Here is an example set of steps
sudo nmrpflash -v -i YOUR_ADAPTER_NAME -f R7000-V1.0.3.56_1.1.25.chk -t 10000 -T 10000 -A 10.0.0.2 -a 10.0.0.1
Right after running the command, power on your router. Your router checks for the nmrpflash server on boot. If all goes well you should see this:
sudo nmrpflash -v -i enp0s25 -f R7000-V1.0.3.56_1.1.25.chk -t 10000 -T 10000 -A 10.0.0.2 -a 10.0.0.1
Adding 10.0.0.2 to interface enp0s25.
Advertising NMRP server on enp0s25 ... /
Received configuration request from ab:cd:ef:12:34:56.
Sending configuration: 10.0.0.1/24.
Received upload request without filename.
Using remote filename 'R7000-V1.0.3.56_1.1.25.chk'.
Uploading R7000-V1.0.3.56_1.1.25.chk ... OK
Waiting for remote to respond.
Received keep-alive request (19).
Remote finished. Closing connection.
Reboot your device now.
Reboot the device. You now have old firwmare, congratulations.