If you are using the Netgear Orbi Pro (SXR80/SXS80) in a non-Netgear environment (e.g., behind a different router like a FritzBox that should handle DHCP and IPv6), you've probably noticed annoying log entries, constant "calling home" attempts via SOAP, and a closed ecosystem.

By "liberating" your Orbi trio with OpenWrt, you gain:

• No More SOAP Spam: Netgear’s proprietary communication (which fills logs on third-party networks) is completely gone.
• True "Dumb AP" Mode: Native support for professional bridge-mode without hidden DHCP or IPv6-address conflicts.
• Rock-Solid IPv6 & Multicast: Optimized IGMP snooping ensures your AirPlay, Spotify Connect, and Smart Home devices work instantly across all nodes.
• Pro-Level Mesh Roaming: Full control over 802.11r (Fast Transition) with custom Mobility Domains (e.g., cafe) for seamless transitions without dropouts.
• Privacy & Control: No cloud dependency, no mandatory Netgear account, and a much smaller attack surface for security.

Introduction

I own the Orbi Package of 2 satellites (sxs80) and the router (sxr80). Since Netgear decided to declare them as EOL and I still see a bug regarding multicast using IPv6, I decided to install OpenWrt. So the journey began. I make it short here: I started with Netgears latest firmware and the procedure from the manual at Github didn't work for me. First of all I have overseen the warning:

and Murphys Law war correct once again 🙃

This blog is for all who encountered the same problems as me that procedure "bricked" the device. Or want a stable way to install OpenWrt at these devices.

Phase 1 - Preparing the hardware

Parts

• A hair dryer
• A set of Torx screw drivers
• A serial interface (I used a FT232RL USB TTL USB-C to TTL serial converter adapter module for 3,3V and 5V)

Summary of the steps

1. Open your device
2. Solder Pin Header (my advice)
3. Connect a 3.3V serial adapter
4. Use a proper Terminal Software (i.e. CoolTerm - I used it because it provides a transmition control to delay input by 1ms)

1. Open the device

You will find the torx-screws below the rubber. I used a simple hair dryer to warm it up. Please take a look at this photo to see the location of the screws.

2. Locate the Test Pins for serial connection

Take a look on the left side. You will find TP17-TP20.

Test Point	Meaning	Use this point
TP17	VCC 3.3V	🛑 no!
TP18	TX	☑️
TP19	RX	☑️
TP20	GND	☑️

You see my pin header that I used. Now it's time to solder the pin header to the board.

3. Connect the serial adapter

Now connect the adapter crosswise.

Adapter	Pin Header
GND	GND (TP20)
TX	RX (TP19)
RX	TX (TP18)

Phase 2 - Software Installation (Flashing OpenWrt)

Now that you have your serial connection (115200 8N1) ready, follow these steps to replace the Netgear firmware with OpenWrt.

1. Preparation

Download the 4 files from the hardware page of OpenWrt (<release>.itb and <release>.bin for SXS80 and SXR80) and rename them to sxr80.itb / sxr80.bin (for the Router) and sxs80.itb / sxs80.bin (for the Satellite).

Ensure you have the following files ready on your PC/Mac or NAS in a directory provided by a TFTP server:

• sxr80.itb or sxs80.itb (The Initramfs image for the initial boot)

Copy the final firmware to a Mac or Linux that runs in the 192.168.1.0/24 network to later copy the file on your device.

• sxr80.bin or sxs80.bin (The Sysupgrade image for the permanent flash)

I used a Synology NAS and prepared a TFTP Server on it. I was lucky to have a second LAN Port in my NAS that I assigned a static IP (192.168.1.10)

2. Booting into OpenWrt (RAM-Disk)

Connect your PC/NAS (having a TFTP service at 192.168.1.10) to a LAN port (i.e. Port 2) of the Orbi (do not use the yellow WAN port for TFTP).

1. Power on the Orbi and immediately tap Enter in your terminal (e.g., CoolTerm) to interrupt the boot process. It will countdown - you will see it.

2. Once you see the IPQ807x# prompt, you are in the so-called U-Boot prompt. Set up the network environment:

   setenv ipaddr 192.168.1.1
   setenv serverip 192.168.1.10  # Replace with your PC/NAS IP
   setenv bootdelay 5
   # The "Magic" command to bypass Netgear's CRC check:
   setenv wrtboot 'mii write 0x0 0x0 0x800; sleep 1; nmrp; nand read 0x40000000 0x1980000 0x06d00000; bootm 0x40000000'
   saveenv

3. Load the Initramfs image via TFTP:

   tftpboot 0x44000000 sxs80.itb  # or sxr80.itb

4. Start die downloaded Image (OpenWrt)

   bootm 0x44000000

The Orbi will now boot into a temporary OpenWrt system. Press Enter to activate the console when prompted. You will see OpenWrt in ASCII Art. You device will now have the address 192.168.1.1

3. Copy the Firmware to the Orbi (SCP)

Now you need to transfer the permanent firmware image from your computer to the Orbi's temporary memory (/tmp).

