Articles

Hi, today I decided that I would write an article about the wireless range extender with OpenWrt that I use in a WiFi-dead zone, the TP-Link RE200 v4.

I’ve owned this thing since the COVID days, and last year, I wanted to see if OpenWrt could run on these range extenders by searching for it in the OpenWrt Wiki, and for my surprise, my repeater was supported, which was awesome because I wanted to get rid of the proprietary TP-Link spyware.

I installed OpenWrt, and I tried following a few guides from the OpenWrt Wiki to make the device work as a range extender, including using relayd, and since I could never get the thing to work, ultimately I ended up reinstalling the TP-Link stock firmware… Until one day, after a few months went by, I decided to give it another shot.

I installed OpenWrt again, this time only trying to set up relayd, as it’s my only option considering my network setup, and I followed this guide from the OpenWrt Wiki step-by-step. This basically only makes a wireless access point, and when hosts connect to this access point, the DHCP requests get sent to the main router.

It took a while to get both the 2.4GHz and 5GHz bands to work, but I got everything to work in the end, and now I’m going to talk about my sensations.

It’s an extender that nowadays you can buy used for really cheap (avoid the brand new RE200 v5, as it cannot run OpenWrt due to the fact that it’s a 4/32 device) and it does the job pretty well if you don’t need a really fast Internet in the WiFi dead zones. Sometimes, the Internet access will go out (the hosts are still able to get an IP address from the main router), but it rarely happens, and when it does, rebooting my home router and extender has always fixed the issue. I’ve been using OpenWrt in this device for a bit over 6 months if I remember correctly, and this only happened like once in 90 days. Unplugging or rebooting the repeater without rebooting the main router doesn’t cause any issues, though. If you’re going to buy an RE200 specifically to run OpenWrt, buy the v2, v3 or v4, and avoid the v1 and v5 at all costs.

Why should you avoid the RE200 v1? Because the latest releases of OpenWrt for this device are broken for some strange reason and will end up bricking the device. It’s mentioned on the TP-Link RE200 page in the OpenWrt Wiki.

When I was setting up OpenWrt and supposedly finished the setup, my hosts would never get Internet access, but the DHCP requests would get sent to the main router and the devices would get a local IP address, which meant that relayd was set up correctly, but rebooting both the main router and the repeater fixed this issue. I also had the same issue when I switched the security of the access points hosted by the repeater from WPA2-PSK to mixed WPA2-PSK/WPA3-SAE, but a simple reboot of both the repeater and the main router fixed this issue.

Another issue is that, at first, only the 2.4 GHz band would work, but not the 5 GHz one even though it was enabled, but to fix the issue, all I had to do was to set the Country Code to my country, Portugal. Also, when setting up the access points, make sure the channel and width match your main router, you can usually check them within the main router’s web interface.

Another thing to point out is that I’ve been using OpenWrt in this device since the release of OpenWrt 23.05, and a little while after OpenWrt 24.10 got released, I downloaded a sysupgrade image and updated the firmware, and while it keeps the current settings on the device if you tick the box to do so, it doesn’t keep installed packages, so I had to reinstall relayd, and when I tried to do so, for some reason it couldn’t reach the Internet even though it was connected to the main router, so I ended up resetting factory settings and setting it up all over again. I ended up also having to reboot both the repeater and main router again to get my setup back in business again.

What more cool things can I say about OpenWrt? Since it’s literally Linux for routers, you can do cool stuff like SSH-ing into the repeater and getting an ash shell.

And why would I want to SSH into the repeater? Some people may prefer to set it up from a command line interface instead of the LuCI web interface, and you can run scripts such as Neofetch for the kicks and giggles.

Just keep in mind that you need the bash package, because Neofetch is written in bash. It’s readily available in the repositories of the OpenWrt package manager (opkg), so don’t worry. Neofetch isn’t available in the repositories, so you must compile it from source. Just clone the source to your main machine, compile it with “make”, test the resulting bash script, and if it doesn’t work, pass “chmod +x neofetch” and copy it to the repeater using the “scp” command. Here’s an example:

cd into the directory where the neofetch script is.

Then, pass this command:

scp neofetch root@REPEATER_LOCAL_IP_ADDRESS:/root/

Note: The package “openssh-sftp-server” must be installed in order for scp to work. You can install it from the system repositories.

This will tell scp to copy the “neofetch” file into the root directory of the target host (in this case, the repeater).

If you want to copy directories, you can execute scp with the -r argument, which stands for “recursive”.

Also for the funsies, here’s htop:

Htop is also available in the system repositories.

You might have noticed that this repeater has an Ethernet port, and it can be used either to create a wireless access point for a wired-only network, or to connect host devices to the extended network via Ethernet. I personally use the latter, with a switch connected to the port so that I can have more than one device connected, and this setup works quite well.

Here’s the switch. It’s a simple TP-Link 8 port Gigabit Ethernet switch. Ignore the HDMI switcher on top of it.

Also, keep in mind that the Ethernet port only has connections for two twisted pairs, so the speed will be limited to 100 Mbps, no matter the cable you use (I use CAT6a cables). So if you already have a working 10/100 switch that you intend to use with a repeater like this, don’t consider upgrading.

Now for the pros and cons of this specific device running OpenWrt:

Pros:

• It’s a compact range extender that plugs directly into mains
• Very cheap
• It works well when you finally go through setting it up
• 8MB of flash storage and 64MB of RAM is just right for a range extender that runs OpenWrt
• You can set a different password or security protocol for the extender’s access points, unlike with the stock firmware from TP-Link
• You can rest assured that there’s no spyware running on this device
• OpenWrt is free software (Free As In Freedom)
• There are still OpenWrt updates for this device, something that the stock firmware no longer has, and barely had
• You can SSH into the repeater to run cool scripts, or set up the repeater from there. And if you don’t use SSH often, you can disable the SSH service and remote root login completely from the LuCI web interface

Cons:

• Can be a pain in the ass to set up for the first time, especially if you are a newbie
• OpenWrt system updates remove the installed packages, and in the worst case scenario, you may have to reset the device to factory settings and do the setup process all over again
• Ethernet port is limited to 100 Mbps, which is okay for me considering that I use it to connect hosts and I get about 50 Mbps of speed from the repeater considering the distance between the router and the repeater, but for those who want to use this device as an access point for a wired-only network, it kinda sucks, because the radios can do higher speeds than 100 Mbps, and your Internet service probably has a higher speed than that
• If you ever manage to brick the device while flashing OpenWrt, you must use something like a swivel vise to crack the case open to get access to the UART, because the plastic casing is welded together instead of being held together with screws

There you have it, my honest review of a cheap wireless range extender that can run free software. If you want an RE200, I’ll say it again, buying new is not an option anymore, as the v5 does not support OpenWrt due to the 4MB of flash storage and 32MB of RAM.

Thank you for reading :3

I’ve already written an article stating my opinion on GrapheneOS, after a year, along with the phone that I’m running it on, the Google Pixel 7a, but since I didn’t back up my website’s database and I lost the two articles that I’ve written, I’ll be writing it again, with a stronger focus on the OS.

I got this phone in January 2024 to replace my then 7 year old Huawei Mate 9, which was really insecure at that point. It was running Android 9 (May 2021 security patch), with an unlocked bootloader and root, MicroG running with signature spoofing, and using the AFWall firewall app that requires root access to block telemetry from few Huawei spyware that I couldn’t remove without breaking important functionality of the phone. It was definitely time for a new phone, even though I only owned this one for less than two years (bad choice of phone) and I really needed to get a new one when I broke the Mate 9.

I was seriously considering a Pixel to install GrapheneOS, because these phones actually have proficient security hardware, and it could run GrapheneOS, which is in my opinion, the best Android-based OS to date. It is an OS that is always up-to-date with the latest Android security patches, it’s open-source, it contains actually useful privacy and security features and it contains no spyware at all.

I got the phone, unboxed it, and installed GrapheneOS using the WebUSB-based Installer on Ungoogled Chromium. After that, I installed the apps I use like anyone normally would, and I was ready to daily-drive this thing.

Now, time to talk about my sensations.

The OS works so well that you may not even notice that you’re running a custom Android-based operating system. Once an Android security patch gets released, it only takes a few days for GrapheneOS to release an update on the Stable branch including it, and major Android updates (example: Android 14 to 15) only take few days to get released in the stable branch.

If you’ve ever used custom OS in Android smartphones, you may have noticed how certain hardware may not work or may not work well, but everything in GrapheneOS running on a Pixel works, and even the camera doesn’t lose any quality. GrapheneOS comes with the Secure Camera app, which is a minimalistic camera app developed by their team that doesn’t include EXIF metadata in pictures or videos, but lacks a lot of features as it’s just a simple camera app, but you can install the Pixel Camera app, and it doesn’t require an Internet connection at all, and works even without the sandboxed Google Play Services installed.

Remember how I mentioned the fact that I was using AFWall in my old phone? Well, that’s not a secure approach to block Internet connections, as apps can still initiate connections by using system APIs or native apps such as the Download Manager, Internet browser, etc, and GrapheneOS has an Internet connection permission toggle that effectively and completely blocks Internet connection to any user-installed app, as this revokes the INTERNET permission, and therefore any apps cannot initiate any connections via any system API. So if for any reason you must use any untrusted proprietary app that has permission to connect to the Internet, you can revoke it in GrapheneOS.

For those who need banking apps or notifications to work via Firebase Cloud Messaging, GrapheneOS has support for Sandboxed Play Services, which are basically Google Play Services installed as a normal user app, and as such, Play Services only get access to what you allow. It’s your choice to install the Sandboxed Play Services, the OS doesn’t come with them by default, and if you need them, you can very easily install them from the included GrapheneOS App Store. Some apps that require the Play Integrity API (usually banking apps) may work as they only check for basic integrity (locked bootloader and working verified boot), but some may not work as GrapheneOS doesn’t pass strong integrity, because Google did not approve GOS as an “official” operating system. Another cool thing is that GmsCompat will inform you when any app is making use of the Play Integrity API, and if the notification gets annoying, you can tell it to not show it again.

Sandboxed Play Services are also a much better approach than using MicroG, as they’re installed as a user app, so it only has access to what you allow it to access, and MicroG not only runs as root, so any attack to the MicroG app could compromise your whole device, but it also requires signature spoofing, which in turn requires root access.

I live in Portugal, and the MB WAY banking app works fine and doesn’t seem to require a Google account to be associated to the Play Services. I haven’t used other banking apps from Portugal, but you can check this website to know which banking apps have been confirmed to work with GrapheneOS + Sandboxed Play Services. It has a vast majority of countries, including Portugal, and it’s also linked to in the GrapheneOS Usage Guide page.

The fact that GrapheneOS only works in Pixel phones is a bummer, but it makes sense as there’s no other kind of phone with similar hardware security as Pixels, which is a must in order to have proficient security.

The facts that this phone has no headphone jack, no micro SD card slot and that the audio chip is pretty bad really sucks, but in my opinion, it’s worth the benefits of using GrapheneOS. I also wished that the fingerprint reader was side-mounted, as the reader under the screen is very inaccurate sometimes, and I wish that this phone could take two physical SIM cards instead of 1 physical SIM + 1 eSIM, but thankfully I could get a non-registered pre-paid eSIM for specific purposes at Vodafone Portugal. Older phones with up-to-date builds of LineageOS were options because they have these useful features and cheaper, but I would be getting security patch updates late, LineageOS and other ROMs are quite lacking in terms of security and lack interesting security features, and the maintainer of the ROMs could choose to cut support for a phone at any given time. A few examples that I can remember are the Samsung Galaxy S9 and Xiaomi Mi A1, which had their support cut with no warnings in December 2024, and besides, most phones that can run LineageOS have no support for custom Android Verified Boot signing keys.

Another awesome security feature is the Duress Password feature. If you set a Duress Password and you type it into the lock screen, all of the data in the phone and the eSIMs will get wiped, and this can save your life if a thief gets your phone and forces you to give them the passcode.

GrapheneOS also has a feature to completely turn off the USB-C port, either only when the phone is locked, charging-only, or completely power off the USB port.

What more cool stuff can I say? It also comes with a very reduced set of built-in apps, resulting in a lower attack surface and having the luxury of not having a phone with bloatware that you’ll never use.

What disadvantages have I found about GrapheneOS? The fact that it runs on Google Pixel only, because of security, and also the fact that a few apps can’t run even with Sandboxed Play Services due to not passing the Play Integrity strong device integrity. This issue does not really affect me, as 90% of the software I use on my phone is FOSS, and the only proprietary software that I use is pretty much banking apps only, and few others that work fine without any implementation of Play Services, but if you’re considering a Pixel to run GOS, keep this in mind and do your research.

What affects me though, is the lack of headphone jack and memory card slot, as I’m stuck to 128GB that I can fill quickly, and the phone’s audio chip sucks, so if I use a USB-C to 3.5mm jack adapter, some static noise will play out of the headphones, quality is worse, and I know that it’s not the adapter causing it, as I’ve tested it with another phone with a much better audio chip (Xiaomi Mi A1).

Also, you’ll lose certain Google features when installing GrapheneOS, which I don’t, never cared about, and don’t need at all as many are spyware and I bought this phone exclusively with the goal of running a private and secure OS, but for those who care, keep that in mind. Features like Factory Reset Protection, for example, are unavailable.

Thanks for reading :3