TP-Link TL-WDR4300 (N750)

TP-Link TL-WDR4300 has 802.11n Dual Band (concurrent) WiFi and Gigabit Ethernet. Advertised as 750 Mbps it is Dual-Stream (2×2) on the 2.4 GHz Band and Triple-Stream (3×3) on the 5 GHz Band. Same as the TL-WDR4310.

Related to TL-WDR3600, which has only two instead of three antennas.

SECURITY WARNING: Unpatched http/tftp backdoor in original firmware: http://sekurak.pl/tp-link-httptftp-backdoor/

NOTE: The Ethernet switch in this device, AR8327N, is working fine with the OpenWrt default configuration. Some of the more advanced functions of the switch are not yet fully supported by the driver in 12.09.

ALSO NOTE: The Ethernet switch lets WAN traffic through for a few seconds on bootup. This can be a problem.

If your wireless cannot be enabled when using wide channel modes, this may be due to the friendly neighbor “feature” that prohibits operation of such a mode and you may have to use the standard modes before wireless can be enabled.

• Download OpenWrt factory image as shown above
• Rename it to the format that the original firmware expects. Something like: wdr4300v1_en_3_14_3_up_boot(150518).bin. Otherwise the page will show error messages like “please select a file to upgrade”.
• Connect your PC to a LAN port of the TP-link via ethernet.
• Login to the TP-link web administration webpage. (Default address is 192.168.0.1)
• Under 'System Tools' select 'Firmware Upgrade'. Browse to the previously downloaded *.bin file. Click Upgrade.
• Connect to http://192.168.1.1 with your web browser
• Set your password and configure the router through the web UI. Basic Config

Note: Factory default IP address range is 192.168.0.1 while OpenWrt uses 192.168.1.1 by default. If you have trouble accessing your router after initial flash, check that you have a 192.168.1.x IP address on your PC.

1. Update to stock firmware: 3.13.33(130617) before installation (highly recommended). This firmware features a bootloader with handy TFTP recovery mode → Flashing via TFTP, de-brick or OEM installation using the TFTP recovery
2. Download OpenWrt factory image as shown above
3. Look for openwrt-ar71xx-generic-tl-wdr4300-v1-squashfs-factory.bin, unless your device was purchased in Israel. In that case, look for openwrt-ar71xx-generic-tl-wdr4300-v1-il-squashfs-factory.bin.
4. Rename the file (original firmware expects a specific format)
   1. The following filename will please the vendor's web UI firmware update tool: wdr4300v1_en_3_14_3_up_boot(150518).bin
   2. Otherwise the page will show error messages like “please select a file to upgrade,” or will not respond to clicking the upgrade firmware button.
5. Use the original firmware vendor's Firmware Upgrade tool to write this firmware-file onto the flash-chip of your device.

Once installed, in order to use wifi, you need to activate wifi in the configuration, see wireless configuration.