On your Mac or Linux Terminal in your temporary 192.168.1.0/24 network, navigate to the folder where your .bin file is located and run:

# Replace 'sxs80.bin' with your actual filename (either Satellite or Router)
# The -O flag is required for compatibility with the Orbi's temporary SSH server
scp -O ./sxs80.bin root@192.168.1.1:/tmp/fw.bin

4. Flashing the image

1. Flash the firmware to make OpenWrt permanent:

sysupgrade -n /tmp/fw.bin

2. Write the correct start command: Now it's time to activate the prepared bootcmd that will boot OpenWrt instead of Netgear OS

setenv bootcmd 'run wrtboot'
saveenv
reset

This finalizes your work 😊

Optional stuff

You can add the WAN port to br-lan that you have more ports available if you wish.

Phase 3 - Optimal Configuration (Dumb AP & Mesh Roaming)

After the reboot, your Orbi is running OpenWrt with the default IP 192.168.1.1. To integrate it perfectly into an existing network (e.g., behind a FritzBox) and ensure seamless roaming, follow these steps.

1. The "Dumb AP" Setup

If you want your Orbi to act as a pure Access Point without its own DHCP server (to avoid IP conflicts), use the following UCI commands in the console.

Note: Change the IP address in the second line for each device (e.g., .2 for Router, .3 and .4 for Satellites).

# Set static IP and Gateway
uci set network.lan.proto='static'
uci set network.lan.ipaddr='192.168.10.2'
uci set network.lan.gateway='192.168.10.1'
uci set network.lan.dns='192.168.10.1'

# Disable IPv6 assignment to prevent conflicts with your main router
uci set network.lan.ip6assign=''

# Create a lan6 interface for the Orbi's own connectivity
uci set network.lan6=interface
uci set network.lan6.proto='dhcpv6'
uci set network.lan6.device='br-lan'
uci set network.lan6.reqaddress='try'
uci set network.lan6.reqprefix='no'

# Optimize Bridge for Multicast (AirPlay, Spotify Connect, etc.)
uci set network.@device[0].igmp_snooping='1'
uci set network.@device[0].multicast_querier='0'

# Disable DHCP Server and IPv6 Advertisements
uci set dhcp.lan.ignore='1'
uci set dhcp.lan.ra='disabled'
uci set dhcp.lan.dhcpv6='disabled'
uci set dhcp.lan.ndp='disabled'
uci set dhcp.@dnsmasq[0].authoritative='0'

uci commit
/etc/init.d/dnsmasq restart
/etc/init.d/network restart

2. Configure Wireless

I used Luci to configure my Wireless Setup for Radio 1 und Radio 2. Provide SSID and WPA2_PSK.

3. Seamless Roaming (802.11r)

To allow your devices to switch between Orbis without disconnecting (Fast Transition), you must synchronize the Mobility Domain across all units. Important for Apple Users: Apple devices are very strict. To ensure a stable connection, we force WPA2-CCMP and use Over-the-Air roaming.

# Execute this on all Orbi units
for radio in $(uci show wireless | grep "=wifi-iface" | cut -d'.' -f2 | cut -d'=' -f1); do
  uci set wireless.$radio.ieee80211r='1'
  uci set wireless.$radio.mobility_domain='cafe'  # Use any 4-digit hex code
  uci set wireless.$radio.ft_over_ds='0'          # Better for Apple devices
  uci set wireless.$radio.ft_psk_generate_local='1'
  uci set wireless.$radio.encryption='psk2'       # Force WPA2
  uci set wireless.$radio.cipher='ccmp'           # Force AES
done

uci commit wireless
wifi reload

4. Dark Mode (Optional)

If the green status LED is too bright at night, you can create a small script to turn it off 5 seconds after booting:

# Disable the default LED trigger
uci set system.led_status='led'
uci set system.led_status.sysfs='green:status'
uci set system.led_status.trigger='none'
uci commit system

# Create the startup script
printf '#!/bin/sh /etc/rc.common\nSTART=99\nstart() {\n  echo 1 > /sys/class/leds/green:status/brightness\n  sleep 5\n  echo 0 > /sys/class/leds/green:status/brightness\n}\n' > /etc/init.d/led_finish
chmod +x /etc/init.d/led_finish
/etc/init.d/led_finish enable

5. Final Result

You now have a high-performance Mesh system with:

• No SOAP log spam from the Netgear firmware.
• Instant AirPlay/Cast discovery thanks to IGMP snooping.
• Professional Roaming that handles handovers in milliseconds. Enjoy your "liberated" Orbi Pro!