Aug 18, 2013

TP-Link TL-WR702N clones and English firmware upgrade (FAST FWR171, Mercury MW151RM)

TP-Link
TL-WR702N
57×57×18mm
34g
FAST
FWR171
56×56×18mm
32g
Mercury
MW151RM
56×56×18mm
32g

TP-Link's TL-WR702N is essentially a TL-WR703N without the USB port, and with less memory (2M+16M vs 4M+32M). The international version is blue colored and has English firmware. The Chinese version comes in either lime or pink. Rebranded models are sold in China as FAST FWR171 and Mercury MW151RM; these obviously only come with Chinese firmware.

There is no DD-WRT or OpenWRT for these routers, due to the small flash rom size. However, it is possible to flash the official English firmware of the blue TL-WR702N to the lime/pink Chinese models, or to the FWR171 and MW151RM clones. This can be done easily without opening the case. To see what the firmware looks like, please visit this page. Below are some screenshots I took with the latest 702N firmware (130528) running on my FWR171.
The English WR702N firmware downloaded from TP-Link's website must be modified, in order to fool the stock Chinese firmware into accepting the update. Details can be found in this forum thread. As usual, I have created English firmware files for the Chinese 702N and the Fast/Mercury clones. I will be making them available to my customers through email.

The method of flashing the modified firmware is by a combination of the web configuration page and TFTP. You must have a TFTP server to host the firmware file. Windows users may use tftpd32. Once the TFTP server is up and running, enter its IP address and the filename of the firmware into the router's admin page, and click upgrade. The router will fetch the firmware from your TFTP server, flash it, and then reboot. If everything goes well, you should get the green TP-Link status page at the router's new IP address (192.168.0.254). From that point on, you will no longer need to worry about TFTP or firmware modding. The router will behave exactly as an English WR702N, and any official 702N firmware updates can be flashed directly via the web interface.

Jun 18, 2013

TP-Link TL-WN725N clones (Mercury MW150US, Fast FW150US)

TP-Link TL-WN725N 18.6×15×7.1mm

Mercury MW150US 18.9×14.8×6.85mm

Fast FW150US 18.9×14.8×6.85mm


TP-Link TL-WN725N is a 150Mbps wireless-N "nano" USB adapter. As with all popular TP-Link products, variants of TL-WN725N are sold under domestic Chinese brands as Mercury MW150US and Fast FW150US. All these adapters share the same internals. Drivers and user guides in English can be downloaded from TP-Link's website. Windows 7 and above has build-in support (plug and play) for these adapters.

TL-WN725N has two hardware revisions: V1 based on Realtek rtl8188cus, and V2 based on rtl8188eu. The same versions exist for Mercury MW150US and Fast FW150US. If you get any of these adapters today, chances are that you will receive a V2 with rtl8188eu. The version doesn't really matter in Windows. But in Linux it appears that V1 is better supported, although the driver for V2 has recently become available. If your Linux distro doesn't have built-in support for rtl8188eu, you can download the driver here and compile it yourself. Users of Raspberry Pi with Rasbian may also try this binary kernel module.

Jun 8, 2013

Mercury M301 and English firmware upgrade (TP-Link TL-MR11U, TL-MR3040)

Mercury
M301
105×62×17.5mm
102g
(incl. battery)


Available only in China, Mercury M301 is basically a TL-WR703N (or FAST FWR171-3G, Mercury MW151RM3G) with a built-in rechargeable battery. The 2000mAh battery is good for 4 to 5 hours of usage. TP-Link has two similar routers, TL-MR11U for the Chinese market, and TL-MR3040 for the international market. These routers differ only in the case, number of LEDs, and some non-essential hardware buttons. The default Chinese firmware of M301 can be replaced with the stock English firmware of TL-MR3040, or any 3rd party firmwares of TL-MR11U/TL-MR3040.


English firmwares


The stock English firmware of TL-MR3040 is recommended for normal users. It is very similar to the TL-MR3020 firmware, which I recommend on TL-WR703N, FWR171-3G and MW151RM3G. The list of compatible 3G/4G modem can be found here. TP-Link's firmware emulator is available here.