NOTES

1. When flashing the factory firmware image using the web interface, you may see TP-Link's error code of 180005 saying something like the “version of the upgraded file was incorrect”. That means your device's firmware is locked to a particular region. See Error code 18005
2. Recent (2016+) TP-Link firmware in the USA may be locked to prevent re-flashing. If you have such locked firmware, you can downgrade to use the original TP-Link firmware and flash OpenWrt from the web interface. You will need tools from dd-wrt to effect the downgrade: go to dd-wrt website and search the router database for wdr4300, then download the TL-WDR4300v1-webrevert.rar file from the router database page. Unrar the file to extract the binary. Next, from https://dd-wrt.com/site/support/other-downloads, select betas for the WDR4300, then select the most recent date (e.g.2016), then find the latest wdr4300v1. Your path is reported as something like: Downloads › betas › 2016 › 08-24-2016-r30471 › tplink_tl-wdr4300v1. Download the file factory-to-ddwrt.bin. This tool will install dd-wrt, and the revert tool will then install the original unlocked TP-Link firmware. To flash dd-wrt (dd-wrt reccomends IE/windows for this), login to the locked TP-Link router (admin/admin), and then use the “System Tool Update Firmware” to flash the factory-to-ddwrt.bin file. After the router has finished rebooting, the router has dd-wrt running at http://192.168.1.1, and you are ready to revert to the unlocked TP-Link firmware. Browse to 192.168.1.1, assign an ID/PW, then navigate to Administration → Firmware Upgrade. Select the extracted tl-wdr4300v1-webrevert.bin from your host's download directory and click the Upgrade button, dd-wrt will be replaced with the original unlocked TP-Link firmware. Now browse to http://192.168.1.1, hit reset on the router for 5+ seconds to revert the ID to admin/admin and reboot. The router is now running the old TP-Link unlocked firmware at the IP address 192.168.0.1, after the router reboots, browse to http://192.168.0.1 and login with admin/admin. To install Openwrt firmware, browse to System Tools → Firmware Upgrade and select the new firmware file of your choice (e.g.: OpenWrt Designated Driver) and click Upgrade to flash the WDR4300 with OpenWrt.
3. TP-Link's firmware defaults to 192.168.0.1 with username “admin” and password “admin”. After installation, OpenWrt defaults to 192.168.1.1 and no assigned password.
4. Precompiled images do not activate the wireless feature by default (you will have to use Ethernet for the initial configuration).
5. Trunk images don't have luci, you must install it manually, see luci.essentials
6. For devices in Israel, try flashing the original image first, in most cases it will work just fine. Devices that require the Israeli firmware will show a warning on the Firmware Update page. If you see this warning, fallback to the “-il-” image. The Israeli firmware differs only in the Hardware ID, in order to enable flashing from the original firmware interface. There is no difference between the images otherwise. See this thread for details.
7. Images for the TP-Link 3600 are largely compatible with a simple modification to the header of the firmware image. The PCB for both models is identical, or close to identical. The third external antenna on the 4300 is on the PCB of the 3600, but not connected to an external antenna.
8. Firmware version 3.14.3 Build 151104 Rel.45874n and hardware version WDR4300 v1 00000000 seems to be locked.

WARNING: Do not flash the sysupgrade firmware via the vendor firmware web interface. Only the 'factory' images should be flashed from the vendor firmware.

Pressing the WPS/Reset button during powerup makes the bootstrap loader enter the TFTP recovery mode. After pushing the reset button, the arrows should be lighten up. The procedure can be used to transfer a firmware image:

1. assign 192.168.0.66 to your local network interface (the router uses 192.168.0.86)
2. publish a firmware image via tftp: cp openwrt-ar71xx-generic-tl-wdr4300-v1-squashfs-factory.bin /srv/tftp/wdr4300v1_tp_recovery.bin
3. configure your tftp server. best if you can have some way of watching the log file so you can see if the router is requesting the file
4. turn on the router, wait until the second light from the left - the asterisk - starts flashing, hold down the WPS button on the back for a few seconds until the asterisk starts flashing faster
5. OR (some models are different) hold down the WPS button on the back and THEN power up the router. You will know it is attempting to transfer the file when the light furthest on the right lights up.
6. wait for the firmware transfer (about 20s), firmware flash (about 90s) and subsequent reboot (about 30s)

If OpenWrt is already installed and you wish to upgrade to a newer version, you have two methods available:

1. Flash Overwrite
2. Generic Sysupgrade

(prior to actual flashing given availability of a serial console it's a nice idea to do dry runs, by ad-hoc RAM booting a factory.bin from a TFTP host server, via uboot “tftp” + “bootm”, served via WDR3600's default 6F01A8C0.img filename).

• Login as root via SSH
• Check memory usage with the free or top commands. The image can be up to 8MB, so only proceed if you have as much free RAM as the image size plus 6-8MB; this should not be a problem on a device with 128 MB RAM.
• An easy way to free up some RAM is to delete the symlinks to /etc/modules.d/20-cfg80211, /etc/modules.d/21-mac80211, /etc/modules.d/2*-ath* and /etc/modules.d/[4-9]*-* and reboot. Drop caches can be useful too:

echo 3 > /proc/sys/vm/drop_caches

• wget or scp the new firmware build to /tmp/
• And finally:

cd /tmp
wget http://domain.tld/openwrt-ar71xx-generic-tl-wdr4300-v1-squashfs-factory.bin
mtd -r write /tmp/openwrt-ar71xx-generic-tl-wdr4300-v1-squashfs-factory.bin firmware

Alternately, you can follow the generic.sysupgrade procedure. Don't forget to populate your /etc/sysupgrade.conf first.

For systems where OpenWrt mtd is not available, mtd-utils commands need to be used (subsequent commands boldly assume that it's mtd5 which equals the “firmware” mtd partition name - cat /proc/mtd to verify!!):

flash_eraseall /dev/mtd5
nandwrite /dev/mtd5 /tmp/openwrt-ar71xx-generic-tl-wdr4300-v1-squashfs-factory.bin

(write operation will take about 5 minutes to complete)

Note that output of newer mtd-utils flash_eraseall recommends using “flash_erase <dev> 0 0” instead (did not test it).

Please read the article flash.layout for a better understanding. It contains a couple of explanations. Then let's have a quick view at flash layout of this particular device:

ART = Atheros Radio Test - it contains mac addresses and calibration data for the wifi (EEPROM). If it is missing or corrupt, ath9k won't come up anymore.

Power up your router. When the 'SYS' light (asterisk symbol right of the power light) starts to blink, immediately push the WPS/Reset button on the back-left of the router for a short time (>1 sec). The 'SYS' light should now start to blink very fast.

On a TL-WDR4300 Ver 1.6 and Barrier Breaker Bleeding Edge, r39211, the above instructions were not terribly successful. The only way that I was able to get the router into failsafe mode was to quickly and repeatedly press the WPS/Reset button starting before the front panel “star” LED started flashing. When that LED finally lit, it appeared to go directly into the rapid-flashing “failsafe” indication. If the WPS LED lights (rightmost, “yin-yang arrows”), it may be that you started clicking the button a little early in the boot sequence.

Years later, at least with OpenWrt/LEDE 17.01, the “magic moment” is the two seconds that the “on” LED starts flashing. As this is from the preinit code, it likely applies to most similar models. (Confirmed on TP-Link Archer C7)

For what you can do in failsafe, go to the OpenWrt Failsafe Mode page.

DON'T TRY to flash wdr4300 with wdr4310 firmware and vice-versa!

The stock firmware is obtained from the OEM: https://www.tp-link.com/en/download/TL-WDR4300.html#Firmware As with the WR1043ND router, there is a also a catch with the WDR4300!!

• in case the file name of this firmware file does not contain the word “boot” in it, you can simply revert back to original firmware. → generic.uninstall
• in case the file name of this firmware file does contain the word “boot” in it, you need to cut off parts of the image file before flashing it

An example of an image file with the word “boot” in it is wdr4300v1_en_3_13_17_up_boot(120426).bin or wdr4300v1_en_3_14_3_up_boot(150518).

Cut the first 0x20200 (that is 131,584 = 257*512) Bytes from original firmware: (1*512 Vendor-info + 256*512 U-Boot)

If you want to find an image that does not contain the word “boot” from the OEM, try downloading smaller zip-files first. With status 12th October 2016 no such zip-files can be downloaded from the vendor's website.

wget or scp the stock firmware file to /tmp/
cd /tmp
dd if=orig.bin of=tplink.bin skip=257 bs=512

(Note: For 3_13_17 the File size should now be exactly: 8,126,464 Bytes, for 3_14_3 the File size should be exactly 8,060,928).

Now the resulting file can be flashed via mtd or web interface (web interface-method is tested 12 Oct 2016, works with 3_14_3)

Other caveats (from vendor web UI):

• If the firmware path is too short, it will fail with the incorrect error 'firmware path too long'. For instance, flashing c:\openwrt.bin will not work.
• If the firmware path is too long, it will fail with the error 'firmware path too long'.

