NETGEAR LBR20

Image Credits: https://www.the-ambient.com/reviews/netgear-orbi-4g-lte-router-lbr20-review-2532/

Flash the current SNAPSHOT of the Openwrt Factory image, or the most recent Factory stable release on Firmware Selector through the Netgear/Voxel firmware. The stable releases on Firmware Selector come with LuCi pre-installed.

• You will get a warning that the version you are trying to flash is older. Just click 'Yes' and proceed.
• Settings in the NVRAM (the settings for the Netgear/Voxel configuration you are currently running) do not get reset.
  • If you flash back to Netgear/Voxel, the LBR20 will start with the settings you had before you flashed Openwrt.
  • This is convenient, because if you have a little difficulty with Openwrt or need to test something out, the N/V firmware will still have your previous settings.

To consistently get the LBR20 into TFTP recovery mode, such as when you want to flash back to Netgear/Voxel from an active Openwrt image, pull power from the connector on the back, press and hold the RESET button with a SIM tool, and push the power connector back in. Wait 30 seconds before releasing the RESET button. The LBR20's white tower light should be regularly turning on and off, and the power LED indicator near the power port, should be blinking RED.

Now you can set your ethernet adapter to 192.168.1.10 and use your laptop to TFTP an image into the device on port 69, as per normal NETGEAR TFTP recovery.

Use the LAN2 port as the wired connection to your laptop when configuring the ORBI LBR20, not the WAN/LAN1 port.

Generic sysupgrade instructions → generic.sysupgrade

Note: Support was only recently introduced. There seems to be a bug where sysupgrade images seem to work, but then the LBR20 reboots into TFTP recovery mode.

Backup your settings, including anything in /root, before attempting a sysupgrade (from one version of Openwrt to another). It's highly likely you will need to do a TFTP flash of the full firmware, then restore your backup.

Follow the TFTP flash guide on this page, above.

See the TFTP flash guide above.

Use the LAN2 port as the wired connection to your laptop when flashing/configuring the ORBI LBR20, not the WAN/LAN1 port.

Follow OpenWrt's instructions to configure your root password.

First Boot: Right after flashing and the first boot, it is possible that the LBR20 won't have any Internet access. Perform a ping test from your computer or the router to verify. You may need to configure the modem itself to use the right communication protocol, or configure the APN and PDP (profile), depending on your mobile provider. Look at the instructions on ltedongle to learn how to configure the modem, if needed. Below is a summary of the configuration steps to set the APN and PDP Type and to configure the modem in QMI mode.

Modem Preparation: QMI protocol is the default and works the best OOTB, as some issues can exist with MBIM/ModemManager and the Quectel modem, related to setting the MTU on the device interface options. So do not set the MTU, otherwise your modem may work for 2 minutes then crash hard, requiring a reboot [MBIM will automatically detect then set the MTU by default, causing the same crash issue]. If you do want to change the QMI/MBIM mode, connect to your LBR20 via SSH and use Picocom or echo to send the AT command to instruct the modem to use another protocol. The device /dev/ttyUSB2 is usually the serial interface allowing to communicate with the Quectel modem on the LBR20.

For QMI (default mode of the modem and Openwrt):

echo -n -e 'AT+QCFG="usbnet",0\r\n' > /dev/ttyUSB2   

For MBIM:

echo -n -e 'AT+QCFG="usbnet",2\r\n' > /dev/ttyUSB2   

The modem will retain the selected protocol in its internal memory and will utilize it after rebooting.

Do a ping test again to check. If you have no internet access, reboot the router, try again, and proceed to configure the APN, APN Profile and PDP in QMI mode, if it's still not working.

Configure APN, Profile and PDP Type: If your OpenWrt installation doesn't come with LuCi preinstalled, you probably want to install it, but you will need internet access to download the packages. OpenWrt enables only IPv4 on the cell connection by default. That can be a problem, because downloads.openwrt.org can have trouble with only IPv4 connection attempts, so you may get errors when trying to run 'opkg update' or 'apk update' then e.g. 'opkg install luci-ssl' (so you can have web access to the LBR20, as SNAPSHOT does not contain LuCi). There are kludgy work-arounds for the underlying wget, but the best option is to use an SCP app (such as WinSCP) to connect into the LBR20, and edit the file /etc/config/network, changing the 'pdptype' value to be 'ipv4v6' instead of 'ipv4', and if needed, here is where you can add your provider's APN (if not provided by the SIM for some reason), or/and if needed, set the APN Profile, and then save and restart the router. At this point, you should have Internet access, particularly if the Orbi LBR20 was working previously on the Netgear/Voxel firmware.

The only text editor included with SNAPSHOT is VI. Not Nano or anything easier and intuitive. So editing the network config via SSH won't be easy, unless you want to learn how to use VI. That is why the suggestion to use SCP.

