Orbi RBR750 — Automatic Daily Reboot

A reference for the working setup: a script on the Synology NAS that logs into the
Orbi, grabs a fresh security token, and triggers a reboot — run daily by DSM Task Scheduler.

Router: Netgear Orbi RBR750, firmware V7.2.8.5_5.1.21
Router IP: 192.168.1.1
Runs on: Synology DS1520+ NAS (192.168.1.40)
Script location: ~/orbi-reboot.sh
Log location: ~/orbi-reboot.log

How it works (the key insight)

The reboot is NOT a simple URL. This firmware uses a small handshake:

Load Reboot_confirm.htm — this sets a session cookie and contains a one-time token.
The reboot is actually a POST to newgui_adv_home.cgi?id=<token> — not reboot_update.cgi,
which is what tripped us up for a while.
The POST body must contain buttonSelect=2 (this is the value the page's JavaScript fills in
when you click "Yes").
The token comes from the form's own action line on the reboot page:
<form action="newgui_adv_home.cgi?id=...">. It is single-use, so the script must scrape a fresh
one on every run.

If the firmware ever updates and the script stops working, re-capture the reboot request in the
browser's Developer Tools (Network tab) and check whether the URL, token source, or form field
have changed.

The working script

Saved at ~/orbi-reboot.sh on the NAS. Replace xxxxxxx with your real Orbi admin password.

#!/bin/bash
# Orbi RBR750 reboot script
ORBI_IP="192.168.1.1"
ORBI_USER="admin"
ORBI_PASS='xxxxxxx'
BASE_URL="http://$ORBI_IP"
COOKIE_JAR="/tmp/orbi-cookies.$"
PAGE="/tmp/orbi-reboot-page.$"
POST_OUT="/tmp/orbi-reboot-post.$"
LOG="$HOME/orbi-reboot.log"
cleanup() {
  rm -f "$COOKIE_JAR"
}
fail() {
  echo "$(date): ERROR - $1" >> "$LOG"
  echo "$(date): debug files: $PAGE $POST_OUT" >> "$LOG"
  exit 1
}
trap cleanup EXIT
AUTH_ARGS=(--anyauth -u "$ORBI_USER:$ORBI_PASS")
HTTP_CODE=$(curl -sS -L \
  "${AUTH_ARGS[@]}" \
  -c "$COOKIE_JAR" \
  -o "$PAGE" \
  -w "%{http_code}" \
  "$BASE_URL/Reboot_confirm.htm") || fail "could not load reboot page"
TOKEN=$(grep -oE 'newgui_adv_home\.cgi\?id=[A-Za-z0-9]+' "$PAGE" \
  | head -n1 \
  | sed 's/.*id=//')
[ -n "$TOKEN" ] || fail "could not get token. HTTP=$HTTP_CODE"
HTTP_CODE=$(curl -sS -L \
  "${AUTH_ARGS[@]}" \
  -b "$COOKIE_JAR" \
  -c "$COOKIE_JAR" \
  -o "$POST_OUT" \
  -w "%{http_code}" \
  -X POST "$BASE_URL/newgui_adv_home.cgi?id=$TOKEN" \
  -H "Content-Type: application/x-www-form-urlencoded" \
  -H "Referer: $BASE_URL/Reboot_confirm.htm" \
  --data 'buttonHit=&buttonValue=&buttonSelect=2') || fail "reboot POST failed"
case "$HTTP_CODE" in
  200|302)
    echo "$(date): reboot command sent. HTTP=$HTTP_CODE token=${TOKEN:0:8}..." >> "$LOG"
    rm -f "$PAGE" "$POST_OUT"
    ;;
  *)
    fail "unexpected reboot POST HTTP=$HTTP_CODE"
    ;;
esac

Rebuilding from scratch (if ever needed)

Step 1 — Put the script on the NAS

SSH into the NAS, then create the file:

nano ~/orbi-reboot.sh

Paste the script above, set your real password, then save and exit
(Ctrl+O, Enter, Ctrl+X).

Step 2 — Make it executable

chmod +x ~/orbi-reboot.sh

Step 3 — Test it (this reboots the Orbi)

~/orbi-reboot.sh
cat ~/orbi-reboot.log

A line like reboot command sent. HTTP=200 ... plus a real Wi-Fi drop means success.

Step 4 — Schedule it daily (DSM Task Scheduler)

Control Panel → Task Scheduler → Create → Scheduled Task → User-defined script.

General tab: name it (e.g. "Orbi Daily Reboot"), user = your account.
Schedule tab: Daily, at a quiet hour (e.g. 4:00 AM).
Task Settings tab: under "Run command", enter:
```
/var/services/homes/<your-username>/orbi-reboot.sh
```
(Use the full path; ~ may not resolve inside Task Scheduler.)

Maintenance notes

Check the log anytime: cat ~/orbi-reboot.log
If you change the Orbi admin password, update the ORBI_PASS line in the script to match,
or it will stop working.
Security reminder: during setup the password appeared in encoded form in command output and
screenshots. The encoding is easily reversible, so changing the Orbi admin password is recommended.
If it breaks after a firmware update, re-capture the reboot request in browser DevTools and
compare the URL, token, and form fields against this document.