Now follow → generic.uninstall

The stock firware (3.13.33(130617)) features a TFTP recovery client in bootloader. To activate it press and hold WPS/Reset Button during powering on until WPS LED turns on. Connect computer to LAN1. Using TCPdump, you should see ARP requests from router having address 192.168.0.86 looking for address 192.168.0.66.

# tcpdump -ni eth0 arp
ARP, Request who-has 192.168.0.66 tell 192.168.0.86, length 46

Set up your computer to address 192.168.0.66, netmask /24 (255.255.255.0).

# ip addr add dev eth0 192.168.0.66/24

Using TCPdump, you should now see request for new firmware image:

# tcpdump -npi eth0 udp
IP 192.168.0.86.2195 > 192.168.0.66.69:  44 RRQ "wdr4300v1_tp_recovery.bin" octet timeout 5

Rename factory image to given name and put it into TFTP server root. → generic.flashing.tftp

In case you are flashing back original firmware, make sure original firmware image name does not contain word boot → Back to original firmware.

# cp openwrt-ar71xx-generic-tl-wdr4300-v1-squashfs-factory.bin wdr4300v1_tp_recovery.bin
# atftpd --no-fork --daemon .

After downloading, the flashing starts immediately. After cca. 1 minute, the router reboots automatically.

If you want to de-brick/upgrade your router using TFTP you follow these steps:

Pre-requisits:

• serial RS232 connected from your machine to TL-WDR4300 & terminal program (e.g. minicom, screen) set to 115200 8N1, no flow control, 3,3V
• copy a working & full OpenWrt firmware image into your tftp server folder (e.g: openwrt-ar71xx-generic-tl-wdr4300-v1-squashfs-factory.bin)

(in case you want to flash the original TPLink firmware it migth needed to delete the first 200 Bytes from this firmware bevor flashing, plz check Video Flash Steps!)

• start a tftpd server on your local machine on LAN address 192.168.1.100/24 and connect your LAN-port to one of the routers LAN ports

Video Flash Procedure: How to debrick TL-WDR4300

Written Flash Procedure:

1. router should be unplugged & your serial line connected & terminal open & tftp server installed not yet running
2. copy your desired openwrt image for the tplink-4300 into your tftp server folder and rename it into openwrt.bin (to save some typing within the flash procedure)
3. first goal is to get the command prompt from the u-boot bootloader on your router
4. you should only plug in the serial into the router's serial port AFTER it initialises for a split second after powering on BUT BEFORE Autobooting starts otherwise it might hang at the initialisation process
5. plug in your router and be ready to type tpl & hit ENTER after you see the line Autobooting in 1 seconds:

U-Boot 1.1.4 (Apr 25 2012 - 18:29:12)

U-boot DB120


DRAM:  128 MB
id read 0x100000ff
flash size 8MB, sector count = 128
Flash:  8 MB
Using default environment

In:    serial
Out:   serial
Err:   serial
Net:   ag934x_enet_initialize...
No valid address in Flash. Using fixed address
 wasp  reset mask:c03300 
WASP  ----> S17 PHY *
: cfg1 0x7 cfg2 0x7114
eth0: ba:be:fa:ce:08:41
athrs17_reg_init: complete
eth0 up
eth0
Autobooting in 1 seconds

1. in case you failed the right timing just reboot again until the prompt appears

db12x>

1. now lets check what kind of parameters the u-boot loader expects (e.g file name of firmware via TFPT & Load Adress)
2. type tftpboot & press ENTER ...

db12x> tftpboot

dup 1 speed 1000
 Warning: no boot file name; using '6F01A8C0.img'
Using eth0 device
TFTP from server 192.168.1.100; our IP address is 192.168.1.111
Filename '6F01A8C0.img'.
Load address: 0x81000000
Log: *
TFTP error: 'Access violation' (2)
Starting again

1. as you can see, uboot expects a firmware image file name “6F01A8C0.img” at tftp server address 192.168.1.100
2. just change you local ip into 192.168.1.100 and start your tftp server
3. start the uboots tftpclient to download the image from your local machine by typing: tftpboot 0x81000000 openwrt.bin + ENTER

db12x> tftpboot 0x81000000 openwrt.bin

Using eth0 device
TFTP from server 192.168.1.100; our IP address is 192.168.1.111
Filename 'openwrt.bin'.
Load address: 0x81000000
Lg: #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         ############################
done
Bytes transferred = 8126464 (7c0000 hex)

1. the last line needs to show a size of 7c0000 hex otherwise your image is unsuitable
2. now we need to erase parts of the flash memory to be able to copy your fresh loaded firmware into it
3. just type in the promt erase 0x9f020000 +7c0000 and wait for the promt to come back

db12x> erase 0x9f020000 +7c0000

First 0x2 last 0x7d sector size 0x10000                                                                                                                                                                                                  125
Erased 124 sectors

1. now just copy the image to the rigth place by typing cp.b 0x81000000 0x9f020000 0x7c0000

db12x> cp.b 0x81000000 0x9f020000 0x7c0000

Copy to Flash... write addr: 9f020000
done

1. so .. you, in case your image is the correct one, your are just a single reboot away from having a working TL-WRD4300 back on your desk
2. type reset or just un-plug and re-plug the power of your router and watch the boot process

db12x> reset

WARNING: risk of frying your hardware. only do this when you understand basic electric engineering.

When the bootloader was trashed as well, and none of the above recovery methods work, you can de-brick the thing using flashrom, see http://flashrom.org/ISP.

If you don't have one of those fancy SOIC clips, desolder the flash chip (google for SOIC desoldering for your favorite method)

The default network configuration is:

Numbers 2-5 are Ports 1-4 as labeled on the unit, number 1 is the Internet (WAN) on the unit, 0 is the internal connection to the router itself.

The switch ports may turn out to be not properly bridged in a default bootup config, causing connection failure. In this case you need to setup /etc/config/network or do manual swconfig setup - see switch for advice.

config interface 'loopback'
        option ifname 'lo'
        option proto 'static'
        option ipaddr '127.0.0.1'
        option netmask '255.0.0.0'

config switch
        option name 'eth0'
        option reset '1'
        option enable_vlan '1'

## Port: internet
config switch_vlan
        option device 'eth0'
        option vlan '1'
        option ports '0t 1'
        list comment 'port internet, eth0.1'

## Port LAN1
config switch_vlan
        option device 'eth0'
        option vlan '2'
        option ports '0t 2'
        list comment 'port lan1, eth0.2'

## Port LAN2
config switch_vlan
        option device 'eth0'
        option vlan '3'
        option ports '0t 3'
        list comment 'port lan2, eth0.3'

## Port LAN3
config switch_vlan
        option device 'eth0'
        option vlan '4'
        option ports '0t 4'
        list comment 'port lan3, eth0.4'

## Port LAN4
config switch_vlan
        option device 'eth0'
        option vlan '5'
        option ports '0t 5'
        list comment 'port lan4, eth0.5'

config interface 'lan'
	option type 'bridge'
	option proto 'static'
	option ifname 'eth0.2 eth0.3 eth0.4 eth0.5'
        option ipaddr '192.168.1.5'
	option netmask '255.255.255.0'

config interface 'setup'
	option ifname 'br-lan'
        option proto static
	option ipaddr '192.168.1.1'
	option netmask '255.255.255.0'
        #notes
        # - this is an alias interface, that will let us continue
        #  the setup.

config interface 'wan'
        option ifname           'eth0.1'
        option proto            'dhcp'
        option type             'bridge'
	option metric           10

I ordered the switch ports to make it in order. port 1 is eth0.1 and wan port is eth0.5, which is just another network

config interface 'loopback'
        option ifname 'lo'
        option proto 'static'
        option ipaddr '127.0.0.1'
        option netmask '255.0.0.0'

config globals 'globals'
        option ula_prefix 'fd9e:344e:c4fd::/48'

config interface 'lan'
        option ifname 'eth0.1'
        option proto 'static'
        option ipaddr '192.168.1.1'
        option netmask '255.255.255.0'

config interface 'lan2'
        option ifname 'eth0.2'
        option proto 'static'
        option ipaddr '192.168.2.1'
        option netmask '255.255.255.0'

config interface 'lan3'
        option ifname 'eth0.3'
        option proto 'static'
        option ipaddr '192.168.3.1'
        option netmask '255.255.255.0'

config interface 'lan4'
        option ifname 'eth0.4'
        option proto 'static'
        option ipaddr '192.168.4.1'
        option netmask '255.255.255.0'

config interface 'lan5'
        option ifname 'eth0.5'
        option proto 'static'
        option ipaddr '192.168.5.1'
        option netmask '255.255.255.0'

config switch
        option name 'switch0'
        option reset '1'
        option enable_vlan '1'

config switch_vlan
        option device 'switch0'
        option vlan '1'
        option ports '2 0t'

config switch_vlan
        option device 'switch0'
        option vlan '2'
        option ports '3 0t'

config switch_vlan
        option device 'switch0'
        option vlan '3'
        option ports '4 0t'

config switch_vlan
        option device 'switch0'
        option vlan '4'
        option ports '5 0t'

config switch_vlan
        option device 'switch0'
        option vlan '5'
        option ports '1 0t'

Remove the 4 screws on the bottom of the case.

The top is clipped to the bottom of the case at 9 attachment points: 3 on each side of the case, 1 on the back, and 2 on the front. Each attachment point consists of two pins which fit into holes in tabs which protrude from the other half of the case. All of the tabs are on the bottom of the case, with the exception of the case back, where the single tab is in the center of the top of the case.

One method known to work, once, is to start at one of the rear corners. The corner by the ethernet ports seems to work best. Gently flex the case and slightly separate the top from the bottom at the corner by lifting on, or inserting a fingernail or other thin object into, the crack above the antenna. While doing this insert the tip of a knife blade (upward, given the geometry as the unit normally sits) into the crack between the two halves along the side of the case toward the rear. This will force the pins in the top of the case outward, flex the tab protruding from the bottom of the case inward, and free the pins from the tab. If necessary the knife tip may be levered slightly toward the case interior after insertion. Due to the force separating the top of the case from the bottom near the antenna, the pins should pop out of the tab located on the case side near the rear, lift slightly upward, and remain free.

Continue to free the other tabs, first working from the rear corner toward the front of the case, then across the front of the case, and finally from the front of the case toward the rear along the opposite side. The two halves of the case will then separate without having to work at freeing the last attachment point at the rear of the case.

With care, this method leaves no marks on the case.

Serial console is available on the J1 (1.7) connector, 3.3v signals.

1 = TX out 2 = RX in 3 = GND 4 = VCC 3.3V
DO NOT CONNECT VCC. Use only TX/RX/GND.

Baud Rate: 115200 Data Bits: 8 Parity : No Stop Bits: 1

To break bootstrap sequence, type 'tpl' during the 1-second boot delay.

Factory firmware login credentials are not known at this time (it's not root/5up as with other tp-link models).

Below is an image of the PCB with the serial TTY console shown, in addition the JTAG pin location is shown as well. Both has all its pins labled as well.

→ port.jtag general information about the JTAG port, JTAG cable, etc.

How to connect to the JTAG Port of this specific device: See picture above.

The TL-WDR4300 DE (v1.1) comes bundled with the following PSU:

Specifications:

The WDR4300/3600 consume about 3 W with both radios enabled and idle. Each connected ethernet cable adds about 0.3 W.

→ port.gpio The AR933x platform provides 30 GPIOs. Some of them are used by the router for status LEDs, buttons and other stuff. The table below shows the results of some investigation:

To make the GPIOs available via sysfs, the required ones have to be exported to userspace, as it is explained on a page of the Squidge-Project. Kernel modules occupying that resource need to be removed before (e.g. “leds-gpio” and “gpio-buttons”). In output-mode, voltage levels of the GPIOs were measured against GND, after the value 1 or 0 had been written to /sys/class/gpio/gpioX/value. In input-mode, the value of the file /sys/class/gpio/gpioX/value was read when the GPIO was floating (initial state), pulled to GND or pulled to Vcc.

The 5GHz LED seems not to be controlled via GPIO.

• Installing packages into the USB storage
• Adding a USB wireless adapter to the router

Tested with |http over nginx|←wan-|wdr4300|←lan-|Client|

WARNING: risk of frying your hardware. only do this when you understand basic electric engineering.

The task was to make ext-root without using the default ports.

It turns out that the GL850G chipset used by the TP-Link in WDR3600/4300/4900 models can handle up to four ports.

Analysing the router's PCB it appears that pins 8(D-), 9(D+), 11(D-) and 12(D+) are unused. Aditionaly each factory USB port has separate power section.

GND is at the TP7 pin point. +5 V was taken directly from the MOSFET.

Internally, the device generates +1.2 V, +3.3 V and +5.0 V (just for USB). All voltage regulators will work from 4.5 V - 13.4 V. This makes the device capable of running from USB power (e.g. a power bank).

You have to open the case and remove (bridge) the input diode, which you will find directly in between the power connector and the input capacitors. Care: There are no thermal reliefs so you need a quite powerful soldering station. Unsolder the SMD diode, place a wire across the pads and solder that.

As the 3.3 V regulator is only specified for 13.4 V (with absolute maximum of 16 V), you will lower the allowed input voltage by this modification. Running directly of the car 12 V (up to 14.4 V while charging) is outside the limits when the diode is removed and on the edge when diode is in place.

USB devices connected to the USB port on the WDR4300/3600 may not work when the device is powered with less than 5.5 V.

Read about bootloader in general and about Das U-Boot in particular.

Forum member pepe2k made a modification of U-Boot 1.1.4 for Qualcomm Atheros SoCs based devices (the project is still being developed, so new devices and SoCs will be supported in the future). Up to date information, binary images and sources can be found on official GitHub repository.

This modification started from wr703n-uboot-with-web-failsafe project, but supports more devices, all modern web browsers, has a lot of improvements and other modifications (like U-Boot NetConsole, custom commands, overclocking possibilities etc.).

More information:

• OpenWrt wiki: pepe2k
• Official repository on GitHub: U-Boot 1.1.4 modification for routers
• Discussion about this project on OpenWrt forum
• An article (in Polish) about one of the first version of this project on www.tech-blog.pl - WebArchive

(for 1.7, at least)

db12x> printenv
bootargs=console=ttyS0,115200 root=31:02 rootfstype=squashfs init=/sbin/init mtdparts=ath-nor0:256k(u-boot),64k(u-boot-env),6336k(rootfs),1408k(uImage),64k(mib0),64k(ART)
bootcmd=bootm 0x9f020000
bootdelay=1
baudrate=115200
ethaddr=0xXX:0xXX:0xXX:0xXX:0xXX:0xXX
ipaddr=192.168.1.111
serverip=192.168.1.100
dir=
lu=tftp 0x80060000 ${dir}u-boot.bin&&erase 0x9f000000 +$filesize;cp.b $fileaddr 0x9f000000 $filesize
lf=tftp 0x80060000 ${dir}db12x${bc}-jffs2&&erase 0x9f050000 +0x630000;cp.b $fileaddr 0x9f050000 $filesize
lk=tftp 0x80060000 ${dir}vmlinux${bc}.lzma.uImage&&erase 0x9f680000 +$filesize;cp.b $fileaddr 0x9f680000 $filesize
stdin=serial
stdout=serial
stderr=serial
ethact=eth0

Environment size: 686/65532 bytes
db12x> 

Changing variables through 'setenv' doesn't seem to make the changes stick, unfortunately.

The following kernel log was capture on a WDR4300 running OpenWrt Designated Driver r48648 (trunk):

How to add tags