Unofficial TRENDnet AC2600 (TEW-827DRU v1.0R) release v18.06.8 and v19.07.2

Device Support Status

This device is end-user ready. Wired and wireless works, LEDs work, buttons work, and factory image installation works. Testing has shown the system to be stable under load. I have a small collection of these devices operating in personal and business envrionments and they have proven to be reliable.

This document applies only to the 1.0R version of hardware. Other hardware revisions are not compatible or supported here.

OpenWRT/LEDE Project leaders previously rejected all of my patches and I didn't see any situation where it was possible to get them merged so I gave up trying. If someone else wants to take my work and move on with it, you are welcome to do so.

Currently Known Issues

There are no significant issues specific to this device.

Factory installation via the OEM web interface is not supported yet because the install will revert after next reboot due to the Safe Upgrade/redundant partition system. However, there is a recovery loader in u-boot which is easy to use, so we can and should install our image that way instead.

The "LED on/off" button can't be made to work because we currently can't shut off the ethernet switch port LEDs. This may be fixed in the future if I am able to support it. The button currently does nothing, but it is configured in the DTS so you can write a script to use it if you want to. This button doesn't work under the OEM image either, so nothing lost.

Downloads/builds

The latest builds are based off the OpenWRT v18.06.8 (patch set v14) and v19.07.2 (patch set v16) releases.

Minimal image files are here:

https://jmomo.net/files/lede/TRENDnet_TEW-827DRU_20200301180729_OpenWRT_v18.06.8_minimal/bin/

https://jmomo.net/files/lede/TRENDnet_TEW-827DRU_20200301181953_OpenWRT_v19.07.2_minimal/bin/

Minimal+luci image files are here:

https://jmomo.net/files/lede/TRENDnet_TEW-827DRU_20200301181034_OpenWRT_v18.06.8_luci/bin/

https://jmomo.net/files/lede/TRENDnet_TEW-827DRU_20200301190427_OpenWRT_v19.07.2_luci/bin/

You can download older builds and patches here:

https://jmomo.net/files/lede/

The minimal builds have a basic bare-bone package set just like you would get from an official OpenWRT release image. You have roughly 45MB of free space on the overlay to work with. No LuCi web interface or anything else. Install the packages you want with opkg.

Luci builds are like the minimal builds, but with luci-ssl added to provide a web interface.

Recovery and Installation Instructions

Installing OpenWRT/LEDE on this device is very safe, relatively speaking, and it's easy to restore the OEM image if you want to go back.

This device offers three methods for installing images: The uboot http Recovery Loader, the OEM http upgrade tool, and console uboot tftp. However, installation by the OEM http upgrade tool is not yet fully supported.

Most users should use the uboot http Recovery Loader because it's easy and safe to use.

DO NOT use the OEM web/http upgrade page at this time. While the OEM upgrade tool will accept and install the OpenWRT/LEDE image, we don't yet support TRENDnet's "Fail Safe"/safeupgrade dual boot system, which means that the device will revert to the old OEM image on the next reboot.

Finally, you can install images via serial console uboot and tftp.

Be sure to download a copy of the OEM installation images in case you want to go back. See this post for more details.

uboot http Recovery Loader

Connect an ethernet cable from your PC/switch/whatever to any one of the ethernet jacks on the router.

Manually configure your computer with an IP on the 192.168.0.0/24 network. The router does not offer DHCP services in this mode.

Press and HOLD down the RESET button on power-up for four seconds. Then release the reset button. NOTE: My testing shows the recovery system will not load if one of the ethernet ports doesn't go active/up. Make sure you have a cable plugged into an active port on other side before starting the reboot process.

The recovery page will be at at http://192.168.0.1/

The page should say "TRENDnet Recovery Mode" in blue text at the top and there is a "Choose File" button and "Upload" button.

If installing OpenWRT/LEDE, then upload the factory image file.

If you want to go back to the OEM image, use the OEM firmware file, such as "TEW827DRU_FW100B11.bin".

While the file is uploading, the Internet LED will blink. You can watch progress on the serial console too. Beware the progress/percent animation on the https loader page is fake/placebo.

That's it. OpenWRT/LEDE should be up and running within 30 seconds of uploading the file. The OEM image takes about two minutes and boots very slowly.

