TP-Link TL-WR703N clones and English firmware upgrade (FAST FWR171-3G, Mercury MW151RM3G)

TP-Link TL-WR703N has two cheaper clones: FAST FWR171-3G and Mercury MW151RM3G. All 3 routers are identical except for the case and the color of the LED. They are also closely related to TP-Link TL-MR3020, which shares the same hardware platform but adds a hardware switch and additional status LEDs.

These routers let you create a wifi hotspot from a 3G/4G USB dongle. They can also be used as standard wireless router, AP, or range extender.

Here's a comparison of TL-WR703N and its rebranded models:

	TP-Link TL-WR703N	57×57×18mm 36g	Router only $24.00 USD Router and USB cable $25.00 USD
	FAST FWR171-3G	56×56×18mm 34g	Router only $22.00 USD Router and USB cable $23.00 USD Out of stock
	Mercury MW151RM3G	56×56×18mm 34g	Router only $22.00 USD Router and USB cable $23.00 USD

The stock firmwares on these routers are in Chinese, and support only a handful of 3G dongles from Chinese carriers. But, it can be quite easily replaced. There are several English firmwares to choose from, and several ways to load the firmware onto the router.

Choice of English firmware

Your options are: TL-MR3020 firmware, DD-WRT, and OpenWRT

1. The English firmware of TL-MR3020

I recommend this firmware to normal users, those who use the router as a router. It has out-of-box support for almost any 3G dongles you can find around the world. The MR3020 firmware runs perfectly fine on all 3 variants of 703N.

Features of the MR3020 firmware include:

• Share a 3G/4G mobile connection, compatible with 120+ LTE/HSPA+/UMTS/EVDO 3G/4G USB modems (WiMax modems not supported)
• IP-based bandwidth control allows administrators to determine how much bandwidth is allotted to each connected device
• 3G/WAN failover guarantees an "always-online" internet connection
• Three working modes: 3G/4G Router (for sharing a mobile internet connection through a USB modem), Travel Router (for sharing a wired internet connection), WISP Client Router (for sharing a wireless internet connection, a.k.a. stealing your neighbor's wireless network). 
• WDS, WPS, WPA2, port forwarding, MAC filter, UPnP, QoS, dynamic DNS, etc

The firmware can be downloaded here. TP-Link also provides an emulator of the firmware's web interface.

2. DD-WRT

DD-WRT is used in most TL-WR703N sold on eBay that claim to have English firmware. It is a lot more powerful than the MR3020 firmware, but requires a lot more effort to set up. Compatibility with USB dongles can be found here.

By default, DD-WRT configures the only Ethernet port as a LAN port. This is okay if you want to use it as a 3G router, a wireless client router/repeater, or a simple access point. However, to use a wired internet connection with the router, the following steps must be done in the web GUI:

1. Create a new bridge interface, br1, with the same IP address and subnet mask as the router itself, for example 192.168.1.1/255.255.255.0
2. Assign the wireless interface ath0 to the newly created br1
3. Make sure eth1 is assigned as the WAN port
4. Add an instance of DHCPD to serve br1

Some guides on the internet suggest putting br1 in a different subnet. This requires changes to the firewall script to fix the NAT. In my opinion, it is fine to have the same IP address on two interfaces (br0 and br1, in our case). If you are not comfortable with that, just turn off br0, since it is not used any more. By the way, does anyone know why we can't just remove eth1 from br0, keeping only ath0? And what exactly is eth0 on this router?

The latest DD-WRT for the 703N family is available here. Go under the build directory, then look for "tp-link tl-wr703nv1".

3. OpenWRT

OpenWRT is for the brave souls that want to tinker with things. I am not a big fan of UCI, I think normal configuration files are just fine. As for USB dongles, you are pretty much on your own. I choose OpenWRT only because I need OpenVPN in the firmware. DD-WRT std only provides PPTP VPN, so I ended up building a customized OpenWRT image for my application.

The latest OpenWRT trunk image for the WR703N is available here. There are also several specialized OpenWRT based firmware projects:

1. Gargoyle -- Great web interface with native USB modem support. Recommended alternative to DD-WRT.
2. Maddox's firmware -- webcam server, USB over IP.
3. PirateBox -- Web-based chat and file sharing.
4. P.O.R.T.A.L -- Personal Onion Router To Assure Liberty. A gateway to anonymity and the deep web.
5. ROOTer -- Enhanced USB modem support for Australian users.

Firmware upgrade methods

After you've decided on an English firmware, the next step is to put it onto the router. You can do this via the web GUI, bootloader commands, or a flash programmer.

1. Upgrade from the stock firmware's web interface

This method is as simple as uploading a file. Just point your browser to the router's admin interface (http://192.168.1.1, user/pass=admin/admin), navigate to the firmware upgrade page as indicated in the screenshots, upload the new firmware, wait for reboot, and it's done.

Now here's the bad news. The stock Chinese firmware on these routers will not accept firmware of a different model. So if you have a Fast FWR171-3G or a Mercury MW151RM3G, and attempt to upgrade to the MR3020 firmware or the WR703N DD-WRT firmware, it will be rejected. Turns out that the model info is embedded in the header of the firmware file. If the header is modified with the correct info, the foreign firmware will be accepted.

I have created modded MR3020 firmwares for the WR703N, FWR171-3G and MW151RM3G. But due to copyright issues, I won't post them here. If you buy the routers from me, I will email you the firmware along with detailed instructions on how to do the upgrade. With the modded MR3020 firmware, the router will also accept official firmware upgrades of MR3020 released by TP-Link, or any 3rd party firmwares built for MR3020.

I can also provide modded DD-WRT and OpenWRT firmwares for web upgrade. But I strongly recommend those who play with these firmwares to have a TTL serial adapter ready, since you will likely need it down the road. And with a serial console you should go with the TFTP method below, which doesn't need modded firmware.

2. Upgrade via bootloader commands in serial console with TFTP server

This method requires opening up the router and hooking it to a PC via a USB serial TTL adapter. The cheapest adapter from eBay will do the job for under $2 USD. On the PCB, there are two tiny copper pads labeled TP_IN and TP_OUT. Connect the first one to the adapter's TX pin, and the second one to the adapter's RX pin. Connect GND to the big solder pad as shown in the picture. My "probing station" was built from dental picks, alligator clips, and scotch tape. If you are soldering, make sure to use very thin wires and not to pull them, otherwise the pads may be lifted from the PCB.

You need a TFTP server to host the firmware file. I use OS X's built-in tftpd. Put the new firmware in the TFTP directory. The file size should be 3932160 bytes (0x3c0000). Get a terminal running over the serial port, for example by "screen /dev/ttyUSB0 115200" in linux. Plug in power to the router. As soon as you see the bootloader info, type "tpl" quickly and you'll be greeted with a prompt "hornet>". Now enter the following commands to flash and boot the new firmware.

setenv ipaddr <device-ip, e.g. 192.168.1.111>
setenv serverip <tftp-server-ip, e.g. 192.168.1.100>
tftpboot 0x80000000 <firmware filename on the tftp server>
erase 0x9f020000 +0x3c0000
cp.b 0x80000000 0x9f020000 0x3c0000
bootm 9f020000

3. Flash with a SPI programmer

This is obviously the last resort. It shouldn't be needed unless if you seriously messed up the firmware and damaged the bootloader, or if you are replacing the flashrom chip. I haven't tried it myself yet, but I'll have more info later when my flash programmer arrives.

Finally, some pictures from my old eBay store: