Disclaimer: If you brick (i.e. ruin) your router by following this page, I will not be held responsible.  Although much effort has been made to ensure the correctness of the information presented here, it is possible there are still incorrect or outdated information.  I have personally tried flashing RT-N16 and RT-N12 B1 only.  (If you happen to make the router unbootable, retry the Asus recovery procedure with Asus stock firmware.)

Last update: 2015-10-10

Why install Tomato firmware?

  • You need a feature that is supported by one of the variants of Tomato but not the stock Asus firmware
  • You’re doing P2P and the router crashes / reboots
  • You’re having an issue that you suspect it to be a bug in the stock Asus firmware
  • You don’t like or don’t trust stock Asus firmware

What are the downsides of Tomato firmware?

  • In some cases, the WiFi behavior of the Asus firmware may be different from the Tomato firmware, because they usually use different versions of the Broadcom drivers.  In general, Asus stock firmware may offer slightly higher WiFi performance than Tomato, because Asus usually uses newer Broadcom drivers, while Tomato usually sticks with an older but proven release that is more compatible with other client devices.  As of June 2013, there are test builds of Tomato with newer and faster WiFi driver.
  • Tomato firmware disables Broadcom Cut-Through Forwarding (CTF) by default because it is incompatible with some Tomato features.  At least for some Asus models, on Asus firmware with QoS and certain features disabled, the router activates CTF (known as NAT Acceleration) and yields a throughput that is greater than on Tomato with QoS and CTF disabled.  Recent Tomato by Shibby firmwares show an option for enabling CTF, but there are reports that enabling it may not actually yield a difference for some models or firmwares.  Tomato by Shibby also does not support FastNAT because it is incompatible with QoS, Bandwidth limiter, IP Traffic, Bandwidth Monitor and Web usage functions.  According to Shibby, the performance impact of absence of CTF in Tomato WAN->LAN throughput is as follows:
  • RT-N16 without bcm_nat ~100-120Mbps
    RT-N16 with bcm_nat ~ 170Mbps
    RT-N66U/AC66u without bcm_nat ~240Mbps
    RT-N66U/AC66u with bcm_nat ~320Mbps
    RT-N18u/AC56u/AC68u without CTF ~330Mbps
    RT-N18u/AC56u/AC68u with CTF ~600Mbps
    R7000 without CTF ~410Mbps
    R7000 with CTF ~950Mbps

(In general, people with >300Mbps broadband may consider trying out Merlin firmware first.)

Why Asus router?

  • You want to run Tomato firmware, and a few Asus models are supported
  • Usually cheaper than Cisco / Linksys for the same level of hardware
  • You don’t like internal antennas as found in recent Cisco / Linksys models

Which Asus router to purchase?

[Older versions of this article included a section on my recommendations of Asus router.  It is now deleted and I have already changed to Netgear R7000 running XWRT Merlin firmware.  R7000 has the advantage of having 1GHz Broadcom dual-core ARM CPU, better than the 800MHz CPU in RT-AC68U, while the RT-AC68P (aka RT-AC68U V2) is not generally available worldwide yet, and reportedly Netgear runs cooler than Asus.  In addition to R7000’s own stock firmware, it can run Tomato Shibby firmware and even Merlin firmware, but since this is an article written for Asus routers, R7000 is not further discussed here.  Although I’m convinced R7000 is a really good router, It should be noted that this is definitely not a general recommendation for Netgear routers.  Various Netgear models have specific quirks.]

This is really important: only buy a router with 8MB flash or more.  Avoid all 4MB flash routers.

After flashing an Asus router to Tomato firmware, can I go back to Asus stock firmware?

Yes, simply use the Asus Firmware Restoration Utility from CD or web, together with the correct Asus firmware from web.

Differentiating among various models of Asus RT-N router series:

It is critical to find out the correct model of your router, its hardware revision, and the flash size before you proceed to install any third-party firmware such as Tomato to your router.  Unless otherwise stated, all Tomato-supported models in this list should use the RT-N driver instead of RT driver when choosing a correct Tomato firmware.

In addition to the following list I maintain, please also read the official supported router list of Tomato by Shibby

  • RT-AC5300: ARM dual core BC47094 @ 1.4GHz , 128MB Flash, 256MB RAM, 4×4 tri-band AC5300 (AC2166 + AC2166 + 1000).  Not supported by Tomato.
  • RT-AC3200: Essentially a dual 5GHz radio version of AC68P, 3×3 tri-band AC3200 (AC1300 + AC1300 + N600).  Not supported by Tomato (this requires integration of a newer major version of Broadcom SDK than Tomato uses, so this is a large effort that is unlikely to take place soon).  Can use Merlin firmware.  [Note: Netgear R8000 has the same level of hardware]
  • RT-AC3100:
  • RT-AC1200HP: This model does not use Broadcom chipset and therefore cannot run Tomato firmware
  • RT-AC1200:
  • RT-AC88U: ARM dual core BC47094 @ 1.4GHz , 128MB Flash (?), 512MB RAM, 4×4 AC3100 (AC2166 + 1000).  Not supported by Tomato.
  • RT-AC87U: ARM dual core BCM4709 @ 1GHz, plus Quantenna QSR1000 solution for 4×4 AC2400 (AC1733 + N600).  Since this not a complete Broadcom solution it will not run Tomato.  Can use Merlin firmware.
  • RT-AC68P: Also known as RT-AC68U V2, since it is a bug fix version of AC68U, with the CPU changed to ARM dual core BCM4709 @ 1GHz.  Use Shibby V129 or later.  Can also use Merlin firmware.  [Note: Netgear R7000 has the same level of hardware]
  • RT-AC68U: ARM dual core BCM4708A @ 800MHz, 128MB Flash, 256MB RAM, 3×3 AC1900 (AC1300 + N600).  It has a USB 3.0 performance issue that is fixed in AC68P hardware.  Use Shibby V118 or later.  Can also use Merlin firmware.
  • RT-AC68W: Same hardware as RT-AC68U but in white color
  • RT-AC66U: MIPS single core BCM4706@ 600MHz, 128MB Flash, 256MB RAM, 3×3 AC1750 (AC1300 + N450).  5GHz is only supported from Shibby Builds starting from 111.  Can also use Merlin firmware.
  • RT-AC66W: Same hardware as RT-AC66U but in white color
  • RT-AC66R: Same hardware as RT-AC66U but sold by BestBuy
  • RT-AC56U: ARM dual core BCM4708A @ 800MHz, 128MB Flash, 256MB RAM, 2×2 AC1200 (AC866 + N300), internal antennas.  Use Shibby V118 or later.  This is discontinued and replaced by AC56S.  Can also use Merlin firmware.  Note that many people have 2.4GHz issues with this router.
  • RT-AC56S: Single-core and 128MB RAM version of AC56U.  Note that many people have 2.4GHz issues with this router.  (Tomato support is to be confirmed.)
  • RT-AC55UHP: This model does not use Broadcom chipset and therefore cannot run Tomato firmware
  • RT-AC55U:This model does not use Broadcom chipset and therefore cannot run Tomato firmware
  • RT-AC54U: This model does not use Broadcom chipset and therefore cannot run Tomato firmware
  • RT-AC52U: This model does not use Broadcom chipset and therefore cannot run Tomato firmware
  • RT-AC51U: This model does not use Broadcom chipset and therefore cannot run Tomato firmware
  • RT-N66U: BCM4706@ 600MHz, 32MB Flash, 256MB RAM, dual band 5/2.4GHz support.  Only supported by Toastman Builds starting from 2012-2-(end) and Shibby Builds starting from 085V.  Can also use Merlin firmware.
  • RT-N66W: Same hardware as RT-N66U but in white color
  • RT-N66R: Same hardware as RT-N66U but sold by BestBuy
  • EA-N66: This model does not use Broadcom chipset and therefore cannot run Tomato firmware
  • RT-N65U: This model does not use Broadcom chipset and therefore cannot run Tomato firmware.  Can use Padavan firmware.
  • RT-N56U B1: This model does not use Broadcom chipset and therefore cannot run Tomato firmware.
  • RT-N56U: This model does not use Broadcom chipset and therefore cannot run Tomato firmware.  Can use Padavan firmware.
  • RT-N53: BCM5358U @ 300MHz, 8MB Flash, 32MB RAM, dual band 5/2.4GHz support.  Supported by Shibby build starting from 104 with 5GHz support.
  • RT-N53 H/W version A1: Supported by Shibby build starting from V114
  • RT-N18U: Basically a 2.4GHz N only version of AC68U, i.e. dual core ARM CPU @ 800MHz.  Supported by Shibby build starting from V122 (includes a bug fix for V121).
  • RT-N16: BCM4718 @ 480MHz, 32MB Flash, 128MB RAM, 2 USB 2.0.  Officially it is recommended to use RT driver versions of Tomato, although I use RT-N driver and it works for me.  It seems that many Tomato developers have this router, so this is a nice router for Tomato if your broadband is less than 150Mbps and you don’t need 5GHz WiFi.  I use one too.
  • RT-N15U: BCM5357 @ 500MHz, 8MB Flash, 64MB RAM, 1 USB 2.0.  Supported by Shibby build starting from 093.
  • RT-N15: This model is totally different from RT-N15U.  It does not use Broadcom chipset and therefore cannot run Tomato firmware.  You’re screwed.
  • RT-N14UHP: Seems to use Broadcom BCM5358, triple 9dB antenna.  It is far too expensive for a router without 1000Mbps Gigaibit Ethernet.  There is a forum report indicating success of flashing Tomato as if it is a N53 router, i.e. use RT-N
  • RT-N14U: This model does not use Broadcom chipset and therefore cannot run Tomato firmware.  Can use Padavan firmware.
  • RT-N13: This model does not use Broadcom chipset and therefore cannot run Tomato firmware
  • RT-N12+:
  • RT-N12 LX: This model is totally different from RT-N12 (without LX).  It does not use Broadcom chipset and therefore cannot run Tomato firmware.  You’re screwed.
  • RT-N12E B1:
  • RT-N12E: This model is totally different from RT-N12 (without E).  It does not use Broadcom chipset and therefore cannot run Tomato firmware.  You’re screwed.
  • RT-N12 H/W version 1: BCM4716 @ 300MHz, 4MB Flash (too small for recent firmware), 32MB RAM.  Recommended to use RT driver versions of Tomato, although RT-N driver should also work.  Beware there are reports of instability with this router.
  • RT-N12 H/W version B1: BCM5357B0@ 300MHz, 8MB Flash, 32MB RAM.  Only supported by Toastman Builds starting from 2012-2-6 and Shibby Builds starting from 083V.  Use RT-N.  (Note: There are many web pages listing this model having 4MB flash only, but the unit I tried really has 8MB flash, and many experts in relevant forums agree this model has 8MB flash too.)  (Newer shipments may have changed the chipset to BCM53572.)
  • RT-N12 H/W version C1: Same as RT-N12 B1 but with a “Black Diamond” appearance
  • RT-N12 H/W version D1: (To be confirmed) BCM53572.  This is functionally the same as C1 but equipped with a built-in signal amplifier.  Use RT-N
  • RT-N12HP B1:
  • RT-N12HP: This is functionally the same as D1 but equipped with two 9dbi antenna.  A review reported that its WiFi signal is good enough even after passing through two concrete walls.  There are multiple reports that Tomato works.
  • RT-N12 VP: I suspect this to be a cost-down version of RT-N12 D1, losing the signal amplifier and the antennas may become non-detachable.  There is a report of success using Tomato RT-N5x firmware.
  • RT-N11P: This model does not use Broadcom chipset and therefore cannot run Tomato firmware.  Can use Padavan firmware.
  • RT-N11: This model does not use Broadcom chipset and therefore cannot run Tomato firmware
  • RT-N10P: RT-N53572 @ 300MHz, 8MB Flash.  With a 5dbi antenna, it seems to be a nice 150Mbps WiFi budget variant of the excellent RT-N12 series.  Supported by Shibby build starting from V114.
  • RT-N10P V2: Unknown (To be confirmed)
  • RT-N10+: This model is totally different from RT-N10U.  It does not use Broadcom chipset and therefore cannot run Tomato firmware.  You’re screwed.
  • RT-N10+ B1 , C1: This model is totally different from RT-N10U.  It does not use Broadcom chipset and therefore cannot run Tomato firmware.  You’re screwed.
  • RT-N10+ D1: (To be confirmed)  BCM5356 @ 300MHz, 4MB Flash (too small for recent firmware), 16MB RAM.  There is a forum reporting stating success with flashing tomato, but with the following limitations: 1. Power LED does not behave correctly; 2. WAN/LAN ports are shifted, such that LAN Port 4 needs be used for WAN, and the original WAN port becomes LAN Port 1; 3. GUI nvram clear must not be used otherwise it goes back into firmware restoration mode
  • RT-N10 LX: This model is totally different from RT-N10U.  It does not use Broadcom chipset and therefore cannot run Tomato firmware.  You’re screwed.
  • RT-N10E: This model is totally different from RT-N10U.  It does not use Broadcom chipset and therefore cannot run Tomato firmware.  You’re screwed.
  • RT-N10E B1: (To be confirmed) I suspect this is very similar to RT-N10+ D1.  I have NOT found any report of success of running Tomato on this.
  • RT-N10 H/W version 1: BCM5356 @ 300MHz, 4MB Flash (too small for recent firmware), 16MB RAM.  Some versions of tomato support this model (Build 52 or earlier).  Some do not and WILL BRICK your router.  Exercise extreme caution.
  • RT-N10 H/W version B1 / C1 / D1: This model is totally different from H/W version 1.  It does not use Broadcom chipset and therefore cannot run Tomato firmware.  You’re screwed.
  • RT-N10U: BCM5357 (or BCM5356U?) @ 300MHz, 8MB Flash, 32MB RAM, 1 USB 2.0.  It is functionally a 150Mbps N-Lite (instead of 300Mbps N) version of RT-N12 B1 with a USB port added.  Only supported by Toastman Builds starting from 2012-2-6 and Shibby Builds starting from 079V (with a USB LED fix in 093)
  • RT-N10U B: Same as the original RT-N10U, but with a “Black Diamond” appearance

Choosing the right version of Tomato

There are several forks of Tomato by different developers, and some of which are no longer maintained.  For corporate environment, Toastman Builds are usually more suitable because it has DHCP disabled by default, such that a router that has lost its settings and rebooted will not run DHCP server accidentally.  For home users, many people prefer Shibby Builds – some variants come with Transmission BitTorrent client.

Shibby Builds:

Shibby Builds are available from http://tomato.groov.pl

How to choose:

  • For Shibby Builds, look into the K26ARM folder if your router uses an ARM CPU (i.e. RT-AC68P, RT-AC68U, RT-AC56U, RT-N18U).  Otherwise, if you have an RT-AC router (with MIPS CPU) instead of a RT-N router, look into the K26RT-AC folder.  For RT-N routers, look into the K26RT-N folder.  Special cases: For RT-N66U, you have a choice between using the K26RT-AC version or the K26RT-N version.  For RT-N16 or RT-N12 H/W version 1, you have a choice of RT-N driver or the old RT driver.
  • Find the latest release by version number with the appropriate language suffix (-EN or none for English).  To avoid the OpenSSL heartbleed bug, use only V117 or later.
  • Choose a “K26USB” or “K26” (without USB) firmware depending on whether the router hardware has USB ports or not
  • For specific models such as RT-AC66U, RT-N66U or RT-N53, there may be special builds for them, different from other models.  For RT-N53 the file is named in the format of tomato-K26USB-1.28.RT-N5x-MIPSR2-XXX-RT-N53.trx
  • If both MIPSR2 and MIPSR1 firmware are listed, use only MIPSR2 firmware for the Asus RT-N models described on this page
  • If your router has more than 8MB Flash, you may use the AIO (All-in-one) firmware with all features
  • If your router has a USB port and you need to run a BitTorrent client on the router, choose BT-VPN, otherwise I suggest Big-VPN.  (See the builds.png below)
  • Verify that its file size is less than the flash size of your router.  Be very careful if you have a 4MB Flash router – you may need to use Mini variants in order to fit the 4MB Flash requirement.  However, recent releases may not have any variant that will fit into 4MB.
  • Stay away from NVRAM60K versions or those with other model names (Ex000, F7Dxxxx, etc.)
  • There may special test builds with a newer and faster WiFi driver.

Here’s the builds.png that illustrates the different configurations of Tomato by Shibby.  This is not necessarily the latest version, if necessary please search each folder for the latest version.

Toastman Builds:

Toastman Builds are available from http://www.4shared.com/dir/v1BuINP3/Toastman_Builds.html  (Start from early 2012 It seems to require creating a free account for downloading.)

For latest build types, find “Toastman Releases” from linksysinfo.org

  • Mini – no USB, no CIFS, no Zebra
  • MiniIPV6 – no USB, no CIFS, no Zebra + IPv6
  • Std – normal build
  • Ext – normal + Extra utilities + NTFS
  • VPN – normal + Extras + NTFS + VPN
  • VPN-NOCAT – normal + Extras + NTFS + VPN + NOCAT portal

How to choose:

  • For Toastman Builds, go to the RT or RT-N folder according to your Asus model requirement discussed above.
  • Read the changelog and see which version you want to try out, or just go to the latest version.  To avoid the OpenSSL heartbleed bug, use firmware 2014-4-22 or newer.
  • If your router has USB port(s), find those firmwares with “USB” in the filename, otherwise find those firmwares without “USB” in the filename.
  • Unless you have to use the VLAN feature, do not choose a VLAN firmware.
  • Unless you have to use the Captive Portal feature, do not choose a NOCAT firmware.
  • Get a firmware with VPN in the filename, and verify that its file size is less than the flash size of your router.  Be very careful if you have a 4MB Flash router – you may need to use Std or Mini variants (instead of VPN) in order to fit the 4MB Flash requirement.
  • Stay away from NVRAM60K versions or those with other model names (Ex000, F7Dxxxx, etc.)

Installation Procedure (adapted from patricksheedy.net)

Note: some people say you need to install DD-WRT first.  I do NOT recommend anyone to install DD-WRT first before installing Tomato on Asus routers.

If you use a modem with router function provided by the ISP, make sure you have admin password for it AND the modem provides an option to be configured as “Bridge mode“.  Otherwise I’d recommend NOT installing Tomato in your case.

  1. Download a suitable tomato firmware as described above
  2. Install the Asus router utility from the CD that came with the router.  Run \Utility\setup.exe from the CD to install it.  If you no longer have the CD you can also download it from the Asus website.
  3. Disable Firewall on your computer.
  4. Disable anti-virus on your computer.
  5. Connect your computer to one of the LAN ports of the router with an ethernet cable.
  6. Assign a static IP of 192.168.1.10 and subnet mask 255.255.255.0 to your computer LAN port.
  7. Disconnect the router WAN port if you already have a cable plugged into that port.
  8. From Windows Start menu, run ASUS Utility -> RT-N Wireless Router -> Firmware Restoration.  (If you experience problems uploading, try running it as Administrator.)
  9. Click the Browse button and select the file that you downloaded in step #1. Don’t click the upload button yet.
  10. Put the router in recovery mode: Unplug the power cord of the router. Hold down the black Restore button using a pen (not the red button). Plug the power cord back in. Once the power light starts flashing slowing, release the Restore button. The power light should continue to flash. The flashing light means the router is ready to accept the new firmware in recovery mode.
  11. Click the upload button in the Restoration utility. If it warns about incorrect Asus firmware, ignore it. The firmware should now start uploading into the router. Don’t touch anything while the firmware is being uploaded. (Note: these steps worked when I flashed my RT-N16.  However, the utility could not find my RT-N12 B1 when I tried to flash the router, although it did work for other people.  After failing for more than a dozen times, I tried to perform the upload first before putting the router in recovery mode, then it finally worked.  Later I tried a different unit of RT-N12 B1 strangely it could be flashed the first time using the normal procedure.  If neither of these procedures work, please see the Addendum in The Wiert Corner, and the tftp method described by Simeon W in the comments section.)
  12. No matter whether the utility says the upload is completed, or it hangs at a certain percent, DO NOT PANIC, and WAIT FOR FIVE MINUTES before you do anything else.
  13. After five minutes, open a browser and go to http://192.168.1.1. Login with user “admin” (or “root”) and password “admin”. You should be logged into Tomato.  [Note: if you cannot access the router configuration page here, try pressing the WPS button (could be a different button for some models) for 30 seconds while powering on the router – See Demian’s comment below.]
  14. Administration -> Configuration -> Restore Default Configuration -> Erase all data in NVRAM memory(thorough) -> OK (Note: there is a forum report saying this reset function does not work properly on RT-N53 – in this case, try the hardware reset button.)
  15. After it is completed, login again, enable DHCP (for Toastman Builds), change admin password, enable WiFi security if you use WiFi, plug in your WAN connection and configure it.  Also take a look at the CPU frequency, you may need to manually change it if it is not correct.  (Note: overclocking your router is usually not a good idea from my experience.)
  16. Change your computer LAN port back to use DHCP (dynamic address) and dynamic DNS.
  17. If there is anything abnormal, some models require an additional reset by WPS button: Unplug the power of the router. Hold the WPS button on the back of the router.  Plug the router back in. Hold the button for about 30 seconds and release it.  You will need to reconfigure everything again – you must not backup the settings and restore settings – this defeats the purpose of the reset.

Troubleshooting

  • If you happen to make the router unbootable, retry the Asus recovery procedure with Asus stock firmware.  (This occurred to me once when I tried to upgrade a RT-N12 B1 from a 2012 Toastman Build to a 2014 Tomato by Shibby.  After some struggle with the timing precision required by the Asus Firmware Restoration utility, I recovered it successfully using Shibby V117 tomato-K26-1.28.RT-N5x-MIPSR2-117-Max.trx )
  • If you upgraded from DD-WRT to tomato but cannot login, it’s because you did not get the password before the upgrade, so you need to reset it – google for it
  • If something does not work as expected, try “Erase all data in NVRAM memory(thorough)”, and/or use the reset button.  You may also try the WPS button in addition to the reset button.  If you run Toastman build, remember that after this you’ll have to use static IP instead of DHCP to connect to the router before you can re-enable DHCP again.
  • If you experience WiFi issues, try a different WiFi channel, turn off Interference Mitigation and APSD Mode, use 20MHz instead of 40MHz channel bandwidth.  Turn off power saving at the WiFi client side (or set it to CAM if there is no off setting).  Auto channel in some configurations may yield channel 12 or channel 13, and many client devices do not support these channels without changes to an advanced setting (could be a driver property in case of Windows client).  If you’re using a test build with a newer WiFi driver, try falling back to the normal build, and vice versa.  If you’re using RT-N16 or the original RT-N12 H/W Version 1, you have an additional choice between RT driver or RT-N driver – try each of them to see which one works better.  If you’re using RT-N66U, you have an additional choice between the RT-N version and the RT-AC version.
  • If 5GHz does not work, check that you are using the correct build (especially for RT-N53 firmware, which may be different from others).  Set Country to EU.  Also try clearing the NVRAM data, and clearing it using the hardware reset button.
  • If AC mode does not work, set mode to Auto and Channel bandwidth to 80MHz.  Make sure you are on the latest Tomato compiled for RT-AC.
  • With very new router models that are not completely supported, sometimes the Ethernet port order may be reversed.  Look for a newer firmware, or try “Invert Ports Order” option.
  • If your router reboots while doing BitTorrent, etc., reduce the number of connections in the router and/or BitTorrent client.
  • If you use Shibby BT-VPN and found the built-in Transmission BitTorrent client to be unstable even after reducing the number of connections, you may try Big-VPN or BTgui instead, then install Transmission as optware.  This should be more stable.  Google for it.
  • If you have a 150Mbps+ broadband internet but found that Tomato is not delivering a reasonable WAN-to-LAN performance, try to make use of the bcm_nat module for Fast NAT.  Google for it.
  • Royee (see the comments section) found that the Windows driver for the network adapter needs to be updated in order to connect to the Tomato router.