherwise; whether or not injury was sustained by persons or property or otherwise; and whether or not loss was sustained from, or arose out of, the results of, this item, or any services that may be provided by Bay Area Tech Pros.
WARNING:
Do not update to new Asus or Merlin builds without executing code for fixing mtd5 partition. (see below)
How to flash AC1900 to AC68U:
- Install WinSCP, Putty, and a file archiver (click this link for ez). Install the Asus Restore Utility, mirror.
- Create a folder on your desktop, name it “router”.
- Download this file and extract it to the newly made router folder. It contains a firmware to downgrade to, a firmware to upgrade to, and mtd-write.
- Set static IP for PC.
start > run > ncpa.cpl > double click Ethernet > properties > IPV4 >
IP: 192.168.29.5
Subnet: Default (255.255.255.0)
Gateway: 192.168.29.1 - Place router into Recovery/Restore mode
Start with powered off router.
Hold reset button and turn on router while holding reset for 10 seconds. - Go to 192.168.29.1 in a web browser
If Mini-CFE webpage won’t load use Asus Restore Utility
If having trouble with this step perform NVRam Reset and try #6 again (see step #18) - Flash TM-AC1900_3.0.0.4_376_1703-g0ffdbba.trx
- Wait for reboot <5 mins – WiFi lights on router will turn on when boot is complete
- Log in to router (admin:password)
- Go to Administration > System > Enable SSH > Yes > Apply
Ezlink: http://192.168.29.1/Advanced_System_Content.asp - Open Putty and WinSCP and connect them to 192.168.29.1 using a admin:admin or admin:password
Tip: In WinSCP select SCP as file protocol, in Putty SSH - In putty type:
cat /dev/mtd0 > original_cfe.bin - In WinSCP refresh the window on the right side and note that original_cfe.bin is present
- Copy original_cfe.bin to a local drive
- Upload original_cfe.bin to https://cfeditor.feng.si/ > Select 1.0.2.0 US AiMesh as Source CFE > Download the new .bin > rename it to new_cfe.bin
- Upload new_cfe.bin & mtd-write & FW_RT_AC68U_30043763626.trx to router through WinSCP
- In Putty type:
chmod u+x mtd-write./mtd-write new_cfe.bin bootmtd-write2 FW_RT_AC68U_30043763626.trx linux - Perform NVRAM Reset, wait for reboot <5 mins
a. Power off router
b. Wait 10 seconds
c. Press and hold WPS button
d. Power up the router and continue to hold WPS button for 15-20 seconds until power LED starts blinking very quickly. - Reset PC IP back to default
- Log in to router using 192.168.1.1 and the router is now an AC68U with 64MB jffs
username:/password is now: admin:admin - Enable SSH (see #10) and execute the code for fixing MTD5 partition that is listed below.
Ezlink: http://192.168.1.1/Advanced_System_Content.asp - You can now flash Asus, Merlin, Advanced Tomato, FreshTomato, Tomato, and DD-WRT firmwares.
Code for fixing MTD5 partition so you can update to latest firmware:
(this is entered in Putty after enabling SSH on the router)
cat /dev/mtd5 > /jffs/mtd5_backup.bin
mkdir /tmp/asus_jffs
mount -t jffs2 /dev/mtdblock5 /tmp/asus_jffs
rm -rf /tmp/asus_jffs/*
sync && umount /tmp/asus_jffs
rm -rf /jffs/.sys/RT-AC68U
nvram unset fw_check && nvram commit && rebootVideo Examples:
Windows
Macintosh
References Used:
- Snbforums.com flash instructions: flashInstructions_cDec04_16.pdf
- Bootymonger from slickdeals: slickdeals.net
- Wherever I found https://cfeditor.pipeline.sh/
- Comment from Albert Lee
Flashable Operating Systems:
Helpful information:
- Asus Rebadger is a script that automates this process on a Windows 10 PC.
- If you have a fast connection you may benefit from Merlin or official builds as they have enabled hardware acceleration which allows the router to handle higher speeds.
- You may check router cpu speed at http://192.168.1.1/Tools_Sysinfo.asp
- If the 30/30/30 reset doesn’t work try this:
1. power off device
2. hold reset 20 seconds
3. power on device holding reset until power light blinks slowly - If you can’t get Mini-CFE or Asus Restore utility to work try the method outlined in this comment.
- There is discussion on the topic at whirlpool forums.
Alex,
Thanks for the instructions. Does this downgrade apply for any firmware version? I am running 3.0.0.4.376_3181.
The purpose of the downgrade is to enable Telnet/SSH as that option does not exist in newer firmware. If you cannot enable Telnet/SSH, whatever version you have, then you must downgrade. If you can enable Telnet/SSH then just skip ahead to step 12.
Hello thanks for this hack, I have a problem with my cfe I get it ok but it’s empty.
I can’t find a way to get it to renew. Says its invalid when I upload it.
Thanks for any suggestions you may have.
John,
This should help you out: https://www.snbforums.com/threads/t-mobile-cellspot.19435/page-10#post-243869
make sure you statically assign an IP when you switch it to AP mode.
I had lots of trouble with the 3181 firmware but it worked. Some of the issues I had were due to either the USB to Ethernet adapter, Ethernet cable, or the firewall software. If you run into issues you might want to consider swapping out the items mentioned above.
Good luck!
I missed the command to delete or fill the mtd5 Asus with FF etc. Anyone able to advise that?
After performing the 10/10/10 reset prior to flashing the TM-AC1900_3.0.0.4_376_1703-g0ffdbba.trx, I am consistently not receiving the Wifi lights. I tried to upload the FW but I get an “invalid transfer error”. What am I doing wrong? I cannot for the life of me, get the wifi lights to go back on.
I was wondering I have a question.
First of all I’m not tech savvy and I do not have access to a computer.
I was wondering do you purchase them yourself like at those prices are like $50 then also flashing and turn around and resell them because if you do I like to know at what site in Amazon or wherever you sell them at to look at them because I like to purchase one considering that since again I do not have a computer or tech savvy and currently I incapacitated due to a surgery from an injury from a fall and the surgery was performed in the VA Center in San Juan. I’m a US Marine retired.
You can contact me if you wish [EMAIL REMOVED]’.
If you don’t flash them and sell them if you know anyone who does that you’re comfortable with and know who they are if you can forward that information to them or to me I would greatly appreciate it.
Rather than paying someone to flash and ship a router just buy a more expensive router.
First, if you don’t have a computer, what do you need a router for? If it’s just to get wifi for your phone or tablet, any cheap ($30) router will be fine. The TM-AC1900 is a fairly high-end router with lots of power. More than needed for many people.
STEP 28.Flash FW_RT_AC68U_30043763626.trx is VERY Important. You have to flash to this specific firmware before flashing to any later ASUS firmware versions or custom firmware.
From the slickdeals thread:” NOTE: If you are flashing later versions of Asus or Merlin 376.xxxx or ANY version of 378.xxxx or 380.xxxx (Asus or Merlin), you must flash to a firmware that will expand your rootfs partition from 32M to 64M first. Asus 376.3626 is recommended. Flash Asus 376.3626 and after installation, reset NVRAM. This will expand your rootfs partition and allow the new firmwares to install correctly!”
Thank you for putting all this together!
Thanks, I left a note in the guide to reference this. I don’t recall doing that when I flashed my router though. If I get another one of these routers I’ll verify the procedure.
my tmobile ac1900 firwire version is 3.0.0.4.376_3181-g247286a.. but it never goes to rescue mode.. what could be reason… i am following ur instructions as written, please help.. i want to flash this router
If it never goes to rescue mode I cannot help you as that sounds like a hardware defect. More likely, however, is that you’re improperly describing not being able to connect to the router while it is in rescue mode. You’ll need to confirm your issue and provide some more information as to what you’re doing and experiencing for me to provide assistance.
as @skn99 said, I’m having same issue. I tried the method describe in this article, 10 sec hold, turn off router while holding for 10sec, and turn on the router while hold 10 sec. I even timed with the stopwatch and tried other method found on internet but no luck. I have same firmware (3.0.0.4.376_3181). I wish there’s better way to describe the issue, but it’s simply not going into rescue mode… going into rescue mode might be different in this firmware?
try this:
1. power router off
2. hold reset button 20 seconds
3. power on and hold until power light flashes slowly
The newest firmware seems to make the rescue mode much more difficult to enter into and stay in. When I received a TMC-AC1900 with the 3.0.0.4.376_3181-g247286a firmware on, to enter into rescue mode I had 1) power of the router 2) hold down all three of the Reset, WPS, and Wifi On/Off buttons down 3) power on the router and wait till the power LED on the front starts blinking rapidly 4) release the WPS and Wifi On/Off buttons but continue holding the Reset button down, the Power LED should now start blinking slowly and you will be in Rescue mode. You may need to continue holding the reset button through the entire firmware flash.
I also noticed that rescue mode is either unstable or has a short time limit on it, so I would recommend having a browser(Chrome) open to 192.168.29.1 and constantly refresh while you restart the router holding the Reset button down. It may take you to a page with something about “Your settings have been applied…”, just keep hitting the refresh until the Mini-CFE page comes up. You will then have to quickly select the firmware file you’re trying to upload and click upload. If you’re using Chrome, it will tell you the status of the upload. If it fails to upload, restart the router with the method above and try again. The Asus Rescue Utility seems to fail every time during upload, so I would steer clear of it, though it will tell you if your router is in Rescue Mode.
Also, just a note on Step 12. In order to use WinSCP you must also enable the SSH Daemon in that same page along with Telnet. SCP uses SSH and is not enabled by default.
I have uncovered another piece of the puzzle for those of you having a difficult time getting into recovery/restore mode.
I have read through all the posts up and down a couple times and noticed that a few people have the misfortune of getting devices that cannot, for the life of them, no matter what method they use, get the power led to slowly blink (aka get into recovery/restore mode).
I was one those unfortunate individuals. This is what worked for me. It is uses Rob’s method in addition to my discovery.
1) Power off the router
2) Hold down the Reset, WPS, and Wifi On/Off buttons
3) Power on the router and wait till the power LED on the front starts blinking rapidly
4) Release the WPS and Wifi On/Off buttons but continue holding the Reset button down. For most, the power LED will begin blinking slowly. For the unfortunate few, it will still be solid.
5) Continue Rob’s process as if the power LED is blinking. Open to 192.168.29.1 and refresh the browser until the Mini-CFE page comes up. Flash firmware 1708.
6) Continue Alex’s tutorial from here on out
Note: Once firmware 1708 is flashed, the 30/30/30 method will work all the time.
I was able to convert AC1900 to AC68U successfully as well as update to the latest Asus firmware. Running smoothly now.
Good luck guys and thanks for the all the info.
mine is 3.0.0.4.376_3199, used your method and works !!
make sure:
111. LED light ON- pressed in. other wise not goona work!!!
follow these steps
1) Power off the router
2) Hold down the Reset, WPS, and Wifi On/Off buttons
3) Power on the router and wait till the power LED on the front starts blinking rapidly
4) Release the WPS and Wifi On/Off buttons but continue holding the Reset button down. For most, the power LED will begin blinking slowly.【Mine does not blinking slowly, it turns solid after I release WIFI on/off+WPS button, but Iam able to flash now】
didn’t see any one have the same verson (3199) like mine, only 2 differences. led on + appears solid light instead blinking slowly.
continue my flash, YAAA
After Step 4, the LED light did not blink slowly but it turned solid. However, I was still able to flash it.
Initially, I was using ASUS restoration utility and I was getting a message that the router was not in recovery mode. But then, I used mini-CFE and was able to flash the router.
Thank you guys for your help.
i have same version 3199 as “tony says”. with 3 button pressed following the same step as his and I can confirm “no slow blinking power light” but I have the Mini CFE screen. However when I upload the stock TM firmware 1703, I repeatedly have this error:
Receive file size=16949297 The file transferred is not a valid firmware image.
I have re-downloaded this firmware from multiple sources and all end up with the same result.
Anyone has this issue and way to resolve it?
Great Tips you guys. I got an 3.0.0.4.376_3181-g247286a firmware version also
I did Rob’s three finger and a pen while looking at a light (sheesh how bad can they make it!) trick, I didn’t get the flashing light, and I proceeded as Mitesh stated. One time I saw the CFE screen so I had home, and moved fast, but no upload. Most of the time it would show the “wait, settings are changed screen” which comes after the WPS and power on causes a reset.
So I wondered, maybe there’s a hybrid here? Maybe they disabled the flashing light, but the three fingered method was mostly causing a nvram reset. So I tried the original method, power off, hold reset only, power on while still holding reset, and ignore the light (which doesnt blink)
I hit refresh continually on the browser….
It went right into the CFE upload screen first time! So give that a shot too…
I used Chrome, it shows the file uploading in the lower left, you should finally see this:
Receive file size=16949294
Upload completed. System is going to reboot.
Please wait a few moments.
Continue
So please post up if this works, I’m sure this will get some more of the refurbs off the market until the next bad patch
Thanks All
PS OMG I wrote all this and I was still offline through the ASUS, thank god it was still cached in there whew!
For others having a hard time with 3.0.0.4.376_3181-g247286a firmware which my device came with already flashed, I tried all these steps and random variations over and over with no success, in the end what worked to my surprise was stop worrying about counting seconds and flashing lights and:
1) Power off
2) Holding reset button in using a clamp and a small scrap of plastic to make CERTAIN it stayed pressed.
3) Power on
4) Manually refresh browser until Mini-CFE flash page was displayed
5) Flash to 1708, reboot
Follow the instructions here
Once that was done, flashed the latest ASUS firmware and reboot, then configure operation mode to “AiMesh node” and it worked first time.
THANKS! I am uploading NOW!!! :)
I had the version 3181 and got stuck at the page where it said something to the effect that “settings have changed…”
I followed hoopsurfer suggestion at 2018/01/11 at 8:39 PM and worked like charm. This is what I did.
1. Power off the router
2. Opened a chrome browser window and typed in 192.168.29.1 (don’t hit enter yet)
3. Hold in the reset button
4. Power on and hit enter the browser window
5. Keep refreshing.. CFE comes up in short order.
6. Browse to the 1703 firmware you downloaded and select and upload
7. As others have suggested, the bottom left of browser window shows progress in percent.
8. Once it reached 100%, got the message “Receive file size=16949294 Upload completed. System is going to reboot. Please wait a few moments. Continue”
9. After few minutes, I clicked “Continue” and got the login screen.
10.NOTE: Through out the upgrade, I held reset in but once in a while, I released it accidentally but didn’t seem to affect.
This is the type I needed.
Thanks, Rob
I tried it and it worked!. Thanks for the post. Much appreciated.
I recall I thought mine wasn’t going to rescue mode… but it was just that the light wasn’t flashing as expected.
Found your Slickdeals link. BIG ups for crafting this together for us. I’m rolling up my sleeves tonite and thankful to have something so much more concise and clear than other instructables. THX THX THX
PS. Had my unit since last July. My motive is when TMobile finally hit me with the _3181 auto update sometime in Feb, something def went fucky: Lots of stalled file transfers on various LAN connected volumes. Took a month of head scratching and old router swaps before I figured it out.
First, Thanks for this post. I get the white light on the back to flash but unable to get Asus Restore Utility to see the router.
I’ve been having issues with the TMO Stock firmware and 5 GHz dropping out. Will flashing fix this issue. I suspect it is a firmware issue and not a hardware because i have experienced this with 3 routers.
Thanks
So, I finally decided to do this… wow… I did it just to run the stock firmware from asus…
It is not a quick thing to do… and had to take parts from several different compilations..
1703 is absolutely necessary…. the guides for cme make that part an easy change, but after getting this far, I was stuck, it wouldn’t load the .3626…
It somehow got caught with a partial load as some parms were changed, it identified as asus, but as a 1703 build… restore would do anything as it felt it was not in recovery.. gui said all tmobile and asus builds were invalid, as would the mini webgui…
Main web gui would say newer was available, but it too was invalid..
After what I can only guess was around router reboot 200, the mini gui finally decided to take the 3626… and was able to upgrade to newest build from there with no issues..
The time I did get out to take i was holding reset as I submitted the boot file… as I had done many times before…
If you decide to do this (and if you have a family that likes to use the wifi) I recommend having another router to act in it’s place, and undertake when you have plenty of time to research other ways to make stuff happen..
Btw, before downgrading I was able to toggle tenetD on as well as sshD… neither worked.. but did show errors on the syslog after turning them on… the error seemed unrelated to either daemon, but only occurred after forcing enable through the web page unhiding…
Big thanks to all who have made this possible!
Hi, and thanks for writing this up. I need a little push in the right direction.
Everything went smoothly (downgraded firmware, reset nvram, enabled telnet) until step 13.
Firefox and Putty connect to the router with no problem, but WinSCP won’t connect to the router – it continuously errors out with “Connection refused”. I have SCP selected as the file protocol, but am stuck without being able to connect WinSCP to the router.
I used the same IP/login/password that I used to connect Putty. I also tried connecting WinSCP without Putty or the browser connected, same issue.
In the WinSCP login screen, I changed File protocol to SCP, entered the router’s IP (192.168.29.1) and the login and password, clicked “Login”, and got “Searching for host…” then “Network error: Connection to 192.168.29.1 refused”.
And so I’m stuck. Any suggestions, please?
Never mind. Did a bunch of reading and looking at videos, and found a way around having to use WinSCP, which I never got to work.
I used a USB stick and Putty for accessing the router files.
That web site that patches the .bin file for you that you found saved a lot of time and anguish, BTW.
And one other thing – if anyone uses the USB stick method, the version of mtd-write that was in the zip file with the images did not work for me; I had to find and use version 2 before everything started working correctly.
So I ran into the same issue that Bob did. Step 13 did not work – SCP would not connect.
The issue is SCP does not work over Telnet. For me, the fix was to enable SSH as well as Telnet in the router at step 13. Once I did this, SCP worked right away. Hope it helps some others!
I just wanted to leave a comment to say thank you for this great write-up! I got mine up and going without a hitch.
Hi guys,
I was able to get everything done multiple times over but one problem I’ve seen. Not sure my router is working at 100% right now or just 99%. When connected to the router through ethernet, the laptop recognizes the router as cellspot, whether I have asus firmware or merlinwrt. Is that supposed to happen? Or is there something I’m missing?
Does it say the router is an AC68U when you log in at 192.168.1.1 ?
Hi Alex,
I have a problem.
26 steps are done, but after I can not Flash FW_RT_AC68U_30043763626.trx.
If I use Mini-CFE always lost connection and no answer.
If I use Asus Restore Utility after 40%-50% apload router automatic restart.
Do you have any ideas?
Regards,
Rez
Try to do an nvram reset and then flash a Merlin or official build. Let me know if that works.
If you’re getting “Connection Refused” for step 13, you need to enable SSH along with telnet.
Thanks, I’ve adjusted the guide to reflect this. There’s no reason to enable Telnet if SSH is enabled, and SSH is accessible through both Putty and WinSCP.
Thank you so much for this guide. I looked at several guides including YouTube and kept finding conflicting or confusing information. Not only was this super easy to follow, my router is ridiculously stable. I couldn’t make stable WiFi calls before, but now I can even stream uncompressed bluray mkv files over WiFi without issues running Asus Merlin. This router is crazy awesome now. I almost gave up on flashing it before finding your guide.
Couple notes…
For OSX users/Newer OSes with built-in hardening, Diffie Hellman rejects will occur; either find a machine with an older OS, or you’ll need to add the cipher to SSH config (and remove when you’re done).
Asus firmware restoration REQUIRED for step 24. The mini-cfe page does not do the trick for step 24, you HAVE TO use the firmware restore utility. Worked fine on my Mac. In step 24, DO make sure your router takes 192.168.1.1, not 192.168.29.1; something is going on here, I had to do it a couple time, including using 1.0.2.1 for it to take 192.168.1.1 and then use the restore utility.
Do verify you completed the CFE upload correctly after 20 by running “nvram get bl_version” after and it’ll be 1.0.2.0 or 1.0.2.1 afterwards depending which you choose. I choose 1.0.2.1 personally.
On step 20, pull the plug instead. Known issue that some folks (like myself) don’t have it actually work unless you pull the plug instead of issuing a soft-reboot. (see step above to make sure it took before proceeding).
mtd-write version 2 should be used if you use a USB drive (I did). The Slickdeal goes into this. For version 2, also follow the slickdeals thread.
Hello, thank you for this information. I performed my flashes with Windows 10 and did not experience any rejects so it may only be an issue for OSX.
The solid confirmation that AFR is required for step 24 is appreciated. I’ve adjusted the guide on that step.
In regards to verifying the cfe upload, I did do that the first time I flashed this. However I flashed 6 more routers after that and did not bother with it because I am lazy and they came from the same source (tanga). I am noob in this regard and don’t know the difference between the versions and doubt it matters for the end result.
I won’t adjust step 20 as it worked perfectly for me with the putty command within context of this guide. Same goes for mtd-write. Though I’m sure someone troubleshooting following another guide will find your information useful.
Thanks for this update. I am on a Mac using the latest version of OS X (High Sierra) and find it impossible to make any connection to the router using a Mac.
I was able to upload the older version of the firmware and enable SSH but I cannot connect I found to it.
I used online instructions on how to create a pair of SSH keys (public and private) and the router asked for the passphrase. But it will never connect fully. I have tried Cyberduck, Mountainduck, Forklift and Mac Terminal and nothing works.
I would appear I need access to a Windoze machine because even Parallels uses the Mac OS X for networking.
Called AppleCare. Useless. Called ASUS. Useless.
Until I can get into the file system of the router, I am dead in the water.
The error message from Cyberduck reads:
Interoperability Failure
EOF while reading packet. Please contact your web hosting service provider for assistance.
Any suggestions? I have no access to a Windows machine.
Is this the error you are getting?
https://www.petenetlive.com/KB/Article/0001245
If so, I tried what was suggested here and I could connect.
how do you confirm the rootfs is 64 MB?
flashing FW_RT_AC68U_30043763626.trx in step 24 expands it to 64m
if it didn’t then the guide would be useless as it wouldn’t be possible to flash ac68 builds
so it’s confirmed
In Putty, you can check your current partition size using the command:
df -h
If you have a 32MB partition, jffs will also be around 32MB. If you have upgraded to 64MB, jffs will show something closer to 64MB.
That’s from my original guide :-). That’s the jffs partition, but it expands when rootfs expands, so it’s easy to check.
Nice work putting this together, Alex, and thanks for the proper citation!
I can’t do step 24 for the life of me. Restore utility can never connect, and CFE says the new firmware is an invalid image. Can anyone help? Thanks!
I’m having the same issue
Check again, the guide has been rewritten and Step 24 is no longer required.
Check again, the guide has been rewritten and Step 24 is no longer required.
I recently started the flashing process on one of these I got a few months back.
Got all the way to the step where I flashed the CFE and rebooted it, At that point, none of the 5 wired ports respond in regular or recovery mode. No pings, no http, nothing.
The wireless still works. I can get the web interface up. I can ping it wirelessly. I can still ssh onto the router via the wireless nic.
I’m kinda at a loss. I suspect the CFE busted the mac addresses of the 2 Ethernet controllers in the device somehow. Not really sure how though, because the macs lineup in the original and new CFE files. I did choose 1.2.0.1 on the CFE website. I wonder if that is the problem.
Just run back through the steps and try with 1.2.0.0 and do an nvram reset.
For future reference, I reflashed the original CFE back onto it and it revived the wired ports. Another build of the new CFE worked fine. Must have been a bad file.
This process worked flawlessly for me. It took less than 30 minutes, I now have a full blown ASUS AC68U running the latest ASUS firmware.
Thank you!
Thanks for the post! I followed it and it works flawlessly. There is no need for PuTTy or WinSCM if you’re on Mac (like me), just the plain old terminal works great. Thanks again.
Thanks for this tip, was just searching for this when looking for winscp alternatives lol
As a first time flasher, could you please provide a little more detail on how to do all the steps on an Apple MacBook Pro using Terminal? Especially the part about how to connect the computer to the router and log in in order to issue the commands, upload, and download, etc. Could I use Cyberduck instead of Terminal?
How much time should I budget to complete this conversion?
What version of Mac OS are you using?
I cannot make an SSH connection into the file system of the router, even after downgrading the firmware and enabling SSH, Port 22.
I thought maybe creating a public and private RSA key set would help. But no.
The error message from Cyberduck reads:
EOF while reading packet. Please contact your web hosting service provider for assistance.
When i log into the router admin it shows FW version 3.0.04.376.1703 and putty shows ASUSWRT RT-AC68U_3.0.0.4Was able to complete process up to step #12 and can connect both WSCP and Putty router but when i enter the command line the original_cfe.bin does not get created, What am i missing?
Hit the refresh buttno on the winscp window and it should show the original cfe
Thanks Alex, I tried that and also did a search from root directory for that file but in vain, I’m not getting an error from putty neither, when i hit enter after pasting the command i get back to admin@TM-AC1900:/tmp/home/root# but the original.cfe file is nowhere to be found on 192.168.29.1, what am i doing wrong?
I have no idea what you’re doing wrong, sorry. Try starting again from step 1 and maybe you can find it or refer to another guide.
I’m having the same problem as you, Steve. I can not for the hell of it find original_cfe.bin in the dev folder. I tried reflashing the FW 5 times last night, with no luck :(. I wonder if anyone else is having this problem…
same problem
I was able to downgrade the firmware to the first TM version, but I’m stuck after loading the Asus CFE. I tried 1.0.2.0 and 1.0.2.1 with a couple different mtd-write versions, but I could never get it to load the mini-CFE and the Recovery tool could never find the router (yes, I set a static IP, tried using both 192.168.1.* and 192.168.29.*). My last attempt, I followed some forum post I found saying I should first set it to AP mode then try to go into recovery mode. I did this after flashing 1.0.2.1 with mtd-write v3; now I think I may have bricked it..
It still seems like it responds to the button presses; if I turn it on holding reset and leave it pressed for like 30 seconds, the power button will start to blink. I can also do the WPS button nvram reset, and I can see the lights responding. But after doing either of these, I still cannot connect or talk to the router. Before that, every time I did the WPS nvram reset, it would go back into normal running mode and I could enable SSH or configure the router like normal.
I’ve also tried doing 30/30/30 reset and just leaving it unplugged for a while, but I can’t get it back to normal working mode. Any thoughts?
I had the same thing happen. :( Sad times.
I’m stuck on step 25… minicfe says the firmware is incompatible and the discovery utility doesn’t seem to have any options to upload firmware.
Also on the Wipe NVRAM portion, are steps a b c d how to do it or are they to be done after doing it some other way?
Did you find a work round for this.
Realized the install had not completed properly and didn’t have the firmware restore tool installed.
However I guess I am not getting into rescue mode as the restore tool says the device is not in rescue mode and the power button never flashes slowly.
Tried both holding the reset button as described and holding all 3 buttons as the other user described… it doesn’t want to go into rescue mode…
I am having the same issue. I tried Rob Holland’s method. In his method I get to the point where the power light begins rapidly blinking but when I let go of the reset button it goes solid.
I tried the 30/30/30 method which doesn’t work.
I tried the alternate method (power off device, hold reset 20 seconds, power on device holding reset until power light blinks slowly) which also doesn’t work.
Am I doing something here?
Unfortunately, I get stuck at step 19
./mtd-write new_cfe.bin boot
it returns: ./mtd-write Input/Output error
Any clues? I’ve tried rebooting the router, clearing the nvram, …
HELP!!!
did you copied new file with exact name “new_cfe.bin” (no spaces, with “_” sign?) to the root folder with winSCP as it says in the manual?
Thank you very much. Your instructions are dead on. I had problem accessing the router after the upgrade as it automatically kept switching the subnet on me. In the end it worked out and upgraded the router to the recent stock firmware and would not be happier.
BTW Step 23 really means repeat “Enter recovery mode (repeat Step 5)”. I was doing the alternate method of entering recovery on the latest TMO firmware (from Rob Holland comment) — this was ONLY necessary during initial step 5. Once flashed with the 1703 firmware Step 5 instructions applied. That could have saved me an hour.. hoping it saves someone else. This procedure DOES work as of 10/3/2017.
Thank you very much for such a precise and easy to follow instructions. I did a lot of googling to find out this but instructions at other sites are too clumsy.
Well done for such a great job !!!
Worked like a charm. 0 issues, just make sure you follow the steps to the letter.
Can confirm, jsut did this step by step for firmware 3.0.0.4.376_3181. Just don’t forget to set router into AP mode before connecting with PC with static IP and after downgrade to _1703 version otherwice you will not get miniCFE page or Asus firmware restoration tool to connect to router (this info is not very clear stated in the manual).
Actully I was able to set the _1703 file via miciCFE page (was holding reset button till the file started to upload (chrome shows in the left down corner this info)), but for the upgrade to Asus file _3626 miniCFE didn’t load (or was not uploading new firmware, cannt recall) but Asus firmware restoration tool was able to connect and did the job. NVRAM reset was made without any problems.
Many thanks for this manual.
This is a gem. I hope the universe bestows wonders in your general direction. Thanks mate!
I took notes when flashing my TM-AC1900 a year ago and there are parts of these directions that could be greatly simplified.
The T-Mobile firmware includes mtd-write2 so uploading a copy of mtd-write is not necessary. mtd-write2 can be used to write both the new CFE and the AsusWRT firmware image in the same step.
The telnet option is still available in the T-Mobile firmware but hidden in the web interface, so downgrading to a different firmware version is not necessary as long as you have a USB drive to store files since scp won’t be available.
Steps 2-10 can be replaced with:
1. Go to the T-Mobile firmware’s Administration->System page (http://192.168.29.1/Advanced_System_Content.asp)
2. Right-click and select “Inspect” or “Inspect Element”.
3. Look for an element with name=”enable_telnetd” in the inspector window
4. Remove the “hidden” attribute by selecting it and pressing Backspace/Delete until it is gone
5. Select “Enable Telnet” on the web page and click “Apply”
Steps 16-24 can be replaced with:
1. Copy new_cfe.bin and FW_RT_AC68U_30043763626.trx to a USB drive.
2. Insert the USB drive in one of the router’s USB ports.
3. `mtd-write2 /tmp/mnt/*/new_cfe.bin boot`
4. `mtd-write2 /tmp/mnt/*/FW_RT_AC68U_30043763626.trx linux`
Lol, that’s awesome!
3. `mtd-write2 /tmp/mnt/*/new_cfe.bin boot`
4. `mtd-write2 /tmp/mnt/*/FW_RT_AC68U_30043763626.trx linux`
the above are input via putty, right? Thanks and will give it a try soon. waiting my TM router comes
this element is not present in the latest TMO firmware 3181. I’ve searched for it within the window using control F. I can see the other hidden elements and edit and delete them. Telnet is not one of the options.
Thanks for the confirmation.
The telnet option is there on the 3199 firmware. I am not a guru and I got there in Chrome by logging into the router then system. On the system tab I right clicked inspect. Then go to the Misc heading on the router display and right click inspect. Then search for telnet control F and it shows up in the box (32 of 5 when searching) and you will see display “none”
remove the none to look like this
That puts the telnet there but the radio buttons are not operable
To fix that I can’t seem to copy it but when I click on the attribute I changed the value of the radio button and was able to select the Yes button and apply.
When I go back in even though I do not see it –if I select the element again it is enabled
My next step to is try to upgrade this router so I am following the instructions here – the first time I tried I could not even get it into recovery mode
The suggestion from Albert Lee about using Putty to upload the firmware image solved the issue I was having where I could no longer enter recovery mode after writing new_cfe.bin. The router would have the flashing power light, but the ASUS rescue app would find the router and indicate that it was not in recovery mode. Similarly, the router would not respond to a ping. Using putty to write the firmware was much easier and solved all of my problems. Since I was not using a USB drive, I modified the command to be: mtd-write */FW_RT_AC68U_30043763626.trx linux
Thanks for the instruction. I was stuck at Step 24, couldn’t enter mini-CFE and Asus restore utility always aborts at about 50%. To flash FW_RT_AC68U_30043763626.trx, I eventually did the following:
1) enabled sshd in the router,
2) scp the mtd-write and FW_RT_AC68U_30043763626.trx,
3) ssh into the router, performed the following:
./mtd-write2 FW_RT_AC68U_30043763626.trx linux
4) reboot the router by powering it off
– reboot via command prompt will result in seg-fault, since we just wiped the system,
5) erased the nvram, and waited for couple of minutes.
your instruction to use mtd-write2 to flash the ram probably saved me a few hours of work. Thanks.
Thanks Mikeong.
I was able to follow the steps you posted on mine when it would not go to recovery mode.
Only thing I did that was not the same is I used mtd-write rather than mtd-write2.
I am now on the 3626 firmware and will move on from here.
You saved me hours of trying to hold two buttons down, while pushing in a [recessed] reset switch, and turning the power on off while trying to observe the front panel power LED, simultaneously using a mouse to try to use the Asus restore. Maybe I am uncoordinated lol
Anyway, I knew that there had to be a simpler way, and this was it.
Follow this instruction, I successfully brick my router.
How can I rescue it?!
never mind. my router is back and successfully flashed to 3626 after I change my static IP to “Obtain the IP address automatically”.
./mtd-write FW_RT_AC68U_30043763626.trx linux
is the best solution.
It seems that even if you enable telnet and ssh in browser using “Inspect Element” only sshd_enabled:1 will be sent as form data during POST in “Apply”. Nothing about Telnet.
But problem is that even if sshd_enabled:1 is getting sent to backend, it does not enable ssh and Putty still failing.
Any ideas? I already tried to reboot router
Unable to login after step 8. Neither login combo works. Any suggestions?
Reset router holding the reset button as it is powered on, it will reset the password to admin:admin or admin:password.
I’m had the same problem.
For me, password reset was by holding reset button for 10-seconds while it was already powered on, then waiting for it to reboot.
Got a 2015 TM-AC1900 with stock FW 3108 from Ebay, followed this tutorial then successfully updated the FW to Asus Merlin 380.68_4. Thanks for putting this together.
A couple of things I noticed while flashing my router:
1). Default admin password for TM and Asus’ FW is different. Swap between admin / password to figure it out if system says your password is wrong.
2). Clearing NVRAM — make sure you do so each time you update FW (this includes downgrading between TM 3108 and 3107; between TM 3107 to Asus AC68U FW; and between AC68U FW and Tomato / Merlin FW; and after you flash to Merlin FW…)
3). Step 28 — once you are on Asus FW_RT_AC68U_30043763626 FW, you can directly upload Merlin FW from router’s UI: update firmware option, instead of booting to rescue mode then using Firmware Restoration Utility (this option actually didnt work for me — which is weird…)
I got stuck at step 23 BUT i have found a work around that worked for me.
To get into recovery mode power off the router. When you power it on, make sure you are pushing and holding down the RESET button at the same time as powering on. The power light will then blink afterwards, the back light will not blink so pay attention to the power light on the front.
The Asus firmware restoration did not work for me so I used the CFE mini browser to upload. MAKE SURE YOUR CACHE IS CLEARED before using the CFE browser. It will not complete if you dont take that step. You can also use Google Chromes incognito mode if you dont want to clear cache.
Thank you! The cache clearing/incognito tip helped immensely. Should have thought of it but didn’t.
Worked exactly as written, with no hassles or workarounds needed. Thanks for taking the time to make this guide, Alex.
Stuck at step 9. Neither admin:admin, nor admin:password work for me to log in. Any thoughts?
Factory reset the device by holding the reset button. That should clear the password.
Thanks. Worked flawlessly
I’m having a problem getting back into recovery mode after rebooting on telenet after clearning NVRAM on step 23
I went from Merlin back to stock… Merlin didn’t add anything I needed. Any discernible advantage to over clocking?
Overclocking will help if you’re installing apps from optware/entware like owncloud (which you’re not since it is running stock) or a bunch of vpn servers or a media server. Otherwise, if you’re not pushing the router, it will probably give it longer life to run at lower clocks.
Also it isn’t really overclocking, the stock speed for the ac68u router is 1ghz, but the ac1900 one runs at 800mhz even though it has the same hardware (citation needed).
Settings have been updated. Web page will now refresh.
Changes have been made to the IP address or port number. You will now be disconnected from TM-AC1900.
To access the settings of TM-AC1900, reconnect to the wireless network and use the updated IP address and port number.
this is all im getting ughh
What have you tried? Tried a factory reset? Tried flashing from minicfe or recovery tool? Have you read the other comments here and their solutions for getting past step 23? You’ve got to give more detail, otherwise you’re just complaining and making it difficult to give you any help.
So I left the router off over night and was able to get it into recovery mode but ran in to more problems after that. I wasn’t able to flash FW_RT_AC68U_30043763626.trx. It said that this firmware was invalid. I tried using the asus utilities but it didn’t work also. I tried using the stock built and got firmware was invalid
I was able flash step 4 and start all over. I gave more time after rebooting. I was successful after this. Thanks.
JUST TAKE YOUR TIME.
I bought two TM1900ACs and both were on 3181. One worked with Rob Hollands 3 button instructions, the other one did not. This is what worked for me on the other! Credit goes to awrsantos @ snbforums! Link here: https://www.snbforums.com/threads/t-mobile-cellspot.19435/page-10#post-243869
The exact instructions didn’t work for me. At step 4f, I released the reset button once the CFE page loaded and continued. Everything else otherwise worked!
1) Disconnect the router from the network/internet, only 1 wired Ethernet cable should be plugged
into any LAN port, DO NOT do any firmware related flashing via WIRELESS
2) Restore FACTORY DEFAULTS of the Router, this should set the IP of the router to 192.168.29.1
3) Set your computer to use a static IP of 192.168.29.88
4) Place router into Rescue/Recovery/Restore Mode
a) Turn power off to the router by disconnecting the power cable
b) Wait 10 seconds
c) Press and Hold the Reset button
d) Restore power to router while continuing to hold Reset button
e) Continue to hold Reset button for 8 seconds while entering 192.168.29.1 on browser
f) Wait for MiniCFE webpage to appear
5) Flash the T-Mobile firmware version 3.0.0.4_376_1703 TRX file using the “Asus Firmware
Restoration Tool” or “MiniCFE webpage.” Continue to hold Reset button while flashing custom
firmware
a) TM-AC1900_3.0.0.4_376_1703-g0ffdbba.trx
6) Wait 5 mins
7) Perform NVRAM RESET
a) Turn power off to the router by disconnecting the power cable
b) Wait 10 seconds
c) Press and hold the WPS button
d) Restore power to router while continuing to hold WPS button
e) Continue to hold WPS button for 20 seconds then let go
8) Wait 5 mins
9) The firmware should now be downgraded and you can verify by longing into the router and
checking the firmware version through the web browser interface.
I cannot get the command cat /dev/mtd0 > original_cfe.bin to work. always says
-sh: can’t create original_cfe.bin: Input/output error
I can’t find original_cfe.bin either. Must be a recent FW block of some sort coming from T-Mobile.
The procedures for entering restore mode is wrong. Just power off the device and wait for 10 sec. Hold the reset button, power on, and continue to hold until the power light is flashing.
Thanks for this write up! It worked flawlessly!!
Im on step 15 and I got the original_cfe.bin file but everytime I upload nothing happens. I did the values and everything. My size of the file is at 0KB is that suppose to be right?
Probably not. If you open the file in notepad is it blank?
I have the same issue… and yes it is blank
Hi I keep trying to upload the original cafe but it keeps saying invalid.
Any ideas.
Thanks.
Hi. Thanks for this. I was able to flash the downgrade. The cfe browser will start uploading the Asus FW but it says invalid image. When I try the Asus restoration software, it says not in rescue mode. Any ideas? Thanks.
I got to step 23 and tried to load but can’t get into recovery anymore
I’m on step 11 and when I open putty and put in the IP I am setting a pop up called PuTTY Security Alert. It says “The first key-exchange algorithim supported by the server is diffie-hellman-group1-sha1, which is below the configured warning threshold. Do you want to continue with this connection?”
I have no idea what this means. Did I do something wrong?
If you want to make the connection you press yes, if you don’t want to flash the firmware you press cancel.
I just purchased one of these (refurbished) directly from TMobile’s website … mine came preloaded with the TMobile 3.0.0.4.376_3169 firmware. Lucky for me, the router’s admin-page still exposes the option “enable SSH”, so I was able to enable SSH from the TM1900’s from admin-page, and skip steps 1-11 of the guide.
From my Windows PC, when I run putty.exe to login to the router, the login-banner says this:
ASUSWRT TM-AC1900_3.0.0.4 Fri Mar 11 09:41:31 UTC 2016
Since my TM-AC1900 came preloaded with firmware from 2016, I thought the rootfs might already be expanded…
admin@(none):/# df
Filesystem 1K-blocks Used Available Use% Mounted on
/dev/root 14208 14208 0 100% /
devtmpfs 127744 0 127744 0% /dev
tmpfs 127852 1492 126360 1% /tmp
/dev/mtdblock6 31488 1080 30408 3% /jffs
/dev/mtdblock7 1280 388 892 30% /T-Mobile
Ok, on second thought, maybe not … I think I better flash the ASUS firmware “3626” just to make sure the rootfs gets expanded (if it isn’t already)!
….
After flashing with the latest official ASUS RT-AC68U firmware:
admin@RT-AC68U:/# uname -a
Linux RT-AC68U 2.6.36.4brcmarm #1 SMP PREEMPT Thu Nov 16 14:29:00 CST 2017 armv7l GNU/Linux
admin@RT-AC68U:/# df
Filesystem 1K-blocks Used Available Use% Mounted on
/dev/root 39936 39936 0 100% /
devtmpfs 127756 0 127756 0% /dev
tmpfs 127860 300 127560 0% /tmp
/dev/mtdblock4 64256 1728 62528 3% /jffs
Those of you having issues with the FW_RT_AC68U_30043763626.trx coming up as an invalid firmware or the asus restore utility telling you that the router isn’t in recovery mode even though you can see the mini-cfe page when you try to log in for step 24, go back and start from step 9 again. I had this problem and researched and tried everything I could find online for 2.5 hours before reloading the cfe file and then everything went as it was supposed to. From what I found online the CFE file is what is determining if the firmware is valid or not and it’s what T-mobile used to lock out the use of Asus firmware.
Thank you so much for this guide! UPNP and Xbox Live NAT was not working on T-Mobile firmware. All the steps worked like a charm on T-Mobile’s latest firmware 3.0.0.4.376_3181. I must be one of the lucky ones getting it into recovery mode with latest firmware. Step 5 worked for me. Only issues I had was the learning curve for moving files in WinSCP. Pretty simple once I realized you can click and drag to copy/move files.
i can’t get the new_ cfe.bin to upload to router using winscp. I had no problem downgrading the firmware to 1703. I’ve tried just about everything. The file checks out with cfe.exe. I’m probably making a simple mistake but can’t figure it out. Any suggestions would be appreciated.
Did you check your spelling? I can see you have a space after the underscore in your comments.
After you flash the Asus firmware does the SSID and stuff change from the tmobile ones that were predefined?
I can’t tell if I was having issues flashing or not. The model updated in the management console, but the ssid and management IP stayed the same. I was expecting it to change to 192.168.1.1 or something after the asus firmware was flashed.
Made it to Step 23 but now I can’t get the router in recovery mode. Tried the method in Step 3 and by holding down the Reset, WPS, and Wifi On/Off buttons described by Mitesh Patel and Rob Holland. The power light never blinks or turns on and 2.4G/5G WAN lights never turn on. What am I doing wrong?
I noticed that the lights were different on the second NVRAM Reset. I was able to flash through the ASUS util anyway.
Worked great and much appreciated. Can’t remember the last time a guide didn’t require me to deviate from the instructions at least once. Wonderful Guide!!!
Hi,
Thanks for this guide. I managed to get on the router, but after several NVRAM resets, I’m still unable to get it to expand the rootfs to 64MB.
So, when I ssh in and do a df, I get this:
admin@(none):/tmp/home/root# df
Filesystem 1K-blocks Used Available Use% Mounted on
/dev/root 27776 27776 0 100% /
devtmpfs 127740 0 127740 0% /dev
tmpfs 127848 3932 123916 3% /tmp
/dev/mtdblock4 64256 1692 62564 3% /jffs
One thing I had to do that was different. The Asus utility couldn’t find the router, so I did a
./mtd-write new_cfe.bin boot
./mtd-write FW_RT_AC68U_30043763626.trx linux
I’m sure the firmware on it now is Asus because the gateway IP address is now 192.168.1.1 instead of the 29.1.
I’ve been using the WPS button to do the NVRAM reset. Is that incorrect? Am I just screwing up the NVRAM reset? You power off, hold WPS, power on while holding WPS for 20 seconds?
TIA for any tips.
Thank you, Alex, for the great write up! Everything worked great, except for after Step #8 I had to do a reset to get the default password to work.
This is the most concise and easiest to use Guide. Just updated my Cell Spot.
Thanks
I received two of the SD TMO rebuilt units today and promptly sat down with these instructions. It went off without a hitch. I did accidentally connect to the WAN port, and struggled aimlessly to get the recovery mode initiated. Self-inflicted, and easily resolved.
However, now that both are up, I have a real issue. Both units have the same MAC address for the LAN and wireless cards! When both are powered up, they naturally become unresponsive.
I’ve been able to manually change the LAN MAC on one of them, and that has resolved the responsiveness issue, but since both 2.4 and 5.0 radios have the same MAC between the two, I’m guessing I’ve a whole other set of issues when it comes to wireless reliability.
Has anyone seen this before?
Well, after a bit of detective work, it looks like I accidentally flashed the same new_cfe.bin to both routers – even though I explicitly renamed them uniquely to prevent that from happening.
By looking at the original CFEs I could see the mac addresses in each one (thanks to +notepad) – and chose the unique one. Instead of starting over, I uploaded the CFE to the site (per instructions) and renamed/moved the modified results back to the router with WinSCP. I then ran the mtd-write commands just for the CFE. After reboot, the affected router had unique mac addresses for all interfaces.
Can’t imagine anyone else will be as careless as me, but if it happens, let’s hope this helps…
Hi Eric Well guess what? I just did the same thing today and realized when I tried to connect the third rt AC68U (TM AC1900) to the new AiMesh. Two of the three have the same MAC address.
Could you please be more specific on how to fix? I also don’t think I have the original CFE from the second unit anymore. I have three of these for my network needs. I guess I was a little careless this third time around.
OK. Had to use Hex editor to change MAC address back to original. Built an old new new CFE and changed the name to match mtd uploaded with WinSCP cmd with Putty and low and behold old mac address is back.
I messed up as well and accidentally copied the same CFE to two routers. I went back in and modified the original CFE with a hex editor and changed the MAC addresses to where they should be; however, only my 2G wireless is working. My 5G shows up when I’m scanning for WAPs, but I cannot connect to it or gain an Internet connection. When I modified the hex I gave the 5G a “two up” number from the 2G MAC address. Any ideas?
Add me to the list. Don’t understand why some folks are mucking around with the “original” cfe. You flashed the new_cfe more than once. Everything in the new_cfe is ok with the exception of the MAC address. So fix just that and reflash the new_cfe. I don’t understand why Asus put the address in the cfe. Each router must have a unique address. For such a requirement the unique data is usually stored in a FPGA or other onboard chip. Putting it in flashable cfe just creates the headaches we’re experiencing.
I’m working the same problem by using the same CFE.bin to both routers which now have the same WLAN MAC addewaawa. I’ve tried using both a hex editor (HXD) and Notepad ++ but I can’t seem to find the MAC Addresses in either the old or new CFE.bin files. I’m not sure if I have the correct settings on the HEX editor. Any help you can provide is appreciated.
Worked OLD and New both methods for me on 3181 versions.
First, Thanks! Second, the router CPU speed link didn’t work for me. Third, here’s some notes on the steps that could help the next person along.
4.1) Connect your laptop/computer to the router’s #1 LAN port (do not use the blue WAN port).
7.1) Wait for the following message: “Receive file size=16949294. Upload completed. System is going to reboot. Please wait a few moments.”
8.1) refresh browser/navigate to 192.168.29.1
11.1) select YES for all the warning popups
16.1) in WinSCP, using the left window, navigate to the “Router” folder you created. Drag and drop the files to the right window
19.1) wait for PuTTY to repsond with “linux: CRC OK”
20 e) the Router’s blue power light in front should rapidly flash
20 f) release the WPS button
20 g) the front lights should flash then return to normal, 2.4 and 5 GHz lights will illuminate
Thanks for the great write up, Alex! Aside from getting it into restore mode, everything went great and I’ve updated mine to the latest stock ASUS RT-AC68U firmware (FW_RT_AC68U_300438218881). Funniest thing though, my router still shows as a TM-AC1900, both on the login page and after logging in (I’ve linked to a screenshot). Shouldn’t it show as a ASUS RT-AC68? Any way to force the change?
https://imgur.com/a/UY9Jp
Thanks again!
Tim
forgot to ad the other pic…
https://imgur.com/a/gQL7Z
If you load that same page in a private browser window does it still show that? Could be left over cache.
I’ve tried loading it in Chrome and Explorer (with and without private browsing) and it still loads the same. I was thinking it may have something to do with the custom cfe that was created, using the web editor.
The mac addresses and WPS pin were all copied over correctly, but perhaps there is/are some field(s) that identify the router make/model that may have been missed in the process. Is there any way to easily view/search/compare the contents of old_cfe.bin and new_cfe.bin, to check for remnants of TM-AC1900?
(sorry for the double-post below…I forgot to reply to your post and started a new comment by mistake)
Is there any harm in simply re-writing new.cfe.bin to the router? That wouldn’t affect my current firmware (FW_RT_AC68U_300438218881) and there’s no need to enter restore mode, right? Just simply perform steps 17, 18 and 20 from your guide?
I don’t think there will be any harm in doing that, I’d run through all the steps of the guide again just to be sure.
Well…I went through all the steps again, and no change. It still shows as a TM-AC1900.
Any thoughts?
Apparently, the third time’s a charm…finally, all the branding shows ASUS RT-AC68.
Of course, NOW I can’t get the overclock to stick. It reverts back to 800, 666 after the reboot. I had it OC’d initially, but now it doesn’t want to. ;-/
Strange, for sure, but I’m not overly concerned about it…this router is definitely a diva, though! :-D
Did you end up running trough all the steps or just the last three multiple times to finally get it to show ASUS-AC68 ?
Thx
I know this was a long time ago,
but I got the overclock to stick by editing the CFE, uploading it, and then doing an NVRAM reset, which you have to set up again after, but the cpu and ram stay at what I set in the CFE.
I followed the steps, and the router is accessed as 192.168.1.1, and FW is 3626, but the display is still showing as TM-AC1900. How do I get the name changed to rt-ac68u?
This has to be a problem with your CFE BIN file. Verify the version with this command from putty.
nvram get bl_version
if the version is not 1.0.2.0, then you did not get your CFE downgraded to the ASUS version, you are probably at 2.1.2.6 which is the T-Mob version. Follow steps 14-20 very carefully, in step 15 be sure to rename your bin file. if you don’t the command is using the wrong name. There will be no error from this mistake, so you won’t notice it when you send the command.
I have done this on 4 of these routers over the past 4 months, one was just a few days ago, all of the steps work fine.
As stated many times, the only step that can be tricky is getting in to restore mode.
Thank you for bringing attention to the treacherous renaming issue! That fixed my problem…
Thank you and every that made this happen got my tm-ac1900 to a asus ac68u with this guide. Happy Holidays everyone
I’ve tried loading it in Chrome and Explorer (with and without private browsing) and it still loads the same. I was thinking it may have something to do with the custom cfe that was created, using the web editor.
The mac addresses and WPS pin were all copied over correctly, but perhaps there is/are some field(s) that identify the router make/model that may have been missed in the process. Is there any way to easily view/search/compare the contents of old_cfe.bin and new_cfe.bin, to check for remnants of TM-AC1900?
Thanks so much for putting this together, super helpful and very well written!
If I may make a suggestion, I think you should mention that the original CFE bin file is 524288 bytes (exactly 512K) while the one I downloaded from the CFE service (rt-ac68u_1.0.2.0_us.bin) is 231923 bytes. I was worried to see a much smaller CFE, and did some extra searches to ensure that smaller was indeed safe (it was: everything worked perfectly :)
This instruction did work work for me.
I was on TMC-AC1900 with the 3.0.0.4.376_3181-g247286a firmware
Rob Holland, instruction on how to place the router on
step 5: “Place router into Recovery/Restore mode”
help alot….
I like to provide a hint,
that you need to check the router firmware after
Step 7
you need to confirmed that flashing on step 7 occur.
* I did not check, I was waiting for a complete or successful message ….this was my mistake
Also you will need access to a different computer on step 15
as this step requires you to be on the internet to access the website…
a USB is very helpful here…
I decided just to stay with the stock version of RT-AC68U and later did a firmware update of RT-AC68U latest firmware, through the wireless settings
best of luck
For step 15 I just turned my wifi on and connected to my other router. Or you can unplug the router cable and connect directly to the modem.
Thank you so much for this wonderful tutorial.
The only little snag I had was getting the router into recovery mode.
I just had to follow the steps twice and the mini-CFE automatically came up on 192.168.29.1 page that was already open from the first attempt.
Maybe have a tip to open the page before powering on the router into recovery so it can be seen as soon as it goes into recovery mode?
In any case THANK YOU!
So i have two of these. One worked flawlessly and shows R68U in the web interface and in the telnet.
The second one shows R68u in telnet but the web interface still shows AC1900. Do you know what is going on?
Ok I got it, had to start over from scratch.
I used a combination of this thread, the comments, the instructions in slickdeals ( esp. the CFE flashing 2.0 thread), the youtube video for doing it on Windows 10 linked in the slickdeals thread, and was able to finish it successfully. So thanks.
My original version was 3181. A few of my observations/suggestions –
When doing NVRAM reset using the WPS button, you should press the NVRAM till the power button flashes quickly. Once you release it, only refresh browser to login to the router when both the Wi-Fi lights start flashing as well. [This gets around timing it for 10-20 seconds etc]
When i tried using mtd-write2 included in the t-mobile firmware to also write the new CFE (as indicated in the comments by Albert Lee), I would get a “Bad trx header”. I tried constructing the CFE using the automatic tool, hand-edit it for both the 1.0.2.0 and 1.0.2.1, but it only worked when I downloaded the mtd-write v2, copied it to the USB and then ran it. the mtd-write2 included in the t-mobile firmware worked to flash the firmware, but not the CFE. I see your steps also say to do the same. Not sure if that was the result of the same behavior.
Again, thanks for the writeup and the contributing comments by people!
I’m at Albert Lee’s steps 16-24, and also get “Bad trx header” using mtd-write2 included in the t-mobile firmware to write the new CFE. i downloaded the mtd-write2 onto my USB. How do I upload mtd-write2, new_cfe.bin and the firmware in Putty? My first time doing something like this. I’m not sure how to type it all out. Thanks.
I had the same issue. I downloaded “MTD-Write v2” from the link this site: https://www.snbforums.com/threads/asus-routers-cfe-dumps-collection.17793/ (look for “MTD-WRITE (ARM)” section). When you unzip, you will see that the filename is still mtd-write, but I guess we just have to trust that snb knows what they’re doing :)
Then I copied the mtd-write I just downloaded to the same folder as my new_cfe.bin (use WinSCP for this)
Then I doublechecked that new_cfe.bin and original_cfe.bin MAC and Secret code matched (if your original_cfe.bin isn’t in the same dir as new_cfe.bin, just reference the fully qualified path in the command):
grep mac ./original_cfe.bin ./new_cfe.bin
grep secret ./original_cfe.bin ./new_cfe.bin
Then I ran this command
mtd-write -i new_cfe.bin -d boot
When the router rebooted, I checked the nvram version and I was back to 1.0.2.0. From there I downloaded the latest firmware .trx from the Merlin sourceforge, upgraded via the regular web GUI and everything is working as expected! Hope this helps!
Worked well me for today. Upgraded to the latest ASUS firmware dated 11/30/2017 after flash. Though I could not get it to go into restore/mini cfe mode initially but using the power off/hold wps/wifi/reset simultaneously till power LED flashes and then letting go of the reset button method worked. I think this method is more reliable and should be part of the guide.
As some noted, the router still says it’s a TM-1900AC though it’s running the latest ASUS firmware and all, not too concerned about that.
Does it make a difference if the name hasn’t changed? I got the latest ASUS firmware installed and while it shows the correct version of that version it still shows the TM-1900AC name. Just hoping this doesn’t make any difference in how it operates before I hand it off to my in-laws.
Thanks in advance!
So it seems that it does make a difference in that the router will not update to newer firmware via the GUI as it indicates a device mismatch. I tested this out by trying to update to the firmware released on 01/02 and got the error multiple times. I repeated Steps 17 onwards again but used the latest firmware this time and sure enough it took the latest 384.x release that way though the GUI still identifies it as a TM-1900AC (after another NVRAM reset still). This morning I edited the cfe file, this time using the 1.0.2.1 as the base and changed the region code to all regions to get the additional 5 Ghz bands and while the new cfe took fine (I can see the extra bands in the GUI), it still identifies as a TM-1900AC. At this point it seems that there is something still left somewhere that makes it identify as TM-1900AC vs vanilla 68U. Not a huge issue for me since I can flash new firmware through telnet/putty if needed but still a minor annoyance.
I was able to correct this on mine. In my case it never took the 1.0.2.0 CFE but updated the firmware appropriately.
To verify use “nvram get bl_version” to see what CFE version, mine was still 2.1.2.6 even though it was running the latest Asus firmware. (My screw up was the naming of the new_cfe.bin, mine was somehow new_cfe.bin.bin and thus didn’t write.)
To fix it, repeat steps 11-16 from this guide to get a clean new_cfe.bin, since you are on the updated software the ip should be 192.168.1.1 and you should be able to login to the router GUI to enable SSH to connect with Putty (No recovery mode needed). Once you have the clean CFE then switch over to Bootymonger’s guide to upload the CFE, after the NVRAM hardware reset step everything should be good to go.
I got hung up on this as well. When reading the instructions to rename the cfe file as “new_cfe.bin”, I renamed it in the file explorer not realizing this was causing it to actually be named “new_cfe.bin.bin”. This resulted in it retaining 2.1.2.6 and kept the name. Redoing steps 11-16 worked like a charm. Kind of a silly mistake on my part, but it might be worth noting in the guide that the name only needs to be changed to “new_cfe” as its already a bin file.
Despite it running the new firmware, so long as it still identified as the TM-1900AC, it would not allow me to flash to merlin through the gui. Once I addressed the new_cfe.bin issue, everything works like a charm. Running the latest merlin now. Thanks for the guide!
You don’t have file extensions visible, the file name is new_cfe.bin
Thanks for the updated instructions! I used the old ones in early Dec, and had to do some trial and error to get things to work right, but that was still the best source! I picked up another TM-AC1900, and I’m wondering: Is the CFE used for this downgrade compatible with the new AiMesh features of the new ASUS firmware?
The latest SlickDeal on this router has some notes on a new CFE to use to enable AiMesh: https://slickdeals.net/f/11119759-asus-tm-ac1900-dual-band-gigabit-router-refurbished-48-free-s-h?p=110565659#post110565659
I’ll wait for it to be out of beta before checking it out, right now it seems there are some issues:
https://www.snbforums.com/threads/official-beta-aimesh-beta-firmware-for-rt-ac68u-rt-ac86u-rt-ac5300-rt-ac88u.40745/page-12#post-354838
Thanks, I may take a crack at it and I’ll let you know how it goes. I’ll be wanting to set up two routers in mesh, with the base by my cable modem, and 3 devices plugged in by ethernet to the satellite. Right now it is in bridge mode, but on a separate SSID.
Anyone know why the step to copy the CFE @ step 12 results in file not found and creates an blank file?
Be sure to leave a blank space after the “cat” command. :-)
In this example below, I put in a double-space so you can see it better, but in puTTY, just type in a single blank space:
cat /dev/mtd0 > oriinal_cfe.bin
Also be sure to type the digit zero, not the letter “O” in “mtd0”
Thanks for the information. Just bought a TM-AC1900 off Amazon for $59 and by following your instructions I now have a RT-AC68U for a fraction of the cost. Right now, the AC68U is selling on Amazon for $135.00 so I saved 56%!
I couldn’t get the router to boot into recovery, so thanks to the poster who suggested pressing the WPS, Wi-FI and reset buttons…that worked for me.
Also I did get an BUS error after completing step 19, but everything seems to be working just fine.
I’m using my new router with the AI Mesh firmware along with my AC88U and now I have a Mesh network that runs great, no more dead spots on the 3rd floor of my condo!
Hi, that’s what I was planning to do. I have a dumb question/problem, I have a dell xps a newer laptop with no Ethernet port.
I have an adapter that lets me connect wired(ethernet to usb), will i be able to do the steps meant for changing to static IP?
yes
As mentioned in earlier posts, I recently converted a TM-AC1900 to ASUS-AC68U without any issues, except inability to overclock. I just got another one and followed the same steps listed above and everything went perfectly…except the overclock. The listed procedure goes fine but, after reboot, the clock settings revert back to 800,666 on both routers. Both used cfe 1.0.2.0 (US), and are currently on stock ASUS firmware (FW_RT_AC68U_300438218881).
Can others confirm that after the overclock procedure, they actually rechecked, nvram get clkfreq, and the overclock settings remain and didn’t reset beck to 800,666?
Has something changed recently, disabling ability to overclock? I would at least like to get to the 1000,800 settings of a stock ASUS-AC68U.
I am seeing the same thing (clkfreq reverts back to 800,666 after a reset). After doing the nvram commit it shows the 1000,800 but after the reset it reverts back. I am using the firmware that came out last week, 3.0.0.4.384.10007.
I will confirm that the same has happened to my router. If anyone knows how to make this stick please leave a reply.
Same thing is happening to me.
Hmm actually if you look at `cat /proc/cpuinfo` BogoMIPS seem to increase to 2398.61 even though `nvram get clkfreq` returns the same old 800,666
Does this mean, its actually overclocked? I checked mine and your correct,BOGOMIPS changed and its sticking after commit
Are you using Merlin or stock ASUS?
I just flashed mine to latest Merlin, and the overclock sticks after a reboot.
I have the latest Merlin firmware with CFE 1.0.2.1 and overlock does NOT stick after reboot
I have had success by editing the CFE and uploading it, then doing and NVRAM reset.
I did the hardware reset, and I had to redo all the settings. You could try:
mtd-erase2 nvram
and then reboot, but it will probably be the same.
I used CFE editor from https://www.snbforums.com/threads/asus-routers-cfe-dumps-collection.17793/
and changed clkfreq, it’s near the top in advanced mode.
Showing higher BogoMIPS in cpuinfo, persisting through reboots.
Receive “Not found, error 404” message when trying to post question. Message is shorter than others on this page.
I don’t have any length requirements for comments. This is just the standard comment feature that comes with WordPress blogs. Your other comment test comment worked fine but I deleted it just now.
I got a TM1900 refirb from Amazon for $59, and was able to follow the steps described here to get it operating as a regular AC68U.
Thank you so much for collecting up this information and also to the folks commenting with additional info and links.
I now have it working with my existing AC68U in AIMesh mode!
Am I allowed to upgrade firmware normally or do I need to do special steps?
It shows i’m on 3.0.0.4.376_3626, is this the latest one?
Thanks for writing these instructions. Able to downgraded TM 1900 fw to 1703. Item 12 couldn’t get the CFE bin in putty. When typed in “cat/Dev/mtd0 > original_cfe.bin” error message came out ” -sh: cat/dev/mtd0: not found” what am I missing? TIA!
>When typed in “cat/Dev/mtd0 > original_cfe.bin” error message >came out ” -sh: cat/dev/mtd0: not found”
it is cat /dev/mtd0
i.e space between “cat” and “/”
also its “dev” not ‘Dev”. these commands are case-sensitive.
I receive a password request in Putty when I type cat/Dev/mtd0 > original_cfe.bin,
I tried password and admin to no luck
To set the router in recovery/restore mode was hold all these buttons together… Reset, WPS and Wifi in/off instead of just the reset
I can’t find AiMesh node when searching. Anyone have similar issues or have a solution? I followed all the steps and updated to the last Asus firmware. I have 2 TM-AC1900 routers: one connected as a AiMesh router and the other reset as an AiMesh node
Have you flashed the beta AiMesh CFE? Or did you just follow this guide? This guide does not touch upon the AiMesh CFE, you’ll need to look elsewhere (snbforums.com)
Your Cfe.bin may need to be updated from Step 18 otherwise the router is not recognized to do AI Mesh.
1. Step #18 should have been weitten like this in the putty:
./mtd-write -i new_cfe.bin -d boot
This is to ensure that the new_cfe.bin gets written successfully. Then making sure the renamed uploaded cfe.bin thru SCP is the one generated from this site from step 15: https://cfeditor.pipeline.sh/
Otherwise once the mac address was updated and new label was made to RT-AC68U, AI mesh node was enabled.
This a really helpful guide though overall. Thanks to Alex!
Try setting the router to Aimesh node manually in the network map settings (operation mode top left side link), let it finish and reboot and then run the search from the main router, it should come up and then you’ll be able to configure it, update to latest firmware.
I just followed this and not only had none of the problems getting it into recovery that others had, but was able to overclock on Merlin firmware and it seems to have stuck after reboot. Maybe this is just a hardware difference and some units are easier to get to do this than others?
Thank you very much for posting this.
The router came with the latest T-Mobile firmware. I was able to successfully flash this back to Asus official firmware. One issue was with Step 7, during the firmware transfer, it would get interrupted at 68% with the Mini-CFE on Chrome. I had to factory reset it more than once, then switched to Internet Explorer and it transferred successfully. Seems like Merlin is very popular so I flashed it.
This was my first time flashing firmware on a router. Many thanks for this wonderful guide! It was simple to follow and the easiest one out there.
You a G
This is a great guide and a LOT of work went into making it work smoothly.
Just carefully follow the most recent instructions and it works.
Thank you Alex, for your efforts.
These instructions are excellent – but one thing could make them even better. The AC-1900 that I purchased required an extra set of steps between step 8 and 9 as currently written (January 2018). After flashing “TM-AC1900_3.0.0.4_376_1703-g0ffdbba.trx” and rebooting, the NVRAM *must* be reset for admin/password to work in step 9.
To do so: turn the router off, press and hold the WPS button (on the side), turn router power on while holding the WPS button down until the power LED starts flashing (about 20 seconds), then release the WPS button. [Same as in Step 20 in the procedure.]
Once I figured that part out, everything else worked exactly as written and I have a working RT-AC68U!
Thanks for the writeup. I have two fine working cellspot routers that have been converted over to merlin successfully. The routers are very stable and cover even the remote parts of my house. The method you describe here is perfect!! I did not make any changes to the method described here.
thanks again.
Do you need the 1.0.2.0 AiMesh CFE in order for AiMesh to work once converted to RT-AC68U?
I upgraded two TM-AC1900s to the RT-AC68Us but can’t get AiMesh to work.
The .7z file from mega.nz with the mt_write is corrupt. I can not unzip it with winrar or 7zip. Anybody have a mirror?
Try downloading it again. It works fine here.
I installed newest version of winrar. works now. thanks.
Thank you Alex for this guide. I was able to convert 2 routers following these instructions.
I can’t just find that damn node!!!!!!!!!!!
Has anyone been able to do AiMesh with two converted routers? it is proving very difficult for me. I see on this thread that I might need a new CF file or something of that sort. The thing is that I can see the AiMesh icon on both routers, it is just that they cannot find each other. Not much, but I am willing to donate $20 for anyone willing to write a nice guide on how to update converted AC68U routers to do AiMesh.
I plan on writing/updating this guide for AiMesh once the cfe is out of beta and ready for customer deployment. Last time I checked there were some bugs with the AiMesh CFE and isn’t up to par for deployment so I’m not messing with it yet.
Thank you Alex. Looking forward to the updated guide.
Thanks for this, everything was spot on, although I had a little trouble at first getting it into recovery mode in the beginning. I had just picked up a TMO ac68U and tried about 8 different ways to get it to get the mini- CFE page. i think the new instructions above are correct, but chrome was not showing the page for some reason. switching to IE win10 Edge DID show it.
after getting past that point, everything else was great, including overclocking (which seems to have been committed )
I found on a post on SNB forum an engineer guide to CFE mode. The instructions do not mention waiting 1:30 minutes for the CFE to appear. I tried to access immediately after releasing the reset switch.
Also, the NVRAM reset requires waiting 5 minutes for it to work. I actually wrote the time down in order to be patient.
Even though I did the CFE.bin change and everything as per the directions, The ASUS page still shows TM-AC1900, but the update went through, and I have one router setup with AIMesh as the router, waiting on the second router to arrive to set up as a node. Access it in network settings. I got the 20308 version running.
One other issue, I tried the ASUS Router APP on my phone, but it did not see the router, so I could not get it to work. I noticed that the update has a setting to use TELNET and SSH, so if someone could help me get the WINSCP and PUTTY to note the name change, maybe the app would work. It isn’t beneficial, but would be nice as a future reference.
I am relatively new to firmware/CFE flashing so I am watching this with interest. I have one factory stock RT-AC68U with firmware 3.0.0.4.384_10007 and two TM-AC1900 routers that I would like to setup in AI Mesh mode. From what I have been reading there is not currently a stable CFE to flash the AC1900 routers? Also I am reading that I will need to modify one of the CFEs so that I do not have MAC overlap between the two routers once I convert them to AC68Us?
Yes that’s correct. I suggest you flash with this guide and then follow a aimesh cfe guide once it is out of beta.
I know this website provides quality dependent articles or reviews and extra stuff, is
there any other site which presents these kinds of information in quality?
Worked like a charm following the steps above.
Was able to add the modified router into my mesh, but this required manually setting the router to Aimesh mode, let it reboot, and then run the search from the main router.
Was not able to overclock though, seems settings are overwritten on boot.
Are you using a genuine ASUS AC68u as your main router? How is the mesh setup working out for you so far?
After flashing to AC68U, why doesn’t the router show an aiprotection section like a regular AC68u?
Have you flashed the latest ac68u builds? It should have ai protection.
Aiprotection is not visable in AP mode. I had to reconfigure my network so I can use the device in router mode.
Thanks for this great resource. I was able to follow all of these steps and get the AIMesh setup using the 1.0.2.0 US AIMesh CFE.
However, it seems like my AIMesh node goes offline at least once a day and needs to be reset. I’m thinking I would be better off setting it up as an access point.
Is anyone else having this issue? Any suggestions would be appreciated.
Thank you for this superbly clear and precise guide! When dealing with something as critical as re-flashing, such detail is absolutely essential!
I can confirm that overclocking (to 1200,800) works on Advanced Tomato.
Two different routers seem stable and there seems to be little effect on temp (at moderate workloads).
Thanks!
P.S. Very much looking forward to AiMesh version. That will be a great excuse to do this a few more times.
I got the AiMesh to work by using “1.0.2.0 US Aimesh” as the source
Have you had any problems with the node going offline?
Thanks for these instructions. They worked like a charm though I had to use the 30-30-30 reset method.
My router was a new one from Amazon. It came with 376.2827 but as soon as I got it running it auto updated to 376.3199, a very recent TM-AC1900 firmware.
After I followed these instructions, I updated the firmware from the ASUS site. It updated to 384.20308, a firmware that was released yesterday. All seems well except for one thing. On the admin page when I changed the password and tried to save it, it gave me an error with the time zone. It simply wouldn’t accept Pacific time and the DST start/end time fields were not usable — they wouldn’t pull up any values. Following something I found on the web, I had to set the time to GMT and then I could save my admin password.
I’d like to sync the time properly so I’ll see if ASUS offers a newer firmware — they released two versions in the last week. Or I may go for the latest Merlin.
For 3199 firmware issue, follow this document. I was able to flash successfully to RT-68U
https://docs.google.com/document/d/1NsZMONmJ70zMmoAKKQJXbTVKytaPJptWTpqih1TD5n8/edit#
Hi Alex,
I did all the steps and all went fine but my router model name is still TM-AC1900.
I am running the latest Asus AIMesh firmware
3.0.0.4.384_20308-gead790e
I also have the choice to setup AiMesh router or Node.
How can I change the router name into Asus RT-AC68U??
Thx.
double check your new_cfe.bin make sure you rename the file the website output because it will not be new_cfe.bin. I had the same thing happen to me just re-up the files and try it again and NVRAM reset at the end and you should be RT-AC68U
I can’t add my units to aimesh. For some reason, aimesh can’t detect the new nodes. On another forum, they think we need to use CFE 1.0.2.5 instead of 1.0.2.0. Can we update the instructions on how to do that?
Now I see that we need to use an aimesh-enabled version of 1.0.2.0 and the CFEditor website now has that option: 1.0.2.0 US AiMesh.
I don’t have my original CFE file anymore but I upload my current modified CFE to the website to update it to the AiMesh version?
use step 12 to get your cfe
Alex, should we wait for a CFE out of beta?
Can anyone help me out in getting into restore mode? My Refurbished T-mobile ac1900 just arrived today and I couldn’t get it into restore mode. I’ve done alot of varied steps already and I still couldn’t get into it.
Already tried the step in this guide which ends up on the router having power led and lan led on and responds to pings but not loading the CFE Mini Web Server and firmware restoration tool tells me that the router is not in restore mode. It constantly responds to pings however and it will be in this state until I turn it off and on like it’s really on firmware restore mode.
I also tried holding the reset, WPS, and wifi buttons at the same time but still no luck. I tried this one too https://slickdeals.net/forums/showpost.php?p=85157887&postcount=5538
sadly I’m still stuck.
I tried using both my PC that is running on Windows 10 using Chrome and my laptop running on Windows 7 using Chrome and IE 9. Firmware Version is 3.0.0.4.376_3181
While making this post, I played with the Wifi toggle button a bit and it doesn’t feel so responsive. Sometimes it toggles, sometimes no, sometimes it behaves as if it was pressed two times. I tried pressing it normally a couple of times and it doesn’t seem to respond to like 5-7 presses. Even pressing hard and firmly sometimes flukes at it.
Could it be possible that the reason for my trouble is a faulty Wifi toggle button? Cause the blinking of power led also happens if I press and hold the WPS button before powering on which triggers the NVRAM reset right? It stops almost as soon as I let go of the WPS button.
I however, was able to make the CFE Mini web server show up by having a tab keep on loading 192.168.29.1/index.asp, holding the reset button after the router has fully started normally, power led starts blinking then letting go after 5 seconds, pressing and holding the reset button again immediately once all leds lit up once. From this step, I tried both letting go of the reset button and holding it but the result is the same where the CFE Mini web server page shows up but that only lasts for like a second. If I try to refresh the page after that, it would either give me ERR_CONNECTION_RESET or the tab gets stuck trying to get a response from the destination.
It’s like the firmware is intentionally dropping my attempts to connect to the mini web server.
I got mine this through amazon and the seller was Mobile Dist. It’s backed with a 90 day warranty which I’m really hoping I could use if all else fails.
I had to use Firefox to upload 1703 firmware. Chrome didn’t work although I managed to make CFE Mini web show up in Chrome.
Oh I see Thank you for this reply
I will give it a try with Firefox
In case I’ll need it, would you tell me what version of firefox did you use? Are you already using Firefox Quantum or still the old one?
It doesn’t matter what version of firefox is used.
I used Firefox Quantum 58.0.2 (64-bit). I changed 5G to higher channel (157). The default channel 44 resulted in very short coverage range.
THANK GOODNESS I WAS ABLE TO FLASH IT
MANY THANKS!!! I really thought I was gonna have wasted investment there T_T
Thank you for Alex too for the reply. The version didn’t matter at all, so long as it’s firefox.
Thanks, you’re clear concise steps worked perfectly! Step 7 image would not flash in recovery but worked fine in normal boot, so skipped step 5 and follow the rest to the letter. I also used my Linux box with ssh/scp no issues.
Skip step 5? Using CFE Mini Web server?
I’ll probably check out on this, might be the same case as mine. Though I already tried using Asus Restore Utility and it didn’t work in normal boot.
To everyone who would possibly be facing the same struggle as I had in trying to do this guide’s Step 5, whether you may be running Firmware version 3181 or 3199 (my router auto updated just 3 days ago after getting connected to the internet)
The most reliable way for me to get the router to restore mode:
1. Boot up normally first
2. Go check if you could load 192.168.29.1
3. If it’s good, go load 192.168.29.1/index.asp
4. Press and hold the reset button for 8 seconds or more
5. Eventually, all leds in front of the router should light up and that’s when you should press and hold the reset button again
6. Reload your index.asp tab if it doesn’t auto reload
7. Mini CFE Web Server should load and quickly upload your firmware
8. Once the page stops loading and shows you how many bytes have been uploaded, let go of the reset button in relief and your router should be up and good soon
It’s best if you are in a calm state of manner when executing these steps
I’m not really not understanding how to even get the initial downgrade to take. I’ve tried about 10 times now and CFE does not change the firmware. Router just sticks with the one LAN port and power LED on no matter how long I wait. Web page updates to “Settings have been updated.” blah blah. Asus Restore Utility can’t find the router. Step 8 needs more details. Router has 3181 at the moment.
I too followed all steps, no errors, product ID still says Product IDTM-AC1900, does this mean flash did not take effect?
Same here. TM-AC1900 is shown all over the places.
On “Firmware Upgrade” page it shows “3.0.0.4.384_20308-gead790e”
admin@TM-AC1900:/tmp/home/root# nvram show | grep -i cfe
pmon_ver=CFE 6.37.14.86 (r456083)
size: 44213 bytes (21323 left)
admin@TM-AC1900:/tmp/home/root# nvram show | grep -i tm | sort
size: 44213 bytes (21323 left)
MULTIFILTER_TMP=
TM_EULA=0
asus_device_list=TM-AC1900>192.168.1.1>xx:xx:xx:xx:xx:xx>0>wireless2a>255.255.255.0>1
cfg_device_list=192.168.1.1>xx:xx:xx:xx:xx:xx>1
computer_name=TM-AC1900-7D80
daapd_friendly_name=TM-AC1900-7D80
dms_friendly_name=TM-AC1900-7D80
lan1_netmask=255.255.255.0
lan_netmask=255.255.255.0
lan_netmask_rt=255.255.255.0
lld2d_hostname=TM-AC1900
modem_roaming_scanlist=/tmp/cops.txt
odmpid=TM-AC1900
tm_debug=0
tm_device_name=
tm_partition_num=
tm_ui_setting=0
tm_usb_path_pid=
tm_usb_path_serial=
tm_usb_path_vid=
tm_vol_size=0
wan0_netmask=0.0.0.0
wan0_netmask_x=0.0.0.0
wan0_xnetmask=0.0.0.0
wan1_netmask_x=0.0.0.0
wan_netmask_x=0.0.0.0
wps_device_name=TM-AC1900
wps_modelnum=TM-AC1900
Your router showing TM-AC1900 means you didn’t install the CFE correctly. You need to redo steps 9 through 18 again. These steps convert the T-Mobile CFE to an Asus Aimesh CFE.
This is exactly the issue.
What I missed was in step 15 I did not rename the .bin file and in step 18 the mtdwrite did not report any error when new_cfe.bin didn’t even exist.
It’s all good now. Thank you.
I need some help or advice.
I used a ported version of PuTTY on my Mac to gain access to the file system in the router and can navigate throughout the TM-AC1900 file system. Nothing else would work to connect. Even Mac Terminal failed to connect. PuTTY gets right in no problem as one might expect.
I am stuck trying to SSH into the router to download the original_cfe.bin file.
I am on an Apple Mac and running OS X High Sierra.
Since everyone on this thread is on a Windows device, and there is no SCP protocol tool available for a Mac, I have come to the conclusion that doing this conversion using a modern Mac is simply impossible.
No SSH tool that runs on a Mac will successfully connect to the TM-AC1900 router with the downgraded firmware that allows turning SSH on. I tried Cyber Duck, Mountain Duck, Forklift, Transmit and Interarchy. Not a one of them will connect to the router.
It is possible that the hardware on the router is the problem because no company in their right mind would create an SSH tool for Mac if there was something inherrently wrong with OS X that killed SSH on the Mac platform.
I need to find a Windows computer to try to complete this conversion. I don’t know anyone with a Windows machine that would let me use it because my friends aren’t technical enough to understand what I was doing and would freak out if they watched.
Does anyone know of a company in San Francisco that rents time on a Windows machine? Or that I could pay to complete the conversion? It appears this is easy to do on a Windows machine.
I consider myself pretty technical but I am not a command line expert and rely on a GUI to get things done.
This was so totally ridiculously easy once I used Windows.
I can assure you that it is simply not possible to connect a 2017 Mac running OS X High Sierra to a 2014 model Asus Router via SSH. I spent 7 hours yesterday trying.
I downloaded Parallels (Trail Mode Available). I downloaded Windows 10.
From there it was a snap using Windows on my Mac to follow all the steps.
I now have an RT-AC68U!!
I just wanted to chime in and say that these instructions worked perfectly on a refurb 1900 that I just got from Amazon. It still had firmware from 2014 (release firmware?). Thank you for the write up.
Worked flawlessly. Thumbs up for the author.
This guide really simplified the other over abundance of information on the net about this process, your guide had me up and running in about 15 – 20 minutes. Much appreciated as I had been wanting to do this for a year now and always came to the conclusion it was to much of a pain in the a** before reading your guide that was laid out really well.
Glad I came across your guide as it made the task very easy –
Thanks for the guide! It worked for me perfectly on the latest T-Mobile firmware (3199), if anyone is wondering.
Step 15 on the Asus Router flash needs to be updated to reflect selecting 1.0.2.0 US AiMesh. That website was recently updated. Without seleting that CFE build the router will never find the node.
Thanks for the instructions. I managed to download the 3626 firmware, but the 192.168.1.1 page still shows TM-AC1900 at the top. I also tried to install the newest firmware, hoping to enable AIMesh, but I could not get it installed, either by the file on a USB Thumbdrive or directly downloading. Did I miss a step, or is the TM-AC1900 on the page preventing the update from installing?
Thank you very much for sharing this guide! It is very straightforward and easy to follow.
Another success story here. Things mostly worked for me, with a few modifications.
In step 5 (Place router into Recovery/Restore mode) I did the hold down reset for a bit, power off, then power on again, or something along those lines. For me, the blinky lights didn’t indicate anything different, *and* I couldn’t connect to 192.168.29.1 from my Mac laptop, which was connected via wire directly to the router. I went back to my Linux workstation, which is also of course directly wired to the router, and went to see what the deal might be. I went to reload the login screen and was presented with the miniCF page! I think the reason for this might be that I have a custom subnet, 10.0.69.* (get your mind out of the gutter – I was born in 69…). From that point, I followed the instructions to a T and everything worked great. Thanks so much for providing this howto! Oh, and I was on the latest 3199 T-Mobile firmware when I did this.
Finally nailed it. Once you have ssh is totally easy.
I had the 3199 version and had many problems.
At the end i was able to get into recovery mode y holding reset before, after and during the flash of the downgraded version.
Besides that i had to change to esge explorer because for sone reason incognito chrome never worked!!!
Thanks everybody!!!
This all worked flawless for me. Thanks so much for the detailed instructions!
I do have a question:
When I log into the server it tells me that there is an update available (RT-AC68U_3.0.0.4_384_20308-gead790e) but it doesn’s seem to want to install it.
Is this supposed to happen?
Download the latest update manually from the asus website.
I downloaded manually the update from the website but still can’t update to the new version. Any suggestions?
Try the merlin builds instead. If those don’t work then something likely went wrong in the process, most likely being that the process is only part way done or a step was skipped.
Use putty to transfer to router that should work. or clear nvram and try again.
Hi Everyone,
It looks like I’m stuck in
When I try to connect with Putty and WInSCP
I get a warning message about saying something about
In Putty that the host key has change
and in WinSCP i get the following message
the first key exchange algorithm supported by the server is diffie-hellman-group1-sha1, which is below the configuration warning threshold
do you want to continue with the connection?
Yes or no?
I hit yes
I will try to add picture links to this problem, later.
them in
step 12 ( i type)
In putty type:
cat /dev/mtd0 > original_cfe.bin
—–then putty is asking a password
i tried putting typing password as the password and then i get access denied.
so i’m stuck at this point.
Do you guys know what I can do or what am I doing wrong.
Thank you for your help
instead of typing in the admin username you are typing in a command. Log in first, then enter commands.
im stuck at the same spot. putty is asking for a password and “password” isn’t working. Did I miss something?
nevermind I see what you mean
Well done explicit instruction. I was able to flash to asuswrt firmware successfully with your help. Thanks.
I have flashed to Tomato firmware, now want to flash to Asus firmware. Do I complete all the steps, or where do I pick up at? Easiest way to get there.
No, just load up recovery mode and flash any trx. These steps only need to be done once.
WHY?
WHY?
Can someone explain why it would be worth the 2-3hrs to flash the ac1900 to the RT-AC68U?
Is it worth it for the average user?
Thanks.
2-3 hours? Where are you getting that number from?
Has anyone here actually gotten an AiMesh setup working, using a converted TM-AC1900 as the primary router? Was it as simple as loading a new CFE, using 1.0.2.0 US AiMesh (rt-ac68u_1.0.2.0_us_am.bin), and then updating to the latest official ASUS RT-AC68 f/w?
Currently, I’m using three converted TM-AC1900’s in a typical router/AP setup and would like to switch to AiMesh, but if the TM-AC1900 won’t work well as the primary, I’ll just buy a new, genuine, RT-AC68U for that purpose.
Thanks!
I went through the steps in flashing 2 ASUS TM-AC1900 routers to RT-AC68U with firmware Version 3.0.0.4.384.20308 to set up an AiMesh network. Both have been successfully flashed. I was able to set one as the router but not able to search the other router to set it up as a node. Can someone please help?
A better place to ask for help with the aimesh cfe is in the snbforums aimesh beta thread.
https://www.snbforums.com/threads/official-beta-aimesh-beta-firmware-for-rt-ac68u-rt-ac86u-rt-ac5300-rt-ac88u.40745/
While that thread is a good source of info, since AiMesh is out of beta, that thread has been locked…here is the new ‘Official Release’ thread that has taken it’s place.
https://www.snbforums.com/threads/official-release-aimesh-firmware-v3-0-0-4-384-10007-for-all-supported-products.43125/
Nice, thanks for the heads up. Now that it is stable I’ll be doing some testing with aimesh in the next week hopefully.
Nice! Can’t wait to hear the results and your recommendations.
Can anyone confirm if the 1.0.2.0 AiMesh option on the cfeditor site works to get these working as the AiMesh router? I followed the instructions exactly, so I didn’t use the AiMesh option, and that part definitely isn’t working with these.
Can I just follow the CFE steps to switch from the 1.0.2.0 CFE to the 1.0.2.0 AiMesh CFE?
Thanks, by the way, your writeup is pretty awesome!
Yes, use the 1.0.2.0 AiMesh option if you ever intend to use ASUS AiMesh, otherwise, you’ll scratch your head for a week wondering why your AiMesh router couldn’t detect or connect to your AiMesh node(s). You’d use this CFE in place of the regular CFE.
Hi Alex,
i have follow your steps and successfully flashes my AC1900 to AC68U but…my router model still show TM-AC1900 in the Tool – Sys Info…
any ideas where i have did wrong?
Thank you for the step-by-step instructions.
BTW, I tried step 7 using Mozilla Firefox (ESR 52.5.0, 64-bit on Windows 10 Home) but it didn’t work. Tried again using IE 8 and it worked perfectly.
Muito obrigado!
How do you do a NVRAM reset?
Step #20
one of the easier upgrade process for this super router. I am starting to play with the AiMesh option with an existing model.
excellent guide!
Thanks for the write up. Got it done via Ubuntu without having to go to Windows, and it worked okay with a couple of minor issues.
I want to flash my tm ac1900 to stock FW to use Aimesh, should i use the BL 1.0.2.0 US or
1.0.2.0 Aimesh from https://cfeditor.pipeline.sh/ ?
Any expirience ?
Same happend to me but when i checked the BL version it was still 1.2.1.6, so the boot loader was not replaced, i repeated the steps 16,17 and 18 once the BL was correctly replace the name changed to RT AC-68U and i could flash the newest asus software
Step 15:
Which is the most current CFE to use? It seems that that website (https://cfeditor.pipeline.sh/)may have been updated with newer CFE’s since the BayAreaTechPros instructions?!
ie. Does 1.0.2.1 US incorporate AiMesh?
1.0.2.1 US
1.0.2.0 US
1.0.2.0 US AiMesh
1.0.2.5 US (RT-AC68P/V2)
Answer: I used 1.0.2.0 US AiMesh and it worked fine. Updated the firmware on the AC68U via web interface with no issues…..AiMesh works perfectly!!
Thanks for that info. Will test myself when I get a new batch.
Nathan, are you using a converted tm-ac1900 for your main router in your aimesh setup, or just for the node(s)?
The cfeditor website has been updated with an alternate AiMesh enabled CFE. The 1.0.2.5 US (RT-AC68P/V2) CFE will turn your T-mobile router into an RT-AC68P which will, by default, run the router’s CPU at 1ghz instead of 800mhz. Not that big of a difference, but some people report that the router’s U.I. feels a little snappier. Check out the following thread for more info on this CFE.
https://www.snbforums.com/threads/aimesh-on-the-t-mobile-tm-ac1900.43278/page-28
So if you want to run AiMesh on your T-mobile router, you now have two working options!
Can someone help, i cant get pass step 11. Putty and winscp says that connection refused to 192.168.29.1
Why is the connection refused? Do you have SSH enabled in rotuer? Is your firewall blocking it?
I followed this guide just prior to the 1.0.2.0 US AiMesh option becoming available on the https://cfeditor.pipeline.sh/ site. So while my router shows the AiMesh Node as an option, it doesn’t actually detect any compatible devices on my network (I have another, properly flashed device, currently running in standard AP mode, but running 1.0.2.0 US AiMesh).
So, for my router running regular 1.0.2.0, would I just start the process at step 10, enabling SSH, to get it on 1.0.2.0 US AiMesh? There’s no need for me to downgrade the firmware or anything prior to that, right?
Correct. The only reason for downgrade is to enable ssh…if you already have ssh access, no downgrade is necessary.
Excellent. Thanks, Tim.
This no longer works after upgrading the bios to 3.0.0.4.384_20624-g14d2f02. The Router still says it is an AC68U, but you can no longer use AiMesh with the router after firmware updating it.
And downgrading the firmware doesn’t fix the issue.
Yes this happened to me as Well. Do not update to the new firmware. Aimesh will no longer be available if you do.
Is that an official Asus firmware?
My app said that there was an update available, so I updated from my pc. After that both ac1900 went offline but still said rt-ac68u. Could not get the aimesh to connect. So I called tec Support and the CSR ask what firmware that I was running, and when I told him it was the 3.0.0.4.384_20624-g14d2f02 he seam surprise that I was running this. He said that it had been only released for one day, but he said that was the latest firmware and should be fine. With his help we could not get back into the aimesh nor could we down grade back to _3.0.0.4_384_20308. Then I tried to downgrade using the method from here and could not get into cfe . So now im stuck with two ac1900 that are useless.
If downgrading the firmware doesn’t fix the missing AiMesh with the latest firmware update. Check the CFE version. It is possible the latest firmware updated the CFE to 1.0.2.9. If so one has to roll the CFE back to a prior version in addition to rolling back the firmware.
Fortunately I still had the CFE generated when first running these steps so I simply used SSH to roll the CFE back. Then rolled back the firmware. Basically start from Step 16 in the directions. I was able to get AiMesh back by staying with the previous firmware (3.0.0.4.384_20308).
People are reporting the latest firmware that breaks the AiMesh appears to work fine in all other respects. So if one doesn’t need AiMesh they should be OK with the latest firmware.
Cannot stress this enough. Do an NVRAM clear either when starting from scratch or from step 16 with the steps above. Doing an NVRAM clear at the very end will fix the Daylight Saving Time broken/missing on the System Administration page if one experiences it.
I can’t get into recovery mode to do this.
I was not able to either. However i was able to use the asus recovery tool. Ran the firmware updater. I did have my adapter set to 192.168.29.5 but it wouldn’t connect. I was able to connect wirelessly via 192.168.1.1. I did finish clearing the NVRAM but I had to return to work before I could see if AiMesh was back. As I too did the firmware update and it took my node out of the mesh.
I am going to return these two back to amazon and get two more, then start fresh.
Hope you got the refurbished units, otherwise that would be very unfair to the seller.
Yes they are.
I made the mistake of updating to the 3/26/2018 firmware and one(strangely just 1 out of 2) cellspot router reverted back to the TM branch of the firmware.
After the update I have been unable to get it into recovery mode again and am stuck with T-mobile’s crappy firmware without AiMesh.
They’ve removed the SSH access from the firmware page (you can still see it commented out and hidden in the source).
Not sure exactly why the other router did not revert to the TM firmware.
Exact same thing happened to me. This update is now on there support page for download. Wondering would you lose AiMesh if it was an official Rt-Ac68u? If so, then they should be coming with a fix.
Why is my download speed considerably slower when its connected to my AiMesh Node? Has anyone else had this problem? Is there a setting that can be changed to make it better?
Are you using the node router? If so you could have a weak connection in between the two routers.
Yes it’s the node. My signal strength is 5 bars when I check from the ac-5300 to ac68u. They are less than 10ft apart. Ac-5300 is in my Living room and ac68u in the garbage.
Have to revert all the way back to the old firmware to be able to enable SSH again.
Has anyone had issues getting the AIMesh option to show up on their converted TM-1900? I have two that I just converted and used the 1.0.2.0 US AiMesh cfe, but it still doesnt show up, even after multiple factory resets. I’m using the latest ASUS firmware (384_20624), could that be the issue? I get the option in QIS, but when I try to set up an AiMesh router, it skips and goes straight to the page for setting up the radio. It’s no the end of the world if i cant get it to work, but I’d like to try it out at least once.
Yes, the 384_20624 is broken for AiMesh. I am thinking this is a new CFE issue that needs to get adapted for use in the TM1900.
Could you provide links to all the downloads from their respective sources? I can get putty, winscp and 7zip no prob, but I’m hesitant downloading random files from mega and installing them.
Thanks,
Ed
Don’t overthink it…Considering this thread has been going strong for a year, if there were anything funny going on with any of the files, it would’ve come to light by now.
A quick Google search for both “WinSCP” and “Putty SSH” provides exactly what you request. I am pretty sure nothing special is needed for a compression program as Windows’ built in app or 7zip works fine
https://i.imgur.com/VbVXHIm.jpg
I flashed the 1.0.2.0 US AiMesh CFE, but the AImesh is not working properly. What can I do if I want to re-flash up to 1.0.2.5 CFE?
Why do you think 1.0.2.5 CFE will be any different? What specific issue are you having with AiMesh? What firmware version are you using? There is a huge thread on AiMesh and this router at the following link: https://www.snbforums.com/threads/aimesh-on-the-t-mobile-tm-ac1900.43278/
It is not clear what bumping up to 1.0.2.5 CFE does other than give a slight bump in CPU Clock speed (from 800 to 1000) and the unit name on the router administration pages changes from AC68U to AC68P. If you really want to change the CFE just follow the steps in the directions at the top where one copies the CFE to the router and writes it.
Thanks for the guide! Just a headsup on prerequisites for newbies like me:
1. Plug your computer directly into one of the ethernet ports on the back of the router.
2. Leave your router plugged into your internet gateway. You’ll need this for getting your new cfe file
Great guide. Thanks for posting. Once completed and I had the FW_RT_AC68U_30043763626.trx firmware, I did some wifi speed testing on 2.4 and 5.0, and it maxed out at my full bandwidth (~110 Mbps)…perfect. I upgraded to the last ASUS firmware: Version 3.0.0.4.384.20624, published 3/27/18 and my wifi speed cut in half (~45 Mbps). Did a quick Google search and found some discussion around TM-AC1900 issues with that firmware but it has only been a couple days since it came out. Downloaded the previous version of the Asus firmware, Version 3.0.0.4.384.20308 and updated it manually from within the firmware check/update option and it stated that it updated successfully. Upon reboot of the router, it reverted back to the original TM-AC1900 3.0.0.4.376_3199 firmware. Thoughts? Which update firmware version should I be using?
I ran into a similar problem. My FW was reverted back to 3199 after I tried to flash Merlin within the firmware check/update option. I tried to re-do the whole thing. But all attempts of downgrading to 1703 has failed even though I could get in mini CFE. Are you able to downgrade?
Hey I am having this exact issue. Followed steps, everything went smoothly (third router I am doing this on).
However, for this one, when I tried to flash Merlin, my FW reverted back and it seems that I can no longer downgrade either. I can get into mini CFE, but it is rejecting all firmware as “not valid firmware.”
It seems that it is stuck in upgrade limbo.
Same to me!
I tried every thing but nothing happened!
“not valid firmware.” comes out every time.
I think CFE changed into higher version。To solve this must enable SSH，but I cant do this now。
who can help us？
I too have the same problem as three previous post. Can some please shed some light on the subject and that would be greatly appreciated
I am having the same issue. Does anyone have a resolution?
WORD OF CAUTION: DO NOT UPDATE FIRMWARE BEYONDVERSION 20308. THERE IS A NEWER UPDATE THAT WILL NOT WORK WITH AIMESH.
HELP, Please!!
I was able to follow these steps and flashed the router to AC68P. Everything worked until…..I tried to flash the latest Merlin while plugged in a external hard drive. The flash wasn’t successful because of the plugged in device. I unplugged and restarted the router, only to find out the router was reverted back to TM firmware 3.0.0.4.376_3199.
Fine, I thought no big deal just re-do the whole thing. There comes the problem. I could get in mini CFE no problem, but I keep getting “Receive file size=16949294. This is not a valid firmware”…. I’ve tried switching all 4 land ports. no luck….
What was wrong with the router? Did the unsuccessful attempt flashing it the Merlin broke it? I can still get in the router interface and use it as Tmobile….
Any thoughts?
Same here
FYI there has been some updates that will allow the use of the latest Asus AC68U https://www.snbforums.com/threads/aimesh-on-the-t-mobile-tm-ac1900.43278/page-47
So I had mine setup as a aimesh node, and it was working… then I deviced to update the firmware.
Seem like my router is now a TM-AC1900 again with 3.0.0.4.376_3199. The only way I can get the recovery page to show up is the hold down the reset button while hitting 192.168.29.1
When I upload the older TM firmware, it says its not valid. Am I totally fucked now?
If you figure this out please let me know….. I’m having the exact same issue… GRRRRRRRR I should have paid the extra 50 bucks… this has been a huge PITA
Found a post from Frank and it worked!!!!!!! back to the start again (running tm 3.0.0.4.376_1703) a version that allows to enable SSH……
Long story short, keep the reset button held in order to upload the old version of firmware once you are running the new tmobile firmware v xxx.3199
From Frank!! Thank you Frank if you see this!!!!
—–
Finally nailed it. Once you have ssh is totally easy.
I had the 3199 version and had many problems.
At the end i was able to get into recovery mode y holding reset before, after and during the flash of the downgraded version.
Besides that i had to change to esge explorer because for sone reason incognito chrome never worked!!!
Thanks everybody!!!
worked on one but not the other… not sure why this would be.. back to square 1.. one is working but for some reason the other the same process did not work.
Been there, did that. Still invalid firmware. It doesn’t matter if I hold the reset or not during the firmware load.
I just followed the guide on two units. I used the 1.0.2.5 CFE as I don’t need aimesh. I will used them as APs + wired switches.
Both units still show TM-AC1900 at the top in the title.
Both units are now on 3.0.0.4.376_3626 stock.
Is everything ok up to here? Asking since I don’t see the title change to RT-AC68U or RT-AC68P. However, I do have SSH.
Assuming all is ok, can someone tell me what is the latest Merlin firmware that I can upgrade to without reverting to some TM CFE stock option?
Thanks,
No, it should show AC68P. You may have missed an nvram reset along the way.
guys tried to do a manual install of the latest 68p firmware and it reverted completely back to a tm1900 with latest firmware!!!!!!! the only way around this seems to be to unplug the wan when doing a firmware upgrade and disable autoupdate. also, my tm1900 automatically updated its firmware when i plugged it in. beware everyone not to plug in wan when switching firmwares!!
t-mobile updated my cfe!! I can no longer downgrade firmwares. It locked it. If I try to use a previous firmware I get a firmware no valid error from the miniweb page. Also, asus restore utility does not detect a rescue mode
so unhappy!
i was successful in flashing my TM-AC1900 to AC68U, but when i did a recent Asus firmware upgrade, it screwed the AiMesh. This prompted me to update the firmware back to the old Asus (RT-AC68U_3.0.0.4_384_20648-g21e3702), which ended up converting my router back to TM-AC1900 with 3199 firmware. :(
i’m now stuck with a TM-AC1900… is there a way to bring it back to stock to AC68U?
I’m in the exact same boat. I was successful in flashing to a AC68P. I did a firmware update and it completely converted me back to a tm-1900 and i can’t flash back to old firmware. It says invalid firmware. I think we are unlucky and got locked out.
Same boat… so sad now…
I got my TM-1900 flashed to an AC68U and was able to add it as a node. I then made the mistake to update the firmware on my original AC68U. This updated both routers to 3.0.0.4.384.20648. The TM-1900 was running but no longer part of the network. I had to do a factory reset of the TM-1900. You press and hold the reset button on the router until the power light on the router begins to flash, and then release the button. Wait until it reboots and then connect to it. You’ll go through the setup wizard. Set it up as a standard router then log back in and enable SSH. Then follow all the steps starting at #16 (you still have your new_cfe.bin, right?).
What’s annoying is after you do a factory reset with the 648 firmware, the TM-1900 wizard shows the option to make the router into an AiMesh Node. BUT, my AC68U still can’t see it. So the most recent firmware the TM-1900 can run is 3.0.0.4.384_20308-gead790e. My AC68U is still running v648.
this solution still working. I tested it.
is there any solution for those of us now stuck on the tm-1900 (during an upgrade of our 68p firmware, asus seems to have reverted us!) ? telnet, ssh all disabled. Unable to downgrade as mini web cfe says every firmware i try is an invalid firmware/image.
very frustrated!
This TM-AC1900 to RT-AC68U conversion isn’t perfect, that’s for sure.
Here’s the issues … 1) cannot check for new firmwares from web interface 2) doesn’t enable aimesh and there’s no aimesh popup after web interface login.
Aside from that, if you download the firmware manually and update the modified router while it’s connected to the internet, there’s a good chance it will revert back to a T-Mobile firmware.
When it does that, it probably? stays on the asus cfe and now it won’t allow any T-Mobile firmware downgrades or Asus firmware upgrades either from web interface or recovery.
You also cannot re-enable telnet or ssh via html hack, so as far as I can tell there’s no way to modify it again … Any ideas?
Worked for me!!!!
I had little trouble loading Mini-CFE but after few minutes the page loaded and everthing went smooth.
Thanks
I flashed the 1.0.2.0 US AiMesh CFE, but the AImesh is not showing, any suggestions for AIMesh ?
Thanks,
Same here, no AI Mesh icon, please help
Roll back to RT-AC68U_3.0.0.4_384_20308-gead790e, reset and you will have it.
I just completed another TM-AC1900 conversion last night.
I had the same problem as many above that from the T-mobile 3.0.0.4.376_3199 I could not put the router into recovery mode. After an hour of trying, I found the the Reset/WPS/Wifi button solution and with the mini-CFE page I was able to load the 1703 version.
Another BIG issue was that Asus removed all but the latest T-AC68U_3.0.0.4_384_20648 version from their website. The last safe version is 308 was no longer available. After 15 minutes of google/bing. I found the a link to the 308 version on a dutch website. Since the file came from an Asus server, most likely will be removed soon. So hurry up before it goes.
As far as the upgrade from 308, last week I found instruction on snbforum with couple of lines of code which I was able to use and update my other without reverting my router to TM. Unfortunately Asus made snbforum remove the whole discussion from their site so I no longer have it.
Does anybody have the instructions. I think the instructions came from a guy name XVortex and I even remember that it was on page 47 of the forum but that’s all I remember.
I found the instructions on Google cache. I tried it on a router last week and worked. You need to do this BEFORE attempting to upgrade to the 648 FW version
cat /dev/mtd5 > /jffs/mtd5_backup.bin
mkdir /tmp/asus_jffs
mount -t jffs2 /dev/mtdblock5 /tmp/asus_jffs
rm -rf /tmp/asus_jffs/*
sync && umount /tmp/asus_jffs
rm -rf /jffs/.sys/RT-AC68U
nvram unset fw_check && nvram commit && reboot
Credits go to @XVortex tested/written up by @Ronald Schwerer.
Any tips on how to transform a router that was rolled back to TM-AC1900? The Recovery Console will complain both older TM-Mobile firmware and Asus firmware has invalid signatures. The Asus Restore Utility won’t connect to the router.
Basically as near as I can tell, what is needed is either a way to change the firmware signatures to something that will be accepted, or another way to gain shell access.
Until there is a solution, I would highly recommend against trying to use the Asus Firmwares, as at any time your router could permanently revert to broken firmware.
Is yours AC68 U or P before it rolled back to TMo? Of what i gather it may be limited to the “P” CFEs going to 1.0.2.9?
I have 3.0.0.4.376_3199 I’m pretty techy but still nothing is letting me downgrade to version 1703 of firmware. I can get to the mini cfe flashing page but still I get invalid firmware when I try to downgrade. I too downloaded latest merlin firmware and it got reverted back to t-mobile firmware and now stuck with this firmware. Anybody have a solution? I tried holding reset while flashing but also a no go with this firmware. Someone please help us.
I upgraded to firmware .20624 on 3/27, how can I revert back to .20308?
I’m worred about getting locked to ac1900 firmware if I take the wrong steps.
Also the threads trying to fix this issue at SNB forums have been deleted today making it harder to find information on this.
Can anyone help?
so SNB Forums deleted that thread. Go grab it off of the google cache while you can! I tried to grab a bunch of the latest pages that included the fix for updating to the latest firmware. Here’s the link: https://mega.nz/#!fT4mDBab!DQxKvfhDX8WiafG9lPhF8AflY84REu-9C7pnaodvVTo
The thread never publicly said how to update a locked TM router.
I know it can be done, I’ve done it, but I don’t have the steps
required anymore because I lost my private messages on SNB …
You didn’t write any of the steps down offline before posing to SNBforums? Do you remember any of the steps or what you did? Posting them, even if partial, may help others figure out a way.
Aren’t these the steps?
http://forums.redflagdeals.com/amazon-com-refurbished-t-mobile-rt-ac68u-dual-band-gigabit-router-us-48-15-2185681/
SNBForums removed the big AiMesh thread on these TM-AC1900 routers that had lots of good information. And issued a notice they will be removing any additional discussion (on their site) about converting these routers. :-(
https://www.snbforums.com/threads/snbforums-policy-on-asus-tm-ac1900-conversion-discussion.46018/
Not only that, they removed people’s PM’s on the subject.. Time to move the discussion here.
I managed to salvage the important steps to upgrade to the latest firmware. Here’s the mini guide. Use at your own risk, but I personally tested with my 3 units:
0. DONT PLUG THE ROUTER TO THE INTERNET. Before you start, you should:
Download manually Asus Firmware 20308 (RT-AC68U_3.0.0.4_384_20308-gead790e)
Download manually Asus Firmware 20648 (RT-AC68U_3.0.0.4_384_20648-g21e3702). This is the latest as of April 12, 2018 and works with AiMesh once you follow this mini-guide.
1. Follow the instructions on this page. They work perfectly. Make sure when you get to step 15, where you select the version select 1.0.2.0 AiMesh, NOT 1.0.2.5
2. Once you get to step 22 and everything is nice and dandy, you will want to do a manual firmware upgrade to the 20308 firmware. You can use the router’s web interface at 192.168.1.1 to do this without any issues.
3. Once updated to 20308, enable SSH once again on the router (Go to Administration > System > Enable SSH > Yes > Apply)
4. Putty once again into the router, this time at 192.168.1.1
5. Issue the following commands:
cat /dev/mtd5 > /jffs/mtd5_backup.bin
mkdir /tmp/asus_jffs
mount -t jffs2 /dev/mtdblock5 /tmp/asus_jffs
rm -rf /tmp/asus_jffs/*
sync && umount /tmp/asus_jffs
rm -rf /jffs/.sys/RT-AC68U
nvram unset fw_check && nvram commit && reboot
The router will reboot, wait for it the usual 2 minutes. This will delete the TMobile certificates on the router, and will let you update to newer firmware. I’m pretty sure there is no turning back after this.
6. Now you can manually update the firmware to the 20648 version, the latest available now (as of April 12, 2018). I dunno if this is future proof. You can update using the user interface manually without issues.
7. If you are paranoid, you can putty to the router once you finish and re-flash the 1.0.2.0 US CFE file you already created on step 15.
Thanks for that.
Thank you!
Just FYI for those who hasn’t gone through this:
The reason we are preforming this following command:
cat /dev/mtd5 > /jffs/mtd5_backup.bin
is to make a back up of the mtd5 partition (similar to making a back up of CFE). Before you proceed to anything other step,
SCP that file out of the router!
otherwise you’ll lose it forever.
That being said, you’ll probably never need it unless you want to flash the router to TM-1900 for return purposes.
Since snbforums has decided to deleted all traces of flashing TM-1900 to the latest AImesh firmware I wanted to post this code that @Vortex posted to get you on the latest firmware without it reverting back to a TM-1900. There are other steps involved and this code is ONLY for wiping the MD5 partition so stock firmware will not revert it back.
mkdir /tmp/asus_jffs
mount -t jffs2 /dev/mtdblock5 /tmp/asus_jffs
rm -rf /tmp/asus_jffs/*
sync && umount /tmp/asus_jffs
rm -rf /jffs/.sys/RT-AC68U
nvram unset fw_check && nvram commit && reboot
Here is the SSH code I saved from the SNB forum discussion if you would also like to permanently remove mtd5 fro. The T-Mobile router. This may be an important step in case ASUS rolls out a new firmware that checks for this TM-AC1900 only partition (does not exist on a real 68U). The extra code writes FF’s to remove all traces of the partition. This is not my own code and all credit goes to out to all the great guys that contributed to the SmallNetBuilders forum thread that got deleted.
cat /dev/mtd5 > /jffs/mtd5_backup.bin
mkdir /tmp/asus_jffs
mount -t jffs2 /dev/mtdblock5 /tmp/asus_jffs
rm -rf /tmp/asus_jffs/*
sync && umount /tmp/asus_jffs
ln -s /sbin/rc mtd-erase
./mtd-erase -d asus
rm -rf /jffs/.sys/RT-AC68U
nvram unset fw_check && nvram commit && reboot
Oops.. There it is!
Out in the wild.
Thanks for the info.
I am currently on firmware version 20308. Just to be clear, if I perform these steps, I can then upgrade to v20648 using the built-in firmware upgrade method and I will retain aimesh functionality?
I was on 20308. I did a factory reset, enabled ssh, ssh’d in and entered all the commands, upgraded to Merlin’s 384.4_2 release using the normal built-in firmware upgrade method and everything is gravy. I decided against using aimesh and went back to an ethernet-connected AP. Merlin never did us dirty like Asus did, so I’m staying clear of it for now.
Now we just need the information on how to recover a TMO router that has been auto rolled back to the TMO firmware and one is having trouble flashing new firmware to the unit. Supposedly it involves some sort of “webserver” but the person who posted about it lost the info when SNBforums wiped/nuked people’s posts and PM’s on the TM-AC1900.
The webserver in question is just the ASUS built in recovery mini webserver. It becomes increasingly hard to push the router into recovery mode. The trick that worked for me is:
_
1. Change the PC IP to 192.168.29.2 / 255.255.255.0
2. Find a steady way to hold the Reset button on the router, because you will spend a lot holding it.
3. Open a Command Prompt on your PC and use the command: ping -t 192.168.29.1
4. Open your web browser and type on the address bar 192.168.29.1 BUT DONT press Enter yet.
5. Here comes the fun part.
6. Hold RESET for 10 seconds, Power off router holding RESET still. Wait 10 seconds more. Power back on still holding reset.
7. Look at your command window and wait for the exact moment when the router starts again to respond to pings.
8. Press enter on the web browser so the mini-cfe webserver starts. Press refresh a million times. It will open eventually. If you are unsuccesful after around 15 pings or so, start over.
9. Once the miniweb server opens, you have a few seconds to click browse and select the first firmware mentioned in the guide on this page. (TM-AC1900_3.0.0.4_376_1703-g0ffdbba.trx)
10. When you start the flashing, release the Reset button. Nothing will happen but wait… like 3 minutes. It will eventually say success and you will be able to start the guide over here along the extra steps I mentioned before.
11. Done!
Okay sooooo…..
It would be nice to get the people who figured this all out to make a Reddit thread or something….
This shouldn’t even be a big deal? It’s the same hardware. Router hacking has been around for a long time and also this is an older model anyways?
Seems like a waste of resources.
Anywho…. So I see the commands to remove the traces of the T-Mobile AC1900 but wouldn’t the key be to add a AC68U/P certificate or id or whatever it is after?
I thought I had read if you flash DD-WRT or Tomato that will also clear all the traces of the AC1900 and then you can flash the CFE and Firmware too?
I’d look in the archives and PM the people who helped contribute and ask them to crowd source somewhere like Reddit or Discord, somewhere and continue work on this…. Then give Alex here the info to update this page.
I believe it was XVortex and Ronald Schwerer….. I’m sorry if I forgot anyone else who also helped….
Need a place where people can crowd source. However it looks to be pretty much fixed.
I don’t get the big deal of taking an out of warranty router and giving it new life? Not like we’re gonna keep this router forever either? This does hurt ASUS a bit as many may choose to look elsewhere….
They have bigger things to focus on then one piece of hardware….
this does not work for those who get reverted and locked on 3199. Webserver method from SNBforum is the only known way that could effectively hack into the router and allow downgrade to 1703 again.
Correct. The webserver method is apparently NOT the steps mentioned elsewhere in this site. One can read Docbill’s posts starting on cached page 61 as they explain the problems they had after being rolled back to the TMO firmware. Specifically see Docbill’s posts on the cached page 64 and 66.
See this link for a listing of cached pages from the now nuked SNBforum thread.
http://whrl.pl/Re8fXq
Docbill #1202 page 61
Docbill #1206 page 61
Docbill #1212 page 61
Docbill #1217 page 61
Docbill #1231 page 62
Docbill #1240 page 62
Docbill #1241 page 63
Docbill #1264 page 64
Docbill #1307 page 66
If you are registered there, could you perhaps share the method here?
been trying to register to the new message boards (https://whirlpool.net.au/profile/?action=register), but i don’t seem to receive the email they send to start the registration process..
“If you are registered there, could you perhaps share the method here?”
There is much hesitation on sharing one specific hack since it involves exploiting a CVE security vulnerability in the rolled back TMO 3199 firmware to push different firmware to the router so one can enable SSH. Once SSH is enabled, previously discussed methods of pushing new firmware to the unit along with removing the MTD5 can be performed.
It is probably best to join that other forum and contact user 003detsiwt or other users in that forum via PM to obtain the exploit workaround directions.
The general fear is if the exploit directions are published Asus will quickly patch the exploit locking people into the older vulnerable TMO firmware.
The webserver thing was due to a user on the SNBforum who couldn’t get into the CFE. Their post started on page 61 of the now nuked SNB AiMesh TM-AC1900.
Any luck fixing this. I updated my router Ac5300 and it disconnected from the unit as a node. I tried starting over on the he tm1900 and it tells me the file size of the tm-ac1900_3.0.0.4_376_1703-g0ffdbba.trx is an incorrect size.
Firmware shows as 3.0.0.4.376_3199-ge62f8ab
Have you found a workaround? I have exactly the same issue.
Same Issue, it is solved yet?
I had followed all of the directions as indicated and the router was working great! Until today when I logged on to the router and it indicated there was a firmware update. After running the update the router is back to the TM AC 1900 firmware. I’m not sure how this happened but you probably do NOT want to run any updates!
Did you remove the MTD5 ?
I have upgraded to 3.004.384.20624 . However, it did not revert me back to the TMAC1900 firmware even if I reset the router. IP is at 192.168.1.1
The original Process I used CFE 1.0.2.0 not 1.0.2.0 AiMesh. How do I fix it so I can use AiMesh.
Thanks for your help!
Cant seem to enter Recovery/restore mode any advise?
Use the Asus FIrmware Restore Tool. I could not for the life of me get the MiniCFE page to load to upload the older firmware, but I was able to put it in rescue mode. If the TTL is 100, it’s in rescue mode and the tool will work.
This is a great article. I do have a question regarding the recent updates and AIMesh. I used the AM version of the update, but do not see any additional functionality in the firmware to actually enable AM. Am I missing something? I purchased this to utilize it as an AM node, as I have a retail AC68U for my main router.
After dumping “linux” mtd of converted TM-AC1900 with firmware 20308, I found that 16MiB hidden trx data placed at 0x0300 0000 – 0x0400 0000. The hidden data seems to be a TM firmware, have T-Mobile directory (which is empty), have no cfes but only tmo_2.1.2.6.bin. Maybe a factor of FW roll-back? Because my router also has been roll-backed to TM firmware while upgrading to 20648, but luckily it was available to downgrade to TM-1703 again.
Anyone who have genuine AC68U, please dump “linux” mtd and verify that the region is empty (filled with 0xFF) or contains any contents like TM-AC1900.
So has anyone had any luck downgrading from 3199 after being updated to 3199?
Just wanted to let others know that it’s easy to brick a RT-AC68U converted from TM-AC1900. I followed the given procedure and indeed it worked. The problem was that media bridge connections kept getting dropped. I then upgraded to the latest Asus FW (3.0.0.4.384_20648) which unbeknownst to me not only blocks flashing of 3rd party FW like Merlin, but it also reverts the installed FW to TM. So when I attempted a flash of Merlin 380.70 not only did the flash fail, but I ended up with a TM-AC1900 (3.0.0.4.376_3199) which was a RT-AC68U (3.0.0.4.384_20648) before the flash attempt. That is some seriously malicious code by Asus. It’s one thing to block unapproved 3rd party mods, but it’s quite another to actively alter a piece of equipment that is private property. Asus has transgressed from the unethical into the illegal. What makes this so egregious is that I explicitly asked Asus if there were any future flashing impacts if their latest FW was flashed. They clearly and unambiguously said no. Regardless of how this plays out for me I wanted to share this so others don’t get burned. Please take care in flashing newer FWs.
Were you using CFE 1.0.2.5? That seems to the the common trigger for quite a few who had their firmware rolled back to the TMO firmware when using the official Asus firmware. The workaround is DO NOT use 1.0.2.5 CFE, and instead use 1.0.2.0. Then use previously posted directions to remove the MTD5 from the router, then one can upgrade to C86U firmware 3.0.0.4.384.20648 or 3.0.0.4.384.20308 without being rolled back to the TMO firmware.
I’d say a better workaround is not to use official Asus builds on a modded router after they’ve made it clear they will resort to sabotaging your devices.
Made it clear how? Where? How would anyone know that by just following your procedure which as an end result leaves the modded router flashed as 30043763626 which is an official Asus build. I did not come across any hints or warnings that said starting from 30043763626 be careful because Asus is looking to lock out FWs and the way they do it is with official FW that contains traps. Maybe it would be helpful to include such a warning immediately preceding the beginning of the procedure or include URLs to SNB forum threads that cover this subject (yes, I learned about these *after* bricking my router).
Are you asking if I made it clear or if Asus made it clear?
Asus started reverting the firmware version from AC68 to AC1900 on flashed routers, so it is pretty clear they are taking your physically owned devices and doing what they want with them. As for this guide, there’s been a WARNING encased in a red box linking to a snbforum source since before snbforums got purged. So maybe what would be helpful is if we had a time machine, so I could go back in time and write that warning before Asus began this beahavior, and so you could go back in time and scroll up on your mousewheel before writing your comment.
That box wasn’t in the procedure as recently as end of March. I saved the full HTML just in case. And the underhanded behavior by Asus seems to have started long before that. It didn’t help that Asus flat out lied to me when I sent them an explicit query on this subject. I was assured by them that flashing to their latest official FW would *not* impact upgrades/downgrades. I guess my bricking the router was the result of a perfect storm, incomplete information and deliberate deception by Asus. I apologize if it seems like I’m being critical of your efforts, that’s not at all the case. I just wanted to lay out my scenario to see if anyone could help and also as a warning to keep others from falling into the same trap. Thanks for making the procedure available, it is greatly appreciated.
Thanks SmithB. If I understand correctly my working router which is at 3.0.0.4.384_20648 is not a goner yet. It would revert to TMO if I attempted a flash of Merlin, Tomato, DD-WRT, or a newer Asus FW. Having bricked my media bridge I definitely will not repeat that error. How about if I flashed back to 30043763626 or a FW between that and 3.0.0.4.384.10007 ? Is that safe or do I need to get to CFE 1.0.2.0 first and if so how do I do that? And how do I remove MTD5? Many thanks.
Router is at 3.0.0.4.384_20648.
I ran these commands in telnet:
nvram get boardrev – 0x1100
nvram get HW_ver – 170
nvram get bl_version – 1.0.2.0
I guess that answer’s SmithB’s concern about CFE 1.0.2.5. I was not using it, I was using 1.0.2.0 all along. Specifically for the bricked media bridge I tried flashing Merlin on top of 3.0.0.4.384_20648 and that apparently caused the revert to TMO. So since I’m at 1.0.2.0 on the good router can I flash back to 30043763626 without doing damage? How about other Asus FW like that has AIMesh (3.0.0.4.384_20648 had it removed)?
Generally you can roll back to prior firmware from within the firmware interface, but doing so may introduce issues if one is using AiMesh as it has been (if I remember right) indicated that AiMesh works best when all nodes/master router are using the same firmware version. Also using older firmware means the possibility of certain security vulnerabilities not being fixes. Generally it’s best to use the latest firmware if possible.
.
AiMesh was working fine using 3.0.0.4.384_20648 firmware with CFE 1.0.2.0 AiMesh US for me on two TMO routers when I tested it.
Many thanks. Your comments have been a big help.
@vegas_pete: The router would typically roll back to the earlier TMO firmware if using just the Asus firmware. It is claimed that the Merlin firmware has the rollback disabled so one is potentially taking a risk using the Merlin firmware because it uses the Asus firmware as a base.
.
Using third party firmware like Tomato or DDWRT shouldn’t potentially roll back to the TMO firmware, assuming they are not built using the Asus firmware as a base like Merlin firmware is.
.
The code for removing the MTD5 partition is listed above in the BayAreaTechPro directions under the “Code for fixing MD5 partition so you can update to latest firmware” section.
@SmithB: Sorry, still not connecting all the dots. Parts of your first paragraph don’t make sense to me. The latest Asus FW (3.0.0.4.384_20648) did *not* cause a rollback – my router is at 3.0.0.4.384_20648 and appears healthy. My media bridge also accepted 3.0.0.4.384_20648 without rollback. What caused the rollback on the media bridge (i.e. bricking) was attempting to flash Merlin. I need to clearly understand this subject. With the router now at 3.0.0.4.384_20648 you’re saying that flashing *any* Asus FW will rollback to TMO? Even much older FW versions that were created before Asus instituted this rollback nonsense? And can such older (not newer!) FW be flashed after applying the MD5 partition fix? What I’m trying to get to is 2 RT-AC68Us that have stable AIMesh. I ordered a replacement AC1900 for the bricked media bridge so getting that replacement to the AIMesh FW version should be a non-issue since the conversion procedure works. Getting the router counterpart (which is now at 3.0.0.4.384_20648) to the same AIMesh FW is the problem I’m trying to solve. I hope that clearly explains what I’m trying to do and why (I may still be harboring misconceptions).
The automatic rollback from the Asus firmware to the earlier TMO firmware was happening ONLY (not shouting – just emphasizing) with the Asus firmware. It was an automatic process apparently. Having one’s router bricked when moving/flashing from the Asus firmware to the Merlin firmware is probably a different issue. Could be a corrupted flash and the router tried to recover using older firmware or just up and bricked.
.
The TMO router rollback issue didn’t affect everyone (I wasn’t affected on two TMO routers). Apparently a small subset of people using these TMO routers, who didn’t delete the MTD5 partition, got rolled back automatically when they ran the embedded firmware update option within the Asus firmware to update to the latest (at that time) Asus firmware. Read through the Forums.Whirlpool link where several people discuss their problems with the Asus firmware upgrade and being rolled back to the earlier TMO firmware.
https://forums.whirlpool.net.au/forum-replies.cfm?t=2693988&p=1
Thanks, that helped a lot. With my router at 3.0.0.4.384_20648 it looks like I should perform the MTD5 partition fix procedure before attempting a downgrade.
I keep getting the following message when I attempt to login using WinSCP:
Cannot initialize SFTP protocol. Is the host running an SFTP server?
What do I need to do to proceed?
“What do I need to do to proceed?”
Change the protocol in WinSCP to SCP.
User DocBill on the forums.whirlpool.net.au site has publicly posted a workaround for users stuck on 3199 firmware and other firmware versions and cannot roll back or enable SSH. Use at your own risk!
.
From AC1900 To AC68U After Revert
https://docs.google.com/document/d/1NsZMONmJ70zMmoAKKQJXbTVKytaPJptWTpqih1TD5n8/edit?usp=sharing
Wow Thanks SmithB,
hmm though it looks like USB method is the easiest route to take.. correct?
If one cannot downgrade then yes the USB method may be easier than using the web server method. It appears people have been successful using either method.
I had an AC1900 that reverted and could not be re-flashed to AC68U — the google doc helped me figure out how to reflash the devices. Instructions about MTD5 should prevent reversion again.
Hello All,
I flashed my router 3-4 months back and right now using Merlin firmware(version 384.4).
Can I run the following command now? or it will brick my router?
cat /dev/mtd5 > /jffs/mtd5_backup.bin
mkdir /tmp/asus_jffs
mount -t jffs2 /dev/mtdblock5 /tmp/asus_jffs
rm -rf /tmp/asus_jffs/*
sync && umount /tmp/asus_jffs
rm -rf /jffs/.sys/RT-AC68U
nvram unset fw_check && nvram commit && reboot
Please advise.
Thanks
Thanks for the instructions.
I wonder what is in the original AC68U /dev/mtd5 partition. My TMO router has tmo-XXXXXXXXXXXX.tgz file, which contains TMO certificate and router certificate and key.
It can be viewed by
mkdir /tmp/asus_jffs
mount -t jffs2 /dev/mtdblock5 /tmp/asus_jffs
ll /tmp/asus_jffs/
I did all the steps including final:
mkdir /tmp/asus_jffs
mount -t jffs2 /dev/mtdblock5 /tmp/asus_jffs
rm -rf /tmp/asus_jffs/*
sync && umount /tmp/asus_jffs
ln -s /sbin/rc mtd-erase
./mtd-erase -d asus
rm -rf /jffs/.sys/RT-AC68U
And
./mtd-erase -d asus
didn’t work for me. It just hanged doing nothing to /dev/mtd5
After that with cfe 1.0.2.0 US AiMesh asus firmware reported router as RT-AC68U
but with cfe 1.0.2.5 firmware still reported as TM-AC1900
After that I’ve created a file with size of /dev/mtd5 partition filled with FFs and flashed it with dd to /dev/mtd5:
dd if=ffs.bin of=/dev/mtd5
I verified that contents of /dev/mtd5 was all FFs.
After that with cfe 1.0.2.5 the router is reported as RT-AC68P
If you try that remember the nickname of dd command – ‘Data Death’
Make sure you use right if=/dev/mtd5 param or you can destroy your router without warning.
do you have detailed steps? Your steps read too much in paragraph form to follow.
./mtd-erase -d asus failed for me too. though I am technical, not so well versed in Linux and other lingo. do you have specific steps if this persists? Thank you in advance.
Just wanted to say thanks for this walkthrough! I just got my refurbished TM-AC1900 yesterday and everything worked flawlessly.
I can also confirm the “Code for fixing MD5 partition” section works as I am fully updated to the latest Merlin firmware.
Ditto… I just updated two TM-AC1900 using the instructions and it all worked like a charm (used the 1.0.2.0 for AIMESH CFE 68U). Used the “Code for fixing MD5 partition” and it must have worked since I was able to update both routers to latest ASUS firmware. The AiMesh selection is there, so it is time to give it a go and see how well it works. Kudos to all!
I remember there was a guide how to overclock this thing to 1ghz and make it stick on stock Asus firmware. It was about editing some file and then uploading to the router. Cannot find this information anymore, can someone please help?
Thanks!
The guide had to do with updating CFE in Hex editor to 1000,800. Seems like I bricked my router by not finding that guide and just editing bin file blindly…
I literally followed every step in this guide including the MD5 fix and I can say 100% that my TM-AC1900 is now an RT-AC68U. I already had an original RT-AC68U as my main router so this was bought to flash and make into an AIMesh node.
Some additional instructions:
After the MD5 fix, download the official latest RT-AC68U firmware from the Asus website.
Extract the file from the zip download and manually flash (current latest at this time is 3.0.0.4.384_20648). This is done in the web GUI by the way.
Once done, reset to factory default (either in GUI or by holding down reset button for 10 seconds) and once it’s done correctly you should be at the router setup page.
At this point, do a scan on the main router and you should see the new device as an available node and you can start pairing.
Mine works great, no issues, and I get my full internet bandwidth (100Mbps/ 20Mbps).
Kudos to the OP and those who assisted in the making of this tutorial.
Thanks everyone. I was able to downgrade using the USB method. I’m on the latest merlin with the cfe (ai mesh version). I cannot for the life of me get the overclock to stick. Any advice? It resets after every reboot. In fact, it doesn’t work at all. Although it returns the overclocked values in the gui and nvram check, the cpu check doesn’t show an increased value.
For those having trouble getting the clkfreq to stick after reboot, try the following directions. They worked for me to make an alternate clkfreq stick after reboot. One can try a variety of clkfreq’s to see which works best for them; 800,666, 1000/666, 1000/800, 1200/800, or 1400/800. The commands (change asuscfeclkfreq and clkfreq to your preferred values):
nvram set asuscfeclkfreq=1000,800 && nvram set asuscfecommit=1
nvram set clkfreq=1000,800
nvram commit && reboot
thank you you’re method works in terms of keeping it after reset. I haven’t come across this method before so very much appreciated. The other commands for overclock wouldn’t keep it after reset. What firmware are you on?
While it shows up in the gui as frequency of 1000 and also in the nvram get clkfreq,
it doens’t seem to have actually overclocked.
Processor : ARMv7 Processor rev 0 (v7l)
processor : 0
BogoMIPS : 1998.84
processor : 1
BogoMIPS : 1998.84
My understanding is the bogomips value should now be 2400ish
Any ideas? Did asus disable this? what firmware and cfe are you using?
Currently running CFE 1.0.2.0 AiMesh US and Asus firmware 3.0.0.4.384_20648 on two TMO routers. Have the clkfreq set to 1000,800. The BogoMIPS is: 1998.84.
.
Not sure where your seeing the clkfreq should be 2400ish. It appears, per one person’s post elsewhere, their Asus RT-AC68U is at clkfreq=1000,666 with BogoMIPS at 1998.84. See this link: http://whrl.pl/ReTTyD
.
Don’t remember what the BogoMIPS was at the stock TMO clkfreq of 800,666.
The update works!
” cat /dev/mtd5 > /jffs/mtd5_backup.bin
mkdir /tmp/asus_jffs
mount -t jffs2 /dev/mtdblock5 /tmp/asus_jffs
rm -rf /tmp/asus_jffs/*
sync && umount /tmp/asus_jffs (gets rejected “-sh: unmount: not found”)
rm -rf /jffs/.sys/RT-AC68U
nvram unset fw_check && nvram commit && reboot ”
I did this running “RT-AC68U_3.0.0.4_384_20308”, run the commands, wait for the reboot.
Then I manually installed the latest FW (04/22/2018) RT-AC68U_3.0.0.4_384_20648-g21e3702
The router rebooted and now I have AI-Mesh with the TM-1900 as a AC68U
Thanks to all for your work and updates!
I’ve installed 2 routers with AiMesh and latest firmware version without problems. This is the procedure I’ve followed in MacOS
Set static IP
IP: 192.168.29.5
Subnet: Default (255.255.255.0)
Gateway: 192.168.29.1
Place router into Recovery/Restore mode
Hold reset button 10 seconds
Power off router (keep holding reset)
Wait 10 seconds, keep holding reset
Power on router holding reset for 10 more seconds
Go to 192.168.29.1 in a web browser (Firefox) holding reset button and refresh until
you see mini-cfe browser to upload TM-AC1900_3.0.0.4_376_1703-g0ffdbba.trx
After reboot go to 192.168.29.1 in a web browser (Firefox)
Log in to router (admin:password)
Go to Administration > System > Enable SSH > Yes > Apply
mac sudo nano /etc/ssh/ssh_config (to enable legacy algo)
mac Offending DSA key in /Users/[your username]/.ssh/known_hosts:3
mac sudo nano /Users/[your username]/.ssh/known_hosts (delete line:3)
mac ssh 192.168.29.1 -l admin (pass: password)
router cat /dev/mtd0 > original_cfe.bin
mac scp [email protected].1:/tmp/home/root/original_cfe.bin .
Upload original_cfe.bin to https://cfeditor.pipeline.sh/
mac scp new_cfe.bin [email protected].1:/tmp/home/root/
mac scp mtd-write [email protected].1:/tmp/home/root/
mac scp FW_RT_AC68U_30043763626.trx [email protected].1:/tmp/home/root/
router chmod u+x mtd-write
router ./mtd-write new_cfe.bin boot
router mtd-write2 FW_RT_AC68U_30043763626.trx linux
Perform NVRAM Reset, wait for reboot /jffs/mtd5_backup.bin
router mkdir /tmp/asus_jffs
router mount -t jffs2 /dev/mtdblock5 /tmp/asus_jffs
router rm -rf /tmp/asus_jffs/*
router sync && umount /tmp/asus_jffs
router rm -rf /jffs/.sys/RT-AC68U
router nvram unset fw_check && nvram commit && reboot
wait after reboot and upload firmware RT-AC68U_3.0.0.4_384_20308-gead790e.trx
mac ssh 192.168.1.1 -l admin (pass: admin)
router cat /dev/mtd5 > /jffs/mtd5_backup.bin
router mkdir /tmp/asus_jffs
router mount -t jffs2 /dev/mtdblock5 /tmp/asus_jffs
router rm -rf /tmp/asus_jffs/*
router sync && umount /tmp/asus_jffs
router rm -rf /jffs/.sys/RT-AC68U
router nvram unset fw_check && nvram commit && reboot
wait after reboot and upload firmware RT-AC68U_3.0.0.4_384_20648-g21e3702.trx
http://dlcdnet.asus.com/pub/ASUS/wireless/RT-AC68U/FW_RT_AC68U_300438420308.ZIP
http://dlcdnet.asus.com/pub/ASUS/wireless/RT-AC68U/FW_RT_AC68U_300438420648.ZIP
I followed the guide on this page without a hitch. But I only ran that final procedure beginning with cat /dev/mtd5 > /jffs/mtd5_backup.bin, once not twice. Then I upgraded to the latest Asus firmware. Did I make a mistake? I see the AIMesh in the firmware settings page.
Also a victim of the rollback but the USB instructions saved my @$$. I did save my CFE so it made things easier. Step 15 only worked with Firefox & Chrome. For some reason IE11 didn’t make the download part available. Drove me nuts for a while when I couldn’t enable SSH due to my inability to edit the timezone for Pacific. Had to use Greenwich & was smooth sailing after that. The erase MTD steps were spot on, no problems. Running 20648 on both TM routers & AIMESH has been pretty solid so far. Much better than when I had 1 router as media bridge.
Anyone know how to set a static IP for the AIMESH Node?
Thanks again for the wealth of info!!!
[quote] Feel free to flash AC68U builds from Asus, Merlin, Tomato, DD-WRT, etc or to “overclock” it using instruction below.[/quote]
Beware that Merlin 384.4 also content TMO cfe, it might also revert back to tm-ac1900 if flash to any further updates version!
To expand a bit more on the Merlin issue. While Merlin may run without issue on these TMO routers, the authors of the Merlin firmware have repeatedly stated that they do not officially support Merlin on these TMO routers. See this link: https://www.snbforums.com/threads/preview-384-ng-asuswrt-merlin-384-5-early-test-builds.45769/page-3#post-395449 and this link: https://www.snbforums.com/threads/announcement-running-asuswrt-merlin-and-forks-on-non-asus-devices-is-illegal.44636/
Because the Merlin firmware is based on the Asus firmware it is possible the Merlin firmware could contain the auto rollback to TMO code. Currently there do not appear to be any confirmed reports of Merlin firmware auto rolling back a TMO router like the Asus firmware has done, but it is something users should be aware of.
Hey guys,
So I did all this and went with the 1.0.2.0 US AiMesh CFE. Completed the whole thing, did the md5 thing and then flashed Merlin. I now realised that with 1.0.2.0 US AiMesh CFE the CPU is 800mhz instead of 1ghz.
I heard that changing the CFE to 1.0.2.5 will get the 1ghz back. Does anyone know how can I do this? Do I have to re-do step 16-20 and flash back the old Asus firmware etc? Also, I kept my original CFE for backup, do I use that or should I extract the CFE again? Considering that I changed that to 1.0.2.0 US AiMesh.
One can manually change the clkfreq rather than use the 1.0.2.5 CFE. See my post earlier up page:
http://www.bayareatechpros.com/ac1900-to-ac68u/#comment-1812
Read through the various comments above that give warnings on using 1.0.2.5 when coupled with later versions of the official Asus firmware.
I was pointing to the boot when it should have been the linux part. I should of have known this.
Bought it on Amazon for 39.00 refurbished.
Thanks Bud, works great first try.
Now back to the R7000 (brick)
PEACE
Someone please tell me what this ‘USB Method’ is.
Look for the Google docs link here posted by SmithB:
http://www.bayareatechpros.com/ac1900-to-ac68u/#comment-1665
Select which USB method works best for your situation.
I have already updated my routed to Asus firmware about 6 months. I was going to update 648 but it I am glad I looked at this site again.
What I don’t understand is how to prevent the rollback.
Do I just manually update to 648 or do I need to do something before to prevent rollback?
Can someone please tell me if its possible to downgrade from 3.0.0.4.376_3199 to 3.0.0.4_376_1703 so that I can enable ssh and proceed?
If it is then please list the detail steps. I tried the tricks mentioned above but none has worked till now for me.
Thanks in advance!!
See my post above with a link to a doc that has several methods to try and roll off the TMO 3199 firmware when one cannot enable SSH.
http://www.bayareatechpros.com/ac1900-to-ac68u/#comment-1665
Had the same issue, even tried a full search in WinSCP and the ‘original’ file could not be found.
Closed the session and reopened the connection and there it was!
Hi, I did flash TM-AC1900 to a RT-AC68U. It has the latest firmware version 3.0.0.4.376_3626. Can any one please tell me what will the latest build that I can update?
It looks like if I use the latest ASUS official firmware, it will reflash the router back to AC1900. Thanks in advance for your help
I can confirm installing RT-AC68U_3.0.0.4_384_20648-g21e3702.trx will reflash the router back to TM-AC1900. Previously was using RT-AC68U_3.0.0.4_384_20308-gead790e.trx and had no problems.
My router reflashed to TM 3199. Now, I am trying to revert back to Asus AC68U. I can get to the CFE miniWeb Server and upload TM 1703. Once the upload is finished I get this error message “The file transferred is not a valid firmware image”. Some are talking about flashing 1708 but there is no reference to where to download this firmware or any comment on why 1708 would be preferred over 1703.
I would appreciate any help on this matter.
Just purchase another TM-AC1900 and for some strange reason this one name never changed from TM-AC1900. I reloaded different CFEs such 1.0.2.0 US and 1.0.2.0 US AiMesh but no success. Additionally this Router is currently on Asus RT-AC68U_3.0.0.4_384_20308 firmware and has not icon for AiMesh. Any help on these two issues would be greatly appreciated.
I had done this previously with a TM1900 and decided to try it again. Bought a refurb on Amazon (April 2018) and had no problems. Easier this time, didn’t have to hexedit files. If you have a Mac with a newer OS, you will have to do this:
In Terminal:
sudo nano /etc/ssh/ssh_config
Remove the hashtags from the lines that say:
# Ciphers aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc
and
# MACs hmac-md5,hmac-sha1,[email protected],hmac-ripemd160
And paste this at the end of the file:
HostkeyAlgorithms ssh-dss,ssh-rsa
KexAlgorithms +diffie-hellman-group1-sha1
If you install the Tomato firmware, be advised you may get a “bad tax header” error if you try to go back to Merlin or a stock firmware. The solution is to use the ASUS Firmware Restoration app. Running the latest from Merlin- I like his version better, personally. I haven’t tried the AiMesh option yet.
I did all the steps and it’s configured BUT not seeing AiMesh option. How do I get that?
I was able to reflash back to Asus, but from TM 3199 could not downgrade. Had to use an exploit explained here https://docs.google.com/document/d/1NsZMONmJ70zMmoAKKQJXbTVKytaPJptWTpqih1TD5n8/edit#
The one that worked for me was the USB method. There are some typos on the step numbering and also at some point before inserting the USB, the zip file needs to be copied to it. During the process there was some buffer error when running the command to write the FW_RT_AC68U_30043763626.trx firmware, but after NVRAM reset is showed the firmware had been installed successfully.
I have used the CFE 1.0.2.0 US AiMesh but still have no icon to configure AiMesh. If someone has a solution to AiMesh, please share.
I had problems with web server method. The USB method was successful. Note that there are errors in the step numbering and before inserting USB in the router, the files12345.zip needs to be copied to it.
Alright I am looking for clarification on how to get AIMesh back. Currently when I log into either router it shows as RT-AC68u in the upper corner of the web interface. I auto updated to the latest firmware before realizing they killed AiMesh.
Do I need to repeat steps 15 on to get AIMesh back or can I just run the code to remove the TMobile certs and get it back? Again my router doesn’t say or indicate that it is a T-MOBILE ac1900 it still shows as a 68u so I am confused as to if I am in the same boat as everyone else.
Terrific – my “refurb” AC-1900 came with Firmware version 3181. Followed steps above EXCEPT used Resonce’s suggestion for reset and got to Mini-CFE page on the first attempt. Did get the buffer error, but as noted by others, it did not interfere with the flashing.
I SOOOOO appreciate not having to resort to using a hex editor to modify the binary. This process was a pleasure. Thanks for your attention to detail.
I do not have ai mesh option. I verified that my CFE version changed from 2.1.2.6 to 1.0.2.0 and I am running 30043763626.
Flashed merlin 380.7 and still no aimesh. CPU model ARMv7 Processor REV0 (v7l) 800 mhz. Rechecked cfeditor and made sure I selected aimesh option.
I’m not sure that Merlin 380.7 supports AiMesh, version 384.4_2 does.
I did the steps, everything went well but I have no AiMesh button on the GUI any help would be appreciated
Many Thanks! After reading this, I purchased 3 of the routers via Amazon, for $48 each! Took me a couple of hours each, but all three are now DD-WRT. I was never able to get the mini-cfe to show up, but all were successfully upgraded with the Asus restore tool. The only thing I’ve noticed so far is that the 5.0Ghz indicator light does not operate after upgrading, but the 5.0 network is there….and usable.
Wonderful instructional!
Hi, I’m having the same problem, now i’m sutck at tmobile and I’m not able to downgrade to 1703 because CFE show this message: (the file transferred is not a valid firmware image), I also tried to upload a asus firmware just in case but neither work.
There’s any possibility to change the CFE to a Tmobile version?
Thank you for the detailed guide. I was able to upgrade from the GUI to the newest ASUS firmware (3.0.0.4.384.20648), from the 3.0.0.4.384.20308 using the “Code for fixing MD5 partition” detailed above, which wipes the T-Mobile certificates from the mtd5 partition.
After rudely being downgraded by asus, did the USB thing PLUS the MD5. All back to normal now.
Those asus guys seem to have nothing better to do than to do detructive deeds.
No more asus stuff for me.
Thanks to all the kind contributors to help save this hardware from being added to the huge heap of junk humanity has already accumulated.
asus, shame on you and your engineers….
Currently updated to RT-AC68U Firmware Version:3.0.0.4.376_3626. If I update through the GUI interface… will I be update to latest version with Airmesh?
I have enable the AiMesh on Merlin 384.4_2 but have not been successful pairing a Node, using same configuration. Let me know if you have been successful.
Update the the GUI Interface to Asus v3.0.0.4.384.20308. Then enable SSH and enter the ZVortex’ commands to wipe the TM certificates from mtd5 partition. After the reboot, you should have AiMesh and you should be able to upgrade to latest ASUS firmware (3.0.0.4.384.20648).
Just leaving my experience, in case it helps anyone:
I opted for the ac68p route, and kept connected by ethernet cable the whole time.
Steps went well. I did see the BUS error, like one other person did, but it did not seem to cause any issues.
For winscp and putty I had to use my own password
Make sure for winscp to select SCP as file protocol,
I then did the fixing MD5 partition steps (still typing the U, in RT-AC68U) Not sure if it was necessary
I then downloaded merlin 384.4_2 and uploaded through the UI
Biggest reason for me to go through this was getting to open ports for targeted IPs only, which allows me to use my server at work, without risking getting port 22 spammed by hackers
I currently have Firmware 3.0.0.0.4.376_3626 with no AiMesh. I have another on 3.0.0.4.376_20308 WITH AiMesh. Would it be a downgrade or an upgrade to get to 20308, and what would be the process?
Hi just changed 3 routers into rt68u with imesh. One mistake, big mistake, was to use same new_cfe file for all 3 routers. Now all have the same mac address. Any help on how to fix this?
No worries, easy fix. Use a “hex editor” to edit the cfe and input the mac address that’s on the router sticker, then flash it using the same instruction as in the guide. Web search for “cfe hex mac address” and you will find more info.
I can tell you the untested section to remove MD5 partition works as advertised. Once I followed the steps the anonymous user submitted to your page, I updated to the latest Asus firmware 3.0.0.4.384 20648 without issue. It still is seen as an Asus RT-AC68U and still has AiMesh.
I can’t access the router remotely. I guess it’s because since it was originally a TM-1900, the MAC address somehow is not registered in the ASUS remote server/service. Am I right?
No
To pair AiMesh Router and Node running Merlin 384.4_2, just had to ensure that both devices were close to each other (<2m) and no cable connections between the two. It worked … and after pairing, I installed the node in its final location and connected a cable between the WAN port of the Node and LAN port of the Router. The CFE boot file was configured for higher WiFi power and 1000/800 MHz CPU/RAM clock speed. The AiMesh configuration has been running for 6 days very stable. The WiFi signal strength has improved significantly.
“I can’t access the router remotely.”
If one is using the stock Asus firmware and want’s to enable remote access to the router’s administration interface they should enable “Enable Web Access from WAN” under Administration > System > Remote Access Config.
Of course allowing remote access to the router’s administration interface opens up the potential for hackers to gain access to the router and change it’s settings.
My remote access works fine. My only problem was that my ddns address wasn’t released by my old router, so I had to request ASUS to release it. But once they did I was able to set it up on the T-Mobile router I flashed to RT-AC56U. Of course there are no guarantees that future firmwares will still work.
ddns is not the same thing as accessing the router remotely, if you’re worried about asus service breaking later the Merlin builds allow use of a number of third party, free, ddns services.
edit: asus official firmware does this, so you can stick with that and pick a different server
question:
after updating the firmware I was back to tm-1900
so I follow the google doc instuctions : NO CFE USB
https://docs.google.com/document/d/1NsZMONmJ70zMmoAKKQJXbTVKytaPJptWTpqih1TD5n8/edit#
and then follow this guide guide from step 9.
but I notice that the TM-AC1900 logo was still present
so I when to official build : https://www.asus.com/us/Networking/RTAC68U/HelpDesk_Download/
and got Version 3.0.0.4.384.20648 and was able to install it.
the TM-AC1900 is still present in the router setting
should the TM-AC1900 logo had change to RT-AC68U or something similar?
also how can I confirmed I can flash firmwares therefor I am no longer stuck into the tmobile asus router firmware..
I know that now the router says Firmware Version:3.0.0.4.384_20648
Thank you for any help
The AC68U/P logo should show, some people have reported the same error in the comments. I’ve flashed like 10 routers bought at various times and never had that issue, so it may be a user error with one of the steps.
would you recommend following all the steps again?
do you think that flashing the correct firmware should take of this issue?
Is there a way to prevent ASUS from creating another firmware, where we will send back to a different TM-1900 firmware?
Yes, there’s a code snippet toward the bottom of the article that should prevent asus from messing up your firmware.
It looks like I have to follow the appendix 2
instructions found on
https://docs.google.com/document/d/1NsZMONmJ70zMmoAKKQJXbTVKytaPJptWTpqih1TD5n8/edit
but because I am on the firmware to the 20648 version (dated 12 April 2018) via the router’s web interface
Can I follow Appendix 2 instructions from firmware 20648?
If not, where should I start?
If Im not mistaken the official Asus firmwares also allow other ddns. But I dont want to change mine to something else. Without ddns, I dont see how one can access the router remotely because there is no way to tell what the IP address is. My ISP is changing the IP all the time.
Interestingly when I called into Asus for support on reassigning my ddns address to this router Asus asked for the serial number and identified it as a T-Mobile router and they informed me they would not support it. The fact it was flashed to official firmwares didn’t seem to matter.
you should be able to access the router remotely.
I used the android app.
what you nee to do is to start your router from factory setting.
Then you will connect the the ASUS wifi from the app, you should download it.
Continue setting the router from there.
Good luck
Hey All,
I was able to convert my TM-AC1900 to a RT-AC68U via ssh using the steps in this article. However, I made the mistake of allowing it to upgrade to the latest ASUS-WRT firmware (384.20648) before I read the part about removing the ‘TM certificates from mtd5 partition’. Now my router seems to be stuck in recovery mode (no access via IP 198.168.29.1 and no wifi leds) Any suggestions?
Read the section “Directions for rolling back to AC68 after AC1900 rollback”
The router may have defaulted back to using IP address 192.168.1.1. Further the following doc may help if you are one of those who got rolled back to TMO firmware and cannot change it.
https://docs.google.com/document/d/1NsZMONmJ70zMmoAKKQJXbTVKytaPJptWTpqih1TD5n8/edit
“If Im not mistaken the official Asus firmwares also allow other ddns.”
Yes, the official Asus firmware allow for a number of DDNS services:
http://WWW.ASUS.COM
DOMAINS.GOOGLE.COM
http://WWW.DYNDNS.ORG
http://WWW.DYNDNS.ORG(CUSTOM)
http://WWW.DYNDNS.ORG(STATIC)
http://WWW.SELFHOST.DE
http://WWW.ZONEEDIT.COM
http://WWW.DNSOMATIC.COM
http://WWW.TUNNELBROKER.NET
http://WWW.NO-IP.COM
http://WWW.ORAY.COM(花生壳)
Merlin’s 384.5 stable will revert you to TM-AC1900 / 3.0.0.4.376_3199 FYI
It did not for me, I used the md5 partition code before flashing it.
Question,
If on a TM-AC1900 branded with
Firmware Version:3.0.0.4.384_20308
CFE 1.0.2.0 (confirmed by putty using ” nvram get bl_version” )
Aimesh option on router GUI
I’m not sure if (here are the questions)
a) I need 1.0.2.0 US Aimesh
b) want to update firmware Version 3.0.0.4.384.20648
— which will cause to roll me back to TM-AC 1900 firmware 3199.
—-which will lock you
But
If I am correct by following Appendix 2 instruction
https://docs.google.com/document/d/1NsZMONmJ70zMmoAKKQJXbTVKytaPJptWTpqih1TD5n8/edit
It will allow me to upgrade to 20648 with out being force to be roll back
Thanks for your help…..
I have to say I read every single reply here and wow it took a while
If you use the code for fixing MD5 partition so you can update to latest firmware it should not roll you back.
Thanks for all your suggestions. Here’s what I tried:
Tried to put router in recovery mode using the Reset/WPS/Wifi button solution
– Got the flashing on/off LED, but still no access via IP 198.168.29.1 or 198.168.1.1
– Tried flashing with the TM-AC1900_3.0.0.4_376_1703-g0ffdbba firmware and the newest rt-68u firmware again (RT-AC68U_3.0.0.4_384_20648-g21e3702), using the ASUS firmware restore utility, but it could not access the route (either timed out or complained route not in recovery mode)
I looked for other methods in the From AC1900 To AC68U After Revert doc, but since I cannot access the web interface none of them were available. Please correct me if I am wrong about this.
for @jrandym
I had something similar… i could not get connect via lan using 192.xxx.x.x.
But it help was connecting to lan via router and wifi to the default wifi signal , I think it was ASUS and ASUS 5.
When I was connect to the WIFI
I was able to access router GUI via 192.XXX.X.X
I hope this helps
I forgot tell you try accessing router GUI using router.asus.com instead of 192.XXX.X.X
Correct – I didn’t delete the tmobile certs just yet, waiting to see what the next firmware update has in store before doing that.
For those of you who got RT-AC68U with CFE 1.0.2.0 and can’t find AI Mesh, the instructions should be updated to be clearer. 3626 doesn’t have AI Mesh in it. I spent about an hour trying to figure this out.
You DO need to run the MD5 steps which are listed further down after the step by step procedures. That will allow you to take the latest firmware without being reset back. Then take the latest firmware update. That will get you to 3.0.0.4.384_20648 and that has AIMesh and everything else, and its a very impressive toolset!
worked perfectly, thanks!
Thank you very much for the detailed step by step guide. Although I don’t have any domain knowledge in this area I was able to convert my router to AC68U without any issues in the first attempt.
Would it be possible to write a more detailed step by step instructions to fix the MD5 partition in order to s update to latest firmware?
I tried to backup mtd5 by typing “cat /dev/mtd5 > /jffs/mtd5_backup.bin” and refreshed WinSCP but I didn’t see the mtd5_backup.bin file
However when I typed “cat /dev/mtd5 > mtd5_backup.bin (without /jffs/) the mtd5_backup.bin 1,280 KB file appeared
Since I am currently 376.3626. should I first upgrade to 384.20308 before upgrading to 384.20648?
Between this guide and another, these helped me to complete the installaition to the ASUS stock 376 version.
From there, I installed Merlin. Merlin is good but the 380 legacy version didn’t support AIMesh so I saw that someone said their 384 version(s) did. Unfortunately, this is where I got stuck. The router was unable to upgrade beyond the 380. It kept giving me an error message.
So, I tried to then flash it back using the guidance from this document but I wasn’t able to. I put the router into recovery mode (flashing ASUS light) but the CFE bootloader wouldn’t come up again.
After spending many hours and lots of reading, I have just become stuck. Maybe I did something that broke the device from allowing recovery. not sure.
Thanks, again!
@Christian Thanks for your reply and help. I gave up last week and shipped it back to Amazon (5/14). Still waiting to hear about my refund. May try again, but limping along with my rt-ac66 for now. ;-)
just out of curiosity, what will be the advantage of flashing the ac1900 to ac68u as opposed to ac68p instead?
@ Ed Uy
One of the advantages will be running at faster CPU at 1 MHZ its of the 800 MHZ.
So you will see a faster re load of your router GUI and as well of other things.
But it says above that there is a way to overclock the CPU to 1 Mhz anyways. So what could be the advantage?
cpu OC doesn’t stick after reboot on asuswrt builds
Have anyone tried to upgrade to 3.0.0.4.384_20942-ge38bead? Is it working on flashed routers?
Have anyone tried to upgrade to 3.0.0.4.384_20942-ge38bead? Is it working on flashed routers?
Version 3.0.0.4.384.20942 2018/05/22 42.79 MBytes
ASUS RT-AC68U Firmware version 3.0.0.4.384.20942
– Improved system stability.
– Improved AiMesh performance.
– Fixed XSS vulnerability. Thanks to Yonghui Han of Fortinet’s FortiGuard Labs.
– Fixed CVE-2018-8877, CVE-2018-8878, CVE-2018-8879
– Fixed plain text password vulnerability in lighttpd.
– Modified Quick Internet Setup wizard process.
– Main SSID and guest network can hide independently.
– Fixed OpenVPN client authentication issues.
– Administrator can asisgn specific WAN interface to register DDNS in dual wan load balance mode.
– Fixed OpenVPN client DNS related issues.
Please unzip the firmware file first then check the MD5 code.
MD5: 3b357de8f37d79dd132fd77b191b2511
I blindly, out of curiosity, upgraded to 3.0.0.4.384_20942-ge38bead. It seems fine. Shows up as a 68P, has options for enabling SSH and aimesh. Is there anything else I should check?
This is reported in ASUS forum:
since this update my 2,4G went down -20dB less TX-power and wont cover all of my home !!!>
5m direct sight I had -20dbm, now only -40dbm if not connected on 2,4G.
If connected fluctuating between -30 and -25, dont know what it is.
I had -20 constant all the time, regardless I am connected or not.
With -40 nearby it is not even found by devices far away, no chance to see this network at all!
Going back to previous firm dont help anymore, they have done something in CFE and/or NVRAM.
Even a initialize or factory recover or reset button or WPS/poweron will not do a factory reset!!!
It now starts after reset with previous language setting, has been english before by default all the time, now it is starting in my language?
THATS NOT FACTORY RESET !
https://vip.asus.com/forum/view.aspx?id=20180522195439040&board_id=11&model=RT-AC68U&page=1&SLanguage=en-us
Which update? This guide is about leaving TM firmware and making the AC1900 a AC68.
Hi, I successfully changed the mac address using the hex editor for the 2 routers.
The funny thing is that one of them shows the status of the wired connection as Cell-Spot…
but the GUI is still, as far as I could see, identical to the other one. Both show i-mesh etc.
Should this be of concern… Something wrong happened?
Reaching out to the group for help setting up Aimesh…
I have two converted TM-AC1900s. At one point, I had AImesh set up, but I had an issue with the node going offline every 24 hours or so. After failing to troubleshoot the issue correctly, I just powered off the node and hoped a future firmware fix would resolve. Unwittingly I updated the main router at one point and was rolled back to the TM firmware. I have fixed that issue and now I see the Aimesh icon on my main router, but I can’t connect to the node. Both router and node where running 20624, however I did downgraded the router to 20308 in order to troubleshoot – that didn’t help.
Via SSH nvam command I can tell I am running 1.0.2.0 CFE – almost 100% sure it’s the US version. Tried to pair using a wired connection but that didn’t work either. Any suggestions?
there’s no aimesh on TM firmware, see Directions for rolling back to AC68 after AC1900 rollback.
I experienced something similar, if you are using Windows then the following site lists some options: https://superuser.com/questions/741514/how-do-i-change-a-networks-name-in-windows-8
I deleted the corresponding registry key and that wired network connection name was gone.
I am having a similar issue. Two converted AC1900 running on the latest AC68 FW (3.0.0.4.384_20942).I Running aimesh CFE and have deleted the mtd5 files. I managed to avoid the rollback issue thanks to the postings of many who did experience it. Aimesh finds the node but will not connect. I’ve done multiple nvram resets, swapped routers. Tried wired, not wired. Rolled back to the original Aimesh firmware with no joy.
I would appreciate any guidance on getting the routers to connect. Thanks in advance.
This is the latest update available 3.0.0.4.384_20942-ge38bead. It fixes some serious vulnerabilities and I’d like to know if Aimesh is still working with this update. Thanks
I am facing the same issue. Router webpage says RT-AC68U but i don’t have AiMesh. Currently on 3.0.0.4.384_20648
Do i need to complete all steps or is it sufficient to only run the code to remove T-Mobile certificates.
Currently on 3.0.0.4.384_20648 and i lost AiMesh. Router webpage says RT-AC68U.
Tried the steps to delete T-Mobile certificates and it worked.
Now i have AiMesh on the same firmware 3.0.0.4.384_20648
Hesitant to try 3.0.0.4.384_20942
Thanks to everyone for the instructions.
Question for you Tesla:
Im on the exact same situation as you. Currently on version 20648 and just deleted the T Mobile certificates, and when rebooted, I got AiMesh back. Have you tried newer versions? How did it go? You are a lifesaver to me, thanks for posting your results!
Peace
I have 3 routers using firmware 3.0.0.4.384_20648 with Aimesh configured and working. I’d like to know if someone has tested 3.0.0.4.384_20942 with Aimesh and their nodes get connected. Not only if the icon appears.
I upgraded 3 AC68Us from 20648 to 20942, and AIMesh kept fully working, with no issues. I first upgraded the router, and then the 2 nodes from the router’s interface. No issues, speed testing looks roughly the same – ethernet backhaul in my case.
Ugh. I just followed all the steps, selecting the AiMesh option, then then updated to the latest ASUS Firmware. I didn’t find any options to turn on AiMesh, now I see why. Anyone know the best way to go back to a version that works? I am hoping someone has the proper firmware posted and then we can use the “Chose file” option for the firmware update to get this feature back.
I also did the 3.0.0.4.384_20942-ge38bead upgrade through the admin GUI but now AiMesh doesn’t show up on my converted TM-AC1900 :( Wonder why it would work for you? Was your AiMesh router & node both converted TM-AC1900?
Upgraded for me, but I lost the AiMesh as even an option now! There are reports of that on other sites too. I’m not sure what to do now.
you are describing exactly what I am seeing on both my TMO routers.
I updated my AC1900 to RT-68U long time ago (but didn’t clean out mtd5 partition). It worked for couple years even with all the upgrades. However, I made the mistake of upgrading via the Asus Router App today, and it reverted to the T-Mobile 3.0.0.4.376_3199, and completely locked me out. I tried all the methods to downgrade, I am able to reset (reset, WPS, Wifi, power) and get to the mini-CFE page, but when I upload the image, it always say it’s invalid. Any pointer as to how I can downgrade?
This is a reply to Evan and The Alchemist (@a1ch3mista)
After you upgraded to 3.0.0.4.384_20942 and lost the AiMesh option on your converted TM-AC1900 what does the web login show up as? Asus RT-AC68U or TM-AC1900.
If it still shows up as Asus RT-AC68U, try the procedure to delete the TM certificates. Follow procedure given in Appendix 2 within the link below
http://www.bayareatechpros.com/ac1900-to-ac68u/#comment-1665
NOTE: I have tried this with the previous version of firmware only, not 3.0.0.4.384_20942
If your router webpage shows as TM-AC1900, then you may need to complete the full procedure given in the file.
Mi procedure was updating to 20308 fix MTD5 partition than upgrade to 20648 and then fix MTD5 partition again. This was the last safe AiMesh configuration. I will test 20942 in two weeks. If you miss to fix MTD5 partition after 20308 you will be locked out
It completely reverted to TM-AC1900. And I tried many methods (with the except of booting with TFTP) to downgrade, the procedure outlined here, the method to edit the javascript to be able to post with telnet and ssh enable in the submit. None of the methods worked…
I had stock ASUS firmware on mine. The auto update firmware reset my firmware back to the t-mobile cell spot firmware. It also reset all my configuration.
is there a way to flash the router back to either DDWRT or tomato ?
Directions for rolling back to AC68 after AC1900 rollback above did the trick.
Code for fixing MD5 partition so you can update to latest firmware was the key to not have Asus view this as a TM device. I am on the latest version and everything is working.
Thanks! Very help info here.
@Joe
are you on TM branded running AC68 with deleted mtd 5 as on appedendix 2 with FW 3.0.0.4.384_20942 and everything is working fine??
Hi,
I upgraded from 20648 to 20942 with no issues. I don’t use aimesh, but the option remains. Performance remains the same.
I have already removed the MTD5 partition prior to 20648, so I never encountered the rollback.
I thought I was losing my mind. I have twice converted my T-Mo router to ASUS and each time, eventually, T-Mobile somehow reaches out to it to convert it back to stock T-Mo. Until I discovered this site tonight, with recent entries of people who had the exact same issue, I thought I was just having back luck with failed updates.
So far, I’ve been unable to get CFE to work anymore (for the initial downgrade), but at this point, I’m more concerned with how the hell to keep T-Mobile out of my router if I can get it upgraded again. Surely there are a range of IP addresses that can be blocked. There must be a way through Telnet to know what firmware is staged on the router when it tells you there’s an update available. I told it to upgrade because ASUS had updated firmware dated 5/22/2018, so I figured that’s what is ready to be installed.
But no, it was stock T-Mo firmware. Unreal. T-Mo no longer supports the thing, they never provided updates, but they’re pissed off that people converted these things to keep them useful & secure (against malicious attacks).
you can still revert back to good firmware by following the instructions under the section “No CFE Usb
‘ section in the google doc mentioned in the appendix of the OP. I was in the same boat is you Where I couldn’t reflash the fw using mini cfe.
under the section in OP “Directions for rolling back to AC68 after AC1900 rollback”
…reply to tesla. I still get the RT-AC68U web login. I saw the instructions for deleting the TM Certificates in another forum but am reluctant to do so as there may be no turning back from that point. I dont want to brick my devices.
