TP-Link WDR4300 and OpenWRT

Categories: Linux, OpenWRT

Introduction

I’ve just bought a new TP-Link WDR4300 router; this is both a review of the router and a description of how I installed the OpenWRT linux distribution on it. I’m familiar with Linux, and familar with networking basics, but no guru - this guide is most likely useful for people with beginner-to-intermediate network and linux administration skills.

Overall verdict on the TP-Link WDR4300: thumbs up. Good functionality, reasonable price, and OpenWRT works well on it.

NOTE: documentation updated 2014-11-02 with new links to OpenWRT resources, as OpenWRT version “Barrier Breaker” has now been released.

Much of this information is derived from the official tl-wdr4300 page on the openwrt wiki. Since this article was written, that page has been significantly improved; if you have experience with linux on routers then you may wish to just use that page as a guide rather than this one.

My Home Setup

This is the equipment I had at the time the WDR4300 was bought, ie what I had to work with while setting up the router. If you have a different setup, then you may need to make some adjustments to the steps below.

  • network access via a Cable TV provider, using the cable modem they provide (one cable connection in, one ethernet connection out)
  • an existing Linksys WRT45GL wireless router; bought 6 years ago with the intention of installing OpenWRT but never got around to it, so it’s still running the stock firmware. Network technology has improved to the point that it isn’t worth installing OpenWRT on it now - and it doesn’t have enough ram/flash to take a modern linux distro anyway!
  • a laptop running Linux Mint 15 Olivia (Ubuntu-based) using wireless to access the internet via the existing Linksys router

Physical Assembly

Unpack and assemble router (attach antennae, remove label over network ports, throw away Windows CD). Nothing else to do.

The router comes with a short ethernet cable.

Download Required Files

From http://downloads.openwrt.org/barrier_breaker/14.07/ar71xx/generic/ download file “openwrt-ar71xx-generic-tl-wdr4300-v1-squashfs-factory.bin” (or whatever the latest patch-release of barrier-breaker is, ie use v2 instead of v1 if available).

Also open this installation-guide webpage and leave it open for later reference!

Obtain the Existing Outbound MAC Address

My ISP (a cable provider) used to permit only a single device on a “home” connection; the MAC address of the device was registered at the provider, and only that MAC address was permitted. Of course this was rather pointless; any decent router simply provided the option to dynamically configure the MAC address it used on the WAN side, and then multiple devices could be connected to the router. This single-device limitation is getting pretty old-fashioned now that even “home” customers typically have multiple internet-capable devices (multiple PCs, WiFi tablets, televisions, etc). But for safety, I still connected to the admin page of the existing router and wrote down the MAC address it uses (for later use).

Check your ISP’s terms and conditions to see whether you need to set the MAC address of your new router to emulate your current device.

Connect PC to New Router and Log In

Simply connect the ethernet cable from PC to any local port on the router (not the WAN port!). Ensure PC has switched to new network (ie has obtained a DHCP address from the new router).

In a browser, go to “http://192.168.1.1” and enter credentials “admin/admin”.

Theoretically it should be possible to establish a network from the PC to the new router while still having connectivity to the internet via your existing router. Unfortunately, I couldn’t get this to work : I use WIFI to connect to the old router (it is in a different room), and as soon as a physical ethernet cable was attached to my laptop the WIFI shut down. According to advice on the internet, it should be possible to tell NetworkManager to run both a wireless and wired network concurrently, and indeed all the relevant options seemed to be present in NetworkManager. As I understand it the following should have worked; it didn’t for me but I’ll leave these notes here in case they work for someone else..

  • open NetworkManager applet by clicking on the status-panel network icon and choose Network Settings
  • select “wired” and then “options”
  • in the “general” tab, disable the “Automatically connect” option
  • in the IPv4 tab, set “Method” to Manual (ie laptop should not request DHCP address)
  • in the IPv4 tab, select “Routes” and enable “Use this connection only for resources on its network”, then add address 192.168.1.1 with mask of ‘255.255.255.255’

In my case, connecting the ethernet cable always terminated the wireless connection despite the above (running /sbin/ifconfig showed no relevant interface). Maybe this model laptop has something in ACPI that does this; unfortunately even “sudo rfkill unblock all” did not help. I also tried connecting the new router directly to the existing one, hoping it would obtain a DHCP address from the current router and be accessable/configurable that way. Apparently that doesn’t work, at least out of the box with the standard firmware.

However it isn’t actually necessary to have internet connectivity while configuring the new router as long as everything necessary has been downloaded first.

Upload New Firmware

Go to “System Tools” page, and checked the status info. For my device it was: WDR4300 v1 00000000 Firmware Version 3.13.23 Build 121225 Rel.37950n

Go to “System Tools Firmware Upgrade”, select the openwrt-ar*-factory.bin file downloaded earlier. The upload and install took about 2 minutes on my system.

Allow the system to restart.

Log In to OpenWRT

Disconnect ethernet cable (ie stop interface) and reconnect cable to router (reinit interface).

The default behaviour for a new OpenWRT install is to have:

  • a DHCP server enabled, with the router having fixed address 192.168.1.1
  • a telnet server with no password (yes, very insecure but it’s only temporary)

So:

  • connect to the router with “telnet 192.168.1.1”
  • run command “passwd” and enter a real password for the system (a good one).
  • log out (ctrl-d)

Now that a password has been set, telnet is disabled. So reconnect with “ssh root@192.168.1.1” and enter the password from above.

Configure Wireless

Ensure the physical wifi switch on the back of the router is in the “on” position.

Run “vi /etc/config/wireless”

In section “config wifi-iface”, change

  option ssid OpenWrt --> option ssid '{newnetworkid}'
  option encryption none --> option encryption 'psk2' 
  option key '{newWiFiPassword}'
  option hidden '1'

In section “config wifi-device radio0”, make the following changes:

  option disabled 1 --> option disabled '0'
  option country '{code}' where code is US, GB, DE, etc

Run “wifi down; wifi up”. Some error messages may be displayed about “insufficient entropy to generate keys”, but reconfiguring the PC to connect to the new wireless network and using “ssh” over this network to log back in to the router should work fine.

Note that I chose to make the network a ‘hidden’ one. I’ve never seen the point of making the SSID available; it’s very little more effort to connect to a hidden network than a nonhidden one, and more secure. For Windows PCs, just choose “unnamed network” to connect to, and enter the name. For Linux PCs with NetworkManager, just choose “connect to hidden network” from the wireless networks page.

Connect to WAN

Now disconnect the old router from the cable modem, and connect the new one (via the router WAN port of course). You should have internet access through the new OpenWRT-powered router!

Install Web Admin Interface

While OpenWRT can be configured fine by either editing config files or using the “uci” commandline tool, it can be nice to also have a more graphical interface. To install one (the LUCI web interface), do the following..

Log in using SSH, and run:

  opkg update
  opcg list luci-*
  opkg install luci-ssl

Run “vi /etc/config/uhttpd” and change

  list listen_http 0.0.0.0:80 --> remove line
  list listen_https 0.0.0.0:443 --> 192.168.1.1:443

Run

  /etc/init.d/uhttpd enable
  /etc/init.d/uhttpd start

Then connect with a browser to “https://192.168.1.1” and log in with the root password.

The changes to /etc/config/uhttpd above are because I have no reason to administer this router from anywhere but within the same network (ie no need to administer it from work, overseas, etc), and no reason to ever use the LUCI webserver over http (unencrypted!). Given that wireless is enabled, it would be nice to lock down this web interface (and ssh) even further; right now anyone who can connect to the wireless network can try to connect to the admin interface via a password.

Still To Do

  • somehow lock down access to the admin interface further (eg by mac address, or by private key). Maybe use fail2ban or similar?
  • enable logging of all inbound and outbound connection attempts
  • figure out how to use the inbuilt tftp server (in case I misconfigure openwrt at some time and need to reinstall..)

Upgrading Firmware

If a new version of OpenWRT is released, then the installation can be upgraded following the instructions in section “Upgrading OpenWRT” here:

I find the easiest way to upgrade is to use the LuCI web interface:

  • Download the appropriate *-sysupgrade.bin file from http://wiki.openwrt.org/toh/tp-link/tl-wdr4300
  • Connect to LuCI via a browser
  • In menu “System | Backup/Flash Firmware”:
    • Generate Archive –> saves settings to local PC
    • Flash new image –> select “keep settings”, upload the wdr4300-*-sysupgrade.bin file and click the “flash image” button.

After reinstall, internet access will be working, and ssh. However anything installed via opkg (such as LuCI) will not be working. Therefore, log in using ssh and reconfigure/reinstall any packages, eg:

opkg update
opkg install luci-ssl
/etc/init.d/uhttpd enable
/etc/init.d/uhttpd start

To verify upgrade was successful, run the following from your ssh login session:

  • cat /etc/openwrt_release
  • cat /etc/openwrt_version

More Detailed Device Review

Pros:

  • reasonable native firmware (I played with it a bit)
  • really easy to install OpenWRT
  • reasonable price
  • good specs (gigabit ethernet, dual-band wireless, lots of flash and ram storage)
  • physical wireless enable/disable switch on the back - good if you don’t want wireless
  • physical on/off switch on the back - nice not to have to disconnect the powercable.

Cons:

  • physically quite a large device (bigger than the Linksys WRT45GL that it replaces)
  • lots of bright LEDs on the front panel; as this device sits in my living room I had to put tape over the front panel
  • slightly rounded on top, making it trickier to stack things on top of it
  • a somewhat ugly device; won’t take pride of place in the glass-fronted electronics cabinet
  • quite a large wall-wart power supply; could be a problem in tight spaces.
  • so far, I haven’t been able to get great WAN performance out of it; might be just my setup or ISP though; more testing required.

References

comments powered by Disqus