OpenWRT on TP-Link TL-WDR3600: enabling Wifi channel 12+13 and higher power on 5 GHz

A few months ago I recommended the TP-Link TL-WDR3600 as an OpenWRT router. I did complain that it unnecessarily limits me to 50 mW in the 5 GHz. After I discovered that it also prevents me from using channel 12 and 13 (which are only available in Europe an Japan, but not in the US), I looked around for a solution.

The in-kernel regulatory database is not the issue. Running iw reg get on the router shows:

country DE:
 (2400 - 2483 @ 40), (N/A, 20)
 (5150 - 5250 @ 40), (N/A, 20), NO-OUTDOOR
 (5250 - 5350 @ 40), (N/A, 20), NO-OUTDOOR, DFS
 (5470 - 5725 @ 40), (N/A, 27), DFS

Some googling around reveals that the ath9k wireless chips have a bit in EEPROM that may be set to either US or worldwide. Apparently, there is a law in the US or an FCC regulation that requires all Wifi devices shipped to determine on the hardware level (in this case, in the driver) whether the desired frequency and power level is allowed.

Unfortunately, TP-Link simply sets the bit to US mode on all devices shipped worldwide. The stock firmware simply ignores it and offers frequency and power choice based on the selected country code. OpenWRT however (as would a stock Linux kernel) respects the bit and applies a logic AND over the selected regulatory domain and the US regulatory domain.

If you run iw phy phyX info, you can see the result:

* 2412 MHz [1] (20.0 dBm)
* 2417 MHz [2] (20.0 dBm)
* 2422 MHz [3] (20.0 dBm)
* 2427 MHz [4] (20.0 dBm)
* 2432 MHz [5] (20.0 dBm)
* 2437 MHz [6] (20.0 dBm)
* 2442 MHz [7] (20.0 dBm)
* 2447 MHz [8] (20.0 dBm)
* 2452 MHz [9] (20.0 dBm)
* 2457 MHz [10] (20.0 dBm)
* 2462 MHz [11] (20.0 dBm)
* 2467 MHz [12] (disabled)
* 2472 MHz [13] (disabled)
* 2484 MHz [14] (disabled)
* 5180 MHz [36] (17.0 dBm)
* 5200 MHz [40] (17.0 dBm)
* 5220 MHz [44] (17.0 dBm)
* 5240 MHz [48] (17.0 dBm)
* 5260 MHz [52] (20.0 dBm) (passive scanning, no IBSS, radar detection)
* 5280 MHz [56] (20.0 dBm) (passive scanning, no IBSS, radar detection)
* 5300 MHz [60] (20.0 dBm) (passive scanning, no IBSS, radar detection)
* 5320 MHz [64] (20.0 dBm) (passive scanning, no IBSS, radar detection)
* 5500 MHz [100] (20.0 dBm) (passive scanning, no IBSS, radar detection)
* 5520 MHz [104] (20.0 dBm) (passive scanning, no IBSS, radar detection)
* 5540 MHz [108] (20.0 dBm) (passive scanning, no IBSS, radar detection)
* 5560 MHz [112] (20.0 dBm) (passive scanning, no IBSS, radar detection)
* 5580 MHz [116] (20.0 dBm) (passive scanning, no IBSS, radar detection)
* 5600 MHz [120] (disabled)
* 5620 MHz [124] (disabled)
* 5640 MHz [128] (disabled)
* 5660 MHz [132] (20.0 dBm) (passive scanning, no IBSS, radar detection)
* 5680 MHz [136] (20.0 dBm) (passive scanning, no IBSS, radar detection)
* 5700 MHz [140] (20.0 dBm) (passive scanning, no IBSS, radar detection)
* 5745 MHz [149] (disabled)
* 5765 MHz [153] (disabled)
* 5785 MHz [157] (disabled)
* 5805 MHz [161] (disabled)
* 5825 MHz [165] (disabled)

Some earlier fixes that no longer work with the current OpenWRT involved editing the US regulatory domain in the userland regulatory database. Nowadays that’s part of the kernel itself and no longer easily possible.

Luckily, someone created a binary patch called reghack that replaces the in-driver US regulations with unrestricted ones by (as far as I can tell from the source code) permitting both 2400-2483 and  5140-5860 MHz with 40 MHz wide channels at up to 30 dBm and without any restriction flags. Only channel 14 still seems to be unavailable, but that’s not a big deal as it is only available in Japan for use with 802.11b (that 14-year-old protocol that did a maximum of 11 Mbit/s). Applying the patch is simple (it is downloadable in both source code and binary form), though I needed to perform a cold reboot after the reboot.