OEM http upgrade tool

DO NOT use the OEM http upgrade tool at this time. While our factory image file conforms to the OEM requirements to be accepted and installed, we don't yet support TRENDnet's "Fail Safe"/safeupgrade redundant partition boot loader scheme. The result is that the device will successfully boot into OpenWRT/LEDE after the first reboot, but upon the second reboot it will revert to the old OEM system.

I plan to work on supporting the OEM http upgrade tool and the redundant partition system in the future, but I have not gotten around to it yet.

Console uboot tftp

The serial console on this device is fairly easy to access. A 3.3v/TTL serial port can be found in the corner next to the USB ports. You will need to soldier in header pins. Disassembling the chassis is not difficult.

JP1 = Rx
JP2 = Tx
JP3 = Ground
baud = 115200

uboot gives a 2-second "Hit any key to stop autoboot" prompt, so that's easy to break. No special key combo required.

This device uses a FIT archive file, which includes an installer script, a bootconfig image, and the UBI (kernel+rootfs). All we really need to do is tftp the factory image into memory and execute the script embedded within it.

setenv ipaddr 192.168.0.1
setenv serverip 192.168.0.2
setenv netmask 255.255.255.0
tftpboot 0x42000000 openwrt-ipq806x-trendnet_tew827dru-squashfs-factory.bin
setenv imgaddr 0x42000000
source 0x42000000:script
reset

Future Plans

JTAG recovery is something I want to do some day. It may be possible to recover from JTAG by booting from RAM or programming the NAND flash on this device. I've already experimented with this and had some progress but I've not yet figured everything out and I regret that I don't have time to work on it right now.

Expand the NAND partitions, or otherwise fully use the NAND flash space. The default "rootfs" partition is 64MB in size, but there is 108MB of completely-unused space on the NAND flash, outside of smem/mtd partitions. There is also an additional 64MB of space used by the redundant rootfs_1 partition. It may eventually be possible to have a rootfs file-system of 228MB in size. If you want to use that 108MB of free space right now, see this thread on how to set up and use the "freespace" partition.

Custom u-boot. This depends upon being able to safely recover. We would need either TRENDnet's broken "Fail Safe" system to be fixed, or JTAG recovery. Otherwise the risk of permanently breaking the device is too great.

Boot from USB. This is not possible right now because the OEM u-boot wasn't built with the right modules. This would require building a custom u-boot.

Previous Forum Threads and Old Development Info

In May of 2018 the old OpenWRT forum died due to negligent administration. Previously, this is where I had kept a running log of changes and updates for this device.

This new thread replaces and supersedes any information on the old forum, but you can still read the old thread for background information on how I ported the device, previous issues, and additional technical information.

The old forum thread can be read here:
https://forum.archive.openwrt.org/viewtopic.php?id=65956

The original (now potentially invalid) URL to the old forum was:
https://forum.openwrt.org/viewtopic.php?id=65956

Then in 2019 the powers that be decided that it was a good idea to prevent the editing of forum posts after a short period of time, to combat some spam mechanics. Thus I intend to start a new thread for each new release since I can no longer edit my posts.

Previous release threads can be found here:

2 Likes

I did not test the v18.06.8 builds. v19.07.2 tested okay on my test unit.

This build fixes a minor issue where the MAC address on the wlan1 interface was not incremented correctly.

Hello guys.

I am kind of newbie to this and my device is on the last released firmware OEM version. Did the reset, reached http Recovery Loader on the TrendNet device, loaded the factory luci build v19.07.02 and device rebooted. It did reboot into the OEM last upgraded version with all previous settings.... So:

  1. What did I do wrong?

  2. I have also noticed in the old firmware links there is also a recent folder with minimal, luci and oratew - what is the oratew build?

Thank you in advance.

Best regards,

I have no idea. It sounds like you did everything right. The only way to troubleshoot it is to get serial console log data. See the "Console uboot tftp" instructions above for info on that. You can also just try to load the factory firmware a few more times to make sure.

It's for testing. Don't use it unless you want to break your device.

It's been awhile since I tested the factory image. I'll do a test on it here soon to make sure nothing has changed which might have broken it, but that's not very likely.

Hi Jmomo,
Thanks for replying, much appreciated.
Unfortunately I do not have a serial port to log into the console to check the logs.
I will do the procedure again via Recovery Loader. Will let you guys know how that went.

Best regards,

I decided to do a test of the current factory images today to make sure they were working right.

First I loaded up the OEM 1.00b11 image via the recovery loader and that worked fine. Then I upgraded to the latest/1.05b01 image via the built-in OEM upgrade tool. That all went fine.

However, the first time I tired to install the OpenWRT Luci factory image, it failed.

When it failed, this is what I got on a serial console. The last three lines of error message repeated for a minute or two until I reset the power:

httpd: PTM UIP_ETHTYPE_ARP, uip_len=60
httpd: PTM UIP_ETHTYPE_ARP, uip_len=60
httpd: PTM UIP_ETHTYPE_ARP, uip_len=60
offset is 1, offset = 1 is GET , = 0 is POST
mime_content_body 360: Current_Length: 851 content_len: 0
Error: End boundary wrong
mime_content_body 360: Current_Length: 1363 content_len: 0
Error: End boundary wrong
http_appcall() : send count down page 
mime_content_body 360: Current_Length: 1875 content_len: 0
Error: End boundary wrong
http_appcall() : send count down page 
mime_content_body 360: Current_Length: 2387 content_len: 0

A successful load will start with this:

httpd: PTM UIP_ETHTYPE_ARP, uip_len=60
httpd: PTM UIP_ETHTYPE_ARP, uip_len=60
httpd: PTM UIP_ETHTYPE_ARP, uip_len=60
offset is 1, offset = 1 is GET , = 0 is POST
mime_content_body 360: Current_Length: 24842740 content_len: 24908259
mime_content_body 360: Current_Length: 24843252 content_len: 24908259
mime_content_body 360: Current_Length: 24843764 content_len: 24908259
mime_content_body 360: Current_Length: 24844276 content_len: 24908259

On a second and third attempt the OpenWRT factory image installed just fine. Nothing had changed.

This isn't the first time I've seen the recovery loader fail. It's happened once or twice before, out of perhaps a hundred loads I've tried.

I think it's just flakey. Try it again a few times.

There could also be some factor that I've not considered, but I don't know what I don't know.

Hey Jmomo,

Finally today I had time to try again. Three time failed to load the v.19, at reboot from Recovery Loader, went directly into the stock firmware with all the settlings that had before (like nothing happened...).
So I have decided to go with the V18 and try eventually to upgrade after. The V18 seemed to work just that I could not connect to the router, either in DHCP enabled or manually set IP for the Ethernet connection (at this point I thought it might had bricked...). So i have went again to power up and keep reset for 4 seconds, set the Ethernet manually to 192.168.0.2 and got back to the Recovery Loader page. At this point I have loaded again the factory firmware V18, the router rebooted to ...factory OEM last 1.05b01 with all settings I had before... Seems there is a recovery mechanism which always brings back the last firmware and settings.
Any ideas what to do next?

Best regards,

This means the FIT image isn't actually being written at all.

The v18 never installed. You are mistaken in your belief (without evidence to support it) that the OpenWRT image was ever installed. If it had been, you would not have gone back to your old settings.

Trying v18 instead of v19 was smart, but won't actually do anything different on this particular model. The factory image install methods are identical between all revisions. And, I just tested the v19 image on my test device a few days ago so we know it works.

Here's what I think...

Your hardware might be broken or wrong somehow. Bad RAM in just the right place might cause the Recovery Loader to fail even though you don't have any symptoms in the regular OEM firmare, or it could be some other hardware change. The only way to know for sure is to get serial port debug info.

It's possible that you have a different version of hardware. The FIT install script does a variable check to make sure that "machid=1260" in the uboot variable env. If this check fails. the recovery loader doesn't try to install because it thinks it's the wrong hardware. The OEM install script doesn't do this check, but mine does. There's no way for you to check this on the OEM image without getting a root shell or serial access.

Buy a cheap little serial adapter for $3 and hook it up:


You are never going to find out what is going on without a serial adapter. You don't have to solder anything on this model, though you'll have to tape the pins down the header pins.

Hi, Jmomo

Thanks for the quick reply.
It seems there is no other way than go with the serial.
So, recapping, I will order the two items above, TTL Serial Adaptor to USB. Which Dupont cable, Male 2 Male or Female to Female cable?
Last, is there any tutorial how to to this?

Regards,

Here's a gallery of the router and board: https://imgur.com/a/5cSfg

To take the router apart, just wiggle off the rubber feet and take out the screws. The top will practically fall off after the screws are out. That's it; you don't need to take the board out of the chassis and you can access the serial port from the top.

See this picture: https://i.imgur.com/dMOD58l.jpg

That single row of vertical holes in the upper-right with "JP1" at the top? That's the serial port. JP2 and JP3 are immediately below JP1.

JP1 = Rx. You connect this to the Transmit pin on your adapter.
JP2 = Tx. You connect this to the Receive pin on your adapter.
JP3 = Ground. You connect this to the Ground pin on your adapter.

This particular device didn't solder in header pins; it just gives you the holes.

Normally you would buy some header pins like these, break off a row of them and solder them on: https://www.aliexpress.com/item/32724478308.html

But you don't have the solder on header pins if you don't have a soldering iron. You can just stick a wire into the holes and use some masking tape to hold them down so that you have a good electrical connection. It's hacky, but it works.

Then you need a short wire to get from your header to your adapter. You probably want some M-to-F type (holes one side pin on the other) if you don't plan on soldering. They look like these: https://www.aliexpress.com/item/32962785036.html

Finally you need an adapter. There are multiple chips which get used in these little TTL-level serial adapters, but FT232 and PL2303 are probably the most common. I hear CP2102 is fine too but I don't use them. CH340s are horrible garbage.

Note that most of these cheap adapters actually use fraudulent chinese clones most of the time, which don't fully implement the features of the real chips, but they work just fine for the kind of basic stuff we are doing here.

Do yourself a favor and buy one of the FT232s and a PL2303 or CP2102. At $1 they cost practically nothing: https://www.aliexpress.com/item/704553060.html https://www.aliexpress.com/item/32826575637.html https://www.aliexpress.com/item/32717057832.html

Also note that some of these adapters often use a mini-USB connector (NOT micro), so make sure you have a cable for it. If you don't, buy one: https://www.aliexpress.com/item/32767361411.html

While you are at it, consider buying a cheap USB extension cable unless you already have one. They come in handy: https://www.aliexpress.com/item/32415077335.html

The adapters are USB 1.1 or 2.0 devices, so you don't need a USB3 cable.

Finally when it comes to software, download Putty, select Serial mode for a new connection, use 115200 baud, Open, and tada you have a serial console. If you are on linux, use picocom.

There are a ton of guides and how-tos for Putty and accessing serial ports all over the internet, but this post tells you about 95% of what you need to know.

So if you add all this stuff together, it's about $10 USD. Here's a shopping cart I put together. Some of these are from different vendors than what I linked above, but this list is probably better:

Then you just have to wait. It usually takes 30-40 days for stuff to get to me on the west coast USA, but with the whole plague thing it might be slowed down a little. I did just get a bunch of stuff in last week. It had been held up in customs for an extra two weeks. Took 60 days in total I think.

Thanks Jmomo,

I am preparing the order to AliExpress.
To get this right, even if I may sound novice: I need to insert a dupont cable M2F into the JP1, JP2 and JP3 holes (use masking tape to hold) and on the other end connect them to the adaptor (adaptor goes into USB and further to the PC).
Looking at the adaptor you listed first in the text, two are normal USB (no micro, so better) but they all have 5 pins (others listed at the end of the post even more pins). I will be having only 3 wired pins out of the router, so the question is what to connect and where?
https://www.aliexpress.com/item/32717057832.html

Looking on the items I see corresponding pins for Rx, Tx and Gr but that will leave out unconnected the pins for 3.3V and 5.0V, do I leave this unconnected?

Thank you in advance,

Yes, you seem to understand correctly. Only 3 pins needed: RXD (receive data), TXD (transmit data), and GND (ground). The Tx on one side is Rx on the other.

Let me know when the stuff gets there and I'll give you more details. You will need to run a few commands to collect some information. It's pretty easy stuff.

Hi jmomo,

First of all, I'd like to express my appreciation for all your hard work to provide us with an unofficial OpenWrt firmware for this particular Trendnet router model. It's been so much fun to play around with OpenWrt firmware and all its packages.

I've noticed that your 19.07.2 builds now include a new set of images for " [TRENDnet_TEW-827DRU_20200301191258_OpenWRT_v19.07.2_oratew]. Could you please explain what "oratew" stands for and what the difference between it and the regular LUCI image is.

Thank you very much in advance.

It's a test build. DO NOT USE IT. It has all kinds of packages, kernel modules, and other stuff built into the image that you almost certainly don't want. Sometimes it's broken on purpose.

Thanks a lot for the very fast response.

Best regards, and please stay safe through this horrible COVID time.

Hi jmomo,

I've just received my 2nd TEW-827DRU v1.0R. It comes with the original Trendnet firmware 1.00. I've tried to flash it with your OpenWrt factory image using the method "uboot http Recovery Loader" to no avail, in spite of repeated attempts. Every time, the TRENDnet Recovery Mode page indicated that the upgrade was successful but the device always booted up later with the Trendnet OEM firmware.

Out of frustration, I also used the Trendnet OEM http upgrade tool (default WebUI) to successfully upgrade its Trendnet OEM firmware from the version 1.00 to 1.04. After that, I invoked the TRENDnet Recovery Mode again to successfully flash your various OpenWrt images (LEDE_v17.0.5, OpenWrt 18.06.8, OpenWrt 19.07.2), but the device always booted with the TrendNet OEM firmware after every single attempt. I even tried to use the TRENDnet Recovery Mode to flash back the Trendnet OEM firmware 1.00 from 1.04 but it still booted up with the firmware version 1.04. It looks like the TRENDnet Recovery Mode is completely broken on this device even though it always indicated a success.

I will buy a USB/TTL module to try the console uboot tftp method and provide you with the console log.

In the meanwhile, I wonder whether you have any idea of why the TRENDnet Recovery Mode simply did not work at all on this particular device. From the older threads, its looks like some other users also bumped into similar issue with the TRENDnet Recovery Mode.


[eebrains]

I tried for many hours yesterday to get this firmware onto my TEW-827DRU v1.0R . I was able to reach the "uboot http Recovery Loader". (although this seems quite finicky to reach). I would upload a factory image.bin "successfully". Then moments later the device would auto-recover its original crapware. I tried three images with the same results. The luci versions of the two 18.06 and the 17.01. I've never been so frustrated loading custom firmware before. After hours I gave up and reflashed 1.04 OEM version and restored my settings. Perhaps I should attempt the minimal image? Then load luci afterward? I manage some headless linux servers, so I'm not afraid. I would just prefer a GUI front end.

It feels like I missed some obvious step, since I see others have had success with this...
Any help would appreciated. Thanks!


[ram120]

Thank you. I tried the 1.00b11 firmware early this afternoon but never got to do the latest firmware as the router kept booting into Luci. I'll try it again in case I did something wrong. But I was able to get to the last step and the screen even said "Update Successful" or something to that effect. I'll try it again. I noticed one thing though was that after I got the success message my browser always tried to reload a page that said "Backup Bootloader." Is that normal? If not maybe that's where this is going wrong.


I've been using Linux and OpenWrt on a few other devices for quite some time, so you can be sure that I followed all instructions properly.

Best regards.

It's possible there is a different hardware version/ID out there that I'm not aware of.

The FIT image has an installation script (tew827dru-flash.scr) which checks for two variables in the uboot environment. If one of those is different then it refuses to install.

I will build a new image with these checks disabled and you can try it.

If you want to find out sooner, install the OpenWRT image from the OEM web page like you said you did before and run the "fw_printenv" command in a shell. PM me the output. You can remove the passwords and MACs if you want.

Here's an image built without the hardware checks in the FIT install script. Try installing this and see if it works: https://jmomo.net/files/lede/TRENDnet_TEW-827DRU_20200419111552_OpenWRT_v19.07.2_luci_nohwcheck/bin/openwrt-ipq806x-generic-trendnet_tew827dru-squashfs-factory.bin

Thanks a lot jmomo. I will be loading your new firmware image now.

In the meanwhile, here's the fw_printenv output from my device:

root@LEDE:~# fw_printenv
baudrate=115200
bootargs=console=ttyHSL1,115200n8
bootcmd=bootipq
bootdelay=2
debug=1
ethact=eth0
machid=1260
stderr=serial
stdin=serial
stdout=serial
board_id=2015C1818066
lan_mac=D8:EB:97:xx:xx:xx
wan_mac=D8:EB:97:xx:xx:xx
wlan0_ssid=TRENDnet827_2.4GHz
wlan1_ssid=TRENDnet827_5GHz
wlan0_psk_pass_phrase=something
wlan1_psk_pass_phrase=something
admin_password=something
wps_pin=something
hw_version=V1.0R
wlan0_domain=0x10

Best regards.