• Lease Restrictions: Zero drilling or running permanent cable drops through walls, ceilings, or floors.
• Cabling Realities: The only coax drop in the house is downstairs where the primary ISP modem and router reside.
• Workplace Layout: My primary lab, test bench, and workstation are located upstairs.

My goal was to avoid having four or five separate devices competing over individual Wi-Fi links in a confined room. Standard consumer advice suggests installing a wall-plug Wi-Fi range extender or a powerline networking kit, but both introduce major performance penalties:

• Powerline Networking: In older structures with aging copper wiring and split-phase electrical panels, high-frequency line noise and phase-crossing drop throughput significantly and introduce unpredictable packet jitter.
• Consumer Wi-Fi Repeaters: Most plug-in extenders operate on a single radio that splits airtime between the upstream gateway and downstream devices. This store-and-forward repeater penalty cuts practical wireless bandwidth in half and doubles channel contention.

Furthermore, either of those options would still require buying, powering, and placing an additional desktop switch to wire up my workbench.

Repurposing a used consumer router running OpenWrt solves both problems at once. By dedicating the router’s entire 5 GHz radio strictly as an upstream client backhaul and disabling local wireless broadcasting, downstream traffic remains isolated to physical Gigabit copper at line rate—with full Linux CLI control and zero recurring hardware costs.

Phase 1: Feasibility & Preparation

Consumer routers frequently undergo silent hardware revisions under the same commercial model name. Before downloading firmware, always verify the exact hardware version printed on the underside sticker:

• Target Device: TP-Link Archer AX21 v4.6
• OpenWrt Hardware Target: ramips/mt7621
• Target Version: 23.05.x (or current stable release)

1. Download and Verify Image Integrity

From the OpenWrt Firmware Selector, search for TP-Link Archer AX21 v4 and download the FACTORY image (used when upgrading directly from TP-Link’s stock interface).

Always calculate and verify the cryptographic checksum before flashing:

(On Linux/macOS: sha256sum <filename>.bin)

2. Pre-Flash Hardware Reset
   1. Perform a hardware reset by pressing and holding the recessed Reset button on the back of the router for 10 seconds until all LEDs flash. This guarantees the default LAN interface is clean and listening at http://192.168.0.1.
   2. Connect your PC directly to LAN Port 1 with an Ethernet cable.
   3. Disable your PC's Wi-Fi and unplug any other network cables to prevent IP routing conflicts.
   4. Navigate to http://192.168.0.1 and walk through the basic initial TP-Link setup wizard (set a dummy admin password and click through). You do not need to configure WAN or Wi-Fi settings since the entire OS will be overwritten in the next step.

Phase 2: Loading OpenWrt Firmware

1. In the TP-Link management interface, navigate to Advanced > System > Firmware Update
2. Scroll to Local Update, click Browse, select the downloaded openwrt-...-squashfs-factory.bin file, and click Update.
3. Wait 3 to 5 minutes. Do not disconnect cables, refresh the browser, or power off the router while the internal flash partitions are rewritten. The router will automatically reboot when complete.

Troubleshooting Note: If your specific TP-Link firmware version rejects the file with an Invalid File Type or signature verification error, power down the router, hold the Reset button while plugging the power back in for 6 to 8 seconds until the Internet LED turns solid amber, and access http://192.168.0.1 in your browser. This opens the low-level U-Boot HTTP Recovery Mode, which bypasses stock signature checks.

Phase 3: Configuring the OpenWrt LAN Switch

Once the device reboots into OpenWrt, the default gateway changes to 192.168.1.1.

1. Open your browser and navigate to http://192.168.1.1.

2. Fresh OpenWrt installs have no default password. Leave the password field blank and click Login.

3. Go immediately to System > Administration and configure a strong root password.

4. Navigate to Network > Interfaces, locate the LAN interface, and click Edit.

5. Change the IPv4 Address to an isolated subnet to avoid collisions with your primary downstairs network (for example, change 192.168.1.1 to 10.10.10.1 or 192.168.2.1).

6. Click Save, then Save & Apply.

7. Force your PC to release its old address and pull a new lease from the updated pool:

   ipconfig /release
ipconfig /renew

8. Reconnect to your router’s web interface at its new address: http://10.10.10.1.

Phase 4: Configuring the Wireless WAN Client

With the local switch isolated, we now configure the 5 GHz radio to act as the WAN uplink to the downstairs router:

1. Navigate to Network > Wireless.
2. Locate the 5 GHz radio (MediaTek MT7915/MT7975) and click Scan.
3. Find your household's primary 5 GHz SSID in the results and click Join Network.
4. Check Replace wireless configuration.
5. Enter your WPA2/WPA3 passphrase.
6. Verify the interface is assigned to the WAN firewall zone (LuCI defaults to this automatically).
7. Click Save & Apply.

All four Gigabit LAN interfaces on the AX21 now operate as a dedicated, line-rate switch upstairs, backhauled over a low-latency 5 GHz 802.11ax link to the downstairs gateway (You may also reconfigure the "WAN" interface to act as part of the switch as well for a total of five interfaces).

Phase 5: Supply Chain Hardening & Next Steps

Beyond solving physical cabling limitations, replacing stock firmware on commodity networking gear eliminates a significant attack surface:

• Eliminated Telemetry: Stock firmware runs continuous background daemons that check in with vendor cloud servers (such as TP-Link Tether services). OpenWrt contains zero telemetry by default.
• Wiping Closed-Source Bloat: Proprietary inspection engines and third-party security suites often bundled in consumer routers are completely removed when the squashfs root filesystem is overwritten.
• Protection from Edge Implants: Vulnerabilities frequently leveraged by botnets and edge threat actors targeting stock router web servers (httpd) are rendered inert.

Recommended Baseline Hardening

To finish the build, secure the management plane:

1. Enforce SSH Keys: Add your public key to /etc/dropbear/authorized_keys and disable password authentication entirely under System > Administration > SSH Access.
2. Restrict Management Access: Ensure the WAN firewall zone drops all incoming management traffic so LuCI and SSH are only accessible from your physical upstairs LAN ports.

Repurposing surplus enterprise or consumer hardware with open-source firmware turns a $25 thrift or secondhand find into a fully transparent, highly configurable, and isolated network drop—without running a single cable through the floorboards.