OpenWrt Forum Archive

Topic: ALFA R36 Router Hacking

The content of this topic has been archived between 25 Mar 2018 and 1 May 2018. There are no obvious gaps in this topic, but there may still be some posts missing at the end.

here you go.... … eneric.bin

SSID: OpenWrt

no password has been set so you will need to telnet to either the WiFI or LAN address to see the password before you can login with ssh or lucy.

Basic firewall is set with WiFi and LAN access to the router but forwarding to WAN disabled.  WAN is blocked.. so you can't login through the WAN.

reset button has been implemented.. hold for 15 seconds and release to reset defaults. WPS button has not been configured although the button has been mapped to 'wps'. So you can configure the button by adding it to /etc/config/system.

take care.


thanks :-) work r36 but not drive update list:kmod-rtl8187l, and kmod-usb2,and kmod-ohci

ok. i have added the requested kernel modules and updated the image. please download again.


thanks!!!!!!!!!!!! very good polite and helpful

20 minutes on ok I did, but now only a reboot will not start power led on no longer boot from serial needless why!!

dead no longer works

luis could you please build a new image with the lastest kernel? i want to add some usb wifi dongles smile

Thanks in advance.

you mean share the entire OpenWRT source tree?!?

lsoltero wrote:

svn update and recompile fixed the WAN. 

thanks all for your help.


Hello Isoltero, you wrote that the WAN was fixed. Is the WAN fix also in your last Image (r36-generic-k3.8.13.bin) ?
I need to download the relayd packet on my R36. So i need WAN. I hope i understand that so right.
Sorry if the question is stupid. wink

I still can not build a own image. OpenWRT is a new field for me.

yes... the WAN works on the last image that was posted...

here is the config/network for making the WAN/LAN work on the build.

config 'interface' 'loopback'
    option 'ifname' 'lo'
    option 'proto' 'static'
    option 'ipaddr' ''
    option 'netmask' ''

config 'interface' 'lan'
    option 'ifname' 'eth0.1'
    option 'type' 'bridge'
    option 'proto' 'static'
    option 'netmask' ''
    option 'ipaddr' ''

config 'interface' 'wan'
    option 'ifname' 'eth0.2'
    option 'proto' 'dhcp'
    option 'hostname' 'OpenWrt'

config 'interface' 'wifi'
    option '_orig_ifname' 'wlan0'
    option '_orig_bridge' 'false'
    option 'proto' 'static'
    option 'ipaddr' ''
    option 'netmask' ''
    option 'broadcast' ''

you will note that the WAN is configured for DHCP. You may need to change that to a static IP address if you are not using a nework that provides DHCP.

good luck.


Wow, thank you very much for the fast and friendly support.

Best regards   smile

Using the R36 with the AWUS036H (or NEH) for WAN .. Exactly what I am trying to do!

It sort of works. I have a running config that routes to an internet connected AP. It is all running under Gargoyle 1.5.X (Nov 2013) on attitude_adjustment-38347 with the @gunther patch for eth0.2.

The problem is that the USB connected WLAN dongle runs with Tx-Power=0 until associated
This goes for both my AWUS036H and AWUS036NEH.

Antenna is fine and sensitive as I can see all the hotspots around me. Only, I can only connect to the one 3 feet away (My 3G MiFi)

Any help appreciated!

root@Gargoyle:~# brctl show
bridge name    bridge id        STP enabled    interfaces
br-lan        7fff.00c0ca6e744c    no        eth0.1
br-wan        7fff.00c0ca76f8d5    no        wlan1
root@Gargoyle:~# iwconfig 
br-wan    no wireless extensions.

gre0      no wireless extensions.

eth0.1    no wireless extensions.

lo        no wireless extensions.

wlan1     IEEE 802.11bgn  ESSID:off/any  
          Mode:Managed  Access Point: Not-Associated   Tx-Power=0 dBm   
          RTS thr:off   Fragment thr:off
          Encryption key:off
          Power Management:off
imq1      no wireless extensions.

wlan0     IEEE 802.11bgn  Mode:Master  Tx-Power=20 dBm   
          RTS thr:off   Fragment thr:off
          Power Management:off
eth0      no wireless extensions.

imq0      no wireless extensions.

br-lan    no wireless extensions.

Can some one build a new image update of openwrt please?


new build for R36 ?

Sorry for disturb you all, i was trying to install openwrt on my R36 but i believe i failed.

i flashed … uImage.bin directly from the web page expecting more stable development since it seems that there is support from 12.09 (my bad)

Now the router is with the "WPS" button always on (but it is intermitent on boot), is anything i could do in order to install openwrt from this???

Thanks, any help is appreciated smile


I managed to recover my R36 smile

But with the latest stable build i get the ethernet bug sad , is there a patch for this version ???

(yes, i know luis posted a working build but it is on bleeding edge, is there any posibility to have a stable build???)
what patches do i need to apply in order for the ethernet ports to work?

any help is truly appreciated

P.D. Yes i am a newbie sad

(Last edited by Dragoon on 20 Sep 2015, 02:18)


How did you recover? I'm in the same state. sad

@lsoltero , i know it's been a long time, but do you think you could build a new image for the r36 without the ethernet bug???, i installed your last image: … 3.8.13.bin

but when i try to upgrade the opkg i get the next error

root@OpenWrt:/# opkg update
Downloading … ckages.gz.
wget: server returned error: HTTP/1.1 404 Not Found
Collected errors:
* opkg_download: Failed to download … ckages.gz, wget returned 1.

my guess is that the repository is down for good

of if you don't have the time, could you tell me how did you patched the ethernet bug so i can try in the new image (15.05.1)???

P.D. Forgive my english as is not my mother language sad

have you tried using 15.05.1?  Does it work?  We haven't done anything with the R36 in a very long time.  Not even sure we have patches still.

i am still a noob in this hole thing about compiling openwrt, i ll try to compile it with the patches but since ipv6 was implemented out of the box in 15.05 i believe there ll be a malfunction in wan6 interface, i was looking for the switch config in /etc/config/network but so far no luck sad

i tried 15.05.1 with the same bug.

in the remote case i made a success in compiling an image i ll post it here on a mega mirror i guess.

P.D. i mentioned you @lsoltero in my previous post since you were one of the few that knew what was going on here :v , any suggestion or lights on this topic ll be truly appreciated and maybe i can maintain the build through os upgrades :v

unfortunately the patchs are not longer working in the last stable release, i ll try to configure the /etc/config/network file to manualy use the switch (at least as a dumb switch).

P.D. if anyone has a /etc/config/network suggestion i ll try it gladly, i can recover from dangerous config since i have serial access

(Last edited by Dragoon on 23 May 2016, 19:15)

Any News here? I have smoe r36 and after update I can't connecto to it only terminal works...

latest stable works fine on the r36, i'll recap everything I needed to do to install it as it will be easier to find

and watch out for the links in this post, i had to cut them because the forum software is dumb

you need to open the case (2 screws under the leg pads on the USB port side), and connect a serial uart cable to 3 of the 4 pins on the left side when looking at the board with the usb port facing you, there's a picture posted on page 2 of this post htp

openwrt image is here htps

after you download, move it for tftp (debian/apt-get install tftpd-hpa), i had to use a shorter name as it seems uboot clipped it

apt-get install tftpd-hpa
cd /tmp/
wget htps
wget htps
md5sum -c md5sums 2>/dev/null | grep openwrt-15.05.1-ramips-rt305x-w502u-squashfs-sysupgrade.bin
mv openwrt-15.05.1-ramips-rt305x-w502u-squashfs-sysupgrade.bin /srv/tftp/openwrt.bin
ifconfig eth0 netmask
/etc/init.d/tftpd-hpa restart

connect an ethernet cable from your eth0 to the wan port (or was it the lan i used?)