Not removing the Tmo certs would just give asus the opportunity to roll back the router to the default Tmo image… and it would be just slightly better than a brick
I have confirmation that upgrading from 20648 to 20942 is working with no issues in AImesh. Just make sure to remove MTD5 partition before doing anything and repeat the procedure after that.
Reply to Evan.
If i understand comments from others correctly (on other forums as well), the next update to your router will convert it to the TM-AC1900. This is true even if you install the same version as the one currently on your router. Once it does convert to a TM router, getting it back is tough.
At the point where you are now, reverting back to a regular RT-AC68U is easy and the procedure took me only about 10 mins.
I see comments from others that after deleting certificates you go on to install a new firmware, you will need to delete certificates again.
I am currently on RT-AC68U_3.0.0.4_384_20648 and deleted certificates with this version.
Something very odd from this. I also had the upgrade and get rolled back to TM firmware problem and followed the steps to resolve it. I’ve had the AiProtection Two-Way IPS enabled for a couple years now and I’ve never had it trigger detections from the internet attacking my router. The day after I visited here, forums.whirlpool.net.au/archive/2693988, the Google doc with the instructions, and tmac1900.weebly.com using the script my router has detected 4 High severity ASUSWRT specific attacks made against it. It seems a little too well timed to be coincidental. Makes me wonder if there’s log data being leaked or compromised or something from the Google Doc being used to attack routers.
Why do you need to delete this MTD5 partition after every firmware upgrade. It doesn’t make sense. If the partition is really deleted, then there should be no chance of a reversion to the T-Mobile firmwares ever again
The reason for delete MTD5 partiion is just in case the firmware update recreates the MTD5 partition after updating
That would be really pernicious. But hard to believe that buried inside the updated firmware would be an obsolete firmware that would then write itself into the missing partition and then install itself. Does anyone have any evidence that this is in fact happening?
It’s not T-Mobile “getting into your router”, it’s the ASUS firmware file. It runs a validation check and if it determines you have an AC-1900, it will flash you back to the AC-1900 firmware and additionally prevent you from downgrading unless you go through some complex steps either using a web server or a USB drive using an exploit. Good luck.
For those installing the latest ASUS firmware versions on your AC-1900’s, make sure you follow the instructions on how to remove the appropriate files from the MD5 partition or you will be flashed back to a highly restricted AC-1900 firmware which will require the use of an exploit before you’ll be able to downgrade and flash a stock ASUSWRT RT-AC68U firmware. If you don’t properly follow the instructions for “fixing” your MD5 partition, you will lose AiMesh and/or be downgraded to an AC-1900 firmware.
I can confirm that AiMesh is working just fine on my own AC-1900, version 3.0.0.4.384_20942 released by ASUS on 5/22/18. Upgrade went without a hitch right through the ASUS web UI, after fixing the MD5 per the instructions above.
Replying to ChrisWNY, I currently have the latest stable version of Merlin installed and I’m trying to figure out what I need to do in order to keep from getting dumped back to the stock AC-1900 firmware. I was advised to create a new CFE and flash it and I also saw the instructions for removing the files from the MD5 partition. Do I need to do both or is just one sufficient?
For those who was using AiMesh and upgraded to 20942, is a nvram reset required? Can you do a straight flash (without reset) and keep all the settings?
I literally spent days customizing my router which currently is on 20648. I would prefer to save a few hours if I can :)
regards,
So, I had the previous Asus version before the very latest 5/22/18 one. I flashed today, and sure enough it rolled back to the old TM-AC-1900 firmware. Pissed, I tried the steps in this forum to go back in time and get back to the Asus version. This time like others, when booting into rescue mode i got the error that the firmware wouldn’t upload since the file was not valid…..I have just completed the USB re-flashing method, and all has worked. What I am wondering now is, I have done the MD5 partition fix at this point. I want to know if it is now “safe” to flash to the latest Asus firmware again. It seems it is a yes, but just want to be sure, as I have spent a few hours messing with it at this point…
Just first save your config and restore it? I think that should work.
I just flashed 20942 literally 10 minutes ago. I previously was on 20648, and 20308 before that. Prior to flashing 20648 I deleted the md5 partition, and flashed 20308 (and now 20648) without having the router connected to the internet. Flash was successful without roll-back.
Ditto, delete the md5 partition if you plan on upgrading to latest Asus firmware else you’ll get reverted to stock tmobile. I found out the hard way on my main router which lead me here, cleared the md5 on my back up router and upgraded and good to go. Now gotta roll back my other router from locked cfe so I can downgrade it and upgrade the firmware.
New version available
Firmware version 3004.384_21045-gb451ba1
– Release Note –
– Modifid the EULA for DDNS, AiProtection, Adaptove QoS, Traffic Analyzer, Web history, Feedback.
– Add Privacy page in Advanced settings
– Fixed IPv6 bugs
– Modified USB 3.0 related strings.
– Increased port formwarding rules limit from 32 to 64.
– Added more protection mechanism for OpenVPN account.
– Fixed AiMesh bandwidth and extenstion channel sync issue.
3 nodes updated AiMesh working, no rollback detected. Everything OK. It’s safe to update if you have deleted MTD5 partition prior this upgrade
http://dlcdnet.asus.com/pub/ASUS/wireless/RT-AC68U/FW_RT_AC68U_300438421045.ZIP
then do you have to putty back into the router and delete the MTD5 stuff again? If so, how can you if ssh is gone after the flash to the latest firmware?
How exactly do i do step 16? What are the steps?
Forget it, SSH is still there. I also upgraded mine successfully, and went back in and deleted the MTD5 stuff again. It then re-booted the router. All looks good for now! Thanks everyone.
To those that have downgraded successfully, is the cfe file supposed to downgraded too? I tried the thumb drive methods and can flash other firmware now but the router still shows up as tm-1900 with cfe 2.1.2.7 no matter what I do.
I have two semi-related questions. I upgraded to 1.0.2.5 US for AC68P, and everything is kind of working with two exceptions.
On my old router (WRT54GL), I had the outbound cable in LAN port 1 instead of WAN, since I could not get the WAN port to configure to 192.168.1.1. Apparently I have not gotten any brighter when it comes to wifi networking. I set the WAN port in the configuration to Static IP and the address to 192.168.1.1/24, but when I plug the cable into the WAN, I cannot ping the interface.
So my first question is how do I set up the WAN port to have the IP .1.1 address?
My second question is how do I permanently set the resolv.conf to point to the correct addresses? I have to set the nameservers in /tmp/resolv.conf, /tmp/resolv.dnsmasq is empty, /tmp/etc/resolv.conf is a symlink to the file in /tmp, and /rom/etc/resolv.conf has nameserver 127.0.0.1 instead of the correct nameservers. How do I configure this so that the wireless router points to the right nameservers?
OK, I updated my firmware like I wasn’t supposed to. It has been working fine but without AIMesh. Today I decided I should try and remove the MTD5 partition. All instructions seemed to say I should do this from FW_RT_AC68U_300438420308 so I went into the router GUI and uploaded this version. This step brought my router back to a T-Mobile Router. My other router in AP mode is still on the old 192.168.1.XXX subnet and is still an AC68U. What should my next step be?
There’s no instruction to upload that version. You are supposed to type those commands in putty.
Run the guide from the start, or from the step that has you uploading that firmware version..
Hi,
I am wondering what is the difference between CFE step-
1.0.2.5 US for AC68P or 1.0.2.0 US ?
I followed the steps, I chose 1.0.2.5 US. Did MD5 fix and upgraded to latest firmware (3.0.0.4.384_21045) Now when I go to router setting page it does show as RT-AC68P.
I am noticing following two performance related issues-
1. The router setting page opens rather slowly. Regardless of being on WiFi or Ethernet, it takes some time. Also when I click on some options in settings e.g. Wireless, it takes a bit to load (~5 seconds minimum).
Is it the case that AC68P firmware performs slowly on TM-AC1900 and instead AC68U firmware is desired?
or there is absolutely no difference between AC68P and AC68 firmwares?
2. The internet download speed seems capped at ~65 Mbps.
I have Google FIber at 100 Mbps up/down. If a device is connected directly to Google fiber router, I do get 95+ Mbps up/down minimum.
Now, the Asus router is connected to Google fiber via Ethernet. Regardless of being on WiFi or Ethernet on Asus, my download seems capped at ~65 Mbps. Upload is good, ~99 Mbps.
Is this again due to running AC68P firmware, perhaps its a lot of load for underlying hardware?
Any suggestions and comments appreciated!
Thanks,
Sam
regarding network speed, look at your QOS settings and correct or disable it
I am stuck on STEP 6. I cannot Flash TM-AC1900_3.0.0.4_376_1703-g0ffdbba.trx
I accidentally connected the router to the internet and perhaps it updated? Once I get to STEP 6 and after Placing router into Recovery/Restore mode I cannot flash anything using the Mini-CFE or using the Asus Restore Utility. What do I do now? Will doing any of the steps below help?
1) “Code for fixing MD5 partition so you can update to latest firmware”
OR
2) “Directions for rolling back to AC68 after AC1900 rollback”
Please help. THanks.
fixing md5 partition is something to be done before updating to latest asus firmwares. rolling back to ac68u is done if you are rolled back to ac1900. I’m not sure what you’re asking though as you did not specify whether your router is displaying ac1900 or ac68u/p
after setting static ip and before putting into recovery mode it says it is TM-AC1900. I’m confused about if I need to roll back and if so to what and if I need to do the MD5 partition fix. I appreciate your help. Thanks.
From my understanding if it says AC1900 the guide was not followed correctly. I’ve flashed like 10 of these routers, they always say AC-68u/p, but some commenters are saying it says 1900. Either there’s a bug of some sort or the direction is not being followed. If my router said AC1900 after the flash I would run through the directions once more in case something was missed.
Also, am I supposed to connect to the router at 192.168.29.1 via the Ethernet cable or WiFi? should it be in the yellow LAN or blue WAN input?
The blue wan input is where the internet comes from, the yellow lan is where the Pcs to which the internet goes are connected.
You definitely need to remove the files from the MD5 partition. This removes specific certificates that the ASUS firmware looks for in order to determine if you’re flashing to a TM AC-1900 or RT-AC68U. Is it foolproof? Probably not – there may be other validations ASUS can run to determine if you’re hacking an AC-1900 or installing onto a stock RT-AC68U. Proceed with caution and always back up your router’s settings.
Additionally, to answer some other questions that seem to be common – once you SSH into your router and run the commands for removing files from the MD5 partition, you should not have to repeat those steps again. The MD5 “fix” removes cert files used by the firmware upgrade to determine whether or not your router is an AC-1900 or RT-AC68U. From what others have posted recently, upgrading to the latest firmware should not be an issue after the MD5 “fix”.
I will also confirm that the ASUS June 1st firmware update, 3.0.0.4.384.21045, went without a hitch, AiMesh is working just fine.
Came here to check if someone had done just that. Thanks for the confirmation, and undertaking the risk for the rest of our benefit.
Is the MD5 fix permanent or do I have to apply that every time before updating the firmware?
Thanks for the reply Alex.
QoS is currently disabled, I never enabled it.
This router can definitely handle 100mbps, perhaps the cpu cores are running at full speed when they shouldn’t, or maybe the Google router is doing something and needs to be set to bridge mode. You may have a faulty unit, returning for a replacement and checking the speed before flashing would be a solid confirmation.
@Shinji – the MD5 fix should be permanent. I’ve SSH’d into the router after the latest 20145 update and it appears that the files within MTD5 were still absent. I doubt any future firmware update would re-populate those files. Apply future ASUS firmware updates with caution however…there may be other ways for ASUS to verify AC-1900 vs RT-AC68U hardware.
@Sam – check Advanced Settings > LAN > Switch Control. Make sure NAT Acceleration is ENABLED. The RT-AC68U/P should be capable of 1Gbps speeds over the WAN, presuming hardware acceleration is enabled and working properly. Note that if you enable port forwarding (like I do) the stock firmware reverts to Level 1 instead of Level 2 acceleration, (Level 2 is CTF and Flow Acceleration, rather than CTF only).
I know with cable internet a fast upload and a slow download are usually signs of signal issues. Since you’re on fiber, that probably isn’t the case. Contact your ISP to ensure it’s not an issue on their end.
To all those who are choosing RT68P in CFE-
I obtained TM-AC1900 from Amazon.
Followed steps above. I had chosen RT68P (1.0.2.5 US on cfeditor website).
Everything went well, except SLOW performance. The router setting page would take considerably longer to load, and clicking on any option would take some time as well.
I asked above if there is a difference between RT68P vs RT68U firmware but did not get a response.
Also, my internet speed seemed capped around 65 Mbps while I get 100Mbps fiber service.
So, as an experiment I re-did some steps today. Instead of choosing 1.0.2.5 RT68P, I chose 1.0.2.0 RT-68U. Afterwards updated to latest firmware. Now router shows up as RT68U and performance is amazing. Settings page loads up quickly. Internet speedtest shows 100 Mbps as expected!
So there is definitely some issue if you go for RT68P 1.0.2.5 US on TM-AC-1900. Maybe not all but at least some devices. Perhaps RT68P config/firmware runs slower on underlying hardware.
@ChrisWNY
Thanks for the reply.
My solution was to flash RT-68U (CFE for 1.0.2.0 US) instead. Everything was speedy after this including internet speeds shown at 100Mbps.
NAT translation was indeed enabled earlier too.
Perhaps some TM-AC-1900 have an issue if you put RT-68P CFE/Firmware
@Sam – ah that makes sense. The TM AC-1900’s are definitely just re-badged RT-AC68U’s, not 68P’s. The 68P is a bug fix version of the 68U, it has a slightly faster CPU as well. The 68W has the same hardware as the 68U but it white in color instead of black.
This site has a comparison of the 68P vs 68U…
https://www.smallnetbuilder.com/wireless/wireless-reviews/32609-asus-rt-ac68p-dual-band-wireless-ac1900-gigabit-router-reviewed
I should say *most* TM AC-1900s are re-badged RT-AC68U’s, especially those that purchased the refurbished models from Amazon. Some of the newer AC-1900’s may be 68P’s. The firmwares are definitely different which was why there is performance problems if running a 68P firmware on a 68U, and vice-versa.
Hi Chris, are you sure? I read people going back to TM-AC1900 after flashing 3.0.0.4.384.21045 firmware. Please advise.
The Diagnose button is actually on the web page, below “Send ICMP ECHO_REQUEST packets to network host.”, it is NOT in the console. Took me a while to figure that out as well. So, look at the actual web page, when on page https://192.168.29.1/Main_Analysis_Content.asp.
Press this button after you copy and paste the command into the console and DO NOT forget to click ENTER after pasting each command.
P.S. I still could not get this to work. I had the original CFE file and it just won’t take. Going to try and downgrade to an earlier T-M firmware first to see if I can get the SSH option back in. I know I can get it to work that route, as I did it before.
Good luck!
Should have scrolled down a bit to see your next reply….oops. But, yes, I am in the same frustrated boat. It almost seems like the firmware it forced me into has figured out how to block the last step of the process and th script is unable to execute…
I was able to get back to the Asus Firmware Version:3.0.0.4.376_3626, by first following the steps to downgrade to the earlier version of the TM firmware, followed by the normal steps to get to Asus firmware.
I then went to go download the 20308 firmware and Asus has removed this download from their website. It is no longer available.
Do I need to be on this firmware to do the MTD5 deletion or can it be done on the 3626? If I need to upgrade to 20308, would anyone be able to host this firmware on a download site for me that has a copy of it?
I used a corrupted CFE file, now I have only the USB light on, any idea how to reflash the CFE?
Sam,
I did the same as u, flash TM-AC1900 to RT-68P. Per https://slickdeals.net/f/11542971-asus-tm-ac1900-wireless-dual-band-gigabit-router-refurb-48-free-shipping?v=1,
“Avoid CFE 1.0.2.5 from the RT-AC68P, as the newest Asus firmwares (3.0.0.4.384.20624 and later) detect this on the TM-AC1900 and revert the mod. Instead, use CFE 1.0.2.0 US AiMesh; it was dumped from an actual RT-AC68U by user goggles99 at SNB.” which seems to be confirmed by some of comments here as well.
How exactly did you convert from 68P to 68U as that is what I want to do?
thanks in advance,
Jim
About 6 months ago I purchased a tm1900 and successfully flashed to 68U. My network was running oddly slow last night so I unknowingly ran the fw update. So now I’m on tm-1900 3.0.0.4.376_3199.
I’m trying to run the No CFE USB rollback method from the links in the bottom. When I run the 1st command in console, I get a syntax error. I didn’t even notice it the 1st time I did, so I got halfway through the steps. I even got this:
If you see the message cp: recursion detected, omitting directory
“./userRpm” you are on the right track.
but then the diagnose button stopped doing anything.
The only issue I think I might be having is, even though I renamed my USB to USB when I plug it in to the router on the main page it calls it Imation (the manufacturer) when I go into Samba share it shows USB, but in a folder inside Imation.
Under USB 2.0 on that main page does it have to be called USB?
Thanks
Is it common for the router to take a few minutes to power up? I’m flashed to RT-AC68P with the latest version of Merlin.
Thanks for the info me3 You could put all you info in it’s proper order and paste it to https://pastebin.com/ and link that here.
Yeah, I replied to your message earlier, and it’s not in line. Pastebin can be very large, I wouldn’t about it being too big, I’m sure people, myself included would appreciate seeing what worked for you. The existing document is confusing. I’m not even sure what step to start on.
@Ed – if you run the MD5 fix prior to attempting an upgrade to the latest ASUS firmware, you should be good to go.
cat /dev/mtd5 > /jffs/mtd5_backup.bin
mkdir /tmp/asus_jffs
mount -t jffs2 /dev/mtdblock5 /tmp/asus_jffs
rm -rf /tmp/asus_jffs/*
sync && umount /tmp/asus_jffs
rm -rf /jffs/.sys/RT-AC68U
nvram unset fw_check && nvram commit && reboot
In case this helps anyone:
If you are having a problem with AIMesh detecting another device, double check the CFE that you fleshed (1.0.2.0 am). I had somehow downloaded the regular 1.0.2.0 and it was named 1.0.2.0 am. The only way to tell was i looked at the file size details. the regular 1.0.2.0 is 231,923 bytes, while the am version is 231,882 bytes.
In any case, it’s easy to get a fresh copy of 1.0.2.0 am and replace the one on your router:
Upload new_cfe.bin (am version) & mtd-write to router through WinSCP
In Putty type:
chmod u+x mtd-write
In Putty type:
./mtd-write new_cfe.bin boot
power off and reset nvram.
One router had the correct file, the other had the non-am file.
OMG!! awesome guide (updated on as of 6/8/18!!). got mine update within 10 mins (helps that i use putty/winscp and linux at home too!!). totally had my pal get one of these via your links since i bought mine from amazon directly and wanted to make sure you got something for your hard work. :)
you mean like 10-15mins max (if you have some tech skills, use the tools before like putty/winscp) and yes.. way worth it!
For those that did the : “Directions for rolling back to AC68 after AC1900 rollback” and still see the Router UI showing TM1900 but have Asus firmware in it… I fixed mine.
Also, for MCA:
” 2018/06/07 at 10:44 PM MCA says
I’m sure people, myself included would appreciate seeing what worked for you. The existing document is confusing. I’m not even sure what step to start on.”
I took your advice and posted the guide on Pastabin site. I also contacted Alex here and he removed my confusing out of order posts. :)
GREAT NEWS, Thank you ALEX!!
So,
Here you go! https://pastebin.com/embed_iframe/sZgn1d10
Hello,
Great document and fruitful correspondence.
Now, if I already have an Original Asus RT-AC68U (not a hacked one) – will it make any difference/easier on the steps/safer if I extract its original CFE -> update with the MAC addresses of the TM one and then push to the TM router?
Will this enable SSH or I will have to downgrade anyway?
I am looking at buying only 1 TM router -> turn to an AC68U to be used as an AiMesh node to the original one I own.
Tx!
No. I think you can’t do this. You won’t be able to push the CFE to the TM router.
You need to modify the CFE in order to use the AC68U firware. You need SSH in order to modify the CFE on the TM router. You need to downgrade the T-Mobile firmware in order to enable SSH.
Hi,
Seeing the same issues with 68P. Internet speed capped at 70 Mbps on a 100 Mbps link. I didn’t have them with 66U. For some people 68U will definitely be the way to go.
Does anyone know if it’s possible to overclock a tm1900->68u router if it is a node on the mesh? I heard that 1.0.2.5 does, but not sure if that will cause other problems on the tm rounter.
After spending 24 hours looking for a solution, this guide solved my problem (AC 1900 > AC68U > AC 1900 because of an update) I was able to return it to AC68U this time using the Merlin 384.5 using the usb version with the 3 files. Kuddos to all for the time and effort on this guide.
**Warning**
Sometimes the GUI will not change from TM-AC1900 to RT-AC68.
I spent hours trying to figure out what I was doing wrong. I’M on the latest Merlin firmware (384.5) and it still shows TM-AC1900. Just a GUI glitch.
Hope this saves someone from the waste of time I had on this.
I had a similar issue with one of two routers that I converted. Turns out the CFE flash failed. I would suggest that you repeat the steps of creating a new CFE and rewrite it. You can do that from your current firmware.
I realize I’m 6 months late in responding (never received a notification of new post here). But I have found a MUCH easier way to change the MAC address… Use Putty and enter this string:
nvram set et0macaddr=DE:FA:CE:DE:FA:CE
nvram commit
reboot
exit 0
Of course, you change the DEFACEDEFACE to something more realistic. What I did was change just a single digit in the second to last group. Once doing this, it worked 100%
I had to relearn what to do when I added a third one of these routers to my network. What I thought was a careless mistake, I think, is something more systemic. I think when a single network has more than one of these, the problem becomes apparent. When the .bin file is uploaded, for some reason the mac address that comes back is not unique – at least it wasn’t with the last three I’ve done.
Hi!
Have 2 TM-AC1900 that have been converted over to AC68U, and updated to the latest firmware. The MD5 partition was fixed before the firmware was upgraded. I am having issues with AiMesh. The AiMesh router does see the node, and tries to add it. It sort of gets to about 75-80% and then fails. The node is now about a 1 foot from the router. I have logged into the node and it is in “receive AiMesh” mode. Both are on the latest firmware. I switched the roles and same issue. Suggestions?
Thanks in advance.
Regards,
Emil
I am doing two units like this and when I did the second one, I realized that I forgot to name the downloaded 1.0.2.5_max.bin to new_cfe.bin.the The first router is running the latest merlin firmware, but still says its a TM-AC1900 on the top left of the GUI. Does this matter? Should I go through the process of renaming and writing the new_cfe.bin file on the first router, or just leave it alone?
Thanks
Did you flash 1.0.2.5_max.bin? It doesn’t matter what it is named, it matters that the cfe is flashed onto the router. If you didn’t do that, you follow do the guide.
when attempting to fix MD5 to update FW made a typo mistake in Putty on ” sync && umount /tmp/asus_jffs ”
now receiving ” ~sh: unmount: not found ” from putty
AND the following when attempting to delete asus_jffs folder in WinSCP and start over
Command ‘rm -f -r “asus_jffs”‘
failed with return code 1 and error message
rm: can’t remove ‘asus_jffs’: Device or resource busy.
any suggestions on how to fix?? Thanks
now receiving ” ~sh: unmount: not found ” from putty
AND the following when attempting to delete asus_jffs folder in WinSCP and start over
Command ‘rm -f -r “asus_jffs”‘
failed with return code 1 and error message
rm: can’t remove ‘asus_jffs’: Device or resource busy.
any suggestions on how to fix?? Thanks
Sam, what FW version did you use? I just tried both 1.0.2.0 AiMesh and 1.0.2.0 and my WAN speed is still limited to 50 Mbps (out of 100 Mbps).
Share my experience – I stupidly clicked upgrade firmware on my (real) 68U and my (firmware upgraded) mesh 68U. Stopped worked and consulted this page (which I used to get info on initial firmware update).
Bad feeling in gut when saw red notice about not upgraded and the many steps to fix. Turns out the below worked for me and hope sharing helps.
1. Get back to flashable firmware
* Used ASUS firmware recovery to get back to FW_RT_AC68U_30043763626
* The final firmware I want is FW_RT_AC68U_300438420308 but that one can’t be put in by the firmware recovery tool
2. Open SSH access
Same as instructions above log into router and get SSH going on admin page.
3. CFE
turns out the upgrade to the firmwares (both induced by ASus and going back by recovery tool) doesn’t break the CFE. So didn’t need to rework that.
4. Putty / WinSCP
Used the same instructions on main page (didn’t need to mess with IP – just used defaults is ok) and uploaded the desired firmware (300438420308) and did the mtd-write2
5. Reboot and reestablish the mesh aspect
after same reboot instructions – everything worked!
Happy to fill in gaps on above if needed but key steps there and hope it helps
(and need to remind self – never update firmwares again)
Did this happen even after you did these steps (if you did this stuff)?
Code for fixing MD5 partition so you can update to latest firmware:
cat /dev/mtd5 > /jffs/mtd5_backup.bin
mkdir /tmp/asus_jffs
mount -t jffs2 /dev/mtdblock5 /tmp/asus_jffs
rm -rf /tmp/asus_jffs/*
sync && umount /tmp/asus_jffs
rm -rf /jffs/.sys/RT-AC68U
nvram unset fw_check && nvram commit && reboot
Just trying to understand if the firmware update was able to tell it was a tmc 1900 even when the Tmobile specfic stuff was removed.
“Eric says
2018/06/09 at 6:31 PM
I realize I’m 6 months late in responding (never received a notification of new post here). But I have found a MUCH easier way to change the MAC address… Use Putty and enter this string:
nvram set et0macaddr=DE:FA:CE:DE:FA:CE
nvram commit
reboot
exit 0
Of course, you change the DEFACEDEFACE to something more realistic. What I did was change just a single digit in the second to last group. Once doing this, it worked 100%
I had to relearn what to do when I added a third one of these routers to my network. What I thought was a careless mistake, I think, is something more systemic. I think when a single network has more than one of these, the problem becomes apparent. When the .bin file is uploaded, for some reason the mac address that comes back is not unique – at least it wasn’t with the last three I’ve done.”
Sorry Eric, I DON’T think you should advise this.
That will change 1 MAC you need 3 changed. This info is learned when extracting the ‘origional_cfe.bin’ from years ago when people changed from TM1900 to RT-AC68’s
…plus a secrete_code.
et0macaddr
macaddr
macaddr
secret_code
“Michal says
2018/06/09 at 9:04 AM
Hi,
Seeing the same issues with 68P. Internet speed capped at 70 Mbps on a 100 Mbps link. I didn’t have them with 66U. For some people 68U will definitely be the way to go.”
When you go https://cfeditor.pipeline.sh/ some people have reported in the above comments ( sorry to sound sarcastic ) that some hardware can’t handle the 1.0.2.5 US (RT-AC68P/V2)
The RT-AC68P router was from, what I understand, a Best Buy exclusive model. It had a 1ghz processor. Was only available at Best Buy ( MAYBE Amazon? Doubt it )
Normal (later) models the RT-AC68U was an 800mhz model.
So, it makes sense that ~ if ~ you put this 1.0.2.5 cfe into a 800 mhz model… .it will not act correctly .
That is MY belief on what is happening when people say what you said.
My advice is to try one of the 1.0.2.0 options. I chose 1.0.2.0 US AiMesh.
“david moxon says
2018/06/10 at 10:42 AM
I am doing two units like this and when I did the second one, I realized that I forgot to name the downloaded 1.0.2.5_max.bin to new_cfe.bin.the The first router is running the latest merlin firmware, but still says its a TM-AC1900 on the top left of the GUI. Does this matter? Should I go through the process of renaming and writing the new_cfe.bin file on the first router, or just leave it alone?
Thanks”
You solved your own problem in your question.
“I realized that I forgot to name the downloaded 1.0.2.5_max.bin to new_cfe.bin”
In the instructions:
18) In Putty type:
./mtd-write new_cfe.bin boot
So the commands had “new_cfe.bin” and you didn’t have ” new_cfe.bin” for the command to find.. so it didn’t take the ‘change’ because there was no change to offer.
In short, that process did nothing as you still see TM-AC1900.
https://cfeditor.pipeline.sh/
The ‘ new_cfe.bin ‘ is what changes the name from TM-AC1900 to RT-AC68U so if there was a mistake in that process ( as you said there was ) then of course it will still say TM-AC1900 :)
Name it ‘ new_cfe.bin ‘ and try again.
If you have a problem with your speedtest results, chose 1.0.2.0 US AiMesh.
“Alex says
2018/06/10 at 5:45 PM
Did you flash 1.0.2.5_max.bin? It doesn’t matter what it is named, it matters that the cfe is flashed onto the router. If you didn’t do that, you follow do the guide.”
———————–
Looking at the guide on this page,
18) In Putty type:
./mtd-write new_cfe.bin boot
Why would it NOT matter what it is named when you are doing a command that clearly wants ‘ new_cfe.bin ‘ ?
–
It says:
./mtd-write new_cfe.bin boot
–Lets break that down… write….. new_cfe.bin
It does not say write 1.0.2.5_max.bin
it is looking for ‘ new_cfe.bin ‘
–
This is a forum here with instructions where if you put an extra space in the code, it breaks it.. if you do a typo, it breaks what ever you are doing.
=============If this person followed step 18 that said : =================
18) In Putty type:
./mtd-write new_cfe.bin boot
And he did NOT have
new_cfe.bin
===== YES IT WILL matter on what you name the file to.========
Step 18 simply wont work. It will not install what it can’t find. It won’t install 1.0.2.5_max.bin because you did not tell it to install 1.0.2.5_max.bin when you put
./mtd-write new_cfe.bin boot
Dungeons & Dragons: Melt wizard.. fail.
You didn’t specify what to use to ‘ Melt Wizard ‘ with.
“Emil says
2018/06/10 at 10:24 AM
Hi!
Have 2 TM-AC1900 that have been converted over to AC68U, and updated to the latest firmware. The MD5 partition was fixed before the firmware was upgraded. I am having issues with AiMesh. The AiMesh router does see the node, and tries to add it. It sort of gets to about 75-80% and then fails. The node is now about a 1 foot from the router. I have logged into the node and it is in “receive AiMesh” mode. Both are on the latest firmware. I switched the roles and same issue. Suggestions?
Thanks in advance.
Regards,
Emil”
———————————————–
One comment above yours was about the SIZE of the CFE:
–
ghentj says:
2018/06/08 at 6:14 AM
“In case this helps anyone:
If you are having a problem with AIMesh detecting another device, double check the CFE that you fleshed (1.0.2.0 am). I had somehow downloaded the regular 1.0.2.0 and it was named 1.0.2.0 am. The only way to tell was i looked at the file size details. the regular 1.0.2.0 is 231,923 bytes, while the am version is 231,882 bytes.
In any case, it’s easy to get a fresh copy of 1.0.2.0 am and replace the one on your router:
Upload new_cfe.bin (am version) & mtd-write to router through WinSCP
In Putty type:
chmod u+x mtd-write
In Putty type:
./mtd-write new_cfe.bin boot
power off and reset nvram.
One router had the correct file, the other had the non-am file.”
—
hope that helps
I have read in this guide:
Code for fixing MD5 partition so you can update to latest firmware:
cat /dev/mtd5 > /jffs/mtd5_backup.bin
mkdir /tmp/asus_jffs
mount -t jffs2 /dev/mtdblock5 /tmp/asus_jffs
rm -rf /tmp/asus_jffs/*
sync && umount /tmp/asus_jffs
rm -rf /jffs/.sys/RT-AC68U
nvram unset fw_check && nvram commit && reboot
———-
BUT in the:
“Directions for rolling back to AC68 after AC1900 rollback:”
There is 2 more lines of code:
ln -s /sbin/rc mtd-erase
./mtd-erase -d asus
——–
So:
cat /dev/mtd5 > /jffs/mtd5_backup.bin
mkdir /tmp/asus_jffs
mount -t jffs2 /dev/mtdblock5 /tmp/asus_jffs
rm -rf /tmp/asus_jffs/*
sync && umount /tmp/asus_jffs
ln -s /sbin/rc mtd-erase
./mtd-erase -d asus
rm -rf /jffs/.sys/RT-AC68U
nvram unset fw_check && nvram commit && reboot
——–
Why the 2 extra lines aren’t mentioned here in these directions above?
“Emil says
2018/06/10 at 10:24 AM”
The experience i had with the wrong CFE (non -AM), was that it never even detected the node. yours sounds like it found it, but then it just stops while trying to add it – i’ve not had that happen.
If you have not already tried doing this, try these: hardware reset (while powered on, hold reset button for 8 seconds – until flashing), or clear NVRAM (power off, hold wps while power on, keep holding for 20 seconds until flashing),
Also, when I added the node, I only had a computer plugged into the LAN port, and nothing in the WAN port – if you had something plugged in, try that out.
Also, I’m on the latest firmware on both devices.
I have a similar situation to Emil, I have changed two TM-AC1900 to RT-68U. I have also done the MD5 partition fix to upgrade to the latest firmware. I have tried 20308, 20648, and 21045 firmware versions and they all get to the same point and not connect to the node. When I try to sync the node to the main router it goes from 0%-50% slowly and then from 50%-100% it goes really quickly and then I get an error message telling me to check 5 things and try again. 1. wait a minute and try again because someone else is trying to install an AImesh network (tried syncing them half a dozen times) 2. Move the routers within 3meters (they are 6 inches apart) 3. check my AImesh node power is on (it is definately on) 4. Make sure your AImesh node has the latest firmware (mentioned above I tried different firmwares), 5. My AImesh node is reset to default. I go into my router that is going to be the node and under the administration tab, I change that router to be an AImesh node and then reset it to defaults before going back to the main router to search for the node. I have tried making each router the main and node at different times. I’ve reset the routers and cleared the NVRAM several times. One thing I can’t do is get my routers back to a TM-AC1900. I can’t figure out how to start back at scratch. Any help would be greatly appreciated.
By the way both routers work well individually, but I am not able to setup an AImesh network together with them.
Adam
Adam,
What is also interesting is that I cannot connect any other router to that “Main” router as a Media Bridge or a Repeater. I suspect that there is some setting on the RT-AC68U that I have to change, and things would work okay. All devices connecting to that “Main” router connect fine.
Regards,
Emil
The only thing I can think of trying is to re-upload the original cfe and download 1.0.2.0 am version for both routers and flash just the cfe files (as it sounds like you’ve re-flashed the actual firmware many times). For me, just re-flashing the cfe fixed it, and the cfe was only wrong on one of the routers. I did not need to re-flash the firmware. if you haven’t tried a new cfe, it doesn’t take that long to at least rule this out as an issue.
When my cfe was wrong though, it wouldn’t even detect as node, when i tried either as the main and the other as a node. So with only 2 devices, it just takes one to not work right.
BTW, my main is set in AP mode, not router mode, but I don’t think that would make a difference., but mentioning this just in case.
I bought two of these and switched them over to 68p running merlin 384.5. I used the 1.0.2.5 cfe (latest) but hear i’m better off with 1.0.2.0. Can I just rewrite the 1.0.2.0 cfe files like I did before? The asus firmware now reads the bootloader is 1.0.2.9.
Seems like it might mess things up , going to an older bootloader and no firmware updates to apply after.
Thanks for any help.
Did you flash 68p firmware? If you used the regular 68u firmware, it seems like you can just do that. I just wrote the 1.0.2.0 am cfe over the non am version without flashing the firmware before. No idea if the 1.0.2.5 CFE version does anything else though.
Step 15 question: Since I’m planning on using Asus Merlin firmware and it’s currently not compatible with AiMesh, should I choose 1.0.2.0 US or 1.0.2.0 US AiMesh?
I’ll have to check out the specific file I got from merlin. I’m pretty sure there was no distinction between u and p. So, you had the latest firmware and reflashed the cfe without issue?
Yes, but from 1.0.2.0 to 1.0.2.0 am, not from 1.0.2.5.
I used the cfe 1.0.2.0 US AiMesh generated by https://cfeditor.pipeline.sh/ (from step 15 above) and could not get AiMesh to work. Then I used cfe by goggles99 from http://archive.is/ongLu (post#73) and his direction and now AiMesh is working.
Sorry if I’m hijacking here, why not flash 1.0.2.0 am from 1.0.2.5? Because that’s exactly what I want to do
Hello alex, I have version 3.0.0.4.376_2827 and I can not put it in re-acquisition mode, when I do the 10 sec procedure, the power light keeps blinking but I do not add the mini web.
Merlin says to use AC68U for AC1900 and AC68p. So, They’re all the same firmware.
Try this, it worked for me when regular wouldn’t.
Kinda tough to do, but if you hold your tongue the right way, it should work for you.
1) Power off the router
2) Hold down the Reset, WPS, and Wifi On/Off buttons
3) Power on the router and wait till the power LED on the front starts blinking rapidly
4) Release the WPS and Wifi On/Off buttons but continue holding the Reset button down. For most, the power LED will begin blinking slowly. For the unfortunate few, it will still be solid.
(Mine did not blink slowly, but this method worked every time on two routers)
I always have a terminal window open and run the command “ping -t 192.168.29.1”
That will keep the ping running and you will be able to see when the router starts communicating.
Have a browser open with 192.168.29.1 ready to go and hit enter or refresh as soon as you see the ping come back =100ms.
This website isn’t working correctly, when you reply. So it is best to copy and paste what you are replying to.
For example I am going to reply to David Moxon’s post below:
—-
“david moxon says
2018/06/12 at 6:15 PM
Kinda tough to do, but if you hold your tongue the right way, it should work for you.
1) Power off the router
2) Hold down the Reset, WPS, and Wifi On/Off buttons
3) Power on the router and wait till the power LED on the front starts blinking rapidly
4) Release the WPS and Wifi On/Off buttons but continue holding the Reset button down. For most, the power LED will begin blinking slowly. For the unfortunate few, it will still be solid.
(Mine did not blink slowly, but this method worked every time on two routers)
I always have a terminal window open and run the command “ping -t 192.168.29.1”
That will keep the ping running and you will be able to see when the router starts communicating.
Have a browser open with 192.168.29.1 ready to go and hit enter or refresh as soon as you see the ping come back =100ms”
——–
By ‘terminal’, David Moxon is using MAC.. in windows use CMD (run as admin) “and run the command: ping 192.168.29.1 -t
Hit Ct;r+C to stop.
—-
I have followed an old school guide on YouTube where you ‘fix’ your CFE by manually and in that tutorial it was mentioned to pull the power cord out of the router, even right click disable and enable LAN…
So, if this pages guide doesn’t work:
Place router into Recovery/Restore mode
Hold reset button 10 seconds
Power off router (keep holding reset) UNPLUG IT AND PLUG BACK IN.
Wait 10 seconds, keep holding reset
Power on router holding reset for 10 more seconds
Go to 192.168.29.1 in a web browser
If Mini-CFE won’t load :
-Open Chrome and clear history ( 3 dots next to search bar in chrome, more tools- clear browsing data.
-Type 192.168.29.1 in the Chrome browser, highlight it and copy it. press enter so Chrome remembers the 192.168.29.1 address. ( you copied it just in case ) Keep Chrome open.
Unplug the router,
I taped a small zip tie upside down to fit in the reset hole of the router, it is easier to press that zip tie and hold it instead of finding a pen to push into the reset hole.
You will need to hold down the Reset, WPS, and Wifi On/Off buttons basically with one hand.
Not that hard to do when you have something taped in the hole of that reset button.
At the same time, you will need to use your other hand to click refresh on Google Chrome.
This is how it is going to go..
When you hold down the Reset, WPS, and Wifi On/Off buttons, you will plug back in the router and press the power on the router and wait till the power LED on the front starts blinking rapidly.. This is when you get ready to hit refresh, or paste 192.168.29.1 back into Chrome to get Chrome to start to search for 192.168.29.1. During the time Chrome is searching for 192.168.29.1, you release the WPS and Wifi but keep holding reset.
So, blinking light, refresh Chrome 192.168.29.1 get it searching for 192.168.29.1, let go the two WPS and WiFi buttons… keep your eye on that Chrome and get ready to hit refresh, or paste and search.
you want Chrome to search and attemp to connect to 192.168.29.1 when you have released the two buttons. The Mini-CFE should open.
The tricky part for me was timing, do this once so you know where your file is when you search in the MINI-CFE.. you want to be SUPER FAST finding that unzipped file and hitting upload.. Once you hit upload, wait 5 seconds, then release Reset.
This used to be easy as this website says.. but recently after asus restored back to tmo, the router is stubbern.
Same with clear nvram in putty, it just didn’t take until I unplugged the router and held WPS while I plugged back in and powered up. For some reason the router is just harder to reset nvram and get into a recovery.
IF you want you can use ping to know when it responds.. but honestly you don’t need to as long as you know when Chrome will want a refresh of the page 192.168.29.1 when the 2 buttons are let go.
Chrome will time out and need a refresh. You have to time it just right and be fast on finding the file and hitting upload. That is the trick.
————————
For those that messed up your CFE and are asking ‘ should I do it again ? ‘.
YES. duh!
:)
And do it right this time.
Quote:
For those that messed up your CFE and are asking ‘ should I do it again ? ‘.
YES. duh!
?
And do it right this time.
Just to confirm, it’s alright to flash the 1.0.2.0 over the latest merlin with a current cfe of 1.0.2.9.
Thanks
Hi Adam!
I figured out what is wrong in my setup. Even though the steps are really straight forward, they never made it “idiot proof”. :-) I was doing two TM-AC1900’s, and looks like in the rush the files got crossed. Now both have the same Mac address, and I believe that this is causing the issue of starting to connect, and then dropping. Now to figure out how to change the mac address.
Regards,
Emil
Hi Everyone!
I accidentally have 2 routers with the same mac address. Is there a way to correct this?
Thanks,
Emil
I did the same thing. Download a hex editor to edit the cfe.bin file. Scroll through carefully and you will find the area where the Mac addresses are located, there are 3 locations. You can then manually change them back to the ones on the back of your router. It’s a PIA but it works.
@Emil.
If you have the original CFE for that router, just follow the steps of creating the appropriate new CFE and follow the steps to upload and flash the CFE. If you don’t you can get the first MAC address from the back of the router and find the steps to manually edit the MAC addresses and the secret code within a CFE.
IIRC, the second MAC is the same as the first and the third you will need to look at an existing CFE and see how it was incremented as I don’t recall. Just add the same amount to your MAC address on the router to get the third.
Apparently you can also change the MAC address via telnet – someone else would need to chime in with the commands.
hello I have already flashed the router to version 3.0.0.4.376_3626 but it does not let me update to the most current version of asus, I get the following error:
Firmware upgrade unsuccessfully. It may result from incorrect image or error transmission. Please check the firmware version and try again.
just like when you buy the router
I did the conversion sometime in March to use as an AI Mesh. I was never able to get my other Asus router to recognize it as a node so I gave up.
Currently the router identifies as AC-68U when I log into it and it starts the setup wizard. From what I understand, I can use the MD5 hack to update the router with no fear of a rollback if I update to the latest firmware. Is this correct?
My only issue is I can’t seem to ssh into the router to execute the commands. It always says network unreachable. Do I need to set it up as a regular router first and then ssh into it?
Thank you.
You need to enable ssh in settings before you can ssh into the router.
You can bypass the initial setup by typing the router IP as 192.168.1.1/index.asp then go to administration then system and enable ssh and telnet.
Thank you very much for your timely post!!!
I was able to log in and execute the MD5 hack commands. So I am good to go? I can update without fear and everything should work?
Thanks again!
I updated and meshed my network! I can’t thank you guys enough!
Emil,
You were exactly right, I had the same MAC address for both routers. @JasonH and @DeverGuy you both are correct in that I needed to find the correct original_cfe.bin and load that back into the CFEditor website mentioned in the instructions. I know where I went wrong, i didn’t refresh the CFEditor webpage after I created my first new_cfe.bin file. So I had to re-upload the correct cfe to the editor, then loaded the CFE to the correct router, then NVRAM reset, then I was able to finally get my Aimesh node connected. I also upgraded to firmware 384_21045 after fixing the MD5 partition. So I can say that the new firmware update did not revert back to TM-AC1900. If anyone else is having any trouble, this link I found helped explain to me what I did wrong; http://mutt.com/aimesh-on-a-t-mobile-ac-1900
Thanks to all for the help and comments. I spent like 20hours over multiple days trying to figure this out and I FINALLY have my Aimesh network setup.
Adam
Can anyone help, I’m stuck trying to upgrade the firmware to the latest one from Asus on June 2nd, but keep getting an error message.
Attached are a few pictures of the errors I see when I try to update the firmware through the router’s GUI –> Administration –> Firmware Upgrade
I get another different error when I try to update the firmware manually by uploading it to the Asus router admin webpage GUI… argh
http://i.dam-img.rfdcontent.com/cms/004/393/563/120x120_smart_fit.jpg
http://m.dam-img.rfdcontent.com/cms/004/393/564/120x120_smart_fit.jpg
http://s.dam-img.rfdcontent.com/cms/004/393/565/120x120_smart_fit.jpg
———————————————————————————————————————————————
Wondering if I messed up at Step #16 and afterwards since my FW version on the Asus router admin page IS NOT at 3.0.0.4.376_3626
Upload new_cfe.bin & mtd-write & FW_RT_AC68U_30043763626.trx to router through WinSCP
In Putty type:
chmod u+x mtd-write
In Putty type:
./mtd-write new_cfe.bin boot
In Putty type:
mtd-write2 FW_RT_AC68U_30043763626.trx linux
Perform NVRAM Reset, wait for reboot <5 mins
a. Power off router
b. Wait 10 seconds
c. Press and hold WPS button
d. Power up the router and continue to hold WPS button for 15-20 seconds
Reset PC IP back to default
Log in to router using 192.168.1.1 and the router is now an AC68U with 64MB jffs
Are those screenshots for ants? They’re tiny!
Just run through the guide again, you likely made a mistake somewhere, like uploading the firmware through the router admin page instead of doing it in putty like the guide directs.
@JK – you probably worked this out, but I ran into an issue of my own regarding step 16. Make sure that you wait for that final confirmation in Putty before you perform the NVRAM reset to finish the process. It takes 15-30 seconds. If you just type in that last line, hit enter and perform the reset immediately (without the confirmation)…it might be causing an issue.
AiMesh not connecting/paring on a converted TM-1900AC? SOLVED!
I had a problem with AiMesh on two converted routers not connecting when trying to add a node and have finally solved the issue. Turns out it was a similar issue that others have had where they inadvertently used the same new CFE when they flashed their routers.
I introduced this issue when I did the MTD fix and reflashed my CFEs. I had double checked that I had used the correct new CFE files when I first converted the routers but didn’t when I reflashed recently. Oddly enough, I reflashed “just in case” I didn’t have the AiMesh CFE.
So, if you have converted TM-1900ACs that will find each other when you are searching for a router to add as an AI Node but it fails to connect, double check to see if you have duplicated the Mac addresses on your routers. After a quick reflash of my router with the duplicate CFE, I was able to connect after fixing the issue.
Now to see how AiMesh works in my environment. Thanks to all for the support.
how to execute MD5 commands to enter these commands to the router??
Code for fixing MD5 partition so you can update to latest firmware:
cat /dev/mtd5 > /jffs/mtd5_backup.bin
mkdir /tmp/asus_jffs
mount -t jffs2 /dev/mtdblock5 /tmp/asus_jffs
rm -rf /tmp/asus_jffs/*
sync && umount /tmp/asus_jffs
rm -rf /jffs/.sys/RT-AC68U
nvram unset fw_check && nvram commit && reboot
Write it in Putty.
So, having no idea that they snuck in their little reflash back to TM-AC1900, I updated yesterday, and it bumped me back to TM-AC1900, and CFE 2.1.2.7 or something like that I believe. i’d check again, but sometime overnight it updated itself AGAIN to Firmware 3.0.0.4.376_3199, which has completely removed SSH and Telnet.
I tried (last night, when I still had the SSH and Telnet options) to go through the No CFE USB method, but couldn’t even get it to return the “helo world” from the string “validForm = function(){document.form.SystemCmd.value = “ping\necho hello world”;return true;}”, so I’m either doing something wrong, or this is outdated.
Looking further through the instructions, it looks like I’m just out of luck. Can someone corroborate or refute that?
see Directions for rolling back to AC68 after AC1900 rollback
WOW, after reading this I just realized where I screwed up and why my routers didn’t want to connect successfully. I downloaded a hex editor and found the original cfe file. But how exactly do I go about flashing it again. I tried doing it through ssh w/ putty like in the guide. but it says mtd-write: not found. I previously did the commands below so I see why. But is there another way to flash the new cfe or to change the mac address of the router?
ln -s /sbin/rc mtd-erase
./mtd-erase -d asus
rm -rf /jffs/.sys/RT-AC68U
You didn’t upload mtd-write as the guide instructs, so it is not found. Follow the instructions to the letter.
@Denver Guy @JasonH @Adam @Emil another idiot here that did the exact same thing, except I think I might be in a greater pickle. I have the appropriate cfe file now, BUT I can’t execute it because mtd-write: cannot be found. Did any of you guys also execute the code below? (I executed the code in order to not get reverted again). If so how did you go about changing flashing the new cfe with the fixed MAC address?
ln -s /sbin/rc mtd-erase
./mtd-erase -d asus
Sorry for the delay, I fixed mine back before the entire ASUS rollback so I ran the script after I corrected the Mac issue. Not sure if there is a work around for the issue you have.
Hey guys, I upgraded both my routers from the Asus app, to 3.0.0.4.384_21045, and I for some reason remembered I did the MD5 fix when I first converted my routers. I did the upgrade and my AiMesh stopped working. Now I am starting to think that I may have not done the fix, as the AiMesh option is no longer there. It still shows at the top of the router page that the model is RT-AC68U, however no AiMesh can be found.
What is the next step I should take, before making things worse please?
Thank you!
Are you running the latest asus or merlin firmware? Older versions don’t have ai-mesh.
Hey Alex, I was running the newer Asus firmware had Aimesh set-up and everything was running. Now after I upgraded to the latest firmware (21045), now I no longer have the AiMesh option.
Thanks,
Son of a…I’m an idiot. I couldn’t get that string to return anything because I wasn’t using the “Console” at the bottom of Chrome, I was clicking on the one at the top next to “Elements”. I guess this is what I get when trying to read something technical when I’m far too tired.
Thank you for giving me the “You’re an idiot, go read the instructions” answer, because it got me to go back and look at why either I was wrong or you were. Spoiler alert: It as me.
Hi Guys,
Just received my TMO AC1900 router yesterday. It is loaded with 3181 firmware. 10/10/10 method does not work but I managed to get to the mini-CFE browser by holding all 3 buttons while powering up and leaving only reset pushed…
Thing is – when I load the 1703 firmware .trx file in order to downgrade, after a few seconds page changes to 192.168.29.1/f2.htm and seems to be broken reporting taken too long to connect (or something like that). Router continues answering pings with 100 ttl and over 5 minutes nothing seems to be happening. when I manually power down and up again – it is back to 3181 as if nothing happened.
Any idea?
BTW – I saw a way to enable telnetd on those TMO routers that seems to be suppressed or hidden – how do I do it exactly? I can see the code in Chrome but not sure what to do exactly and in what row in the code…
Tx!
I would recreate the 1.0.2.0 am from your original and overwrite it again, nvram reset. Although at 21045, i had the AImesh options, it wouldn’t connect (because i had used the 1.0.2.0 (non-am version) by mistake. Also make sure you don’t get errors when you run the steps below, in case it actually did not overwrite anything.
Copy original_cfe.bin to a local drive
Upload original_cfe.bin to https://cfeditor.pipeline.sh/ > Select 1.0.2.0 US AiMesh for AC68U (i actually used the all version) with AiMesh as Source CFE > Download the new .bin > rename it to new_cfe.bin
Upload new_cfe.bin & mtd-write to router through WinSCP
In Putty type:
chmod u+x mtd-write
In Putty type:
./mtd-write new_cfe.bin boot
Perform NVRAM Reset, wait for reboot <5 mins
a. Power off router
b. Wait 10 seconds
c. Press and hold WPS button
d. Power up the router and continue to hold WPS button for 15-20 seconds
about reply was for this msg:
Ivanv says
2018/06/17 at 8:01 PM
Hey Alex, I was running the newer Asus firmware had Aimesh set-up and everything was running. Now after I upgraded to the latest firmware (21045), now I no longer have the AiMesh option.
Thanks,
@Andy,
You need to also upload mtd-write. Just follow the instructions to upload mtd-write along with your updated CFE.
Thanks ghentj!
I am however running into a problem.
I created new CFE files, but no matter what I do, I am unable to access the router trough WinSCP nor Putty. I enabled the SSH trough GUI, I even enabled the Telnet after reading some comments, and using 192.168.29.1 I am just not reaching anything.
What I did:
1. Multiple NVRAM reset – did not work
2. Enabling Telnet – did not work
3. I was able to reach trough WinSCP using 192.168.1.1, however I was not able to find the /dev/mtd0 that I can upload the CFE file to it.
4. I tried doing this with and without step 4, setting the static IP. Only when its on automatic am I able to reach the router trough 192.168.1.1.
Am I missing something? Is there another step I should take?
Thanks!
cfe is flashed through putty not through winscp. Please follow the instruction instead of making your own.
OK, I think this was a stupid mistake. I can enter trough WinSCP and Putty using 192.168.1.1, which I guess it the gateway of the router now.
The problem I have now, is that I am not able to copy the files into the Root folder, but I was able to copy them into the dev folder. However, now when I run ‘chmod u+x mtd-write’ in Putty, it says that the file does not exist. Tried doing CD /dev to see if I can enter the dev folder and do this command there, however it was not letting me do that (CD: not found).
So now I need to figure out where to copy the files to onto the router, and than how to run the chmod u+x mtd-write and ./mtd-write new_cfe.bin boot commands.
I am probably missing something stupid, but we be grateful for some help :)
Thanks!
Alright! I got it! :)
So here is the steps I have missed. If you are doing this form a router which is already running RT-AC68U, u should use 192.168.1.1. Therefore, there is also no need to set up static IP in your network card.
With that said, if you have the same issue as me that I upgraded the firmware and lost AiMesh, you will unfortunately need to go almost all the way back, steps 9 – 20. I had the original_cfe backed up. Also, inside the original_cfe I was able to see the MAC, and that way know which file is for which router.
Copy the new_cfe.bin & mtd-write & FW_RT_AC68U_30043763626.trx to tmp/home/root# on the router.
Following that, run steps 17 – 20.
BEFORE connecting your router back to the internet, make sure you fun ‘Code for fixing MD5 partition so you can update to latest firmware’.
Once you fix the MD5, connect the router to the internet and upgrade to the latest firmware. And Voila! Your AiMesh should be back as mine did.
NOTE: you will only see the AiMesh option after you upgrade to the latest firmware, but make sure you fix the MD5 first.
Thanks again for everyone help, and Good luck to the ones doing this!
hello I have already flashed the router to version 3.0.0.4.376_3626 but it does not let me update to the most current version of asus, I get the following error:
Firmware upgrade unsuccessfully. It may result from incorrect image or error transmission. Please check the firmware version and try again.
just like when you buy the router
Hi!! I have already flashed the router to version 3.0.0.4.376_3626 but it does not let me update to the most current version of asus, I get the following error:
Firmware upgrade unsuccessfully. It may result from incorrect image or error transmission. Please check the firmware version and try again.
and has the CFE version 2.1.2.2
Why is CFE 2.1.2.2 ? Why is it not 1.0.2.0 or 1.0.2.5 like the guide instructs? Does the router say AC68u in login page?
“Howar says
2018/06/15 at 3:54 PM
how to execute MD5 commands to enter these commands to the router??
Code for fixing MD5 partition so you can update to latest firmware:
cat /dev/mtd5 > /jffs/mtd5_backup.bin
mkdir /tmp/asus_jffs
mount -t jffs2 /dev/mtdblock5 /tmp/asus_jffs
rm -rf /tmp/asus_jffs/*
sync && umount /tmp/asus_jffs
rm -rf /jffs/.sys/RT-AC68U
nvram unset fw_check && nvram commit && reboot”
———————-
“Alex says
2018/06/17 at 5:55 PM
Write it in Putty.”
——-
sigh,
Howar, you have to enable SSH in the router UI… Then after router has SSH enabled and you hit apply, open Putty. in Putty type 192.168.1.1 make sure the default SSH option in putty is checked.
In Putty, log into the router (use the same router log in information )
–
login as: admin
[email protected].1.1’s password: THIS WILL BE INVISIBLE WHEN YOU TYPE IT
You will see this
admin@RT-AC68U:/tmp/home/root#
. When putty is open, after you logged into the router using putty, you copy each line one at a time and enter it ..
like this:
admin@RT-AC68U:/tmp/home/root# cat /dev/mtd5 > /jffs/mtd5_backup.bin
ENTER
admin@RT-AC68U:/tmp/home/root# mkdir /tmp/asus_jffs
ENTER
and so on. be patient, wait a few seconds in between commands.
“G says
2018/06/15 at 8:04 PM
So, having no idea that they snuck in their little reflash back to TM-AC1900, I updated yesterday, and it bumped me back to TM-AC1900, and CFE 2.1.2.7 or something like that I believe. i’d check again, but sometime overnight it updated itself AGAIN to Firmware 3.0.0.4.376_3199, which has completely removed SSH and Telnet.
I tried (last night, when I still had the SSH and Telnet options) to go through the No CFE USB method, but couldn’t even get it to return the “helo world” from the string “validForm = function(){document.form.SystemCmd.value = “ping\necho hello world”;return true;}”, so I’m either doing something wrong, or this is outdated.
Looking further through the instructions, it looks like I’m just out of luck. Can someone corroborate or refute that?”
———–
–
“Alex says
2018/06/17 at 5:55 PM
see Directions for rolling back to AC68 after AC1900 rollback”
—
Alex,
the “helo world” IS from those instructions.
–
G says,
Your information is very bleak. ( I don’t want to troubleshoot. ) it is easier to start again.
BUT! Where you connected to the internet with the router when you tried the no CFE USB installation?
Must read directions perfectly.
First, I had no luck on the No CFE USB instructions. Luckly I had my origional_cfe.bin.
You can make one yourself. You can still make your origional_cfe.bin.
The only way I know that WORKS is the old school method. You need a usb, and you need to flash the router back to asus firmware so you can enable telnet and ssh.
I have a guide on how to do this.. its long but it works. https://pastebin.com/embed_iframe/sZgn1d10
This will get the cfe.bin from your router now, and you can use https://cfeditor.pipeline.sh/ to make it new… My instruction is idiot proof, very intuitive.. sorry if it rambles. It worked for me. It is old method combined with new method and erase tmo crap in the end.
“Ivanv says
2018/06/16 at 8:45 PM
Hey guys, I upgraded both my routers from the Asus app, to 3.0.0.4.384_21045”
————
–
“Alex says
2018/06/17 at 5:56 PM
Are you running the latest asus or merlin firmware? Older versions don’t have ai-mesh.”
—
.
Alex, Ivanv already answered your question in his question; Do you have any other advice to give him?
“Howar says
2018/06/19 at 1:46 PM
Hi!! I have already flashed the router to version 3.0.0.4.376_3626 but it does not let me update to the most current version of asus, I get the following error:
Firmware upgrade unsuccessfully. It may result from incorrect image or error transmission. Please check the firmware version and try again.
and has the CFE version 2.1.2.2”
———————
First thing,
YES you did right by changing the FIRMWARE to 3626. Great, that allows you to enable telnet and ssh for next steps.
Asus firmware upgrade wont upgrade by default when the router is tmobile… “CFE version 2.1.2.2”
it still says TM-1900 in the router webpage right?
Follow directions.. be patient.
IF you have unzipped mtd-write and did that part CORRECTLY.. uploading your ‘new_cfe.bin’ and followed through, Rebooting .. and erasing nvram like the instructions say.. your router UI page should say RT-AC68U and it would be 1.0.2.0 or 1.0.2.5… not 2.1.2.2.
Pull the power cord out, hold WPS plug back in wait for power light to flash. let go and let router start up.. this clears nvram.. nvram clear must be done to finalize the change from 2.1.2.2 to 1.0.2.0 etc.
If it didn’t take, if it still says TM1900… then the process to upload that CFE failed .. you messed up. OR Tmo blocked it in the recent revert sneaky move.
When my router did an upgrade and reverted back to t’mo.. I had your exact issue. I was able to go back to asus firmware but it still said tm1900.
https://pastebin.com/embed_iframe/sZgn1d10 I made this guide.
if you can’t follow steps, or read ahead first and be patient.. don’t use my guide.
By now, everyone… all your questions should be answered in the comments above. My advice is pay attention to files, if they are .rar files.. unzip them. (sometimes there are .rar files zipped in .rar folders so you have to unzip ALL .rar files you are going to use) Don’t make any mistakes and read twice maybe 3 times all directions so you know WHY before going into it :). Make sure you rename to what it says in the examples. if it is ‘new_cfe.bin’.. and you highlight to change the name on your ‘origional_cfe.bin’… you will notice you can only highlight ‘origional_cfe’ and not .bin so you will end up renaming it to ‘new_cfe.bin.bin’ ( which is wrong and will cause the name change from TM1900 to RT-AC68U to fail. Highlight the entire word.
:)
The guide is in parts, drop down the firmware to unlock hidden features like ‘telnet’ and ‘ssh’… do some commands… grab your router internal files.. convert those files for new updated versions of them.. re install those files.. clear memory.. pretty much that is it. The tools, files, instructions, and in the comments are troubleshooting. Everything is above.
Advice, AFTER all is done…. in the future, never be connected to wifi with the router when doing a firmware upgrade. I always download the new firmware file onto my desktop. UNZIP that new firmware on the desktop.
Unplug Ethernet on the router, and chose to search for file in the firmware upgrade section of the router ui. and chose the unzipped firmware file when searching.
Point is, I NEVER want my Router UI page open when I am connected to the internet.. I did not like doing so when I followed the directions on “Directions for rolling back to AC68 after AC1900 rollback:”
Pay attention .
In regards to changing names.. I mentioned above to as an EXAMPLE of changing ‘origional_cfe.bin’ to ‘new_cfe.bin’.
That was not 100% accurate, you have to change your origional_cfe.bin to the latest version THEN name that to new_cfe.bin as seen in
Instructions #15 it stats https://cfeditor.pipeline.sh/ to use the link to upload your origional_cfe.bin to make a ‘new_cfe.bin’
I uploaded the origional_cfe.bin and chose 1.0.2.0 US AiMesh and it gave me ‘ new_1.0.2.0_am.bin ‘
I copied the words;
new_cfe.bin
Highlighted ALL the name new_1.0.2.0_am.bin and changed it to new_cfe.bin.
The point is, pay attention with changing names.
Hi Guys.
Tx for the info. and support.
It is my turn to give back…
Don’t recall exactly where I saw this but for those who encounter the same issue as I did – here is what worked for me:
Tried to flash a TMO AC1900
Reached the Mini CFE browser (10-10-10 did not work but holding reset+WPS+WiFi on/off buttons until Asus led flashes and then releasing WPS+WiFi on/off continuing to press reset – worked)
Uploaded the 1703 trx file to downgrade and get Telnet option
Browser seems busy for 10-20 sec and then reverts to a page with http://192.168.29.1/f2.htm saying the connection timed out or page could not be reached
Tried that with various button holding patterns (keep reset pushed for the entire duration of upload, release after Asus led blinking etc.)
Nothing helped – Same behavior.
I noticed though that the Mini CFE page layout is not appearing right – there was no text box for the uploaded file name and the Upload button was closer to the Browse button..
All the above was from Chrome
when I tried IE the Mini CFE layout was correct and the file upload and flashing was successful as described here and in the Youtube video.
Hope this helps someone
Cheers
Thank you, this worked!
I have upgraded to the latest firmware 3.0.0.4.384_21045-gb451ba1 but have trouble executing the MD5 partition commands in putty. On the cat command, I get a directory doesn’t exit and on tne mount command, I get a “device not found.” I don’t care about Aimesh. Can someone please help?
What are the odds my router will be set back to AC1900 at this time?
You can choose a different path to back up mtd5. Or you can ignore that error and move onwards without the backup.
So, I’m looking at the instructions to erase mtd, and notice that it mentions to update to Asus 20308. Does it need to be this specific firmware? Asus appears to have pulled it from their site. Can I use the “FW_RT_AC68U_30043763626.trx” that I’ll already be on having done the flashing from tm1900 to 68u?
Follow the guide. Firmware is included in step 3 download link. mtd instructions make no reference to any firmware version.
you rock. the last part of your how to fixed all my issues.
It does in the Google Doc link.
” Do a manual firmware upgrade to the Merlin AsusWRT firmware (https://asuswrt.lostrealm.ca/ ) or Asus 20308 ( http://dlcdnet.asus.com/pub/ASUS/wireless/RT-AC68U/FW_RT_AC68U_300438420308.ZIP ). You can use the router’s web interface at 192.168.1.1 to do this without any issues.”
That said, I didn’t wait, and got it all done last night. I didn’t need the 20308 firmware, it worked just fine on the one included in step 3, as you said.
no, the router does not say AC68U says TM-AC1900, what are the steps to install version 1.0.2.5?
It is literally in the guide, above. ctrl+f 1.0.2.5
“Howar says
2018/06/22 at 4:17 PM
no, the router does not say AC68U says TM-AC1900, what are the steps to install version 1.0.2.5?”
———
First thing is first,
It is my understanding the 1.0.2.5 is for 1ghz processor (BestBuy RT-AC68P “Hardware Revision 2.1” ) routers.
You might run into issues with the router being sloooow. (as others mentioned in these comments above )
You may experience no issues… /shrug.
These TM routers are usually 800 mhz. 1.0.2.0 US AiMesh.
If your Origional_cfe.bin is “Hardware Revision 170″, using the 1.0.2.5 will change it to 2.1. This might cause issues if it is NOT 1 ghz processor?
That is what I believe is the cause of peoples slow issues when using the 1.0.2.5.
To change the tag of the router to say RT-AC68U, the process when you load ” mtd-write ” and ” new_cfe.bin ” is what changes it.
So, you have to follow directions carefully, step by step. When you use that
https://cfeditor.pipeline.sh/ to upload (chose your ” origional_cfe.bin ” file, and change it to 1.0.2.0 (or as you wish, the 1.0.2.5 ). Then you rename that file from ” new_1.0.2.0_am.bin ” to ” new_cfe.bin ”
( or if you chose 1.0.2.5 ” new_1.0.2.5.bin ” to ” new_cfe.bin ” )
Then you use that new_cfe.bin and that mtd-write with the instructions.
* Remember, unzip the mtd-write when you downloaded it.. because it is zipped!
*Remember, change the ” .bin ” in … ” new_1.0.2.0_am.bin ” (making sure the .bin is highlighted ) If you don’t change the end .bin you will end up with a file called new_cfe.bin.bin.
So a zipped file will break this step, an incorrect changed file name will break the step, a 1ghz file of 1.0.2.5 MIGHT also break this step.
This step changes the name TM-AC1900 to RT-AC68U. Any issue, and you don’t get it changed. The router will simply ignore all that step of the mtd-write.
Step 15 – 20.
./mtd-write new_cfe.bin boot
so, mtd-write has to be unzipped, and it is saying to write ‘ new_cfe.bin ‘ not any other name of file.
Google doc contains instructions for rollback after being force downgraded to ac1900. Directions for erasing md5 to prevent said rollback and just need to be copy and pasted.
“Alex says
2018/06/22 at 8:19 PM
Google doc contains instructions for rollback after being force downgraded to ac1900. Directions for erasing md5 to prevent said rollback and just need to be copy and pasted”
————
Copy the first line,
ENTER
Copy the second line,
ENTER
etc.
one line at a time
“Alex says
2018/06/22 at 8:19 PM
Google doc contains instructions for rollback after being force downgraded to ac1900. Directions for erasing md5 to prevent said rollback and just need to be copy and pasted”
————
Copy the first line,
ENTER
Copy the second line,
ENTER
etc.
one line at a time
Sigh.
This website really needs to be fixed. The delay on posting a simple reply caused me to hit sign-in again (after waiting 20 seconds). It gave me an error saying I can not do a duplicate post, I hit X and closed that error, then it posted twice anyway.
The lag, the fact replies don’t overlay on the person you reply to.. (Ironically, not the second to last post) makes it so hard for the user to stay on track.
Did that recently get fixed? I don’t recall ANY of my posts every overlay on a person I hit ‘ reply ‘ to?
This is a great guide…great comments.. but messy mechanics of the site makes it extra hard to follow or comment.
Is there anyone else having issues here??
I enabled “Jetpack Comments” some time ago and that seems to have been the thing that caused replies to stop being threaded. It is disabled now. Initially I thought it was the caching plugin’s doing and was troubleshooting the wrong thing.
No idea if this ‘reply’ will over lay on the comment, so I will quote.
“TG says
2018/06/19 at 10:50 PM
Hi Guys.
Tx for the info. and support.
It is my turn to give back…
Don’t recall exactly where I saw this but for those who encounter the same issue as I did – here is what worked for me:
Tried to flash a TMO AC1900
Reached the Mini CFE browser (10-10-10 did not work but holding reset+WPS+WiFi on/off buttons until Asus led flashes and then releasing WPS+WiFi on/off continuing to press reset – worked)
Uploaded the 1703 trx file to downgrade and get Telnet option
Browser seems busy for 10-20 sec and then reverts to a page with http://192.168.29.1/f2.htm saying the connection timed out or page could not be reached
Tried that with various button holding patterns (keep reset pushed for the entire duration of upload, release after Asus led blinking etc.)
Nothing helped – Same behavior.
I noticed though that the Mini CFE page layout is not appearing right – there was no text box for the uploaded file name and the Upload button was closer to the Browse button..
All the above was from Chrome
when I tried IE the Mini CFE layout was correct and the file upload and flashing was successful as described here and in the Youtube video.
Hope this helps someone
Cheers”
——————————————–
A couple of things here,
1) At this stage, a lot of us already have TM-1900 routers converted to RT-AC68U…. but now after firmware update, the router magically reverted back to TM-1900.. so we are commenting on that issue as well.
I think you are doing this for the first time… We will go with that assumption.
In this guide you are replying to, it says:
#6 Go to 192.168.29.1 in a web browser
If Mini-CFE won’t load use Asus Restore Utility
The “Asus Restore Utility” is found in the zipped folder you downloaded in the top of this guide (Steps #1 and #3 ). It is called “tmo2ac68u”.
Your comment about the Mini CFE looking different. The User Interface ( UI ) of the Mini CFE will act differently because your using Chrome vs IE.
Was Chrome up to date? Was IE up to date? Was history and data and cookies cleared in Chrome? was it in IE?
Was the router connected to the modem when doing these instructions to convert the TM-1900 to RT-AC68U? ( was it hooked up to internet)
I never have it connected to the internet… just PC to router.. Router to power..USB used when needed. Unless told to.
You have to read, download files you need.
So those things are issues for me when I read your way of doing it.
I have also read something about switching browsers, even going into private/incognito mode..
but these guides work. When told to do something, Do it. Don’t try ‘your idea’. Things will end up being a learning process for you.. and I ( and others ) will have to explain.
The Mini CFE usually won’t work on the TM. (at that beginning stage you are at ) In fact, It never worked for me unless I did special things to make it work.. like clear history, cookies, something like that.
This is why this guide said if it doesn’t work, use the Asus Restore Utility.
“connection timed out or page could not be reached”
In doing the upload of the 1703, it failed to 100% upload giving that error? or after it uploaded that error appeared?
The connection will drop because of the router installing a firmware and the router will reboot, “connection timed out or page could not be reached”.
:)
Waiting ( as instructed in other guides… 5 minutes ) is needed. The router has to write the files in, configure and reboot, then restart. It can take longer then 5 mins. If you were thinking nothing was happening and connection timed out.. this is just normal router behavior.
I am watching a video right now of a guy doing it as I type, it is about 8 minutes process to downgrade, reboot.
After all said and done, the router says RT-AC68U, you have restarted (unplugged the router and plugged it back in) while holding WPS in, until the power light flashes.. Clearing NVRAM.
You won’t get the Mini CFE to work. You will have to upload new firmware from inside your Router UI 192.168.1.1 and go to firmware in the UI and manually install it.
We experienced users don’t have the router automatically install the firmware because last time we did, it reverted back to TM-1900 and we are here asking why.
Best to download the firmware from asus on to your PC, and then unzip it. Unplug your router from the internet and manually search for that firmware in the router UI firmware upload tool. Install it that way manually.
Clear NVRAM – WPS restart – everytime you change firmware.
Thanks for pointing out the IE worked vs Chrome. But, I had to mention the above.
Does anyone know where the back up erasing md5 get stored? What is the name of that file/folder?
I saved all the contents from the USB drive, is it one of the following?
.minidlna
.___var
.___var.txt.6
.__admin_var
.__admin_var.txt.6
.__folder_list
.__folder_list.txt.9
Just curious,
Thanks.
The command cat /dev/mtd5 > /jffs/mtd5_backup.bin redirects the content of mdt5 in the file mtd5_backup.bin inside the folder jffs (located in the root directory /).
Noob here. I’ve got myself in trouble.
I bought 2 routers and set them up at the same time. I got to the end, but couldn’t ever get the routers to connect via aimesh. Then I happened to notice that both routers have the same mac address. I evidently skipped a step when downloading the cfe.bin file. I uploaded the same file to both routers.
I have downloaded a hex editor and tried editing the mac address, but whenever I upload the new file and reset the router, the old mac address is still there.
Can someone help me revert to the old mac address or somehow make up a new mac address?
I assume you repeated step 18 to flash the CFE with the correct MAC addresses (uploading the file to https://cfeditor.pipeline.sh/ allow you to verify MAC addresses and WPS PIN).
After that, did you perform nvram reset (step 20)?
In Putty you can type the command: nvram erase ; reboot
Yes, after using the hex editor to change the mac addresses, I repeated steps 16-20.
OK, after trying 100 times last night, I tried again this morning and it worked! Thanks.
I then had trouble getting the aimesh network set up, it kept saying it couldn’t connect. Swapped the routers (made the node the router and the router the node) and it worked perfectly.
Thanks so much to this site!!
I must say, resetting NVRAM under Recovery Mode should be the first thing anyone does. I originally had trouble downgrading to 1703. It took three attempts, with percentages going up every time; 51% the first time, 92% the second, finally taking it all on the third… Then I tried to log in with the defaults and got nothing – until I reset NVRAM. I imagine that was the problem all along. After that everything was a slam dunk. I now have a third Aimesh node running the latest firmware on a $48 router.
Thanks guys!
I unboxed one today with 3108 firmware. Set out to install DD-WRT on it, but the instructions in the how-to failed to bring it into rescue/restoration mode. Holding down the reset button during power-on would not enable TFTP access. Editing the HTML in the GUI also would not enable telnet access. What finally worked was 1) holding down three buttons- reset, WPS, and wifi on/off – all at the same time 2) powering on 3) waiting a few seconds for fast blinking lights 4) releasing the WPS and wifi buttons, but still holding down reset, 5) as soon as 192.168.29.1 started answered pings, quickly visiting http://192.168.29.1/ to open the mini CFE uploader, 6) submitting the 1703 firmware, and waiting for upload success message 7) finally releasing the reset button. The rest of the how-to worked just fine.
T-Mobile has made it harder to modify the router, but it’s still possible.
Plus one for continuing to hold reset button down until completion as JJ Wang says. Only hard by maintaining the reset hold but the upload is quick to completion
hi everybody.. i tried to do every single steps. but when i set IP to static.. i can’t connect to the internet ? so what should I do ? i can connect to my router via web browser but can’t connect to the router via win scp and putty
So I rolled through all of the steps until I got to clearing the md5 partition .. when I ran the following: sync && umount /tmp/asus_jffs .. I got an error in putty saying unmount not found or something along those lines (don’t recall the exact words). I still ran through the other commands afterwards. How can I confirm that my md5 partition is cleared?
Also – I upgraded to the latest merlin firmware from 6/1 and I don’t airmesh anywhere in the GUI. I haven’t connected the router to the internet yet so is that why?
Appreciate any insights!
I fell for this as it is umount vs unmount, the brain see unmount and so it will work, just drop the ‘n’
doh! thank you!! do you know if there is a way to confirm wiping of the md5?
any thoughts on the AiMesh piece?
@David, you can mount the mtdblock5 partition again to check.
mkdir /tmp/asus_jffs
mount -t jffs2 /dev/mtdblock5 /tmp/asus_jffs
Browse to folder /tmp/asus_jffs in WinSCP, or run this command in putty: ls /tmp/asus_jffs
Folder should be empty. If the delete wasn’t done properly, there’s a file inside.
When done, close WinSCP and unmount it: umount /tmp/asus_jffs
Regarding AiMesh and Merlin, it’s not supported afaik. You need to use the official Asus firmware for that. https://www.snbforums.com/threads/merlin-384-4_2-on-ac68r-no-radar-no-aimesh-menus.45955/#post-407116
Do I need to start from the beginning again to flash from AC68p to AC68U? My 5ghz is going slow under the most up to date Ac68p firmware and Merlin.
You just need to do the step that flashes the cfe and an nvram reset after.
I have a really weird problem with both of my TM1900. I have one real AC68U as router and the two TM1900 as node. If I flashed the TM1900 to 1.0.2.0 US AiMesh then the AC68U can’t find them as node no matter what I try. However, if I flash them as AC68P with 1.0.2.5 then the AC68U router would find them very quickly. Should I flash them both to AC68P, delete MTD5 then update to latest firmware?
Speed test result with hard wire http://www.speedtest.net/result/7431305091
Just to share my experience with the group. Hardest part was getting into recovery mode. Router wouldn’t show any sign (blinking lights) of entering recovery mode. After reading through all comments and some other sites, here’s what worked for me.
1) Open up a command window and ping the router continuously (ping 192.168.29.1 -t).
2) Have browser address bar set to 192.168.29.1, but don’t hit launch. (I used the Ultra Simple Web Browser, just to be safe.)
3) Start router while holding WPS, Wifi on/off and reset. After a couple seconds, you can release the WPS and wifi toggle, but keep holding the reset button. (Fortunately two buttons on side are easy to hold down both with one finger.)
4) Watch the ping; as soon as you see it connect with TTL=100 (non-rescue mode is TTL=64), connect on your browser. Asus CFE should come up.
5) Don’t waste any time, purportedly the rescue mode doesn’t last long any more (nice ASUS/T-Mobile!), so upload the downgrade firmware (TM-AC1900_3.0.0.4_376_1703-g0ffdbba.trx) and hit update (or flash, or whatever the buttons says, I can’t remember.)
6) Release the reset button, and wait. Web browser won’t look like anything is happening, but give it about 3 minutes, and you should get the success message.
7) Router will reboot, you’ll know it’s up when 3 lights on front right are on. At this point, even though I could see the router login, it wouldn’t let me log in. (Super frustrating!) Easy solution–clear the NVRAM (as in Step 20 above, holding WPS button while powering on,for 20 seconds.) Once it reboots, you should be able to log in.
8) Continue as above–remember the NVRAM, as I had to do it again after upgrading to Merlin, in order to log in.
9) Enjoy a $150 router for whatever pittance you paid for it!
This did it for me too! Couldn’t get CFE loader to appear until I tried your method.
Thanks!
Hi All,
First, thanks for being a great forum. I’ve already converted one router and it works great with the latest firmware.
Recently I bought a new Tmo AC1900 and I’ve encountered some issues. I was able to go through all the steps at the top with no issue. Lastly I wanted the latest firmware (384_21045) and did that via the manual upload, not over the internet. That seemed to complete without a hitch but now I can’t access 192.168.1.1. I’ve tried the NVRAM WPS reset. Do I need to start over? If so, what should I do differently? Anybody encounter this?
“Puneet Chhabra says
2018/06/30 at 12:30 PM
Hi All,
First, thanks for being a great forum. I’ve already converted one router and it works great with the latest firmware.
Recently I bought a new Tmo AC1900 and I’ve encountered some issues. I was able to go through all the steps at the top with no issue. Lastly I wanted the latest firmware (384_21045) and did that via the manual upload, not over the internet. That seemed to complete without a hitch but now I can’t access 192.168.1.1. I’ve tried the NVRAM WPS reset. Do I need to start over? If so, what should I do differently? Anybody encounter this?”
———————-
IF you can access 192.168.29.1 then your CFE change did not take.
Somewhere you made a mistake.
Basically there are 2 parts.
1) firmware
2) CFE (changing it from TM1900 to RT-AC68U in the Router Web Page. (User Interface)
You changed the firmware it seems.
Part 2 changes the 192.168.29.1 to 192.168.1.1.
There are a few things to be careful about. watch out for zip files you downloaded.. make sure they are unzipped before USING them when following instructions. (like mtd-write)
And the renaming of your converted ‘origional_cfe.bin’ USING https://cfeditor.pipeline.sh/ you changed the ‘origional_cfe.bin’ and it made a new file called “new_1.0.2.0_am.bin” ~or~ “new_1.0.2.5.bin” Right? You have to rename that new file to ‘ new_cfe.bin ‘
You have to highlight the entire name and name it.. when you highlight it, it does not highlight the .bin… it only highlights “new_1.0.2.0_am”
So when you rename it, it is ‘new_cfe.bin.bin” .. Make sure it is all highlighted so the name is ‘new_cfe.bin. If it is .bin.bin it won’t load.
What ever CFE you chose 1.0.2.0 or 1.0.2.5.. doesn’t matter, as long as the name of file the CFE Editor gave you is all changed to new_cfe.bin
Anything wrong with this CFE step WILL not take effect, and will simply be ignored.
Result will be 192.168.29.1 still and the tag won’t show RT-AC68U.
So 2 things can go wrong, you didn’t change the name correctly and you didn’t unzip files like, mtd-write .
* Make sure the mtd-write file is Size: 716 KB (733,422 bytes)
Do the CFE steps again, and follow directions. THEN you can continue.
All the files needed are in this guide Alex provided. (thank you Alex!)
Thanks for the help!
I was able to go from 192.168.29.1 to 192.168.1.1. I think the problem was when uploading new firmware at the very end after clearing the md5 partition. I was able to access 192.168.1.1 before. What can I do to start over? I’m trying to access the recovery mode at both IPs and I haven’t been successful yet.
did you set a static IP?
missing instruction to revert back are here.
https://docs.google.com/document/d/1NsZMONmJ70zMmoAKKQJXbTVKytaPJptWTpqih1TD5n8/edit#
“Medhat says
2018/06/30 at 8:54 PM
missing instruction to revert back are here.
https://docs.google.com/document/d/1NsZMONmJ70zMmoAKKQJX”
———–
The link IS just above where the comments start.
Set this up for friends and everything was working fine. They had to power cycle the main router (so they said) and it looks like this has reset the router to factory default settings. Has anyone encountered this issue?
“Clay says
2018/07/01 at 7:01 AM
Set this up for friends and everything was working fine. They had to power cycle the main router (so they said) and it looks like this has reset the router to factory default settings. Has anyone encountered this issue?”
———
Power cycle? Holding WPS will clear nvram and make the router factory default ( Meaning, your wifi name and password is erased etc ) NOT meaning back to TM1900.
What is your exact question?
My TM-AC1900 came with the latest ASUS TM firmware and not only does the web CFE not allow me to revert back to _1703 (invalid file); it seems they’ve recompiled CFE (same version #, updated March 2018) and it’s completely neutered, no commands available to flash, no TFTP and the icing on the cake is no command line available via J3 (serial connector).
Yes, I can Control-C into CFE prior to boot or use the WPS/Reset process, however the CFE replies with: *** command status = -1 to any command entered and I’ve tried every CFE entry I could reference.
Additionally, I’m unable to find any earlier version of the firmware (anything later than _1703, if someone has those files, could you leave a link? FWIW, I tried hex edit the _1703 firmware to replace the RT-AC68U reference to TM-AC1900 (at 01029FC0 offset), still wouldn’t flash and we’re talking over 50 tries with various button combos. So that said, it would seem that ASUS has gone out of their to disable functionality of recovery despite this board being clearing stamped as “RT-AC68U”.
Any ideas?
Digital core power voltage set to 0.9375V
Decompressing…done
Digital core power voltage set to 0.9375V
SHMOO VER 1.13
PKID07DC06011801080000000000001A103F01000000
S3000023B
00001A60
RDLYW0 00000004
RDENW0 00000040
RDQSW0
0000000000111111111122222222223333333333444444444455555555556666
0123456789012345678901234567890123456789012345678901234567890123
00 —-++++++++++++++++++++++++++++++X+++++++++++++++++++++++++++++
01 ————–+++++++++++++++++++++++++X++++++++++++++++++++++++
02 ————-+++++++++++++++++++++++++X+++++++++++++++++++++++++
03 ———-+++++++++++++++++++++++++++X++++++++++++++++++++++++++
04 ——-++++++++++++++++++++++++++++X++++++++++++++++++++++++++++
05 ———+++++++++++++++++++++++++++X+++++++++++++++++++++++++++
06 ——–++++++++++++++++++++++++++++X+++++++++++++++++++++++++++
07 ———–++++++++++++++++++++++++++X++++++++++++++++++++++++++
08 ——–++++++++++++++++++++++++++++X+++++++++++++++++++++++++++
09 ——+++++++++++++++++++++++++++++X++++++++++++++++++++++++++++
10 ——+++++++++++++++++++++++++++++X++++++++++++++++++++++++++–
11 ——-++++++++++++++++++++++++++++X++++++++++++++++++++++++++++
12 —-+-+++++++++++++++++++++++++++++X++++++++++++++++++++++++++–
13 ——+++++++++++++++++++++++++++++X++++++++++++++++++++++++++++
14 ———+++++++++++++++++++++++++++X+++++++++++++++++++++++++++
15 —-++++++++++++++++++++++++++++X++++++++++++++++++++++++++++—
PW0
0000000000111111111122222222223333333333444444444455555555556666
0123456789012345678901234567890123456789012345678901234567890123
00 ++++++++++++++++++++++++++++++++X+++++++++++++++++++++++++++++++
01 —–+++++++++++++++++++++++++++++X+++++++++++++++++++++++++++++
02 —++++++++++++++++++++++++++++++X++++++++++++++++++++++++++++++
03 -+++++++++++++++++++++++++++++++X+++++++++++++++++++++++++++++++
04 ++++++++++++++++++++++++++++++++X+++++++++++++++++++++++++++++++
05 ++++++++++++++++++++++++++++++++X+++++++++++++++++++++++++++++++
06 ++++++++++++++++++++++++++++++++X+++++++++++++++++++++++++++++++
07 –+++++++++++++++++++++++++++++++X++++++++++++++++++++++++++++++
08 ++++++++++++++++++++++++++++++++X+++++++++++++++++++++++++++++++
09 ++++++++++++++++++++++++++++++++X+++++++++++++++++++++++++++++++
10 ++++++++++++++++++++++++++++++X++++++++++++++++++++++++++++++—
11 ++++++++++++++++++++++++++++++++X+++++++++++++++++++++++++++++++
12 ++++++++++++++++++++++++++++++++X+++++++++++++++++++++++++++++–
13 ++++++++++++++++++++++++++++++++X+++++++++++++++++++++++++++++++
14 ++++++++++++++++++++++++++++++++X+++++++++++++++++++++++++++++++
15 ++++++++++++++++++++++++++++++++X+++++++++++++++++++++++++++++–
NW0
0000000000111111111122222222223333333333444444444455555555556666
0123456789012345678901234567890123456789012345678901234567890123
00 —–+++++++++++++++++++++++++++++X+++++++++++++++++++++++++++++
01 ————–+++++++++++++++++++++++++X++++++++++++++++++++++++
02 ————-+-++++++++++++++++++++++++X++++++++++++++++++++++++
03 ———-+++++++++++++++++++++++++++X++++++++++++++++++++++++++
04 ——-+-+++++++++++++++++++++++++++X+++++++++++++++++++++++++++
05 ———+++++++++++++++++++++++++++X+++++++++++++++++++++++++++
06 ——–++++++++++++++++++++++++++++X+++++++++++++++++++++++++++
07 ———-+++++++++++++++++++++++++++X++++++++++++++++++++++++++
08 ——–++++++++++++++++++++++++++++X+++++++++++++++++++++++++++
09 ——+++++++++++++++++++++++++++++X++++++++++++++++++++++++++++
10 ——+++++++++++++++++++++++++++++X++++++++++++++++++++++++++++
11 ——-++++++++++++++++++++++++++++X++++++++++++++++++++++++++++
12 —–+++++++++++++++++++++++++++++X+++++++++++++++++++++++++++++
13 ——+++++++++++++++++++++++++++++X++++++++++++++++++++++++++++
14 ——–++++++++++++++++++++++++++++X+++++++++++++++++++++++++++
15 —-++++++++++++++++++++++++++++++X++++++++++++++++++++++++++++-
WRDQW0
0000000000111111111122222222223333333333444444444455555555556666
0123456789012345678901234567890123456789012345678901234567890123
00 ++++++++++++++++++++++++++X++++++++++++++++++++++++++-+———
01 ++++++++++++++++++++++++++++++X++++++++++++++++++++++++++++++—
02 ++++++++++++++++++++++++++++++X++++++++++++++++++++++++++++++—
03 ++++++++++++++++++++++++++++++X++++++++++++++++++++++++++++++—
04 +++++++++++++++++++++++++++X++++++++++++++++++++++++++———-
05 +++++++++++++++++++++++++++++X+++++++++++++++++++++++++++++—–
06 +++++++++++++++++++++++++++X+++++++++++++++++++++++++++———
07 +++++++++++++++++++++++++++++++X++++++++++++++++++++++++++++++–
08 ++++++++++++++++++++++++++++X++++++++++++++++++++++++++++——-
09 ++++++++++++++++++++++++++++X++++++++++++++++++++++++++++——-
10 ++++++++++++++++++++++++++++X++++++++++++++++++++++++++++——-
11 +++++++++++++++++++++++++++++X++++++++++++++++++++++++++++——
12 +++++++++++++++++++++++++++X+++++++++++++++++++++++++++-++——
13 +++++++++++++++++++++++++++X+++++++++++++++++++++++++++-+——-
14 +++++++++++++++++++++++++++++X++++++++++++++++++++++++++++——
15 +++++++++++++++++++++++++++X+++++++++++++++++++++++++++-+——-
WRDMW0 00000028
WRDMW0 00000027
ADDR
0000000000111111111122222222223333333333444444444455555555556666
0123456789012345678901234567890123456789012345678901234567890123
00 ++++++++++++++++++++++++++S++++X++++++++++++++++++++++++++++++++
Decompressing…done
Detect CPU turbo button…
CFE version 6.37.14.86 (r456083) based on BBP 1.0.37 for BCM947XX (32bit,SP,)
Build Date: Fri Mar 23 10:02:32 CST 2018 (defjovi@ubuntu-odm)
Copyright (C) 2000-2008 Broadcom Corporation.
Init Arena
Init Devs.
Boot partition size = 262144(0x40000)
DDR Clock: 666 MHz
Info: DDR frequency set from clkfreq=800,*666*
et0: Broadcom BCM47XX 10/100/1000 Mbps Ethernet Controller 6.37.14.86 (r456083)
CPU type 0x0: 800MHz
Tot mem: 262144 KBytes
CFE mem: 0x00F00000 – 0x01795EDC (9002716)
Data: 0x00F4E4FC – 0x00F4E9F8 (1276)
BSS: 0x00F4EA08 – 0x00F93EDC (283860)
Heap: 0x00F93EDC – 0x01793EDC (8388608)
Stack: 0x01793EDC – 0x01795EDC (8192)
Text: 0x00F00000 – 0x00F44A54 (281172)
Device eth0: hwaddr 00-90-4C-0F-F0-00, ipaddr 192.168.29.1, mask 255.255.255.0
gateway not set, nameserver not set
Null Rescue Flag.
Null Rescue Flag.
boot the image…
Check 2 trx result: 0, 0
Loader:raw Filesys:raw Dev:nflash0.os File: Options:(null)
Loading: …. 4059264 bytes read
Entry at 0x00008000
Closing network.
Starting program at 0x00008000
In order to get to your Serial Connector you removed the back sticker and found that void sticker on top of the screw head ( which can be carefully removed by a eye glasses screwdriver ) . IF you did not damage it, IF the back sticker is flawless… I would see about an exchange or refund.
BUT, what’s the fun in that :)
1703 is the earliest I see.
Only thing I see that I have for a list of tools is https://www.snbforums.com/threads/cfe-bootloader-update.8259/
My apologies for my rant, after repeatedly using the web/USB method, I was able to revert the CFE and firmware version back to _3626.
I flashed my AC1900 to AC68P. Can flash to AC68U? It is telling me permission denied.
Yes you can, use the cfe website and the cfe flashing instruction in step #15. Not sure what is telling you the permissoin is denied, you’re likely doing something wrong to get that message.
Why is the price for the refurbished units skyrocketing? I missed the chance to buy at $46 a couple weeks ago and now its $69! Thats crazy.
its 44 on amazon… get it now
It fluctuates with the available stock. Inventories have been really irregular lately so the price is all over the place. Set yourself an alert on camelcamelcamel and snag one when the price drops.
Thanks for the amazing job on these instructions. It’s a crazy, complicated process but it worked perfectly.
Is there anyone who has successfully flashed Merlin version 384.6 alpha?
It seems there is still a way to discriminate a converted TM-AC1900 from a real RT-AC68U (see https://www.snbforums.com/threads/preview-early-asuswrt-merlin-384-6-test-builds-are-available.47385/page-10#post-415333).
so I was able to get everything flashed, added the fix etc. was able to update after that to current asus firmware, aimesh is not working my ac3100 sees the router tries to add it gets to 100% thgen fails says unable to add bla bla help please…,.lol
I was never able to get aimesh working with the ac68p re flashed to ac68u aimesh works great this guide taught me alot
Hello, I keep trying every method to upload the 1704 downgraded firmware. I have tried for 2 days straight to get the firmware to be accepted by the router. It keeps saying “The file transferred is not a valid firmware image.” I am am getting frustrated and about ready to take a hammer to the TM-AC1900 and be done with it. There must be a solution to this problem.
Open the google doc procedures. I followed the “No CFE, USB” method and got my reverted TM1900/AC68U back to a AC68U.
The google doc procedures seems daunting, but if you take the time to read thru and understand what is going on, it works. Afterall, for the extra efforts, you get back a AC68U.
tried every single method i can but seems like the new firmware 3199 block all methods…
You have to read the comments more. This has been addressed.
You are making a mistake somewhere.
It is also 1703 not 1704.
This is no room for error. You need to pay more attention and slow down. :)
Which of these steps have to be repeated to get dd-wrt or merlin on the router?
I’d rather ask than potentially undo what I just did this evening. I doubt it’s as easy as just using the firmware update tab within the router login page.
Thanks! Awesome guide!
none. just flash dd-wrt per dd-wrt instructons.
Hi, I have two TM-AC1900 routers upgraded to 3.0.0.4.384_20648 and working well with AIMesh. I’d like to upgrade to the newest ASUS firmware …21045. Assuming I did the MTD (MT5?) fix originally to get the routers working with …20648 then should it be safe to proceed with upgrading to …21045?
I see some conversations of people upgrading to …21045 and losing AIMesh. I can’t tell if they simply didn’t do the fix or if there is a new issue with the newest ASUS firmware.
Recently came across all this great information. Great work BTW! I was given a TMO-router as a gift and just recently flashed and upgraded to latest firmware (384_21045) doing md5 partition fix beforehand, since I plan to use AiMesh in the near future. Everything turned out perfectly fine. I’ve skimmed through the comments for quite a while but I couldn’t find an answer. I read in SNBforums that after a specific version ASUS began pushing auto-updates to their routers and most likely cause rollback to AC1900. Can that be a potential issue even after executing the md5 partition fix? I don’t see an option to disable auto-updates (I’m sure there probably never will be). Is there a way to to avoid this? Will using Merlin give me the option to avoid any rollbacks if I don’t intended to update my router frequently? Thank you
awesome guide. a couple things to help make it even better.
1. you can use “./mtf-write in step 19 (mtd-write 2 FW…trx linux”, it works fine.
2. if you get a bus error segmentation fault error after step 19, don’t worry. ignore it and just continue with the NVRAM reset.
Flashed1.0.2.5 (RT-AC68P) CFE, latest asus firmware (3.0.0.4_384_21045) and merlin (384.5, 374.43) run without problem. BUT the clock is locked at 1/10 (bogoMIPS = 199) and everything is extremely slow, in all three tested firmwares.
nvram get clkfreq shows 1000,800
Tried factory and nvram reset no help.
Anyone else report same problem?
ASUSWrt was locked down several builds ago to disallow any overclocking, therefore locking the clock frequency. There’s no known way to overclock it back to 1000Mhz like you could with older versions of ASUS/Merlin firmware.
Don’t use the 1.0.2.5 Cfe as it doesn’t produce good results with the newer TM-ac1900. Go back and follow the steps for flashing the cfe, but use the 1.0.2.0 ai mesh one. Then when you’re done with all that your bogo mips will be 1998. You still won’t be able to overclock though. It’ll let you set clkfreq but bogo mips won’t ever go past 1998.
After a week’s test now I have a conclusion:
Flash 1.0.2.5 ac68p CFE will bring me default clkfreq=1000,800 in nvram, and get me a bogoMIPS 1998. However during linux boot, there’s a stage where CFE update happens(read from dmesg), and overwrite to a new unknown CFE. The new unknown CFE doesn’t effect this boot, but will after reboot, where the clock is locked at 1/10 regardless of clkfreq value.
Which means, if I flash ac68p CFE, it works fine only at next reboot, not the one after. (The CFE is executed before update by firmware). If one wants to run a good ac68p CFE, he can/must rewrite it back everytime after reboot.
Flashing 1.0.2.0 aimesh CFE also has a CFE update during boot, but everything (at least what I tested) is still good.
Its possible the problem is the base CPU frequency that is getting upped by the CFE’s used to convert the TM-AC1900 to AC68U/P. This is bad if the binned CPU your using in your TM-AC1900 is incapable of sustaining said frequency. (Now it makes sense why the TM-AC1900 exists in the first place, ASUS likely repackaged all their CPU’s that are achieving around 80% yield, instead of trashing them).
What I had to do was down clock the CPU to 800,666 in order for it to function normally again. In doing so, im now seeing BogoMIPS : 1595.80. UI is snappy, and no more WAN disconnects.
Every attempt to put the CPU clock back up to 1000,800 made “cat /proc/cpuinfo” report BogoMIPS : 199.47
So in summary, if your TM-AC1900 Router isn’t totally bricked, but you are experiencing sluggish UI, constant WAN disconnection (due to failed Flow acceleration) – after you’ve converted it to AC68U/P, check to see if maybe the clock rate is too high for your binned CPU, and bring it down enough until BogoMIPS reports higher than 199.47.
Below is what it looks like to set the CPU clock to 800/666 in putty
nvram set asuscfeclkfreq=800,666 && nvram set asuscfecommit=1
nvram set clkfreq=800,666 && nvram commit && reboot
I suppose another option is to modify your CFE, and set the base clock there, so you don’t have to run this command every time you reflash your router, or clear NVRAM.
How to verify that I have the correct CFE version on my router?
I’d previously flashed two TM-AC1900 to RT-AC68U about a year ago using CFE 1.0.2.0. Now I want to use the 2 routers in AiMesh mode and hence I updated to Firmware 384.20308. I then flashed the CFE to 1.0.2.0 US AiMesh using the newly generated original_cfe from the router (I don’t have the old original_cfe), and then wiped the MD5 partition using the instructions above. Both my routers now show up as RT-AC68U and function perfectly as standalone routers. I’m able to see the AiMesh option on both the routers, but when I try to connect them thru AiMesh, the routers can’t find each other. So trying to see if there are any quick checks that I could make to verify if the routers have the correct CFEs/firmwares etc?
Thanks.
Iceman says
2018/07/08 at 8:44 PM
——————————————–
If you still have the new cfe that you used, check, the file size. I think i have post somewhere on here with more info, but basically:
The regular 1.0.2.0 is 231,923 bytes, while the am version is 231,882 bytes.
Out of curiosity, i tried re-creating the original cfe file again from the already updated one on the router, and the file size is different than either, so not sure if it’s possible to tell from the router after it is applied.
What Firmware version are you? Have you done an NVRAM reset (step 20) after all the steps?
I had the newest firmware, but messed up the CFE (used the non AM one). It still showed the option for AIMesh though, but it wouldn’t find anything.
If you’re on the latest, 21045, and did the NVRAM reset, then I would probably run these steps again to ensure you have the correct CFE.
In putty type:
cat /dev/mtd0 > original_cfe.bin
In WinSCP refresh the window on the right side and note that original_cfe.bin is present
Copy original_cfe.bin to a local drive
Upload original_cfe.bin to https://cfeditor.pipeline.sh/ > Select 1.0.2.0 US AiMesh for AC68U with AiMesh as Source CFE > Download the new .bin > rename it to new_cfe.bin
Upload new_cfe.bin & mtd-write to router through WinSCP
In Putty type:
chmod u+x mtd-write
In Putty type:
./mtd-write new_cfe.bin boot
Perform NVRAM Reset, wait for reboot <5 mins
a. Power off router
b. Wait 10 seconds
c. Press and hold WPS button
d. Power up the router and continue to hold WPS button for 15-20 seconds
Confirming that 3.0.0.4.384_21140 released by ASUS on July 10, 2018 works without issues on my TM-AC1900 running RT-AC68U firmware (as long as the process is followed for fixing the MD5 partition). Flashed it this morning with success – flashed over previous version, router restarted, everything was up and running.
ChrisWNY says
2018/07/10 at 9:40 AM
—————————————-
I don’t see this on their website – did you do this through the router’s web interface?
thanks.
I updated my firmwares on both the router and nodes through the router web interface. Clicked on the firmwares and got the option to “check”. After that there was another option below to update and I clicked on that and it updated. I didnt have to go to Asus website at all.
Thx!
Thank you. I just downloaded it and came here to see if any issues.
ack Ford says
2018/07/10 at 12:36 PM
————–
I followed the steps for rolling back without the cfe, and i kept it connected to the internet, so I think that’s fine. that’s the correct cfe as well.
I think it could just be that you have an older firmware, the tmobile 1703 is used so that ssh works, then the 3206 is used to expand a partition, but it might not have (can’t confirm) the aimesh stuff. I think all you need to do is upgrade to a newer firmware (I’m using 21045 from 6/1), but make sure you have followed the steps to erase the tmobile MD5 stuff first.
So I think your cfe is correct, but the firmware version just doesn’t have the aimesh code to take advantage of it – i don’t know how old 3206 is, but the earliest messages are from April of 2017.
Yes you do. The instructions to upgrade an ac1900 to a ac68u are what this page is about and I’ve tried to make them as simple as possible.
:D I’m ROFL!!
“ack Ford”
Hi .
Thanks for the simple instructions provided . I was able to flash the asus firmware successfully , but I notice a drop in download speeds after the flash . With the original tmobile firmware I used to see a 100Mbps download in the 5G band , but after the flash both 2g and 5G bands show me the same download speed of 50mbps . I updated to the latest asus firmware as well . How do I fix this ?
John says
2018/07/11 at 7:56 PM
————————–
Redo a step:
When going https://cfeditor.pipeline.sh/ ,
Chose 1.0.2.0. US AiMesh, make a new_cfe.bin out of it…
Don’t use the 1.0.2.5 US (RT-AC68P/V2)
Just bought refurb one, not able to flash it.
tried 10-10-10, also reset/WPS/WIFI button, nothing worked. basically my browser not able to connect to 192.168.29.1 after the router is reachable after the reboot.
I saw people saying IE browser works better, and also need to see TTL is 100 during ping, is that for real ? Any tips ?
“Paul Yan says
2018/07/12 at 11:01 AM
Just bought refurb one, not able to flash it.
tried 10-10-10, also reset/WPS/WIFI button, nothing worked. basically my browser not able to connect to 192.168.29.1 after the router is reachable after the reboot.
I saw people saying IE browser works better, and also need to see TTL is 100 during ping, is that for real ? Any tips ?”
——-
There is a newer firmware out now FW_RT_AC68U_300438421140
Download it, unzip it.. pull the ethernet cable out of your router from the modem.. and manually update it from Router 192.168.1.1 User Interface.
*assuming you did the “Code for fixing MD5 partition so you can update to latest firmware:”
“Paul Yan says
2018/07/12 at 11:01 AM
Just bought refurb one, not able to flash it.
tried 10-10-10, also reset/WPS/WIFI button, nothing worked. basically my browser not able to connect to 192.168.29.1 after the router is reachable after the reboot.
I saw people saying IE browser works better, and also need to see TTL is 100 during ping, is that for real ? Any tips ?”
——-
There is a newer firmware out now FW_RT_AC68U_300438421140
Download it, unzip it.. pull the ethernet cable out of your router from the modem.. and manually update it from Router 192.168.1.1 User Interface.
*assuming you did the “Code for fixing MD5 partition so you can update to latest firmware:”———-
———–
——-
Obviously this was the wrong reply to the wrong question. I apologize. I KNOW I hit reply on the correct question.. NO clue what happened..
PLEASE ignore this post above. sigh
–
Paul, you must follow directions. Everything is there.
Accurate except I didn’t close the comment (there’s no such functionality in the comment system), anyone should be able too reply to it.
Have you tried the Asus restore utility? When Mini-CFE page doesn’t load it is your best bet. I think just about all the problems that people experience are a result of not following the guide to the letter or taking liberty and switching up or cheating the steps.
See step #6
“If Mini-CFE won’t load use Asus Restore Utility”
And ensure you follow step #4, as well as all other steps.
Folks, the latest versions can get to the mini CFE with holding all three buttons continuously (reset and two side buttons) then only release two side whilst maintaining the reset hold and you can IP into Mini CFE and upload. When showing success then release reset and continue onwards. As per my and another post around the 29/6 era.
I got a refurb unit recently and no matter what I tried, I couldn’t get into recovery mode. Earlier units worked fine. This has nothing to do with not following the guide. You cant even start the process. Eventually I tried that 3 button method method mentioned here and was able to get the mini web page for the flash of the downgraded firmwares. It never went into recovery mode but still worked once I released the reset button and quickly went to 192.168.29.1.
Thanks for the guide. Worked brilliantly. Someone seems to have got a batch of them from Canada and is selling them here in Australia for less than 50% of the new price. They have a big disclaimer about flashing and feature TMobile prominently. Still, I now have a 68U running the latest Merlin for a little over $A100. Thanks again. Great guide.
Finally got both of my TM-AC1900 flashed, here are the instructions I followed somewhere on internet. sorry, forgot where I found them, but it got the job done. in short, 10/10/10 does not seem to work with later T-Mobile firmware. here is the key part on how to get the CFE mini web interface with the latest t-mobile firmware, the rest are just easy.
1) Open up a command window and ping the router continuously (ping 192.168.29.1 -t).
2) Have browser address bar set to 192.168.29.1, but don’t hit launch.
3) Start router while holding WPS, Wifi on/off and reset. After a couple seconds, you can release the WPS and wifi toggle, but keep holding the reset button.
4) Watch the ping; as soon as you see it connect with TTL=100 (non-rescue mode is TTL=64), connect on your browser. Asus CFE should come up. (my observation, firefox seems to work better than chrome here).
5) Don’t waste any time, purportedly the rescue mode doesn’t last long any more, so upload the downgrade firmware (TM-AC1900_3.0.0.4_376_1703-g0ffdbba.trx) and hit update (or flash, or whatever the buttons says, I can’t remember.)
6) Release the reset button, and wait. Web browser won’t look like anything is happening, but give it about 3 minutes, and you should get the success message.
7) Router will reboot, you’ll know it’s up when 3 lights on front right are on. (you may have to do NVRAM reset but it did not happen to both of my routers).
* Notes:
If you are using latest version of Mac OS, you might have problem to ssh to 192.168.29.1(complains about key exchange), use this instead
ssh -o KexAlgorithms=+diffie-hellman-group1-sha1 [email protected].1 (same option applies to scp)
Paul says
2018/07/13 at 9:48 AM
” 4) ..”
I tried this many times. What really worked was to just refresh chrome with the 192.168.29.1 copied and refreshing chrome. So that chrome always kept trying to connect at the exact time when the router connected. IF Chrome lost the page I was trying to do, I would just ‘paste’ and search again. Seemed watching the TTL wasn’t fast enough.. it is tricky.
—————————
—————————
“5) Don’t waste any time, purportedly the rescue mode doesn’t last long any more, so upload the downgrade firmware (TM-AC1900_3.0.0.4_376_1703-g0ffdbba.trx) and hit update (or flash, or whatever the buttons says, I can’t remember.)”
————–
Good point!!
This is important for people to understand.. Find your UNZIPPED 1703.. put it to your desktop or someplace you can QUICKLY chose it.. because it seems it is very picky on how long you have to load it in the Mini-CFE. So picky that 4-5 seconds searching for 1703 and uploading, will be to slow and result a fail.
———–
” 6) ”
—————–
It took me like 4 tries because of the lack of time you have to watch ping, and chose 1703 file. Also, in the end it seemed nothing happened.
With all these above you mentioned, and the fact you got to watch out for files that are zipped.. make sure they are unzipped.. especially the mtd-write.
Also, naming the CFE you made to:
new_cfe.bin
needs to be just that.. not:
new_cfe.bin.bin
And you DO have to reset the NVRAM. Unplug (Yes, unplug), Hold WPS.. plug in.. wait for power to blink.. let go WPS.
Router will boot up.
Also…
I NEVER do any of this while the Router is connected to internet/modem Just a fyi. All your instructions I never do while connected to the internet. The router should not have any contact to the internet to trigger any ‘check for any update’ or ‘ a communication ‘.
The only time you connect to the internet is to initially download the files in the beginning of this guide… and if your 68U reverted back to a Tmo and you have to follow the “Directions for rolling back to AC68 after AC1900 rollback”
Paul, I also did my conversion using an old guide from Slickde*ls.. and one on YouTub* where you use Telnet. I have read hours of the old ways of doing it. Good points you gave on your reply. :)
Just to ad, after you hit upload on the 1703.. count 5 seconds then release the reset button.
1) I managed to flash 2 routers (on same Tmobile firmware) last night, one of them was purchased few days ago via amazon. so it definitely works as we are speaking.
2) It went very smoothly on both routers when I followed the steps posted above, only thing I ensured was when I hold those 3 button “WPS/WIFI/Reset” and power on, I waited until the blue power indicator at front starts to blink, then released the “WPS/WIFI” (keep holding reset) and check whether “ping 192.168.29.1” gave me TTL=100, load CFE miniweb when you see message TTL=100 (it did not give me TTL=64 at all) , release “reset” button when you see the web page.
3) for the first try, it took me at least 20 seconds to locate TM-AC1900_3.0.0.4_376_1703-g0ffdbba.trx, and that still worked, so you do not have to rush to upload the file.
4) my router connects to my MAC ONLY throughout the process, no internet involved until the last step to flash with latest version of asus firmware.
Bonus Pointers:
1) IP address will switch from 192.168.29.1 to 192.168.1.1 and password will change from “password” to “admin” after you successfully flashed to default AC68P firmware. you need to adjust accordingly.
2) After CFE miniweb flash, telnet is not an option, as some sources claims, but you should be able to select SSH server option anyway. once finished upgrading to latest version, telnet will show up.
Enjoy your new router, hopefully the 4 hours I spent on figuring it out can make your life easier, cheers!
In reference to step 3 you mentioned above,
When your router was Tmo, and you changed it to 68U, and if ASUS realizes its a Tmo and reverts it back.
THEN you don’t have 20 seconds.
…the router acts totally different.. The Mini loader simply gets broken.. some people clean there browser, some go incognito .. but things get really different when ASUS realizes its a Tmo and reverts it back.
THEN you don’t have 20 seconds.
When all these ‘resolutions’ from people are discovered and posted, its best to practice them in guides. That why you eliminate threads going on and on for ever. That is why I said 5 seconds :)
lol it’s hard to get that file isn’t it :D you CAN do it in under 5 :) It just takes practice.
Before the “Code for fixing MD5 partition so you can update to latest firmware”
and
“Directions for rolling back to AC68 after AC1900 rollback:”
You stuck your nose in threads and found all the puzzle pieces of fantastic clues to make the quest of fixing the router work. Notepad and piece from this thread, a piece from that thread.. pretty soon you have a guide.
I’m here on this guide by Alex.
I started on Slickdeals, ended up reading SOO many pages there, it is where this all started I think. Then ended up on a guide on YouTube.. I never did the SSH way, I did the Telnet way.
“hopefully the 4 hours I spent on figuring it out can make your life easier, cheers!”
Thanks Paul for posting this.
:)
Indeed, the key for me was not to use Chrome and instead use Firefox. I spent several days trying to get the initial upgrade loaded to no avail until I saw your comment about Chrome. I had concluded at some point that ASUS-TMO had somehow made the bootload process so short that no way it could be done manually. After switching to firefox things just sailed thru. Just be aware there was no notice given of successfully updating until the router actually rebooted.
Unfortunately I bought this router and it came with TM Firmware Version “3.0.0.4.376_3199-ge62f8ab”.
I can get to CFE page, but I can never get to flash the firmware “TM-AC1900_3.0.0.4_376_1703-g0ffdbba.trx”, The CFE loader gives up saying it is invalid firmeware file.
Is there any workaround, I want to get the RT-AC68U firmware installed on this.
Any step by step instructions would be greatly appreciated and thanks in advance.
http://www.bayareatechpros.com/ac1900-to-ac68u/#comment-1665
Alex included the link bottom of his guide “Directions for rolling back to AC68 after AC1900 rollback:”
When you visit that page, just under the top right where it says” Sign in” make sure you click Suggesting and chose Viewing.
If you have a CFE use USB Instructions.
If you don’t have a CFE use NO CFE USB Instructions.
When you are done, as suggested, do the ” Appendix 2 ” to clear your MD5.
Once done, and you want to update to the latest firmware, go to asus website and download the latest version-unzip it.
In your Router UI 192.168.1.1(which it will now be), select manual update, find the unzipped downloaded firmware from the asus website.. and update.
Once done, clear your NVRAM by holding WPS powering off, powering on, waiting for flashing power light then let go WPS.
finally got it to work after few tries.. also accidentally flash to 68P instead and the whole router is unstable…
got it to 68U again it is much stable!
Do you have the routers plugged in to each other? If so, unplug them and keep the router you’re flashing connected only to your PC and nothing else. It doesn’t make sense why you’re saying that you turned the router’s wifi off, it can’t connect to the internet from just having wifi enabled unless you’ve specifically configured it to do so by setting it up to be a wireless repeater (if that’s the case, hold the reset button for 15 seconds while it’s on to reset it to default). Also as I’ve suggested, use the asus restoration utility if mini-cfe is not working, and I have no idea if you did try that. You can also try using a new private tab/window to access the mini cfe in case there’s some sort of caching issue.
Also I don’t think anyone is angry with you, but you are making it difficult to provide you clear advice as you are not being clear about what you are doing and have tried.
But your messing with a loaner router now… I would hand it back in, get your deposit back, and buy another off amazon to work with. cause it is not your router.
The reason why this site guide is good is because it works.
No reason to download from Asus when all you need is here.
Who cares about the one your returning right? /smiles.
Ease your mind. that is just a broken bag of worms that you keep throwing more worms into…
Stick with this site and all the downloads from this site.
haha, looking forward for your next victim er.. router issues.
While your waiting for the Amazon router, which you could use the link from this site so Alex gets $1.00..( if that)
Read the site instructions, download what the instructions say.. get familiar with the procedure.
It is around $2.10 off of a $52.49 router, gives me a few bucks each day I can’t complain by now it has paid off the time I’ve put into the guide.
Have you tried the Asus Rescue utility?
After updating to the latest firmware 384_21140 … well lets start off by saying, I did the SSH putty ” Code for fixing MD5 partition so you can update to latest firmware:” THEN did the firmware update.
I don’t know.. I’m pretty sure I did NVRAM by holding WPS.
So, I wouldn’t have had SSH on.
My point is, my logs are scary.
Jul 12 21:44:14 dropbear[4891]: Login attempt for nonexistent user from 113.108.72.2:50377
Jul 13 16:06:55 dropbear[27610]: Login attempt for nonexistent user from 218.26.9.100:46151
Jul 13 16:06:56 dropbear[27610]: Client trying multiple usernames from 218.26.9.100:46151
So, I went back to 384_21045.. and going to check logs in a bit.
So, is this a result of leaving SSH on?
Anyone else got weird logs?
At the time, I also had an issue where my internet went out, router had to be restored to factory and re provisioned by the ISP via phone. I’m starting to put 2 and 2 together… do you think its the firmware, or I left ssh on?
I think that’s typical, there’s always a bunch of people/bots looking for vulnerabilities. I know I was getting a number of daily intrusions when I was on the Asus. Wouldn’t suggest leaving SSH accessible from WAN. Better to run an openvpn server, and once connected the router can be accessed through LAN.
Personally I’ve made the switch to OPNSense running on this thing + a cisco meraki switch from a slickdeals freebie. WiFi speeds suck but I’m hardwired everywhere except my printer and cellphone so it isn’t an issue.
Everything worked great for the upgrade, but I noticed on the newer firmware from June and July with Asus and Merlin, My Dual Wan does not work with and Android phone using usb tethering. I googled and noticed others are having the same issue. Does anyone know the last working firmware for Dual Wan support?
Interesting. I put latest stable Merlin on mine and it worked fine with dual wan, the second wan interface being a usb tethered phone. I’m now using it as a repeater which also works very well. So at least on my setup I can confirm that Merlin RT-AC68U_384.5_0.zip works with Dual Wan and a usb tethered phone.
I had mine working on an earlier firmware, but now WAN 2 with my Pixel 2 with USB tethering stays in cold stand by.
Can you tell me the setting you used?
Thank you very much for your guide. I worked perfectly for me.
It* worked perfectly…
Confirmed – Firmware update3.0.0.4.384_21140 is working with no issues in AiMesh
Anything weird in your logs
Everything OK
Does this patch work for updating the firmware to Version 3.0.0.4.384.21140 ?
Confirmed working by poster right above you.
Just wanted to say thank you for everyones help on this site. In case you are unable to find a node, it is probably repeated multiple times, but don’t forget to reset the NVRAM. I couldn’t find the node and only did the regular reset, but didn’t do the NVRAM not sure if setting an admin password caused the issue but once I did, I was immediately able to detect the node! Good luck everyone!
I’ve managed to downgrade my router to 1703 and flash it to RT-AC68U but cannot get the router to accept the MD5 partition commands. In both Putty on Windows via Telnet and via SSH in Terminal on a Mac, the router crashes on this line:
admin@RT-AC68U:/tmp/home/root# mount -t jffs2 /dev/mtdblock5 /tmp/asus_jffs
Putty in Windows:
Network Error: Software caused connection abort
Terminal in Mac:
admin@RT-AC68U:/tmp/home/root# cat /dev/mtd5 > /jffs/mtd5_backup.bin
admin@RT-AC68U:/tmp/home/root# mkdir /tmp/asus_jffs
admin@RT-AC68U:/tmp/home/root# mount -t jffs2 /dev/mtdblock5 /tmp/asus_jffs
packet_write_wait: Connection to 192.168.29.1 port 22: Broken pipe
Problem persists when I try to run the commands separately and also when I skip the backup portion at the beginning and go straight to mounting mtdblock5.
When I run this command I don’t find anything:
ls /tmp/asus_jffs
Tried updating firmware to latest Merlin software via TFTP in Command Prompt, says it was successful in transferring the .trx file but reboot doesn’t produce any changes.
Do any of you know what might be going on here? Thanks!
The guide instructs to run those ssh commands after completing the flash. You are running them when your IP is 192.168.29.1, therefore you did not follow the instructions as your IP would be 192.168.1.1 if you did.
Follow the guide.
Anybody get AiMesh working ? With ac68p and latest version of firmware ? I can see the node but they do not sync. Right now ap mode works great.
I am having a similar issue since updating to 3.0.0.4.384.21140. Main router is in my basement (where WAN connection comes in), Node 1 is on the first floor connected via ethernet. Node 2 is on the second floor (wifi). Since updating to 3.0.0.4.384.21140, Node 2 cannot connect via wifi from the second floor (even though every other device I own can connect to the other routers). If I move Node 2 downstairs, it connects fine via wifi. My house is not huge (~1300 sq ft), and I never had this issue until the latest update ( 3.0.0.4.384.21140).
the mesh node does not sync with router even when put side by side. (I am using the firmware version released on 7/10, just did an upgrade via Admin UI after the flash few days ago). but router has no problem to see the mesh node, just can not add it.
is there any known working version of the firmware, and how can I downgrade it ? just download and upload to router ?
Right now I am running the second router in AP mode, they are far away from each other but connected via ethernet cable which works fine and covers all my requirements, I just could not resist the idea of getting aimesh to work. I thought I read something about they can not get too close during sync as well, e.g., < 1m, have not test it yet, just check with your guys if you have any suggestions.
Will be watching to see if you get this resolved. I have tried and cannot get AI Mesh Node to add – like you, discovery is no problem but adding fails everytime. (2 TM-AC1900s flashed to RT-AC68P)
I have the same problem – I flashed to AC68P, and have another AC86U router. The mesh system works *only* if the 86U is the node and the 68P is the base router (not ideal). If I set the 86U to be the base router, I can discover the 68P to be added as a node, but it fails during the sync process (at around the 50% mark) every time. I’ve reset both routers numerous times, updated to latest firmware (both are the same). Currently, the network signal is fine, but the actual internet connection drops at least once or twice a day, and takes maybe 30 seconds to a minute to reconnect – not great. I guess I will try changing CFE to the US AImesh version? Would that make a difference? Hope someone figures this out.
It worked! I changed the CFE to US AiMesh. Router changed from AC68P to AC68U and was able to successfully sync as a node. In the CFEditor setting I also checked “ALL” in the Country row (not sure if that makes a difference). I restarted at step 10 to update the CFE.
Hope this helps!
fwiw I had trouble with the recovery mode step w/ a router recently purchased (July 2018). What worked for me was the following:
Get 192.168.29.1 ready to go in browser
Power off (switch)
Hold Reset
Power On (switch) and continue to hold reset
Immediately start refreshing the webpage and continue to refresh constantly while holding down reset. The CFE website popped up within seconds (less than 10 seconds) and I could upload 1703.
Hi Paul, I am the same as I cannot sync AiMesh, and using ac3100 main and TM converted node. could not finally sync on 21140 and the prior firmware exactly the same. I’m fairly certain it’s a minor bug rather than any attempt to block the sync process, just painful not being able to finalise pairing. I just don’t have a solution yet for this.
Hello, could some put up a link to the 1708 firmware that is being discussed in some posts, stuck on 3.0.0.4.376_3199 I believe I need to flash the 1708 firmware since the 1703 doesn’t work. Help appreciated, thanks.
http://www.bayareatechpros.com/ac1900-to-ac68u/#comment-1665 <
For anyone stuck on 3199. I was trying to look for the other firmware (1708) but you don't need it. Just follow the instructions on this google document. I followed NO CFE USB Instructions. Its very simple. Works like a charm.
I am on the latest merlin after following the initial instructions from there everything working perfectly.
Pro Tip: When you open the google document it opens up in editing/sharing view, switch to read only and it will be easier to select and copy the commands from inside the google document that way which have to be pasted in console.
Can you elaborate in which way it does not work?