Here is a example of a network configured with an named APN, an APN Profile of 3, a PDP Type of IPv4 and IPv6, and the modem in QMI protocol.

config interface 'wan'
        option proto 'qmi'
        option device '/dev/cdc-wdm0'
        option auth 'none'
        option ipv6 '1'
        option pdptype 'ipv4v6'
        option profile '3' # Pull APN Profile number 3 from the SIM
        option v6profile '3' # Usually re-use the same number as you did for 'profile'
        option apn 'yourprovidersAPNgoeshere' # Optional. Choosing the correct APN Profile should load the correct APN into the modem without explicitly declaring an APN.

If your OpenWrt installation comes with LuCi preinstalled, you can easily configure APN/Profile and PDP Type using the web interface, but you might probably find that some extra packages are needed: luci-proto-qmi (or luci-proto-mbim).

If you still have connection issues: At this point you have three options:

• Configure the network manually as explained in the step before.
• Temporarily connect the router to a WAN via WiFi using one of the 3 wireless radios of the LBR20. You might use your mobile phone as a WiFi Hotspot to do it. Another option is to reconfigure the Ethernet port 1 to use it as a WAN interface instead of LAN. OpenWrt is pre-configured to use the Ethernet port 1 as a LAN interface, so connecting it another router won't give any internet access to the LBR20.
• Manually download the needed package on your computer and upload it to the router from the web interface.

• Troubleshooting & Optimization Section of the LTEDongle wiki guide.

• To work-around the inability to set the Device Interface wwan0 MTU directly, for optimal performance, see the LTEDongle link above.

• DO NOT, under any circumstances, configure the ORBI LBR20 tower LED lights (referred to as 'backlights' in the LED Configuration page in LuCi) to blink in coordination with wwan0 (cell modem) receive/transmit. While it looks cool, it causes some kind of hardware signal interference, which will cause a crash of your cellular connection/modem. If you notice, the Netgear and Voxel firmware do not use the tower light for a WAN activity indicator, and in those, that light is completely off when the LBR20 is connected and running properly. A solid LED when the link status is ON, such as a purple light by activating both the red and blue LEDs, is ok and does not interfere.

• NETGEAR provided only 2 firmware revisions for the LBR20 NA models and only 2 for the EA models, that could only be flashed through the Netgear (or Voxel) firmware: A05 and A06 01.002 for NA and A08 and A11 for EA. Both can have issues causing disconnects, or the modem to become unresponsive, sometimes requiring a reboot. See the LTEDongle Troubleshooting & Optimization Wiki Guide. The latest (05/2024) firmware for the NA model is A06 01.008, which seems very stable. The latest (07/2025) firmware version for the EA model is A13; versions A11, A12 and A13 seem very stable too but can still have regular disconnection issues. Beware that A13 on the EA model cannot be downgraded. See the Notes at the end of this page for details. The latest firmware is only available via the Quectel Support Forum. Quectel staff will email modem firmware to you on request, as they do not at present have a download site. It can take a week for them to response. It may be faster to register to the forum and email another member who has already received it! See also EG18NAPAR01xxxM4G Firmware Request and Firmware for EG18-EA.

• If you run the stock A05/A06 (NA model) or A08 (EA model), and do not have a WAN watchdog or modem reboot script running in cron (Scheduled Tasks) to try to compensate for the issues, the 4G LTE connection may just 'die', and you will have no internet, as explained before.

• The Quectel modem's firmware can be upgraded or downgraded. You can perform an easy upgrade/downgrade if you have what it's called a 'Delta' firmware which allows to go from a specific version to another. Netgear provides only delta packages: 'A08→A11' and 'A11→A08' for the EG18-EA (Europe/Australia), and 'A05→A06' and 'A06→A05' for the EG18-NA (USA). If you want to flash another version, you will need to perform the whole qfirehose process.
• Beware the the latest EA firmware (EA R01A13) cannot be downgraded without breaking the modem functionality. The release notes from Quectel clearly states The new firmware version cannot be downgraded to previous versions, otherwise the module will not be able to work normally.
• Netgear's official product page: https://www.netgear.com/home/mobile-wifi/routers/lbr20/. See the 'Downloads' section to find the latest router stock firmware and the official delta packages for the modem firmware.

• Qfirehose Quectel Modem Upgrade-Flashing Procedure: Once you have acquired the qfirehose binary, put it in /root and mark it as executable. Unzip the Quectel-provided firmware to your computer, and upload the contents [update folder, contents.xml, and md5.txt] to the /tmp folder. There isn't enough user-storage space partitioned on the Orbi LBR20 to put it in /root. Disable your wan-watchdog.sh script. From a terminal (laptop) with a wired connection to the router, run qfirehose -f /tmp. Allow the flash procedure to finish to 100% and confirm completion:

        * [083.292]: Upgrade module successfully.

  • The modem (not the entire router) will reboot in 10 seconds, and then reconnect to the cell provider.
  • Using picocom /dev/ttyUSB2, send the modem an AT+QGMR, to display the current firmware revision.
    
    • The latest A06 01.008 modem firmware, does not display a 01.008 revision code after the ...A06M4G response.
    • The Netgear-provided A05 firmware, also does not display a revision code after the A05M4G response.
    • The /dev/ttyUSB2 may disappear after flashing, and be replaced with /dev/ttyUSB3 (0,1,2&3 → 0,1,3&4). That is a temporary artifact of flashing the modem. You might try picocom /dev/ttyUSB3, or reboot the ORBI LBR20, and the assignments will revert to 0,1,2&3.