The next choice of English firmware is OpenWRT. The trunk and Gargoyle releases are available for both TL-MR11U and TL-MR3040. Any of these builds would work on the M301.

There is no official DD-WRT builds for TL-MR11U or TL-MR3040. I haven't tried the WR703N release on the M301; I doubt it would work, since the GPIO configurations are different. DD-WRT users should consider Gargoyle firmware as an alternative.

Firmware upgrade methods

Please refer to my previous post on firmware upgrades of TL-WR703N, FWR171-3G and MW151RM3G. The same methods also apply to the Mercury M301. Web upgrade is the easiest; modded MR3040 or OpenWRT firmwares are available to my customers through email.

The serial console/TFTP method is very doable on the M301, and does not need modded firmware. The case is held together by tabs and Phillips screws. It can be opened easily without damage. The serial console pins are standard through-holes in the bottom left of the picture below; the pinout is the same as TL-MR3040.

Jun 4, 2013

TP-Link TL-WR703N clones and English firmware upgrade (FAST FWR171-3G, Mercury MW151RM3G)

TP-Link TL-WR703N has two cheaper clones: FAST FWR171-3G and Mercury MW151RM3G. All 3 routers are identical except for the case and the color of the LED. They are also closely related to TP-Link TL-MR3020, which shares the same hardware platform but adds a hardware switch and additional status LEDs.

These routers let you create a wifi hotspot from a 3G/4G USB dongle. They can also be used as standard wireless router, AP, or range extender.

Here's a comparison of TL-WR703N and its rebranded models:

TP-Link
TL-WR703N
57×57×18mm
36g

FAST
FWR171-3G
56×56×18mm
34g

Out of stock
Mercury
MW151RM3G
56×56×18mm
34g


The stock firmwares on these routers are in Chinese, and support only a handful of 3G dongles from Chinese carriers. But, it can be quite easily replaced. There are several English firmwares to choose from, and several ways to load the firmware onto the router.


Choice of English firmware

Your options are: TL-MR3020 firmware, DD-WRT, and OpenWRT

1. The English firmware of TL-MR3020

I recommend this firmware to normal users, those who use the router as a router. It has out-of-box support for almost any 3G dongles you can find around the world. The MR3020 firmware runs perfectly fine on all 3 variants of 703N.

Features of the MR3020 firmware include:
  • Share a 3G/4G mobile connection, compatible with 120+ LTE/HSPA+/UMTS/EVDO 3G/4G USB modems (WiMax modems not supported)
  • IP-based bandwidth control allows administrators to determine how much bandwidth is allotted to each connected device
  • 3G/WAN failover guarantees an "always-online" internet connection
  • Three working modes: 3G/4G Router (for sharing a mobile internet connection through a USB modem), Travel Router (for sharing a wired internet connection), WISP Client Router (for sharing a wireless internet connection, a.k.a. stealing your neighbor's wireless network). 
  • WDS, WPS, WPA2, port forwarding, MAC filter, UPnP, QoS, dynamic DNS, etc
The firmware can be downloaded here. TP-Link also provides an emulator of the firmware's web interface.

2. DD-WRT

DD-WRT is used in most TL-WR703N sold on eBay that claim to have English firmware. It is a lot more powerful than the MR3020 firmware, but requires a lot more effort to set up. Compatibility with USB dongles can be found here.

By default, DD-WRT configures the only Ethernet port as a LAN port. This is okay if you want to use it as a 3G router, a wireless client router/repeater, or a simple access point. However, to use a wired internet connection with the router, the following steps must be done in the web GUI:
  1. Create a new bridge interface, br1, with the same IP address and subnet mask as the router itself, for example 192.168.1.1/255.255.255.0
  2. Assign the wireless interface ath0 to the newly created br1
  3. Make sure eth1 is assigned as the WAN port
  4. Add an instance of DHCPD to serve br1
Some guides on the internet suggest putting br1 in a different subnet. This requires changes to the firewall script to fix the NAT. In my opinion, it is fine to have the same IP address on two interfaces (br0 and br1, in our case). If you are not comfortable with that, just turn off br0, since it is not used any more. By the way, does anyone know why we can't just remove eth1 from br0, keeping only ath0? And what exactly is eth0 on this router?

The latest DD-WRT for the 703N family is available here. Go under the build directory, then look for "tp-link tl-wr703nv1".

3. OpenWRT

OpenWRT is for the brave souls that want to tinker with things. I am not a big fan of UCI, I think normal configuration files are just fine. As for USB dongles, you are pretty much on your own. I choose OpenWRT only because I need OpenVPN in the firmware. DD-WRT std only provides PPTP VPN, so I ended up building a customized OpenWRT image for my application.

The latest OpenWRT trunk image for the WR703N is available here. There are also several specialized OpenWRT based firmware projects:
  1. Gargoyle -- Great web interface with native USB modem support. Recommended alternative to DD-WRT.
  2. Maddox's firmware -- webcam server, USB over IP.
  3. PirateBox -- Web-based chat and file sharing.
  4. P.O.R.T.A.L -- Personal Onion Router To Assure Liberty. A gateway to anonymity and the deep web.
  5. ROOTer -- Enhanced USB modem support for Australian users.

Firmware upgrade methods

After you've decided on an English firmware, the next step is to put it onto the router. You can do this via the web GUI, bootloader commands, or a flash programmer.

1. Upgrade from the stock firmware's web interface

This method is as simple as uploading a file. Just point your browser to the router's admin interface (http://192.168.1.1, user/pass=admin/admin), navigate to the firmware upgrade page as indicated in the screenshots, upload the new firmware, wait for reboot, and it's done.

Now here's the bad news. The stock Chinese firmware on these routers will not accept firmware of a different model. So if you have a Fast FWR171-3G or a Mercury MW151RM3G, and attempt to upgrade to the MR3020 firmware or the WR703N DD-WRT firmware, it will be rejected. Turns out that the model info is embedded in the header of the firmware file. If the header is modified with the correct info, the foreign firmware will be accepted.

I have created modded MR3020 firmwares for the WR703N, FWR171-3G and MW151RM3G. But due to copyright issues, I won't post them here. If you buy the routers from me, I will email you the firmware along with detailed instructions on how to do the upgrade. With the modded MR3020 firmware, the router will also accept official firmware upgrades of MR3020 released by TP-Link, or any 3rd party firmwares built for MR3020.

I can also provide modded DD-WRT and OpenWRT firmwares for web upgrade. But I strongly recommend those who play with these firmwares to have a TTL serial adapter ready, since you will likely need it down the road. And with a serial console you should go with the TFTP method below, which doesn't need modded firmware.

2. Upgrade via bootloader commands in serial console with TFTP server



This method requires opening up the router and hooking it to a PC via a USB serial TTL adapter. The cheapest adapter from eBay will do the job for under $2 USD. On the PCB, there are two tiny copper pads labeled TP_IN and TP_OUT. Connect the first one to the adapter's TX pin, and the second one to the adapter's RX pin. Connect GND to the big solder pad as shown in the picture. My "probing station" was built from dental picks, alligator clips, and scotch tape. If you are soldering, make sure to use very thin wires and not to pull them, otherwise the pads may be lifted from the PCB.

You need a TFTP server to host the firmware file. I use OS X's built-in tftpd. Put the new firmware in the TFTP directory. The file size should be 3932160 bytes (0x3c0000). Get a terminal running over the serial port, for example by "screen /dev/ttyUSB0 115200" in linux. Plug in power to the router. As soon as you see the bootloader info, type "tpl" quickly and you'll be greeted with a prompt "hornet>". Now enter the following commands to flash and boot the new firmware.

setenv ipaddr <device-ip, e.g. 192.168.1.111>
setenv serverip <tftp-server-ip, e.g. 192.168.1.100>
tftpboot 0x80000000 <firmware filename on the tftp server>
erase 0x9f020000 +0x3c0000
cp.b 0x80000000 0x9f020000 0x3c0000
bootm 9f020000

3. Flash with a SPI programmer

This is obviously the last resort. It shouldn't be needed unless if you seriously messed up the firmware and damaged the bootloader, or if you are replacing the flashrom chip. I haven't tried it myself yet, but I'll have more info later when my flash programmer arrives.

Finally, some pictures from my old eBay store: