bla bla von ТИАГРА

Fonera – debricking and more

I compiled the information from some of my posts and the corresponding user comments into this Guide to Your Fonera, so please choose from the table of contents what you were actually looking for, or go ahead and read everything :) Finally, feel free to comment here!

So, you bricked it? Me, too. Don’t ask me how – it was almost the first thing I managed to do after taking it out of the box :)


I didn’t know about automatic firmware upgrade over the net, so i thought i’d do it right away, since i saw an option for it in the configuration panel. Downloaded v0.7.1.1 and uploaded it… got some nice messages of what it is doing and after 15 mins noting happened anymore. How nice, maybe it just rebootet to activate new firmware? So i waited another 15mins and nothing changed. Eventuelly i decided to unplug and reboot myself, which, apparently, was a mistake. Even though FON talks about “up to ten minutes”, flashing – maybe under rare circumstances – seems to take much longer! So what did we learn?

  1. Never interrupt after flashing, just wait half a day… just wait until you can reach the Fonera again, otherwise you will need what i’ll write below!
  2. Just don’t update yourself, it happens automagically anyway…

Ok, first was an email to FON-support, describing what i did. A whooping 30 mins later i got anwer from “David” and already the second eMail looked like this:

Hi Martin.
We0re going to exchange your router under warranty, but please, don’t try to manually update the firmware on the new one, since is done automatically when the router is connected to the net :-)
Could oyu please tell me your full name and adress, and a contact phone number?
Also, we need your bricked Fonera, could you put a note with your email on the package, so i can locate it easier when it arrives here?
FON Support

Nice! But do I want to wait that long? No… I waited 2 month for this thingy to arrive, how long would it take to exchange it? I already googled a little and found the pin layout of the internal serial/JTAG connector, so i thought i might just watch the little sucker booting, and see what’s the problem in the first place. Power and internet LEDs seemed to light, sometimes randomly, but you couldn’t reach it anymore on none of the interfaces.

We will use the serial console to communicate with the device, so first thing you do: Find out what’s really going on by bulding a serial cable. You need MAX232 level converter and some C’s and that’s about it. It has been described several times, so i’m not going to cover it here. If you don’t know what i’m talking about, try to use Google and be sure to read the comments! I actually used a MAX202. update: Here you can find the perfect howto for your serial port…

pinout fonera

There is also a 3.3V VCC at pin 2, but since my MAX232 needed 5V, i didn’t bother.

Then just take your favourite terminal application and connect to serial port using baudrate of 9600 with 8N1 settings. On OS X I used, which seems to be working quite nicely.

As pointed out by DarkBlade (I also experienced this, but thought I just built my serial cable to crappy(ly)…): It seems that the Fonera sometimes (or always?) doens’t want to boot when connected to serial. I narrowd it down to the connected TX at the Fonera side. If you don’t see anything and the little sucker apparently isn’t booting at all, disconnect the TX from the Fonera and boot with RX connected only. Once you see the first line of output running over your screen, quickly connect TX line, too. Other people just tried booting and connecting the serial cable only 5sec later, though i suppose you will need some practice, as the point where you need to activate the RedBoot bootloader will come after only a few lines of serial output. Just play a little and be quick :)

So what do we get while booting?

+PHY ID is 0022:5521
Ethernet eth0: MAC address 00:18:84:1b:b9:a8
IP:, Gateway:
Default server:

RedBoot(tm) bootstrap and debug environment [ROMRAM]
Non-certified release, version v1.3.0 - built 16:57:58, Aug 7 2006
Copyright (C) 2000, 2001, 2002, 2003, 2004 Red Hat, Inc.
Board: ap51

RAM: 0x80000000-0x81000000, [0x80040450-0x80fe1000] available
FLASH: 0xa8000000 - 0xa87f0000, 128 blocks of 0x00010000 bytes each.
== Executing boot script in 1.000 seconds - enter ^C to abort


The last line looks interesting, we’ll need it later. I’ll spare you some lines of bootlog and just post the last 5 lines…

Code: 8c920028 00809821 02408021 <8e020018> 8e030010 30420006 00621825 1460002a 00000000

Kernel panic: Attempted to kill init!

Ok, here we go! Booting ok until the point where it seems to encounter corrupted data in the flash, then just kernel panics. Just boot again and remember the CTRL+C at the right time (see above in bold…), which brings us to the RedBoot boot prompt:


I played a little with it but in the end had to ask someone who knew about it. Essentially i was told to:

  • Use Terminal with Xmodem, setup TFTP or HTTP server, provide an image
  • Tell the fonera where to get the image, make new rootfs and boot

Since it didn’t work right away for me due to some minor mistakes, i’ll post this as a step-by-step howto.

  1. Firstly, choose your preferred method of transport. Most people will have a Terminal programm with Xmodem support i guess. HTTP servers are easy 2 set up, too, some people might even go with the TFTP variant. (Thanx to the people in the comments for pointing out the two easier methods, i actually had to use the TFTP, because i was too lazy to read more about RedBoot…)

    • A TFTP OR HTTP server needs to be running on some other machine, e.g. your laptop. I used OS X on a powerbook and just did it the lazy way using TFTP Server, which is a GUI for the TFTP server that was shipped with OS X. Worked almost out of the box, i just had to repair some permissions on the /private/tftpboot folder. The image will later go to this folder.
    • The possibility to use HTTP-Server was pointed out in one of the comments, thank you for that! I guess just put the image in the webservers webroot and continue with the next step! :)
    • If your terminal program supports sending files via xmodem, you don’t need any servers and can continue with the next steop and prepare the image!


  2. Next thing is to prepare an image. For this you download the latest firmware from FON – e.g. from here. The file will be called something like fonera_0.7.1.1.fon. Yes, .fon that is. To make it and .tar.gz you’ll have to remove the first 519 bytes from that file. (If you happen to be using windows – how strange! – you might want to look at comment #15 in case you where wondering about the missing “dd” on your system…)

    dd if=fonera_0.7.1.1.fon of=fonera.tar.gz bs=519 skip=1


    • Unpack the resulting .tar.gz and copy the file rootfs.squashfs into your TFTP boot folder, e.g. /private/tftpboot.
    • Or, as pointed out above: In the HTTP-Servers root-dir.
    • For the Xmodem variant just remember were ypu unpacked it, since you’ll need to upload it later :D You can skip the next step and continue with downloading the image!


  3. Next, tell the Fonera client and server IP, or skip this step for the Xmodem variant:

    ip_addr -h server_ip -l fonera_ip/24

    Do not forget the /netmask_length at the end of your fonera_ip – i spent a good while to figure out why i always get a nice Cannot reach server… warning!

    RedBoot> ip_addr -h -l
    IP:, Gateway:

  4. Now we need to transfer the image file to the Fonera with our chosen method:

    • Download the imagefile using TFTP:

      RedBoot> load -r -b %{FREEMEMLO} rootfs.squashfs
      Using default protocol (TFTP)
      Raw file loaded 0x80040800-0x801c07ff, assumed entry at 0x80040800

    • Or, using http:

      RedBoot> load -r -b %{FREEMEMLO} rootfs.squashfs -m HTTP -h

      … where is the server ip! Nico has pointed out, that the image couldn’t be found with his apache, so he used /rootfs.squashfs instead. My best guess: It all depends on your webserver’s configuration – experiment a little with the path…
    • Or, using Xmodem (as pointed out in the comments by DarkBlade – Thanx!):

      RedBoot> load -r -b %{FREEMEMLO} -m xmodem

      … which should bring up the letter “C” on your console. Now you just use the Xmodem send feature of your terminal programm and transmit the file rootfs.squashfs.


  5. The last step is to create a new rootfs, replacing the bricked one from before:

    RedBoot> fis create rootfs
    An image named 'rootfs' exists - continue (y/n)? y

Now just reboot and you are all set :)

New mail from FON support, i think he is right – you void your warranty :D

Hello Martin
Thanks for the post :-)
But I’m afraid that once you opened the Fonera, you voided the warranty and we can’t exchange your router 8but i thinkt hat you have it running already, so there’s no need for another router, right?)
I think it would be good if you put a note on your blog stating that the people who do that void the warranty.
FON Customer Support

While we are at it, enable SSH on your Fonera. While booting you have to catch it just when you see this:

Please press Enter to activate this console.

You will get a root console where you have to login with user root and the password you set for your configuration section. The rest, again, has been described a hundred times, e.g. by jauzsi before :)

ssh on fonera

Control the automagic update function!

Fonera. Again. Recently i noticed that my public wifi wasn’t working anymore, but i thought ‘hey, as long as you can use the private one…’. Apart from the crappy webinterface that never worked for me, someone tinkered with my /etc/firewall.user and also reset passwort for root and so on. That is NOT nice FON! Again serial console, again enabling ssh. The firewall.user looked different, they just overwrote it. Sorry FON, that is not going to happen again, i’ll cut you off now. As suggested by Stefan and Michael, i’ll just disable the execution of the and check back by myself. IF the webinterface was working, i’d just let them update whatever they want, but it doesn’t work at all. So here we go in the end of /bin/thinclient:

#. /tmp/
cp /tmp/ /tmp/thinclient-$(date '+%Y%m%d-%H%M')

Anyway… happy sharing… now that it’s working AGAIN. &%”/&(/!&”!

Webinterface to WAN

In case you don’t have wlan at hands or just want to be able to configure the Fonera from somewhere else, you need to add 2 more firewall rules to /etc/firewall.user like that:

#http-interface 80 to WAN
iptables -t nat -A prerouting_rule -i $WAN -p tcp --dport 80 -j ACCEPT
iptables -A input_rule -i $WAN -p tcp --dport 80 -j ACCEPT

Happy administrating!

P.S.: This hint was brought to you by pet2001 :D

Recently I read in the FON-Forums, that some people are using huge antennas with their Foneras. Some of them now seem to be concerned about not meeting legal regulations concerning tx power anymore… Well… even though I personally don’t know anyone who’d really care, you can of course cut down the tx power to a level that suits your needs! So let’s check what’s standard:

root@OpenWrt:~# iwconfig ath0 | grep Tx-Power
Bit Rate:0 kb/s Tx-Power=18 dBm Sensitivity=0/3

As you can see, normal configuration is on 18dBm, which, in my calculations, should result into output power of 63mW. You can backcheck this via console:

root@OpenWrt:~# iwlist ath0 tx
ath0 8 available transmit-powers :
0 dBm (1 mW)
6 dBm (3 mW)
8 dBm (6 mW)
10 dBm (10 mW)
12 dBm (15 mW)
14 dBm (25 mW)
16 dBm (39 mW)
18 dBm (63 mW)
Current Tx-Power:18 dBm (63 mW)

Standard config indeed is 18dB = 63mW. You also get a list of all available power steps for the particular interface, where ath0 would refer the public and ath1 the private one. Now you can set tx power to one of the choices listed above. No need to tell whether you are setting dBm or mW, it will know by the numbers. E.g. for setting ath0 to 16dB = 38mW you would type:

root@OpenWrt:~# iwconfig ath0 txpower 16

And then just check back for success:

root@OpenWrt:~# iwconfig ath0 | grep Tx-Power
Bit Rate:0 kb/s Tx-Power=16 dBm Sensitivity=0/3

Now please don’t misuse this setting to virtually disable the FON concept by cutting down on ath0! :)

Finally, feel free to comment here!

This post is also available in: German

1 Comment

  1. Geert Geert
    July 10, 2015    

    Do you still have that firmware for FON2100 ?
    Could you make it downloadable for us?

Leave a Reply

Your email address will not be published. Required fields are marked *

Need something?