Is there a way to verify the MD5 partition has been fixed? Or is there any harm in redoing all the putty Code for fixing MD5 partition twice? I have a router if did a year ago and cant remeber if I went through the md5 steps (however I am on the latest merlin software as of july 17, 2018). Thanks
Please see the previous comment & reply registered by Fellow_User (2018/06/29 at 2:24 PM).
should the prompt for the last step in putty look like this? I’m not sure because a few errors showed up.
ASUSWRT RT-AC68U_3.0.0.4 Tue Nov 11 12:26:58 UTC 2014
admin@(none):/tmp/home/root# cat /dev/mtd5 > /jffs/mtd5_backup.bin
admin@(none):/tmp/home/root# mkdir /tmp/asus_jffs
admin@(none):/tmp/home/root# mount -t jffs2 /dev/mtdblock5 /tmp/asus_jffs
admin@(none):/tmp/home/root# rm -rf /tmp/asus_jffs/*
admin@(none):/tmp/home/root# sync && unmount /tmp/asus_jffs
-sh: unmount: not found
admin@(none):/tmp/home/root# rm -rf /jffs/ .sys/RT-AC68U
rm: can’t remove ‘/jffs’: Read-only file system
admin@(none):/tmp/home/root# nvram unset fw_check && nvram commit && reboot
admin@(none):/tmp/home/root#
Found some errors in your code as followings;
admin@(none):/tmp/home/root# sync && unmount /tmp/asus_jffs
: unmount –> umount
admin@(none):/tmp/home/root# rm -rf /jffs/ .sys/RT-AC68U
:/ .sys –> /.sys (no space between ‘/’ and ‘.’)
Hi,
I was running RT68U firmware Version:3.0.0.4.384_20942
Everything was working fine until recently 5GHz signal does not show up on certain devices.
I am not sure if the router updated to new firmware automatically, or some settings were changed.
I ensured 5GHz channel is not DFS yet most devices are not able to see 5GHz WiFi.
Any help appreciated
I’ve found that some devices (like Amazon devices) do not connect to all the 5Ghz channels. I had to set mine to the low range to get them to connect properly.
Well, the behavior I am seeing is very different.
The laptop, smart TV and phone were able to see 5GHz in the past.
Now all of the sudden this laptop and TV do not see 5GHz band.
Only my phone does.
I am really baffled.
Sam says
2018/07/18 at 10:26 PM
—————————-
You mentioned the DFS channels, and I will say that originally I was using the All version of the CFE to open up all those extra channels, but I had major wifi connection issues after. My phone also worked, but some wifi cameras, AFTV sticks, etc, stopped working. I was suspecting it was the additional channels, so I regenerated an AImesh, Max, and US (not All) CFE and applied it to the AImesh router, and it cleared up all those connection problems (but of course less channels to choose from). I’m not sure if you also need to do this to the nodes, but I replaced all my node CFE’s as well.
Try setting a manual channel for the 5ghz wifi instead of auto.
Tried manual. Still only Phone detects 5GHz but no others.
The biggest concern is how come all of the sudden 5GHz disappeared from other devices on which it was indeed visible in the past!
Make sure your manual channel is 48 or below. That should work.
if i do this to multiple routers, will using the same new_cfe.bin file still work between both routers?
‘new_cfe.bin’ is created for each router from each router, you can not use them in different routers. The MAC address is specific for each ‘new_cfe.bin’.
Follow the directions for each router individually.
okay, thanks.
how do I flash my routers from 68P to 68U ? some comments in this forum saying 68U might be stabler than 68P and I can not get aimesh working on 68P anyway.
steps 12-15
For those having trouble entering rescue mode from a Windows computer, try disabling “Automatically detect settings” in Internet Options. Go to Control Panel > Internet Options > Connections > LAN Settings and uncheck “Automatically detect settings” If the box is checked, Windows checks for a proxy before trying to connect and the router times out before entering rescue mode. I was unable to enter rescue mode until I made that change. Remember to reverse the change when you’re done.
Anyone else experiencing very slow boot times? It’s taking 2 minutes and 20 seconds for my router to fully boot to the point where I can login to it. I started out using CFE 1.0.2.5 and thought that might be the issue because the router interface was very slow navigating between pages. So I reloaded CFE 1.0.2 AIMesh and it’s still taking 2 minutes and 20 seconds to boot. Navigating the router interface is much faster though.
I’m on the latest ASUS firmware 3.0.0.4.384_21140 and have fixed the MD5 partition. My speed tests are clocking over 100Mbps, so nothing else seems slow other than the boot time.
The first AC1900 I bought that I had previously loaded 3.0.0.4.384_21140 on boots in under a minute. It makes me think something is wrong with this new one.
Scott — I have the same slow boot problem. Specs are same as yours (1.0.2.0 AI Mesh CFE & ver 21140). No other problems with router. However, I first became aware of slow boot after fixing MD5 partition and loading June 1, 2018 firmware (ver 21045).
I appreciate the reply Edgar. So at least I know it’s not a defective router since you have the same issue. I do think there’s something abnormal going on though. When I power on the router, within a few seconds my LAN lights, power light, and WAN light come on. Those lights stay in that configuration for approximately 1 minute 40 seconds. Then all the lights go off except for power for about 15 seconds. Then lights come back on, which now include WiFi (which were not on during the first part of the boot process), and about 15 seconds after that, I get my IP address from DHCP and I can login to the router. All in all, about 2 minutes and 20 seconds every time.
It’s a very strange issue. I don’t really care that the router takes that long to boot, it just makes me think something is not configured correctly.
Scott-
Yep — during boot, the lights on mine act exactly the same.
Interestingly enough, someone else complained about slow boots with the RT-AC68u: https://www.snbforums.com/threads/why-does-my-rt-ac68u-take-so-long-to-reboot.36956/
However, this was more than a year ago, and he/she was using a “true” 68u.
Still, I’m with you on this — mine used to boot much faster. So, for me at least, it’s not “normal.” But I rarely shut off the router (thunderstorms, vacations), so it’s something I’ll have to live with for now.
Save your configuration file and reset the router to defaults. Does it still have slow boot? You can always restore your config, but it would be a good place to start testing the router boot speed with default settings.
Alex — that’s a good idea. I will give that a try and let you know. Also, thanks for maintaining this website. It’s a great resource.
Alex-
Reset to factory default using NVRAM clear (held down WPS button until power light flashes). Boot time still the same. However, when I go into the ASUSWRT interface and go to the menu for restoring factory defaults, I noticed a new button. In addition to the “restore” button, there’s now an “initialize” button. R Merlin (of the Merlin firmware) says it clears the /jffs/.sys/ folder. (See discussion re: different model (86U, NOT 68U): https://www.snbforums.com/threads/rt-ac86u-administration-restore-vs-initialize.41944/
I’m not going to touch that button with a 10 foot pole until I’m sure it won’t revert FW to T-Mobile. Do NOT want to do that again!
Alex – ditto what Edgar said. I tried the same steps he did and got the same result after clearing NVRAM with the WPS button. It’s still taking over 2 minutes to boot. Is it safe to assume that is not a normal boot time? Do you have any other suggestions? I did not see anyone else running into this issue. It’s odd two of us are having this exact same problem.
Also, thank you for this great resource to discuss this firmware mod!
Scott —
I had a thought…
My router was rolled back to the T-Mobile firmware a few months ago (whenever Asus issued that update). So I had to fix the MTD5 partition and re-load the Asus firmware.
Was your router rolled back too? If so, maybe that might explain the boot time issue — something got screwed up during the roll back and the reloading?
Hi Edgar – mine never rolled back. It was a brand new router that I went through the steps start to end one time without issue or rollbacks.
Good thought though.
I’m going to keep monitoring the thread to see if anyone else runs into this issue. Maybe if there are others with the same issue something will turn up. I hope it’s not just us two!
Scott-
Thanks for your reply. I’m a bit relieved to learn that you have the same boot problem even though you weren’t rolled back (although, of course, I feel your pain). I was starting to wonder whether the old firmware left a “present” hiding somewhere in the code.
I have followed the instructions and doubele and triple checked. The Router flashed to version 3.0.0.4.376_3626, but its still shows as a ASUS TM-AC1900. What am I missing. I am sure its probably something simple but I have been working on this for hours and am just getting frustrated. Thanks in advance for any help.
Bill,
When you perform step 16 in PUTTY, are you waiting for the final confirmation before you perform the NVRAM reset? If you’re doing the reset before the confirmation comes up, that could be giving you trouble. I had to figure that out the hard way as Step 16 doesn’t say to “wait” before doing the NVRAM reset.
IF you did the NVRAM clear:
Unplug – Hold WPS- Plug in and power on- wait until power flashes- let go WPS.. wait for boot up.
…. and you see TM-AC1900 still, then the CFE part failed.
The cfe part changes the tag from “TM-AC1900″ to RT-AC68U”
So the cfe change probably did not take for any reason if an error was made.
Some things can cause that, inproper copy and paste of code on your part.
the renaming of the changed cfe to “new_cfe.bin” MIGHT actually be “new_cfe.bin.bin” because you didnt highlight the ENTIRE name to when naming it “new_cfe.bin”
The ” mtd-write ” was still zipped and you didn’t check to unzip it.
The problem you talk about has already been gone over by others AND myself, I posted a lot about it already. Search my name in comments. I would make sure all of your steps are done PERFECTLY. I would not connect to the internet doing this. In ALL of the instructions from Alex, there is not one part you need to be connected to the internet while doing this.
You prepare yourself ahead of time downloading everything… read and know the steps.. then disconnect from the internet.
I am using Windows 7. I even delete my LAN profile in REGEDIT. I clean cookies and cache. I use CCleaner. I have EVERYTHING clean before I even plug into the pc/router and start this guide.
Be 100 % prepared, pay attention, ANY ERROR will fail this. A space where you aren’t supposed to add a space… a zipped file where it is supposed to be unzipped, an error renaming…
IF you then still have the issue, you have to use the alternate guide “Directions for rolling back to AC68 after AC1900 rollback:”
If you think Alex’s guide is hard……
… so pay attention here and hopefully you can get it to work from Alex’s guide first.
If you follow that Directions for rolling back guide and can’t cope, search for my name, I posted a link to my guide. I was at the point where my firmware changed (like yours) but the label did not change.
But my advice is to try again.
When setting up your computer with a static IP address (step 4), it is better not to set a default route. You won’t be routing traffic while you do the system administration.
The version of the SSH key exchange protocol on the original TM-AC-1900 firmware is deprecated and will give an error if you try to connect to it with modern clients. On Linux, the following command will work: “ssh -oKexAlgorithms=+diffie-hellman-group1-sha1 [email protected].1″
After the mtd-write2 command, I got a bus error. This seems to be OK.
When the Restore/Recovery mode reset (Step 5) was complete, the light on the back started flashing. The same was true for the NVRAM reset (Step 20).
After the NVRAM reset (step 20), I had to do a power cycle.
I downloaded the firmware labeled “1.0.2.0 US AiMesh” (in step 15), but it didn’t provide AiMesh functionality. I needed more recent firmware for that.
After upgrading to the most recent ASUS firmware, I needed to do another NVRAM reset on one router, but not another.
Hi Folks, after many unsuccessful pairing I really found that the setup process is just fussy. I have the 88U as main and T-Mobile on lastest asus software. When pairing (has to be within that 3 meter mark) I observed the TM Power continuous and two wirless flickering upto about 13% then they remain stable. The result was fail to pair. However, without any changes, if you have success then the power, wirless lights do their dancing on and off for quite a while and presto success!
No I have had many tries and this time, I kept my 88u at full custom settings and just default to aimesh. So for a few posts, like I was asking, its just a bit tricky but it will work. My TM is flashed following this guide then updated offline from 21405 to 21140 (routers 30m apart and manully selected ethernet for backhaul). Hope this assists others.
No, dont disconnect the router from the modem. Just hardwire your device directly to the second router and turn off wifi on the device to perform the flashing. You’ll have to activate wifi to perform step 15 over the internet, but after that is done, you can deactivate it again to finish the process.
The way you describe it is the way I did it: with an ethernet cable from a LAN port plugged into an ethernet USB dongle connected to the Windows 10 device. Just keep in mind that you need to first set a static IP address of 192.168.29.XXX in your ethernet settings until you reach the stage when the router is flashed to become the 68U. Then afterward leave the hardwired connection in place and remove that static IP, while you finish the preparation for the loading of the latest 68U firmwares.
I never thought about that, Disabling your WiFi for your wireless to be disabled during the hardwire to router process. Good looking out!!
I use a desktop so I don’t WiFi it.
Personally I connect to wifi to use the cfe website, then I disconnect from wifi and continue working on the flash router that is disconnected from the internet.
Ohh lol, Wow! in your own thread your not prepared ahead of time.. that’s bad lol!!
: )
This will just potentially cause issues in my opinion. Stay off the internet, get prepared ahead of time.
I have one that is still owned by T-Mobile. Would it be possible to turn the router into an RT-AC68U, use it until I don’t need it any more, then turn it back into a TM AC-1900 before I give it back to T-Mobile?
Currently, people that have done the TM AC-1900 –> RT-AC68U are updating firmware, and the new firmware is triggering to revert the RT-AC68U back to TM AC-1900.
So, people are clearing the md5
“Code for fixing MD5 partition so you can update to latest firmware:”
IF you were to change it to a 68U…
NOT do the step: “Code for fixing MD5 partition so you can update to latest firmware:”
..then MANUALLY update the firmware from INSIDE the User Interface, NOT connected to the internet by anyway… chose the firmware on your desktop you downloaded and unzipped… MAYBE it won’t trigger that revert back to TM AC-1900.
Then when you wanted to revert back… Update over the air.. in the user interface, search for updates and do it while connected to the internet. MAYBE then it would revert it back for you saving you doing it manually .
“still owned by T-Mobile” You might want to pick one up so you own it.
Thanks, Me3. I’m hoping for some confirmation that there’s a procedure that has been tried and works.
My current plan is to save the original_cfe.bin. When it comes time to revert, I’ll re-install that with mtd_write, and then flash the original TM AC-1900 BIOS. Think that will work?
Question is, what mtd-write do you use to revert it back?
There are a couple size files for ‘mtd-write’.
Also, during the tmo —-> 68U process ” expand your rootfs partition from 32M to 64M”
Do you have to change it back?
Remember, the order of the Tmo->68U I would think needs to somewhat go in reverse?
If so, will the “rootfs” size drop back down?
Is it as simple as just do the cfe.bin and install Tmo firmware? or do you have to use old files, lower ‘rootfs’ , old firmware then upgrade that old tmo firmware?
Long story short, I have done it. BUT, it took a while to find the right files to do it such as:
using 2.1.2.1 ~or~ 2.1.2.2 ~or~ 2.1.2.4
MTD-Write v2 ~or~ MTD-Write v1.
(Which took a lot to find reading a lot of forums..but I did link it here in the comments, search my name)
I did get it back to TM AC-1900 from “RT-AC68U”
I was also able to revert it back to the Tmo firmware.
BUT, after I logged in to PUTTY it showed
RT-AC68U
admin@TM-AC1900
So one said: “incomplete NVRAM erasure” happened somewhere.
So to answer can it be done? Yes.
But I don’t know exactly how… NOT exactly. But I did change the tag and firmware.. which was good enough to return. ( It will just get flushed/refurbished anyway)
—————-
What worked… Back in the day, I posted in Slickdeals my solution: I wrote…
“I then used 2.1.2.1 and MTD-Write v1 … then NVRAM command.. THEN after restart.. Unplugging USB during restart. THEN power cord unplugged, waited 10 seconds… plugged back in with WPS held.. waited until flashing lights. THEN it showed TM-1900
I was going to go to 2.1.2.2 next.. which is what the youtube video claimed was his orig CFE.
I don’t know if it was changing to 2.1.2.1, or after NVRAM command and reboot, that I actually pulled the power cord, waited 10 seconds.. then held in the WPS upon pressing power cord back in.. waiting for blinking light.”
—
Keep in mind, I used putty telnet way of doing the router back then. The old way of doing it. NOT SSH.
So it is very hard to answer your question.. Can it be done the SSH way like this forum shows.. what do you use…
I don’t know.
The old way of doing the router with Telnet helped me when ASUS firmware bricked my router to revert back to TMO and it would not allow any downgrade or connection.
So to go back to 68U I knew the old ways of getting in the router. (Which is all over youtube and slickdeals etc..)
So that is the way I know, that is the way I reverted back to TMO from 68U.
well, I didn’t explain in detail how…. that would just take too long. But you got the idea.
EDIT: Just to add to my above comment.
Flashing the RT-AC68U back to TM-1900.
I had lost my CFE at the time…’origional_cfe.bin’
so..
I didn’t know what CFE to convert. I had all the 3 Mac addresses and the secret key.
I download a CFE at : https://www.snbforums.com/threads/asus-routers-cfe-dumps-collection.17793/
I ENDED UP USING
2.1.2.1 (Q2)
.
I tried
2.1.2.2 (US)
2.1.2.4 (US)
.
I changed 2.1.2.1 (mac’s and secrete code )
.
I ENDED UP USING
MTD-Write v1 => *Original version (v1) from ASUS* (602KB)
.
I tried
MTD-Write v2 => *New version (v2), fix update on some specific situations that couldn’t complete the process* (716KB)
MTD-Write v3 => *New version (v3) from ASUS* (511KB)
.
I got the router to TM-AC1900_3.0.0.4_376_1703-g0ffdbba.trx
.
Video of Telnet way of doing tmo2ac68u:
https://www.youtube.com/watch?v=RI6D0LMkm3s&feature=youtu.be
Used 2.1.2.1 (Q2) and MTD-Write v1
(telnet Putty) — remember (“sda1” is the name of USB drive just like in the YouTube tutorial)
cd /tmp/mnt/sda1
mtd-write new_cfe.bin boot
reboot
after router started back up, unplugged .. pulled out the USB drive…. HELD WPS and plugged it back on.
Flashing light, let go the WPS
done.
i have three of the t-mobile routers and ran through the same process for all of them and it worked…BUT i used the same BIN for all the routers as i thought i could just do that….but now they all have the same MAC address and i think that is preventing me from using AiMesh on the routers as it only finds one node and i think the router thinks it is the same router so it wont connect…. does anyone know how to change the MAC address? i tried cloning it but when i do it the AiMesh detection doesnt find the routers. any help or advice would be awesome, thanks.
Watch this Youtube video starting around 11 minutes in to see how to use the Hex editor to change your mac addresses.
https://youtu.be/E_giMfTYIzI?t=10m57s
It has old instructions that use a Hex editor “HxD” to edit the mac address in the CFE file. Your original router is obviously going to be correct, but you’ll need to edit a CFE for the other two routers. Your actual Mac Address can be found on the back of the router. As you’ll see in the video, you’ll need to change the Mac address in three different spots. Just use the Control-F to search them out as the video shows. The only thing I’m not sure about is that I know the “MAC address 3” usually has a different number or letter for the last digit. I’m not sure what to tell you there. Maybe putting in the regular mac address will work?
Also, while you’re at it…you’ll probably want to change the WPS code in each CFE file to match what it says on the back of your router. Just search “secret” when you’re in the Hex editor.
You wont have to go to the Youtube link:
If you can find the ‘original_cfe.bin’ for EACH of the 2 routers, your set.. just change them one at a time (#Sarcastic) using https://cfeditor.pipeline.sh/
IF you lose the ‘original_cfe.bin’ :
The last digit of the twelve, in the ‘ MAC address 3 ‘:
” I know the “MAC address 3” usually has a different number or letter for the last digit.”
You only have 10 to chose from so if you made 10 ‘new_cfe.bin’ by guessing that last number.. one should work.
This will stop your router becoming a doorstop.
Always keep your original_cfe.bin.
Hopefully he can get the originals, but the last digit of MAC address 3 can also be a letter….have fun with that.
To add to that, if the original_cfe.bin is lost you can manually edit the one you have with a hex editor and manually input the mac address that should be printed on the bottom of the router on a white sticker.
Umm.
“Mark says
2018/07/25 at 9:23 AM
Watch this Youtube video starting around 11 minutes in to see how to use the Hex editor to change your mac addresses.
https://youtu.be/E_giMfTYIzI?t=10m57s
It has old instructions that use a Hex editor “HxD” to edit the mac address in the CFE file. Your original router is obviously going to be correct, but you’ll need to edit a CFE for the other two routers. Your actual Mac Address can be found on the back of the router. As you’ll see in the video, you’ll need to change the Mac address in three different spots. Just use the Control-F to search them out as the video shows. The only thing I’m not sure about is that I know the “MAC address 3” usually has a different number or letter for the last digit. I’m not sure what to tell you there. Maybe putting in the regular mac address will work?
Also, while you’re at it…you’ll probably want to change the WPS code in each CFE file to match what it says on the back of your router. Just search “secret” when you’re in the Hex editor.”
that is what your replying to.
Well, what happened? :)
@@
Is there a way to block the fully-updated RT-AC68U from doing automatic firmware updates?
Normally, these are a good thing, but I’m worried that ASUS will get tired of this cat-and-mouse and put up firmware that will detect the blanked-out MD5 partition and brick the router.
On a related note, is there a way to build an MD5 partition that looks like the one on a native RT-AC68U? Or, does that require signing with a private key of some sort?
Thanks for the guide, both routers are running perfectly! Has anyone updated to the new firmware that just came out? 3.0.0.4.384_20648? any issues?
Version 3.0.0.4.384.21140 is the latest firmware, you are 2 behind.
And yes, it works.
https://www.asus.com/us/Networking/RTAC68U/HelpDesk_Download/
EDIT: 3 behind
Does anyone know if there is any value in overclocking one of these routers if it is used as a node? I was trying to post on this site (https://forums.whirlpool.net.au/archive/2693988), but for some reason I can’t register there – there seems to be a lot very knowledgeable people on there.
Alex-
I’ve been sitting on two of these things for awhile, using them as AP’s with TM firmware with the intent of flashing and trying Aimesh. There are many guides out there that make the process seem far more complicated than it is. Your guide does not. Many thanks.
For those interested…(this is nothing to do with the conversion guide above)
When you go to download the latest ASUS Firmware and want to check the MD5 of the file:
For example,
Version 3.0.0.4.384.21140
2018/07/10
“Please unzip the firmware file first then check the MD5 code.
MD5: 5249a5aa1516282422e8474d81d462bc”
—————-
I found a site that can do that for you called VirusTotal.
https://www.virustotal.com/#/home/upload
When you search for the file and hit upload, in the ‘results’ you can click “Details” it will tell you the MD5.
Thought I would share.
(I found the site from CCleaner website talking about checking there file for a virus)
I flashed TMC1900 to AC68U with CFE 1.0.2.0 US in Dec 2017, and things had been working fine. I didn’t realized there was MD5 partition issue until I tried to update the firmware to the latest Version 3.0.0.4.384.21140 yesterday. So now my router is rolled back to TM-AC1900 with firmware Version 3.0.0.4.384.20648. The GUI reminds me there is an firmware update available, but no luck. Router is still functioning fully, and I can still connect to it via 192.168.1.1 in web browser or telnet.
I want to confirm before I go to fix MD partition and update the firmware.
Enabling SSH is still available in router menu . After doing that, I only need to to follow the section described by Alex “Code for fixing MD5 partition so you can update to latest firmware”, then to update the firmware from GUI. Is that everything I need to do?
What about my CFE 1.0.2.0 US? It is not the version 1.0.2.0 US AiMesh recommended by Alex.
Thank you
Hmm, 3.0.0.4.384.20648 is 3 versions behind the current one on the asus website. https://www.asus.com/us/Networking/RTAC68U/HelpDesk_Download/
That is for the “RTAC68U”
So, it seems it changed the ‘tag’ in the routers User Interface from RT-AC68U to TM-AC1900 but nothing else, also breaking any changes as you mentioned it shows an update but wont update?
.
.
You need to make a ‘new_cfe.bin’ (since now it has AiMesh)
https://cfeditor.pipeline.sh/ upload your ‘original_cfe.bin’ chose 1.0.2.0 US AiMesh. You will get “new_1.0.2.0_am.bin”.
Rename ‘new_1.0.2.0_am.bin’ ( highlighting ALL the name including .bin ) and rename it to:
new_cfe.bin
.
Alex provided a link for files to use, one of them is the mtd-erase. Make sure you unzip the mtd-erase before using because it is zipped.
.
Make that new_cfe.bin and continue with the steps. 16 and on I believe?
.
IF you lost your original_cfe.bin I don’t see why you can not use the ‘new_cfe.bin’ you made back in 2017 -TO UPLOAD – to make it the ‘AiMesh’ new_1.0.2.0_am.bin. You probably should rename it to original_cfe.bin? then upload it? try it :)
.
I recommend you do NOT connect the router to the internet when doing this ~or~ have WiFi turned on on the pc/laptop your using at the time of doing it. Do not connect the router in anyway to the internet when doing it, or the Tmo crap in it now might flash a stop in your progress. It seems it is 1/2 converted back to tmo so you might be lucky.
.
If things don’t work, (usually when Tmo flashes back on a 68U you don’t get telnet/ssh ) then you will need to do that other way of fixing ” Directions for rolling back to AC68 after AC1900 rollback:” That is a completely different guide. If you have to do that guide, I suggest you read the comments here about that guide.
.
After you are done Alex’s Guide, you will need to do the “Code for fixing MD5 partition so you can update to latest firmware:” Everything in Alex’s guide is in order step by step.
*thank you Alex
.
The Directions for rolling back to AC68 after AC1900 rollback has step by step guide like Alex’s and includes WHEN to do the Code for Fixing MD5. Don’t jump a step.
.
Be prepaired first, download all downloads/ files.. do not connect to the internet on Alex’s guide.
On the guide for “Directions for rolling back to AC68 after AC1900 rollback” it tells you WHEN to connect to the internet with the router.
.
Since you have the ‘CFE’ you will chose that option on the Directions for rolling back to AC68 after AC1900 rollback Guide. I recommend CFE Thumbdrive method, IF you have to do that guide ( which I don’t think you will )
:)
If I were in your shoes, I would attempt all of the steps in order starting with Step 10.
Hi Guys, so for some reason router reverted back to tm1900 firmware 3.0.0.4.376_3181 when I was on Merlin 384.5.
I’m able to enter CFE mini recovery page to follow the procedure but I get the error message:
“the file transferred is not a valid firmware image”
when trying to upload
“TM-AC1900_3.0.0.4_376_1703-g0ffdbba.trx”
I tried NVRAM Reset but nothing I do seems to help. Any ideas?
You did not fix the md5 partition and asus automatically rolled you back to t-mobile firmware. See Directions for rolling back to ac68u at the bottom of the article.
Hey Alex, thanks for responding. I guess I probably missed that part the last time I did this. Although, I’m not sure what you are referring to “at the bottom of the article”.
All I can see if the putty commands to fix the MD5 that only applies if you can activate SSH on the router, which is not possible from tmobile firmware, right?
My bad, I just saw what you are talking about. Ill take a look and see if I can manage that. thx
Thanks for the Guide! It was pain getting my Tmo AC1900 into Mini-CFE load screen and Asus Restore Utility would not work at all for me. After going through all the steps getting it into AC68U mode then I updated to the latest AC68U code, but have not tested AiMesh yet. I have one question on the CFE config which is what is the difference between 1.0.2.0 US and 1.0.2.5 ???
I used 1.0.2.0 US since I read 1.0.2.5 US was causing some to revert back to T-Mobile firmware?
“Avoid CFE 1.0.2.5 from the RT-AC68P, as the newest Asus firmwares (3.0.0.4.384.20624 and later) detect this on the TM-AC1900 and revert the mod. Instead, use CFE 1.0.2.0 US AiMesh”
https://lazymocha.com/blog/2018/04/16/flash-t-mobile-cellspot-tm-ac1900-to-asus-rt-ac68u-p/
The RT-AC68P model router was a Best Buy exclusive model. It had a 1ghz processor. These Tmo’s have 800 Mhz.
So it is MY belief, that the 1.0.2.5 is for the 1ghz model, and causes issues with this Tmo 800 version.
The history of the RT-AC68’s had different versions.. At first, there were some that were below 800 mhz.. then 800 mhz.. and that P.
THEN to mess everything up, there was an ASUS RT-AC1900 White box. Not ” RT-AC68U” an Asus “RT-AC1900” It was supposed to have a 1ghz processor, but didn’t.
The problem with that one was, it was during the time FAA smacked ASUS hand for allowing others to change the signal strengths by either using Merlin or Tomato. ( think it was Tomato ).. So that Asus RT-AC1900 was a WHITE Box, and It could NOT use 3rd party firmware.
The chips were different model numbers.
I know, I gutted one and took pictures, looked it all up, read a tun of forums about it.
It ended up on being blown out for $45 at Walmart
https://slickdeals.net/f/10235836-asus-rt-ac1900-router-for-45-b-m-ymmv (That was a NIGHTMARE to deal with convincing Walmart they are a blow out price)
Walmart no longer stocks ASUS routers, Office Depot, Staples.. hmm. I’m not sure about Best Buy.
Fry’s, Microcenter, Amazon, Newegg do.
Thanks to everyone who worked on this! I bought two of these off Amazon, got them today and have set up both. Mine came with the 3199 firmware and I had a bear of a time getting into recovery. I spent 3+ hours trying everything from all three buttons to the asus recovery to the single button press with time intervals. What worked for me was turning off the router (power switch), then pressing the reset button for 10 seconds then turning the power on. All of this while watching the ping. When I saw the ping show TTL=100 I had to load the web browser before the third ping TTL=100 or I would get “This site can’t be reached
The connection was reset.” error after trying to load the firmware. I used Chrome because it would give me the load percentage. With all of that it still took several tries before it got all the way to 100%.
I did make one bonehead mistake on my first try and that was failing to rename the cfe file to “new_cfe.bin.” Thanks again to all. I am going to try out the aimesh thingy now.
My Merlin flashed unit currently running 384.4 firmware was working fine for last year or two but for kicks, updated to latest 384.6 firmware. Found I lost wifi, and doing the reset didn’t work, so did a 30/30/30 hard reset and try to install firmware in CFE miniweb server that way but always get a timeout. Then it just takes me back to CFE miniweb server and I can’t get out of it. I’ve tried the last working Merlin firmware as well as latest one, and ASUS stock as well but always get same error.
I also tried to update using ASUS utility firmware restoration but get the message that it ‘failed to recover the system’ after uploading 100% fine.
Can anyone offer any other suggestions to try?
TIA for help!
Please disregard above message- turns out I have to flash the Tmobile firmware and then re-do everything again to make it a ac68u again. Sucks but at least I have a working router!
Thank for you for the very clear instructions. I had to improvise in a few areas, but nothing major. I was able to reflash with no problems at all on the first attempts and install Merlin.
What areas did you have issues with , I’m curious.
Step 5: the posted instructions did not work, I had to follow the recovery/restore mode instructions on Asus’ site. Basically, instead of using 10 seconds, use 30 seconds;
Step 6: the mini-CFE instructions were unclear to me. I eventually figured that the instructions meant if the browser does not open to the router, use the Asus Restore Utility since it is able to communicate with the router, once the utility is opened, upload the file in step 7, then follow the instructions in the utility);
Step 8: I could not connect to the router after rebooting, so I used the windows network diagnostic function and I was then able to connect to the router using 192.168.29.1;
Step 14: I did not know how to copy cfe.bin, since a “copy” option did not exist. I eventually figured out to right click it the file, then select DOWNLOAD, then the downloads (or where you want to save the file) folder;
Step 16: Again, the instructions for this step were unclear to me. I figured out to just drag and drop the files from DOWNLOAD (or wherever you saved the file in step 14) where I saved the file in step 14 into WinSCP right side.
I followed the guide and updated to 68P and then upgraded to latest Asus firmware using the webui. However I am having a problem with my Wifi Printer. I couldnt connect to it from my laptops and desktops. Printer shows connected and receive DHCP IP. So I tried to reset the network setting off the printer and then tried to connect to it again and it connects fine to my wifi. However everytime it connects, it kills the entire network and my systems go on APIPA. I did not have this problem when I was on Tmobile firmware. I also tried Merlin but same problem. Any ideas?
Maybe try the cfe for 68U instead.
Help Please !! . I converted tm-ac1900 to AC68U a year back and have been using it since then by applying the asus firmware updates until recently my router was reverted back to TM-ac1900 . Router was working fine as a TM-ac1900 until yesterday when it just bricked itself when I was trying to reset it as i forgot the password to login . Right now I am only able to get to CFE recovery page . Router login page dose not work , no wifi and I am unable to downgrade to 1703 for obvious reasons . So my priority is to flash the router to latest verion of Tmobile Oficial firmware using CFE so that I can atleast use it as a Tmobile router. Can someone please post links to where I can download the latest version of the tmobile firmware please ? .. Appreciate it …
http://www.bayareatechpros.com/ac1900-to-ac68u/#comment-1665
Go there. There a few options, and I haven’t needed to try any of them. If you have your original cfe from a year back, that will probably help you immensely.
And make sure you remove the MD5 partition this time around. That’s the reason for the automatic rollback with a firmware upgrade.
I’ve seen that google doc before but for that google doc to work I should be able to get into my routers configuration page . but right now I am only able to go to the CFE recovery page . So the only Way I can get into routers configuration page is if I get a copy of t mobiles latest official firmware .trx file .
I did the mtd5 fix and everything went off without any errors
Is there a way to check that I did everything correctly ?
In the guide to resurrect the router if tmo reverted back from a 68u, I believe the person mentions to wait 20 seconds – 2 mins before doing the next copy and paste during the mtd5 ‘fix’.
IF you wanted to do it again, feel free to do so, and pause to let the router do its thing on each paste.
I think I have done mine 5 times now lol
To answer your question. Someone would have to explain how to code in to seek a certain files contents to see? that is a question you shouldn’t worry about.
My router was not reverted back but I did not pause 20 seconds to 2 minutes between each step. So I should do it again?
Wish there was a way to check if everything went OK.
In the guide ” Directions for rolling back to AC68 after AC1900 rollback:”
there are 2 added code for mtd5 ‘fix’.
cat /dev/mtd5 > /jffs/mtd5_backup.bin
mkdir /tmp/asus_jffs
mount -t jffs2 /dev/mtdblock5 /tmp/asus_jffs
rm -rf /tmp/asus_jffs/*
sync && umount /tmp/asus_jffs
ln -s /sbin/rc mtd-erase
./mtd-erase -d asus
rm -rf /jffs/.sys/RT-AC68U
nvram unset fw_check && nvram commit && reboot
Yes, I did those two lines and got the message that everything was deleted. See below. Do I still need to do everything again?
ln -s /sbin/rc mtd-erase
./mtd-erase -d asus
Erasing 0x0 – 0x1ffff
Erasing 0x20000 – 0x3ffff
Erasing 0x40000 – 0x5ffff
Erasing 0x60000 – 0x7ffff
Erasing 0x80000 – 0x9ffff
Erasing 0xa0000 – 0xbffff
Erasing 0xc0000 – 0xdffff
Erasing 0xe0000 – 0xfffff
Erasing 0x100000 – 0x11ffff
Erasing 0x120000 – 0x13ffff
“asus” successfully erased.
nah, as long as you did it in order, your done. There is no ‘ confirmation’ that you did it.. or it was done correctly. I have done mine about 5 different times now. : )
Thanks for the info! I’ve done this before a slightly different way, but I really wanted that AiMesh feature and this did the trick. I have the latest Version 3.0.0.4.384.21140 installed and both routers and they are working great.
Only tip I can give is from experience the lan ports in the back do matter. So pick LAN port 2 as your flashing port and if you’re having issues with a browser then try IE 11 or Firefox.
NVRAM reset sometimes you may need to go with the 30/30 method. Meaning 30 seconds with no power plugged in and pushing in the WPS button then 30 seconds with power plugged in and WPS button pushed.
Lastly once you have two routers ready, you need to manually configure one that was factory reset to AiMesh Node. If you don’t tell that router is a AiMesh Node then the other router will not see it.
Those are my tips!
“I’ve done this before a slightly different way”?
–
You followed a different guide?
.
“Only tip I can give is from experience the lan ports in the back do matter. So pick LAN port 2 as your flashing port”
–
Converting from a TMobile to a RT-AC68U you noticed it didn’t work if you had your PC connected to 1,3 or 4th LAN port on the back of the router? This is the first I have heard that the LAN ports differ..Maybe you had an issue with the end of the Ethernet cable not seating on the pins right on one of the ports? Cat 5 or Cat 6? (personally I use Cat 6).
.
“you’re having issues with a browser then try IE 11 or Firefox.”
–
You should not be connected to WiFi, or Internet when doing the conversion (tmo – 68U) unless told to do so …and always clear your browser data. I have never had an issue using Chrome. (If that could be why you had an issue) : )
I am hoping someone can help me with aimesh setup. I recently bought another ac1900 to convert it to ac68 as a aimesh node.
Here is my setup:
* ac1900 converted to ac68u a couple years back. Just updated to latest firmware (3.0.0.4.384_21140) using instructions from here. I don’t have the original CFE any more. The router has been solid.
* ac1900 converted to ac68u this week. It is also running the latest firmware. I still have the original CFE.
I spent many hours trying to get the aimesh router to recognize the newly converted ac68u as a aimesh node and it is *not* working.
I tried reset both ac68u to default already and also did nvram reset (with WPS button). As this stage, the only differences between the two ac68u are:
1. Different hardware inside because the routers are a couple years apart.
2. I used the 1.0.2.0 US AiMesh CFE to flash the new router while I used a hex editor to update the original CFE in the old router. I ran the command on the router to check version, they both are 1.0.2.0.
I wonder if these differences are stopping the two devices to setup as a aimesh network.
I would appreciate if someone here can help me out. Thanks in advance.
“* ac1900 converted to ac68u a couple years back.”
.
So because you did it 2 years ago, you might be use to the ‘telnet’ way of doing the flash over the SSH way?
If so, here is a guide I know of that is the telnet old way of doing it (a TELNET hands on step by step guide)
.
https://www.youtube.com/watch?v=RI6D0LMkm3s
.
————-Pull your origional_cfe.bin:
.
At 15 minutes and 30 seconds in that guide:
USBDRIVE into pc, right click, format fat32 (erases drive), plug into the back of the router, unplug power to router, plug in power to the router, web browser- log into router 192.168.1.1 (RT-AC68U), 192.168.29.1 (TM-AC1900), Go to USB Application, Servers Center, Network place, expand the ‘+’ sign and check it says “sda1” (Take note of the name the router says your usb drive is)
20:57 log into PUTTY with the ip address of the router chose ‘telnet’, router username and password.
Open telnet – putty log into the router (the video shows TM-1900 so 192.168.29.1 )
Yours is RT-AC68U so 192.168.1.1
check ‘telnet’ put in routers username and password (hit ENTER)
–
(((*Note remember the router showed the name of the USBDRIVE was “sda1”. Whatever the name, in the codes below to copy and paste, where “sda1” shows.. make sure its the name of your USBDRIVE . if different then “sda1” change “sda1” to that name.
So: cat /dev/mtd0 > /tmp/mnt/USBDRIVE/original_cfe.bin
USBDRIVE changed to sda1
cat /dev/mtd0 > /tmp/mnt/sda1/original_cfe.bin )))
–
Start to copy and paste lines into Putty :
cat /dev/mtd0 > /tmp/mnt/sda1/original_cfe.bin
hit enter
dd if=/dev/mtd0 of=/tmp/mnt/sda1/original_cfe.bin
hit enter
cd /tmp/mnt/sda1
hit enter
ls
hit enter
you should see the list directory in green: original_cfe.bin
Remove USB drive and install to PC . Close putty. Open the USB folder
.
.
If you used to the SSH way, Start at STEP 9 here in Alex’s guide. Pull your origional_cfe.bin. Upload it to https://cfeditor.pipeline.sh/ , Chose 1.0.2.0 US AiMesh, receive file “new_1.0.2.0_am.bin”.
Highlight the entire name (including .bin at the end):
new_1.0.2.0_am.bin
and change it to:
new_cfe.bin
.
Now you should have your 1.0.2.0 US AiMesh “new_cfe.bin” file to flash onto the 2 year old 68U.
Go from there… with either this Alex’s guide, or that video.
I replied to this, it has been 45mins, my reply still hasn’t posted.
Short reply:
Step 9 shows how to pull the original_cfe.bin.
– upload the original_cfe.bin ( the 2 year old router ) to the website
– chose 1.0.2.0 US AiMesh so the site edits your cfe.
– rename that new file to:
new_cfe.bin
(make sure you highlight the entire name when renaming it so it doesn’t end up as a .bin.bin file.)
Unzip the mtd-write because it is zipped in a zipped folder (2 times).
Follow directions.
When there’s links in the reply it sometimes sends them for manual approval to prevent spam. I know it is an inconvenience but there’s about a 1:1 ratio of spam comments advertising various stuff per actual relevant comments so it is absolutely necessary.
No worries Alex :)
I had a feeling that was the issue.
Hello ME3, thank you so much for your information, I followed your recommendations and everything seems to be working now.
Details here: I did the SSH way. I dumped the CFE of the old router to original_cfe.bin. Uploaded to https://cfeditor.pipeline.sh/ and downloaded the new version. Did a mtd-write. I then turned off the router and did a NVRAM reset. I was not able to connect to the router after that. I tried 192.168.29.1 and 192.168.1.1 and both were not working. I then hit the reset button. When the router booted up again, I was able to connect it as 192.168.1.1. I then followed the official steps to connect the router to be a aimesh node. It worked at the first try.
Thanks again for your help.
sweet!
Is there a way to download the 1.0.2.0 US AiMesh stock file?