you also need a serial uart connection for the bootloader and initial openwrt config
i used the bus pirate v3.6 stable, i had to flash the 6.2-beta1 firmware but i dont think it was needed, it was a problem of the initial config of the bus pirate which i'll post below - problem was as reported by someone on the first page, the bootloader passed too fast over the option selection and didnt seem to take my keyboard input at all
and not sure if its minicom or screen that was the issue
i ended up using "minicom -b 115200 -8 -D /dev/ttyUSB0 -s" and Serial Port setup, make sure hardware and software flow control are set to NO, then type esc 2 times to get to the minicom screen

for the cable connection i used the sparkfun new bus pirate cable and if you use a similar one you should check the cabling on it as there are several versions and you could burn your bus pirate connecting the cables wrong
bus pirate -> r36 pins (pin 1 closest to the usb port, pins starting from 1 are VDD, RX, TX, GND, and you only need the last 3)

if something isnt working you can check the self test procedure on the bus pirate and also shorting the TX/MOSI to RX/MISO and using a minicom terminal with the bus pirate uart config pasted below (maybe with local echo on), you should see the output as you type, with echo would double it

after you open minicom to the bus pirate, set the bus pirate config:

Bus Pirate v3b
Firmware v5.10 (r559)  Bootloader v4.4
DEVID:0x0447 REVID:0x3046 (24FJ64GA002 B8)
1. HiZ
2. 1-WIRE
4. I2C
5. SPI
6. 2WIRE
7. 3WIRE
8. LCD
9. DIO
x. exit(without change)

Set serial port speed: (bps)
 1. 300
 2. 1200
 3. 2400
 4. 4800
 5. 9600
 6. 19200
 7. 38400
 8. 57600
 9. 115200
10. BRG raw value

Data bits and parity:
 1. 8, NONE *default
 2. 8, EVEN
 3. 8, ODD
 4. 9, NONE
Stop bits:
 1. 1 *default
 2. 2
Receive polarity:
 1. Idle 1 *default
 2. Idle 0
Select output type:
 1. Open drain (H=Hi-Z, L=GND)
 2. Normal (H=3.3V, L=GND)

(1)>2 ((<<<i think the problem was here why i couldnt send any input via the uart interface to the boot loader, i used option 1 as seen on several forums>>>))

 0.Macro menu
 1.Transparent bridge
 2. Live monitor
 3.Bridge with flow control

and after this you are connected to the router's console and you can plugin your router to see the bootloader menu.
you cant control the bus pirate anymore so if you need to change anything you need to unplug it first. to exit minicom you type CTRL+A x

you can also use screen instead "screen /dev/ttyUSB0 115200 8N1" but i'm not sure the input problem wasnt because of it

when seeing the uboot prompt, type 2
   2: Load system code then write to Flash via TFTP.
it will ask you for its ip and server ip, mine was something like for the server (server is your tftp box)
and the kernel image, which is openwrt.bin if you copied it like i did above

router will boot with openwrt, keep the serial console open and press enter and you should be logged in
if you are not familiar with vi editor, press i to edit, press escape to end editing, and then press :wq to save and quit

vi /etc/config/network

paste this at the end of the file

config switch
        option name 'switch0'
        option reset '1'
        option enable_vlan '1'

config switch_vlan
        option device 'switch0'
        option vlan '1'
        option ports '1 6t'

config switch_vlan
        option device 'switch0'
        option vlan '2'
        option ports '0 6t'

then restart the network or router, and you should be able to ping it to (remember to set your eth0 interface and switch to lan)

/etc/init.d/network restart

eth should work fine now, the only problem was the missing switch config

one thing i noticed in my r36, i only have a wlan0, while i understood this router has 2 wireless chips and i've seen 2 interfaces on ifconfig output from this router. any idea what i need to do to see both or do i have a different revision?
chipset says RT3050 F

EDIT: nevermind, the second interface is the 5ghz which isnt working

(Last edited by xwrt on 14 Sep 2016, 02:55)

It works perfectly

version luci

why not use the official one i linked in the post above yours?
wget htps