• NETGEAR falsely advertises the LBR20 as a “1,200Mb/s 4G” device. The reason that is provable, is first, it only has 2 physical antennas connected to the modem. Those are connected to ANTMAIN and ANTDIV. The modem's MIMO antennas ANTMIMO1 and ANTMIMO2, the 3rd and 4th antennas, are not hooked to anything. Therefore, it can only Carrier Aggregate 2x Bands in that mode, not 4, so the data rates are reduced, and this is also in to Quectel's documentation. You can confirm this, by connecting via SSH, then using Picocom (picocom /dev/ttyUSB2) and sending AT+QNWCFG=“mimo_ctrl”, which will respond +QNWCFG: “mimo_ctrl”,0. The 0 means it's not on. The device in that mode is only using it's ANTMAIN and ANTDIV. AT+QNWCFG=“mimo_ctrl”,1 turns on MIMO Diversity. Then send AT+QCAINFO, which responds with Carrier Aggregation information. It will show, at most, primary pcc and secondary scc Band information. Again, because the 3rd and 4th antennas are not connected. Then AT+QRSRP, which responds with the raw MIMO signal strength per antenna. You'll get +QRSRP: -96,-94,-140,-140, where -96 is the value for ANTMAIN, -94 is the value for ANTDIV, and the values for MIMO1 and MIMO2 are both -140 - no signal. Regarding rates, most cell providers are not provisioning that much data per subscriber, anyway. The maximum provisioned data rate can also vary by region.

The default network configuration in Openwrt is:

→ hardware.button on how to use and configure the hardware button(s). Here, we merely name the buttons, so we can use them in the above Howto.

The Netgear LBR20 has the following buttons:

Here's is an example to reconfigure the Sync (wired to wps inside OpenWrt) button to turn on and off the white backlight LED:

1. Rename the file /etc/rc.button/wps to /etc/rc.button/wps_old
2. Write a new /etc/rc.button/wps file with the following content:

#!/bin/sh
LED_PATH="/sys/class/leds/white:backlight/brightness"
if [ "$ACTION" = "pressed" ] && [ "$BUTTON" = "wps" ]; then
    LED_BRIGHTNESS=$(cat "$LED_PATH")
    if [ "$LED_BRIGHTNESS" -gt 0 ]; then
        # led is on, turn off
        echo 0 > "$LED_PATH"
        logger -t rc.buttons "WPS button: LED is OFF"
    else
        # led if off, turn on
        echo 255 > "$LED_PATH"
        logger -t rc.buttons "WPS button: LED is ON"
    fi
fi

Press the 'Sync' button repeatedly in the back of the modem and see the white orb LED turning on and off.

---- datatemplatelist dttpllist ---- template: meta:template_datatemplatelist cols : Brand, Model, Versions, Device Type, Availability, Supported Since Commit_git, Supported since Rel, Supported current Rel, Unsupported, Bootloader, CPU, Target, CPU MHz, Flash MBs, RAM MB, Switch, Ethernet 100M ports_, Ethernet Gbit ports_, Comments network ports_, Modem, VLAN, WLAN 2.4GHz, WLAN 5.0GHz, WLAN Hardwares, WLAN Comments_, Detachable Antennas_, USB ports_, SATA ports_, Comments USB SATA ports_, Serial, JTAG, LED count, Button count, Power supply, Device Techdata_pageid, Forum topic URL_url, wikidevi URL_url, OEM Device Homepage URL_url, Firmware OEM Stock URL_url, Firmware OpenWrt Install URL_url, Firmware OpenWrt Upgrade URL_url, Comments_ filter : Brand=Netgear filter : Model=LBR20 filter : Versions=

See above photos.

→ Warranty

Here's a good video on how to open it up: https://www.youtube.com/watch?v=ModkiMVGvu8

• Remove the 8mm nuts on the LTE External antenna connectors.
• There are Torx screws above and to the outer side of the LTE Antenna ports, behind the rear label.
• Cut the bottom label in half along the seam, or peel it off.
• Remove the two rubber feet on either side, that bridge the front and back halves of the case.
• Now you can slide the front half of the case down, and it will lift directly off.

→ port.serial general information about the serial port, serial port cable, etc.

How to connect to the Serial Port of this specific device:
Insert photo of PCB with markings for serial port

→ port.jtag general information about the JTAG port, JTAG cable, etc.

How to connect to the JTAG Port of this specific device:
Insert photo of PCB with markings for JTAG port

→ bootloader

See the above Youtube video, as after he separates the case, it goes into how to install additional antennas. The ORBI LBR20 has internal UF.L connectors.

• You can download a the full list of AT commands accepted by the Quectel modem, which is very well written and detailed, on their website Quectel EG-18 product page. You might need to register on their site to be able to download documentation. The latest version of the document (07/2025) is V.1.1; filename quectel_em12eg12eg18_series_at_commands_manual_v1-1.pdf.

How to add tags