TP-Link TL-WDR3600 (N600)
TP-Link TL-WDR3600 is 802.11n Dual Band (concurrent) and Gigabit Ethernet. Advertised as 600 Mbps it is Dual-Stream (2×2) on the 2.4 GHz Band and Dual-Stream (2×2) on the 5 GHz Band. This wiki entry is fairly brief, but most things in the TP-Link TL-WDR4300 wiki entry apply here.
Supported Versions
Version/Model | Release Date | OpenWrt Version Supported | Model Specific Notes |
---|---|---|---|
1.1 | July 2012 | Attitude Adjustment 12.09 works fine (since trunk r33219) | Similar to TP-Link TL-WDR4300 |
1.2 | Attitude Adjustment 12.09 | LEDs blue | |
1.3 | Attitude Adjustment 12.09 + wifi patch, or trunk (r39392), | LEDs blue | |
1.4 | July 2013 | Attitude Adjustment 12.09 + wifi patch , or trunk (r39392) | LEDs blue or green |
1.5 | July 2024 | 23.05.4 |
- Chaos Calmer 15.05.x is working with dual band wireless and ipv6 support on comcast.
- Barrier Breaker 14.07 is working ethernet and dual-band wireless (disabled by default), and webUI;
If your wireless cannot be enabled when using wide channel modes, this may be due to the friendly neighbor “feature” that prohibits operation of such a mode and you may have to use the standard modes before wireless can be enabled. For some people radio0 works only when radio2 is also enabled.
Known issues
- 15.05 on 1.5 model: Router may exhibit occasional hangs under load after a long period (a few weeks).
- 14.07: VLAN related switch driver bug → Fixed in r42653
Hardware Highlights
Installation
If your TP-Link firmware is old enough to allow flashing custom firmware, follow the TP-Link TL-WDR4300 installation instructions.
Current versions of the TP-Link firmware for this router, at least in the US, reject custom firmware and refuse to flash it. If your TP-Link firmware is too new and rejects the OpenWRT firmware file, even after giving it a sufficiently short filename, follow this procedure to install an unlocked TP-Link firmware:
- Obtain the TP-Link unlocking firmware. It can be obtained through TP-Link support, and is also attached to this post on the DD-WRT forum, although registration is required to download it from there. It may also be in IPFS.
- Check the hash. It is expected to have SHA256 hash 41720922adb393063d292a3a75d49eb69f83d008e77f9a1e24d273f44ec8a41d.
- Flash the unlocking firmware via the TP-Link web UI.
- When the router reboots, flash OpenWRT via the unlocking firmware's web UI.
TFTP auto recovery in revision 1.5
At least some revision 1.5 routers contains bootloader recovery TFTP client. To activate it press and hold WPS/Reset Button during powering on until WPS LED turns on. Connect computer to LAN1. Using TCPdump, you should see ARP requests from router having address 192.168.0.86 looking for address 192.168.0.66.
# tcpdump -ni eth0 arp ARP, Request who-has 192.168.0.66 tell 192.168.0.86, length 46
Set up your computer to address 192.168.0.66, netmask /24 (255.255.255.0).
# ip addr add dev eth0 192.168.0.66/24
Using TCPdump, you should now see request for new firmware image:
# tcpdump -npi eth0 udp IP 192.168.0.86.2195 > 192.168.0.66.69: 44 RRQ "wdr3600v1_tp_recovery.bin" octet timeout 5
Rename factory image to given name and put it into TFTP server root. → generic.flashing.tftp
In case you are flashing back original firmware, make sure original firmware image name does not contain word boot
→ back_to_stock_firmware.
# cp openwrt-ar71xx-generic-tl-wdr3600-v1-squashfs-factory.bin wdr3600v1_tp_recovery.bin # atftpd --no-fork --daemon .
After downloading, the flashing starts immediatelly. After cca. 1 minute, the router reboots automatically.
Note that some distros may set a fixed root folder location for the tftpd server, where it expects to serve files from. This is the case with Arch Linux, for example, setting /srv/$package as the root, even with a current working directory override.
There also reports that the latest firmware requires certain size images https://mail-archive.com/openwrt-devel%40lists.openwrt.org/msg32888.html. With this firmware, you must set IP to 192.168.0.66 before booting router. There will be small window where you see router ask for firmware image. After which resets.
Back to stock firmware
With the TL-WR3600 router, there is a catch: the stock firmware is obtained from the OEM: http://www.tp-link.de/download/TL-WDR3600.html#Firmware
The firmware image must have a certain size to be recognized as a valid image. Depending on your existing hardware/firmware revision, the file size must be exactly:
- 8,192,512 bytes for newer revisions (at least reported for rev. 1.4 and 1.5) - Use the image as downloaded, without stripping.
- 8,126,464 bytes for older revisions - Strip the firmware image to fit the correct size or get a stripped one (see below).
For those needing the shorter version:
- in case the file name of this firmware file does not contain the word “boot” in it, you can simply revert back to original firmware
- in case the file name of this firmware file does contain the word “boot” in it, you need to cut off parts of the image file before flashing it:
An example of an image file with the word “boot” in it is wdr3600v1_en_3_13_34_up_boot(130909).bin
.
Cut the first 0x20200 (that is 131,584 = 257*512) Bytes from original firmware:
dd if=orig.bin of=tplink.bin skip=257 bs=512
You should transfer the firmware image to the /tmp folder and revert back to original firmware (if available you can flash the firmware via the webinterface as well):
Via the safer method using sysupgrade:
sysupgrade /tmp/tplink.bin
Or alternatively you can use the mtd method:
mtd -r write /tmp/tplink.bin firmware
OEM TP-Link firmware for the TL-WDR3600 with the boot part removed to revert to the original OEM firmware:
- TL-WDR3600 V1 TL-WDR3600-V1-stripped.zip
- TL-WDR3600 V1 TL-WDR3600_V1_130320.zip
Useful Information about Stock Firmware
Updated versions of stock firmware have Firmware Recovery Mode. Upgrading to a version with this feature before flashing to OpenWrt for the first time is recommended, so you can utilize this if necessary.
However, current versions of the TP-Link firmware (at least build 151104 and later) do not allow custom firmware to be flashed. So it is not recommended to upgrade to the current latest TP-Link firmware!
Switch Ports (for VLANs)
Port | Switch port |
---|---|
CPU | 0 |
Internet (WAN) | 1 |
LAN 1 | 2 |
LAN 2 | 3 |
LAN 3 | 4 |
LAN 4 | 5 |
unknown | 6 |
On some hardware revisions of the router, the switch driver refuses to configure a port with tagged and untagged VLANs. (There is reported success with hardware revision 1.5 enabling both tagged and untagged VLANs simultaneously on the same port.)
It is always possible to assign multiple VLANs to the same port when they are all tagged:
root@OpenWrt:/# swconfig swconfig dev <dev> [port <port>|vlan <vlan>] (help|set <key> <value>|get <key>|load <config>|show) root@OpenWrt:/# swconfig dev switch0 help switch0: eth0(Atheros AR8327), ports: 7 (cpu @ 0), vlans: 128 --switch Attribute 1 (int): enable_vlan (Enable VLAN mode) Attribute 2 (none): reset_mibs (Reset all MIB counters) Attribute 3 (none): apply (Activate changes in the hardware) Attribute 4 (none): reset (Reset the switch) --vlan Attribute 1 (int): vid (VLAN ID (0-4094)) Attribute 2 (ports): ports (VLAN port mapping) --port Attribute 1 (none): reset_mib (Reset single port MIB counters) Attribute 2 (string): mib (Get port's MIB counters) Attribute 3 (int): pvid (Primary VLAN ID) Attribute 4 (string): link (Get port link information)
OpenWRT switch configuration Eth0.1 = LAN et Eth0.2 = WAN
root@OpenWrt:/# swconfig dev switch0 vlan 1 show VLAN 1: vid: 1 ports: 0t 2 3 4 5 root@OpenWrt:/# swconfig dev switch0 vlan 2 show VLAN 2: vid: 2 ports: 0t 1
Tag of port 5 on VLANs 1 and 2 successful:
root@OpenWrt:/# swconfig dev switch0 vlan 1 set ports "0t 2 3 4 5t" root@OpenWrt:/# swconfig dev switch0 vlan 1 show VLAN 1: vid: 1 ports: 0t 2 3 4 5t root@OpenWrt:/# swconfig dev switch0 vlan 2 show VLAN 2: vid: 2 ports: 0t 1 root@OpenWrt:/# swconfig dev switch0 vlan 2 set ports "0t 1 5t" root@OpenWrt:/# swconfig dev switch0 vlan 1 show VLAN 1: vid: 1 ports: 0t 2 3 4 5t root@OpenWrt:/# swconfig dev switch0 vlan 2 show VLAN 2: vid: 2 ports: 0t 1 5t
Tag port 4 in VLAN 1, and untag port 4 in VLAN 2: Error, port 4 is removed from VLAN 1
root@OpenWrt:/# swconfig dev switch0 vlan 1 set ports "0t 2 3 4t 5t" root@OpenWrt:/# swconfig dev switch0 vlan 1 show VLAN 1: vid: 1 ports: 0t 2 3 4t 5t root@OpenWrt:/# swconfig dev switch0 vlan 2 show VLAN 2: vid: 2 ports: 0t 1 5t root@OpenWrt:/# swconfig dev switch0 vlan 2 set ports "0t 1 4 5t" root@OpenWrt:/# swconfig dev switch0 vlan 1 show VLAN 1: vid: 1 ports: 0t 2 3 5t root@OpenWrt:/# swconfig dev switch0 vlan 2 show VLAN 2: vid: 2 ports: 0t 1 4 5t root@OpenWrt:/#
''/etc/config/network'' switch ports usable as single ports
config interface 'loopback' option ifname 'lo' option proto 'static' option ipaddr '127.0.0.1' option netmask '255.0.0.0' config switch option name 'eth0' option reset '1' option enable_vlan '1' ## Port: internet config switch_vlan option device 'eth0' option vlan '2' option ports '0t 1' ## Port LAN1 config switch_vlan option device 'eth0' option vlan '1' option ports '0t 2' ## Port LAN2 config switch_vlan option device 'eth0' option vlan '3' option ports '0t 3' ## Port LAN3 config switch_vlan option device 'eth0' option vlan '4' option ports '0t 4' ## Port LAN4 config switch_vlan option device 'eth0' option vlan '5' option ports '0t 5'
Performance
See also performance.
Test in a simulated network
Scenario:
[samba server in a lan network offering a file of 3Gb] [one port connection (so max 1Gbit speed)] [switch 1Gbit ports] [one port connection (so max 1Gbit speed)] [mikrotik rb 750GL with routerOS 6.x as gateway2] [asus wl500gp v2 openwrt 12.09 as gateway2 limiting the wan/lan traffic to 1428 packets per second] [tplink wdr3600 , owrt 12.09, mwan3 for using 2 gw concurrently] [switch 1Gbit ports] [one port connection (so max 1Gbit speed)] [2 windows vm on a esxi server]
Both windows machines asked the same file to save it locally.
Results: the asus router was 40% idle, with the limit of packets reached ( ~ 15 Mbit/s ); the rb750Gl was completely used, idle less than 1% with a bandwidth of ~175 Mbit/sec and ~ 7.5K packets sent and ~ 17K packets received ; the tplink was 20% idle, with a total of ~ 190 Mbit/s , ~18K packets received and ~8K packets sent.
That is impressive, considering that the mikrotik solution is commercial and was expected to provide way more bandwidth (with way less firewall rules!), instead the openwrt solution is able to overload it even without the so 'blamed' hw accel https://dev.openwrt.org/ticket/11779 . Great job openwrt!
For whatever SOHO solution that has no so big traffic between two logical networks (for example, less than 50 Mbit on average), the wdr3600 plus openwrt and thirdy party software (mwan3) is a great solution even for business.
Flash Layout
0x000000000000-0x000000020000 | “u-boot” | /dev/mtdblock0 |
0x000000020000-0x000000120000 | “kernel” | /dev/mtdblock1 |
0x000000120000-0x0000007f0000 | “rootfs” | /dev/mtdblock2 |
0x000000600000-0x0000007f0000 | “rootfs_data” | /dev/mtdblock3 |
0x0000007f0000-0x000000800000 | “art” | /dev/mtdblock4 |
0x000000020000-0x0000007f0000 | “firmware” | /dev/mtdblock5 |
Serie U-Boot
WDR3600 v1.3 Start Log original U-Boot 1.1.4 (Jan 29 2013 - 16:09:44)
U-Boot 1.1.4 (Jan 29 2013 - 16:09:44) U-boot DB120 DRAM: 128 MB id read 0x100000ff flash size 8MB, sector count = 128 Flash: 8 MB Using default environment PCIe Reset OK!!!!!! In: serial Out: serial Err: serial Net: ag934x_enet_initialize... No valid address in Flash. Using fixed address wasp reset mask:c03300 WASP ----> S17 PHY * : cfg1 0x7 cfg2 0x7114 eth0: ba:be:fa:ce:08:41 athrs17_reg_init: complete eth0 up eth0 Autobooting in 1 seconds
Very quickly type tpl when the message Autobooting in 1 seconds appears
WDR3600 v1.3 U-boot help :
db12x> help ? - alias for 'help' bootm - boot application image from memory cp - memory copy erase - erase FLASH memory help - print online help md - memory display mm - memory modify (auto-incrementing) mtest - simple RAM test mw - memory write (fill) nm - memory modify (constant address) ping - send ICMP ECHO_REQUEST to network host printenv- print environment variables progmac - Set ethernet MAC addresses reset - Perform RESET of the CPU setenv - set environment variables tftpboot- boot image via network using TFTP protocol version - print monitor version
WDR3600 v1.3 U-boot printenv
db12x> printenv bootargs=console=ttyS0,115200 root=31:02 rootfstype=squashfs init=/sbin/init mtdparts=ath-nor0:256k(u-boot),64k(u-boot-env),6336k(rootfs),1408k(uImage),64k(mib0),64k(ART) bootcmd=bootm 0x9f020000 bootdelay=1 baudrate=115200 ethaddr=0xba:0xbe:0xfa:0xce:0x08:0x41 ipaddr=192.168.1.111 serverip=192.168.1.100 dir= lu=tftp 0x80060000 ${dir}u-boot.bin&&erase 0x9f000000 +$filesize;cp.b $fileaddr 0x9f000000 $filesize lf=tftp 0x80060000 ${dir}db12x${bc}-jffs2&&erase 0x9f050000 +0x630000;cp.b $fileaddr 0x9f050000 $filesize lk=tftp 0x80060000 ${dir}vmlinux${bc}.lzma.uImage&&erase 0x9f680000 +$filesize;cp.b $fileaddr 0x9f680000 $filesize stdin=serial stdout=serial stderr=serial ethact=eth0 Environment size: 686/65532 bytes
Restoration of original firmware (without modifying U-Boot). The firmware must be 8,126,464 octets which correspond to a firmware without U-Boot. Today, firmwares TP-Link : wdr3600v1_en_3_13_23_up(120820), wdr3600v1_en_3_13_26_up(130129) and wdr3600v1_en_3_13_31_up(130320) come without U-Boot. The version used in the example is wdr3600v1_en_3_13_31_up(130320) on the WDR3600 v1.3
db12x> setenv ipaddr 192.168.0.144 db12x> setenv serverip 192.168.0.11 db12x> tftp 0x80060000 wdr3600v1_en_3_13_31_up(130320).bin dup 1 speed 1000 Using eth0 device TFTP from server 192.168.0.11; our IP address is 192.168.0.144 Filename 'wdr3600v1_en_3_13_31_up(130320).bin'. Load address: 0x80060000 Loading: *################################################################# ################################################################# ################################################################# ################################################################# ################################################################# ################################################################# ################################################################# ################################################################# ################################################################# ################################################################# ################################################################# ################################################################# ################################################################# ################################################################# ################################################################# ################################################################# ################################################################# ################################################################# ################################################################# ################################################################# ################################################################# ################################################################# ################################################################# ################################################################# ############################ done Bytes transferred = 8126464 (7c0000 hex)
ATTENTION Only continue if the last line reads 8126464 (7c0000 hex)
db12x> erase 0x9f020000 +7c0000 First 0x2 last 0x7d sector size 0x10000 Erased 124 sectors db12x> cp.b 0x80060000 0x9f020000 0x7c0000 Copy to Flash... write addr: 9f020000 done db12x> reset
The router reboots
U-Boot 1.1.4 (Jan 29 2013 - 16:09:44) U-boot DB120 DRAM: 128 MB id read 0x100000ff flash size 8MB, sector count = 128 Flash: 8 MB Using default environment PCIe Reset OK!!!!!! In: serial Out: serial Err: serial Net: ag934x_enet_initialize... No valid address in Flash. Using fixed address wasp reset mask:c03300 WASP ----> S17 PHY * : cfg1 0x7 cfg2 0x7114 eth0: ba:be:fa:ce:08:41 athrs17_reg_init: complete eth0 up eth0 Autobooting in 1 seconds ## Booting image at 9f020000 ... Uncompressing Kernel Image ... OK Starting kernel ...
WDR3600 TP-Link Original Firmware Password
TL-WDR3600 login: root Password: ??? Login incorrect
shadow hash password file : root:$1$GTN.gpri$DlSyKvZKMR9A9Uj9e9wR3/:15502:0:99999:7:::
Login: root Password: sohoadmin
Bootloader Mods
Read about bootloader in general and about Das U-Boot in particular.
U-Boot 1.1.4 modification for routers
Forum member pepe2k made a modification of U-Boot 1.1.4 for Qualcomm Atheros SoCs based devices (the project has been archived Oct 2022). Up to date information, binary images and sources can be found on official GitHub repository.
This modification started from wr703n-uboot-with-web-failsafe project, but supports more devices, all modern web browsers, has a lot of improvements and other modifications (like U-Boot NetConsole, custom commands, overclocking possibilities etc.).
More information:
- Official repository on GitHub: U-Boot 1.1.4 modification for routers
- Discussion about this project on OpenWrt forum
- An article (in Polish) about one of the first version of this project on www.tech-blog.pl
Hardware
Info
Architecture | MIPS MIPS 74Kc |
---|---|
Vendor | Qualcomm Atheros |
bootloader | U-Boot |
System-On-Chip | AR9344 (MIPS) |
CPU/Speed | 560 MHz |
Flash-Chip | Spansion FL064KIF docs |
Flash size | 8192 KiB |
RAM | 128 MiB |
Wireless No1 | Atheros AR9340 2.4GHz 802.11bgn |
Wireless No2 | Atheros AR9582 5GHz 802.11an |
switch | Atheros AR8327N Gigabit Switch |
USB | Yes 2 x 2.0 (GL850G chip - 4 ports capable) |
GPIO
Partially based on → tl-wdr4300_v1
Tested with hw version 1.5, BB r41181
Voltage level at GPIO in output-mode | gpioX/value in input-mode when GPIO is: | ||||||
---|---|---|---|---|---|---|---|
GPIO | Common Name | PCB Name | gpioX/value=1 | gpioX/value=0 | Floating | Pulled to GND | Pulled to Vcc |
16 | WPS Button | ||||||
17 | WiFi Switch |
Attach functions to a push button
WPS/Reset button on back reports as “wps”. To respond to that, but a script in /etc/rc.button/wps and reboot.
For example:
> head /etc/rc.button/wps #!/bin/sh [ "${ACTION}" = "released" ] || exit 0 . /lib/functions.sh logger "$BUTTON pressed for $SEEN seconds"
Read button without hotplug
rmmod gpio_button_hotplug echo "16" > /sys/class/gpio/export echo "17" > /sys/class/gpio/export echo "in" > /sys/class/gpio/gpio16/direction echo "in" > /sys/class/gpio/gpio17/direction
cat /sys/class/gpio/gpio16/value cat /sys/class/gpio/gpio17/value
Hardware Modifications
USB Modification
The task was to make ext-root without using the default ports.
It turns out that the GL850G chipset used by the TP-Link in WDR3600/4300/4900 models can handle up to four ports.
Analysing the router's PCB it appears that pins 8(D-), 9(D+), 11(D-) and 12(D+) are unused. Aditionaly each factory USB port has separate power section.
GND is at the TP7 pin point. +5 V was taken directly from the MOSFET. +5 V can be also taken from TP5 near the power switch. The Maplin part N75HL is perfect for adding these externally and can be mounted under one side once a small hole has been drilled in the case.
Reading/Writing Flash without desoldering
It is possible to attach an external programmer and then read/write the serial flash by holding the CPU in reset. This can be done by grounding the right side of the R2 pad (the resistor is not populated on the board I have), near pin 11 on the JTAG header (the 2×7 pin header at J1). I used pin 10 of that header as a ground. The SPI flash can be powered while the CPU is stopped. I used a bus pirate, and reading the flash took about 3 minutes. Writing would be longer. Be careful not to lose contact with that pad during the operation. Safer would be to solder a shunt across R2 and attach a jumper wire between to pin 11 and, say, pin 10.