TP-Link TL-WR740N: Cheapest DD-WRT/OpenWRT Router Ever?

wr740n-box-front

Sometimes, I catch myself buying things I don’t really need, but just seem interesting. Readers may look at this model of router and already ask – “What’s so interesting about a single-stream, single-band wireless N router that has no modem?”

Hi, I’m $22

The first thing you should know is that this router is available for the low price of $22. It’s not the first cheap router ever – routers have often crashed and hovered at the $30-35 mark for years, but those were often the Wireless G variety. At that price, I might as well be buying a bag of cow manure. Or maybe an Arduino.

The next thing to note is that the router claims to be ready for NBN (yeah, that FTTP NBN which is now scrapped), and has a 3 year warranty. Its single stream N is “technically” not N compliant (you need 300Mbit/s dual stream to be certified as an N access point, but just 150Mbit/s single stream is enough to be certified as a wireless card) – hence the wording of the box saying “with some n features”.

But the biggest attraction of all is that this router is supported by BOTH dd-wrt and OpenWRT, if you get the right version that is. If you’re not familiar with these projects, they both spawned around the time of the venerable Linksys WRT54G became popular as it was found that it contained enough of the right sort of hardware (chipset, RAM, flash) that it could run an optimized Linux which opened up many possibilities beyond that envisioned by the original firmware. It literally helped the model fly off the shelves so fast as the firmware brought “pro-level” features to a consumer router.

That being said, this router only has 4Mb flash and 32Mb RAM, so it’s not likely to unlock the complete realm of possibilities afforded by aftermarket firmware, but it gives you an opportunity to improve the stock firmware (if it’s inadequate), and to learn/play around with DD-WRT/OpenWRT and teach yourself a little bit about iptables for example. It is better than the older 1Mb/2Mb flash models which were impossible to support and dominated the low end router market.

My TL-WR740N’s

The key to having these possibilities lies in ensuring you get the correct revision of hardware. Manufacturers often make the sneaky trick of keeping the same exterior and model number, but changing the internal hardware in a series of “revisions” which are (sometimes) completely different chipset-wise and make it impossible to support aftermarket firmware.

wr740n-box-rear

Fearful that I wouldn’t get the right revision, I purchased one locally and one overseas via eBay. Funnily enough, both turned out to be variants of v4, meaning that we’re all good!

wr740n-box-side1wr740n-box-side2

It seems that the numbers after the major version number indicate minor revisions which may include component substitutions but doesn’t seem to cause any trouble whatsoever.

wr740n-box-bottom

The bottom of the box didn’t have anything too exciting, but I thought I’d include it just to be thorough.

The front of the box for overseas versions has varying warranty labels (say 2 years, instead of three), no NBN sticker, maybe a different sticker instead.

WR740N Top

The router itself is a simple piece of plastic – the design seems elegant, but the antenna is not removable. This is unfortunate, but not incurable!

DSC_0025

Yes, it implores you to run the CD, but there’s really no need.

WR740N Underside

The underside is covered with vent holes (maybe a bit over the top) and has four rubber feet. Only the rear two (the ones near the ports) actually conceal screws. Removing those two feet and screws allows you to pry the router apart – but the plastic clips hold very tightly.

WR740N Rear Ports

The rear ports are nicely colour coded. Also nice was for them to include a power button – often omitted on most budget routers.

WR740N inclusions

All up – here are the inclusions. There’s a 9v 0.6A switching power adapter to power it, a short LAN cable for initial setup, a CD (which you don’t need) and a few leaflets. Interestingly, there is one leaflet covering GPL software which implies no warranty on the software – it’ll be interesting if you claim the router doesn’t work properly and they claim it’s the software which we don’t warrant. It also means that the stock firmware may already be running a form of Linux, and the source code being available makes it easier for others to port their own OSes to it.

Inside the Box

Opened Router WR740N

Getting this thing open was relatively hard – the clips on the side of the plastic held fairly firm – it’s a very sturdy design, which, I’m not sure we’d even notice if the screws were missing!

Lets take a closer look – I have two (one local, one imported) which are both practically the same, bar some component level substitutions which are expected when producing things in volume (and having multiple sources).

DSC_0046

DSC_0029

We can see that they’ve done almost everything necessary to save money. They’ve omitted the diversity antenna and seem to have used a printed antenna for the other port (possibly, I’m guessing from the trace pattern top-left). They’ve also omitted the connector for the antenna, instead, opting to solder (what looks like) RG-174 to the board directly. This tells us that if we wanted to get a better antenna on – just buy RP-SMA to anything pigtail, lop off the end and solder it to the board. Drill a hole in the case at the top and screw it in. Voila.

They even have omitted the can which could (and probably should) be fitted on top of the SoC. They also use plastic RJ-45 jacks (incompatible with STP – but rarely used anyway) which don’t have all 8 positions wired (only 4, for 100Mbit/s). It also looks like they omitted a secondary capacitor from the switching converter.

The PCBs are marked with 2050500188 Rev:1.0 and KB-6160.

Okay, enough talk about what they’ve left out – but what goodies have they “left in”?

  • Main SoCAtheros AR9331-AL3A 400Mhz MIPS 24K Highly-Integrated and Cost Effective IEEE 802.11n 1×1 2.4Ghz SoC for AP and Router Platforms. Features 16-bit SD/DDR1/DDR2 memory interface, SPI NOR Flash support, 4 LAN + 1 WAN Fast Ethernet switch with auto crossover, auto polarity, QoS and autonegotiation, integrated RF front end with PA, LNA and switched diversity, UART, I2S, USB Host + Device, GPIO, JTAG.
  • FlashSpansion FL032P1F or Winbond 25Q32BVSIG 32Mbit SPI flash. That’s 4 Megabytes.
  • RAMESMT M13S2561616A-5T or Winbond W9425G6JH-5 4M x 4 banks x 16 bits DDR SDRAM. That’s 32 Megabytes.

Definitely not the most powerful things we’ve laid our eyes on, however, not shabby for $22. There’s also a handful of LEDs, a crystal, a voltage regulator, some caps, inductors, and magnetics for the Ethernet ports that I didn’t mention.

As a router for home use, it’s not really commendable. The 2.4Ghz spectrum is overcrowded, and the chance that you will be able to get 150Mbit/s physical layer rate which requires two 20Mhz bonded channels is pretty much none. As a result, the real physical layer rate will be (at best) 72.2Mbit/s with losses due to interference from other co-channel users. It’s much better to get something proper (if you can afford it) – dual band N dual-stream routers will offer much better performance and can be had about $85AU.

Stock Firmware

If you’re looking for a basic router – this router is pretty good in general. It’s setup is very similar to most TP-Link products in the past – generally well-featured, with a clean interface. Nothing too special – but this one is a bit better than the most basic routers in providing QoS rate limiting options and WDS ability, although I didn’t test how well they operated. In short, I’ve never had many trouble with TP-Link products, and I think the firmware is perfectly adequate for $22.

In fact, because I was skeptical of the ready for NBN claim, I hooked it up to route from 192.168.0.1/24 (my current network) to 192.168.1.1/24 (behind the router, a second network) and I tested the single-session packet forwarding rate. Needless to say, I was astounded that copying from another machine on my LAN, through the router, to its LAN managed to hit 97Mbit/s! For a 100Mbit/s router, you really can’t complain since some of the older value ones start struggling about 40Mbit/s onwards.

That being said, you may be interested in aftermarket firmware if you’d like more customization – say multiple SSIDs, different dynamic DNS services, VPN server, SSH/Telnet configuration of iptables firewall rules, flexible QoS and special DHCP/forwarding requirements. Maybe you’d want your router not to be a router at all and instead be a client bridge. The thing to realize is that the power afforded by aftermarket firmware isn’t easy to harness – you may end up confusing yourself and discovering a few bugs along the way. Luckily, at this price, I was willing to tinker for ages (and ended up building a honeypot for research purposes). If you use an appropriate Wi-Fi card and a regular computer running Linux, you could do the same with some effort, but without the same “form factor” limitations/conveniences.

DD-WRT

Getting DD-WRT onto the router is quite easy. You need to flash using the TP-Link web-interface using the file named factory-to-ddwrt.bin you can find in the router database section. It applies quickly to a reboot – with the DD-WRT default IP being 192.168.1.1 (as opposed to the TP-Link default of 192.168.0.1).

Unfortunately, there’s one more step which isn’t obvious. The present build for the WR740N has a bug which means that wireless modes other than Open just won’t work. You’ll find that clients will not be able to associate, and if you’re operating as a client bridge, that won’t work if the host AP is running any form of encryption.

The latest build solves this problem, but has to be manually downloaded by traversing the Other Downloads section. That is currently build 22118 which you will have to grab the webflash file and flash from within the older build of DD-WRT to bring you up to date.

If you’re feeling lucky, you can try the factory-to-ddwrt.bin from the latest build, although this hasn’t been “guaranteed” yet, so I used the safer route.

Getting back to the TP-Link stock firmware is easy – head back to the Router Database page and download the wr740nv4_webrevert.rar file, unRAR, and flash using the DD-WRT interface. Then, go to TP-Link’s website and download the latest firmware and then flash that – as the webrevert will bring you to an older firmware revision than it was shipped with (which, incidentally, has several bugs too).

So far, I like the customizability and complete feature set of DD-WRT which works almost immediately out of the box. Even nicer is the info screen which shows you the signal level of the client as seen by the access point which can make alignment a breeze. Access via SSH and Telnet opens up a limited ash terminal for tweaks to scripts and so forth.

OpenWRT

A slightly different extended “aftermarket” firmware is OpenWRT. They also support the TL-WR740N with several downloads. In order to get onto OpenWRT, you need to flash a squashfs bin file from the TP-Link web interface – currently this one, named “attitude adjustment” is the latest. As far as I can tell, it is not safe to flash this in DD-WRT. The first time I tried, it failed. The OpenWRT page for the TL-WR740N gives a lot of detail about debricking and soldering up the Serial TTL.

There are several versions with different pre-installed packages, but the philosophy behind OpenWRT is that “you build the router you want by installing the packages you need” which is quite a nice one. Except, it doesn’t quite work well within the 4Mb of flash on this router. Installing most packages will easily cause the flash to become entirely full and the router to behave erratically.

There are many things you can do to configure the router – and some of them will even lock you out from being able to access the router and further configure it. As OpenWRT doesn’t react to the reset button in the same way as DD-WRT does (a hold for DD-WRT will reset all settings), you need to enter failsafe mode instead. It’s really not as hard as it seems, as every button can be used to do it. I typically power off the router, power it back on while continually tapping the QSS button until the LED indicator with the cog blinks quickly (indicating failsafe has been entered). Then it’s a simple case of telnetting in to 192.168.1.1 from a machine with a fixed IP on the 192.168.1.0/24 subnet.

In order to revert the firmware entirely, the situation is less clear, however, I have flashed the factory-to-ddwrt.bin file using the web-interface of OpenWRT and it behaved unusually. The web interface didn’t come up quite right, but it was okay after a reboot. It might not be the safest way, but at least it didn’t brick my router.

The BIGGER Picture

While it turns out that these two firmwares do enable some more tinkering with the router, the hardware itself is capable of much more. If, for $22, you can get a 400Mhz MIPS CPU, a wireless radio, two ethernet MACs with a four port switch, a handful of LEDs, 4Mb of flash, 32Mb of RAM, a power supply, an antenna, a plastic case, a power supply, a cardboard box, a CD and a bunch of leaflets, you have to ask yourself – what am I actually buying when I buy a prototype board, be it an Arduino or a Raspberry Pi.

Sure, the CPU is no powerhouse, and it doesn’t have any video output – but that’s besides the point. The SoC itself is plenty powerful for many tasks – it even has USB host which means you can use it to interface with storage, and it already runs a linux kernel. In actual fact, if you’re writing the code in a high level language, you might not care what architecture it’s running on.

So why don’t we change a few things around. Use this IC to build a prototyping board where the flash is made a little bigger, the RAM might be kept the same, the USB pins broken out to a port, and the LED GPIOs repurposed to drive a microSD card. Maybe strip out three of the four hub ports on the second MAC to save on magnetics and jacks – but keep two Ethernet ports so it can be used as a sniffer, firewall, or one-to-one port router. It’ll already have wireless inbuilt thanks to the IC – and if you’d like, maybe attach an audio input/output to the SIP portion of the SoC so you could use it as rudimentary “voice quality” sound module. Break some things out to headers too, it won’t hurt. Maybe even give us the power supply too :).

If I could get this for $22, I think it would be an absolute hit. Of course, the IDE would need to be made for it, and libraries to make it convenient to do several things. It won’t have ADCs either – but with a USB host, you may be able to team up an Arduino if you really needed to (or you may be able to hijack an SPI/I2C bus if there is any left over).

I think it’s clear that, while SoCs have certain target markets and may be optimized for certain tasks, it doesn’t mean that they’re not worthy of doing something different altogether. In this case, it blows my mind to think we’re getting a single chip, mixed IC design manufactured at such low costs – the computer shop has to make profit, the shipping company has to make profit, etc etc.

So, anybody game to make an Atheros based prototyping board?

About lui_gough

I’m a bit of a nut for electronics, computing, photography, radio, satellite and other technical hobbies. Click for more about me!

This entry was posted in Computing, Electronics, Telecommunications and tagged , , . Bookmark the permalink.

16 Responses to TP-Link TL-WR740N: Cheapest DD-WRT/OpenWRT Router Ever?

  1. Conrad says:

    That link doesn’t seem to work. Where else can I get the latest firmware for that router?

  2. Erich says:

    “what am I actually buying when I buy a prototype board, be it an Arduino or a Raspberry Pi.”

    Raspberry PI – Model A has 256 MB RAM, 1 USB port, HDMI, Audio output. $28.00
    Raspberry PI – Model B Series 2.0 – 512MB RAM, 2 USB port, HDMI, Audio output and an Ethernet port. $45.90

  3. Michael says:

    Nice article. You mention support for revision v4 of the device, but that isn’t corroborated bij the openwrt site? They only mention v3,v5, v7, v8 and v9?

  4. I have this router for years, and it’s awesome, runs fine with openwrt.

  5. Arti says:

    8devices carambola 2 is prettymuch the same router but with two ehernets and bunch of gpios broken out

  6. Ash says:

    You mentioned that TP Link WR740N has 2 MAC addresses… I have the same router and I noticed that the MAC of my LAN port ends with A0 and that of WAN port ends with A1
    Can you tell me what is the purpose of 2 MACs on the same router ? Does every router have 2 MAC ?

    • lui_gough says:

      I think you may have misread – I said that the SoC used by the product has two MACs – Media Access Controllers, not MAC Addresses!

      The two MACs, or ethernet “ports” in laymens terms, are used with one facing the WAN, and one facing the LAN (which is then connected to a switch, which then gives you several LAN ports). This means that the SoC itself doesn’t deal with the four ethernet LAN ports directly, and only has a 100Mbit/s channel as a single port. Technically, there is probably another MAC integrated with the wireless controller as well.

      The number of MAC addresses the router has is a strange thing, as different models will do different things. Some units will have different MACs for each WAN, LAN, Wireless and Guest-Wireless networks. This is necessary as MACs are generally designed to be unique, at least within the network, as a way of identifying the device at the lower levels of the network. This is especially necessary for the Wireless portion of the network, where connection frames are targeted by MAC address (BSSID).

      However, many devices will also offer the ability to change the MAC address of the WAN port, a feature commonly called “MAC Clone” so as to overcome certain ISP’s restrictions (i.e. modem tied to a certain computer’s MAC address for security/authentication). Aftermarket firmware also likely offers the ability to change the MAC address by software configuration. The MAC address assigned by the factory is normally held in an EEPROM somewhere in the device, and is mainly a formality to identify the product’s originator (first 3 octets) and be sufficient that most users see no MAC collisions (i.e. all devices on the same network have a different MAC). If several devices on the network had the same MAC, then devices will likely get confused, along with switches, and ARP/routing would be very very messed up.

      – Gough

  7. Jesper says:

    how about the WR703N?
    It’s about 10$ 🙂

  8. Michael Hampton says:

    The TL-WR741ND is virtually identical (including price) and has a detachable antenna. Each TP-LINK model ending in D has a detachable antenna. I’ve used a bunch of these over the last few years and I still pick them up when I feel like I need an extra one; they’re quite the workhorse. I’ve had as many as 50 simultaneous users on one using OpenWRT.

    To cross-flash from DD-WRT to OpenWRT use the “sysupgrade” image, not the “factory” image, and reset to “factory defaults” or “default settings” on the DD-WRT flash page. Or better yet just skip DD-WRT altogether; it’s jumped the shark…

  9. Renaud says:

    Does it support multiple ssid?

  10. Thank you very much. I was stuck with the build that had problem with wifi security as you mentioned above. I followed your link, found newer version in other section ( http://dd-wrt.com/site/support/other-downloads?path=others%2Feko%2FBrainSlayer-V24-preSP2%2F ) . I installed it in my router and everything is fine now.

    Thanks again

Error: Comment is Missing!