In Germany (country code DE), this gives me the following channel map:

* 2412 MHz [1] (20.0 dBm)
* 2417 MHz [2] (20.0 dBm)
* 2422 MHz [3] (20.0 dBm)
* 2427 MHz [4] (20.0 dBm)
* 2432 MHz [5] (20.0 dBm)
* 2437 MHz [6] (20.0 dBm)
* 2442 MHz [7] (20.0 dBm)
* 2447 MHz [8] (20.0 dBm)
* 2452 MHz [9] (20.0 dBm)
* 2457 MHz [10] (20.0 dBm)
* 2462 MHz [11] (20.0 dBm)
* 2467 MHz [12] (20.0 dBm)
* 2472 MHz [13] (20.0 dBm)
* 2484 MHz [14] (disabled)
* 5180 MHz [36] (20.0 dBm)
* 5200 MHz [40] (20.0 dBm)
* 5220 MHz [44] (20.0 dBm)
* 5240 MHz [48] (20.0 dBm)
* 5260 MHz [52] (20.0 dBm) (radar detection)
* 5280 MHz [56] (20.0 dBm) (radar detection)
* 5300 MHz [60] (20.0 dBm) (radar detection)
* 5320 MHz [64] (20.0 dBm) (radar detection)
* 5500 MHz [100] (27.0 dBm) (radar detection)
* 5520 MHz [104] (27.0 dBm) (radar detection)
* 5540 MHz [108] (27.0 dBm) (radar detection)
* 5560 MHz [112] (27.0 dBm) (radar detection)
* 5580 MHz [116] (27.0 dBm) (radar detection)
* 5600 MHz [120] (27.0 dBm) (radar detection)
* 5620 MHz [124] (27.0 dBm) (radar detection)
* 5640 MHz [128] (27.0 dBm) (radar detection)
* 5660 MHz [132] (27.0 dBm) (radar detection)
* 5680 MHz [136] (27.0 dBm) (radar detection)
* 5700 MHz [140] (27.0 dBm) (radar detection)
* 5745 MHz [149] (disabled)
* 5765 MHz [153] (disabled)
* 5785 MHz [157] (disabled)
* 5805 MHz [161] (disabled)
* 5825 MHz [165] (disabled)

Note that this is still not entirely what is permitted in Germany: 5150-5250 and 5250-5350 MHz may go up to 200 mW and 5470-5725 even up to 1 W. Since radar detection is not currently supported on the OpenWRT, the latter two ranges are not usable anyway. I’d have liked to turn up transmission power to 200 mW, but as it turns out, TP-Link saved a few cents on the 5 GHz power amplifier, which doesn’t even do more than 63 mW…

Warning: Before you change channels and transmission power on your Wifi devices, check with the regulation authority what is legally allowed in your location. The hardware is capable of things that can interfere with radar etc. and you should never set it to a country code other than your current location. Even then, you might be able to choose options that are not legal to operate.

For Germany, the Bundesnetzagentur has the official frequency allocation documents on their website: 2.4 GHz and 5 GHz. Other European countries should have similar authorities and similar allocations. If you’re in the US, don’t even bother applying these changes as the FCC does not permit anything beyond what OpenWRT is already capable by itself.

22 thoughts on “OpenWRT on TP-Link TL-WDR3600: enabling Wifi channel 12+13 and higher power on 5 GHz

  1. Jan

    Hi there,
    I’m from germany too and followed your tip to increase the transmission power. The patching worked like a charm, but after setting my 5GHz wifi to 20dBm (100mW) there was no improvement at all, my wifi is running with 14 dBm now. Do you have any tipps?

  2. Michael Kuron Post author

    As you can see in my post, the power amplifier of the WDR-3600 is limited to 18 dBm at 5 GHz. Where are you seeing these 14 dBm?

  3. Jan

    Maybe I should add that I use the stable OpenWrt Attitude Adjustment 12.09, maybe is here the problem.

  4. Michael Kuron Post author

    It’s probably the firmware version. With a beta version, it says 15 dBm (though not the theoretical 18 dBm) on that page on my WDR3600.

  5. Zmeyw

    I’ve used the hack on a TP-Link TL-WDR4300 and it work well. Actually under Gargoyle (the OpenWRT GUI) it shows up to 30dB for 2,4G (was 20dB before) and the same for 5G (was 17dB).

  6. Jan

    Thanks to Zmeyw for the info, just ordered a TL-WDR4300, the TL-WDR3600 goes back. 🙂

  7. Julian Hughes

    If you build your own OpenWrt you can edit the kernel .config before running make:

    echo “CONFIG_ATH_USER_REGD=y” >> .config

    The compile option is discussed at and some other places too.

    Now when you run make it will not lock the Regulatory Domain to US and you will have available all the channels allowed in your locale. Unlike the reghack patch this doesn’t allow you to assign illegal channels or higher transmission power levels – it just sets the hardware to work as intended/advertised. I did this for my TL-WDR3600 v1 and now radio0 works on channel 13 and I have the channel to myself as everybody nearby is on 1, 6 or 11.

    btw I’m in UK. Using iwlist scan from my laptop or WiFi Analyzer on Android I can see 17 nearby APs, some are domestic and some are Fon or public or office networks. The manufacturers include Huawei, Belkin, Thomson, Impath and Netgear. None use a channel higher than 11. I’m not sure if I’ve *ever* seen channels 12 and 13 in use on SoHo routers here. Maybe TP-Link are not doing anything different to anyone else when supplying hardware that isn’t best suited to its market.

    Anyway I like your post, it was great to find someone with the same hardware had examined the same problem and gave me a good start and it gives a useful option that some people will prefer to compiling OpenWrt.

  8. Michael Kuron Post author

    Thanks for the details on how to build this straight into the kernel. I’ve never built OpenWRT myself, that’s why I used the reghack solution instead.

    There’s no point to using channel 13 if channel 11 is occupied: they overlap. Only channels 1, 6 and 11 are non-overlapping at the usual channel width of 22 MHz. If you (and everyone in your neighborhood!) disables 802.11b compatibility, the channel width decreases to 20 MHz and you can now fit four channels into the spectrum (at 1, 5, 9 and 13).
    As far as I know, it is preferable to have full channel overlap (e.g. multiple networks running on channel 11) than to have partial overlap (e.g. one network running on channel 11 and one on channel 13) because at full overlap, the networks can somehow sort out who gets to broadcast when.

  9. Alex Atkin UK

    This doesn’t seem to work on trunk, I rebooted and every 5Ghz channel is now disabled. :-O

    I would use the stable build but as my hardware is v1.4 I believe that suffers the wifi signal bug and I haven’t found how you are supposed to patch to fix it.

  10. Jez

    The reghack doesn’t seem to work on Barrier Breaker 14.07. The 5Ghz radio just fails and doesn’t work after reboot.

  11. Michael Kuron Post author

    I’m using the release version of 14.07 and it’s working just fine. Make sure to use one of the lower four channels as the higher ones might still be blocked in software, depending on your regulatory region. Also, you may want to look at dmesg or run wifi manually via SSH to see where it’s failing.

  12. Conor

    Hi Michael,

    Good post and an enjoyable read

    I’m just wondering what the max transmit powers are that you can achieve on the WDR3600?

    I have the WDR3600 v1.2 running a customised version of OpenWRT to support mobile dongles – “ROOter MultiWeb_2015-01-04 ( OpenWRT CHAOS CALMER (Bleeding Edge, r43751))”. I don’t think the reg-hack worked as it stated something along the lines of “already applied”. It did seem to open many more channels for me however so perhaps it did something

    I’m seeing the following:

    2.4 GHz: Domain US / Channel 6 / Max Tx-Power achievable: 20 dBm (100 mW)
    5 GHz: Domain US / Channel 40 / Max Tx-Power achievable: 19 dBm (79 mW)

    While I can select up to 1000 mW for both radios, they max out at the above. I’m happy enough with the Tx Power for the 5 GHz radio and it is in-line with the 63 mW limit you noted in your post above. However, I recall I had the 2.4 GHz radio running at a higher Tx Power than 20 dBm. I do notice that the Tx Power on the 2.4 GHz radio changes depending on the channel selected – as in if I change to channel 1 instead of 6, Tx power might drop from 20 dBm to 14

    Are you achieving higher than 20 dBm on the 2.4 GHz radio and if so, what parameters are you using

    Cheers from Ireland,


  13. Alex Ost

    14.07 on 4300. Doesn’t work. Opens options however doesn’t let you save anything. Only if you delete current wifi and make new one, those options (new) will be allowed and saved
    AND there are other problem, the reAL power on wifi doesn’t change still on same 14dbm.

  14. Stefan

    Does anyone know if on stock firmware 2.4 GHz, the setting to 40 MHz channel works as in allows devices to connect at 150 mbps rather than 72 ?

  15. Michael Kuron Post author

    Nobody should ever be using 40 MHz channels on 2.4 GHz. Your neighbors will hate you if you’re occupying 2/3 of the available spectrum for a single network.

  16. Stefan

    Hi Michael,

    Thanks for the quick reply, so is there a way to have 2.4 GHz devices connected at 150 mbps ?

  17. Michael Kuron Post author

    I believe you get 72 Mbit/s per MIMO stream at 20 MHz and 150 Mbit/s per MIMO stream at 40 MHz. I think the WDR3600 does 2 MIMO streams at 2.4 GHz and 5 GHz each, while the WDR4300 does 3 at 5 GHz and 2 at 2.4 GHz. So you should already be getting 144 Mbit/s with a 20 MHz channel on 2.4 GHz.

  18. Stefan

    No matter what settings I apply on the router, Android shows 72 mbps, but if I connect the same Android device to another router, a Mikrotik I have at work, it shows 150 mbps, testing the actual network speed isn’t relevant because I have a 200 mbps connection at home and 30 mbps at work.

  19. Alex Atkin UK

    Most Android devices do not support MIMO, only the very high-end ones do. In fact, a lot of devices don’t support MIMO.

    That said, there isn’t much use for high speeds on an Android device anyway.

    I connect at 866Mbit on my Note 4 (not to the WDR3600 obviously as that only does 300Mbit max) and it still struggles to reach 50Mbit of my 70Mbit broadband. It only really does decent speeds when accessing the LAN.

  20. Stefan

    Seems like it’s a limitation from the Android devices, I flashed a WRT rom on it and even though now my phone shows a link speed of 150 mbps, the actual transfer speed on Ookla is the same as when I had a 72 mbps link speed on stock.

Leave a Reply

Your email address will not be published. Required fields are marked *