Xiaomi Router 3 uses Padavan as a bypass router, and my mother’s ads are reduced by half

When I went back to my mother's house during the Mid-Autumn Festival, her smart TV had to wait 90 seconds for a commercial to turn on. The 71-year-old just sat there and waited, even if the remote control was pressed, she couldn't jump to it. When I was cleaning up the storage room, I dug out a Xiaomi Router 3—the first router I bought for her for 149 yuan in 2016. I put it away in a drawer after replacing it with AX3000T at the beginning of the year ( I usually help her watch the new machine remotely. ). Rather than continue to eat dust, it is better to renovate Padavan and use it as a bypass for TV specifically to block advertisements.

Let’s make it clear first, what else is this old machine used for?

Xiaomi Router 3 is a 2016 machine, priced at 149 yuan, with MediaTek MT7620A single core 580MHz, 128MB memory, 128MB NAND flash memory, and all three ports are 100M. The earlier Xiaomi router mini is on the same platform, priced at 129 yuan, with only 16MB of flash memory and two antennas. These two brothers are the two most common ones in the drawer.

The foundation determines the position. The physical ceiling for 100 Mbit/s ports is around 93 Mbit/s. When I plug in my 500 Mbit/s broadband, it cuts me to the ankle. There is no way this machine can be used as the main router, but I don’t want to use it to do some chores. . By the way, the four antennas of R3 are still enough to feed a bedroom with 2.4G through the wall. The cost of being a small AP is enough. In addition, its official firmware has already reached the end of maintenance, and the plug-in store has also stopped. If I want it to continue to fight for a few more years, the only way is to use third-party software ( I have calculated how many years a router can last. ).

I counted three positions: Use it as a device-level advertising bypass route for TVs or boxes ； Be a 2.4G small AP to feed old equipment at home ； Then I used it to practice. The interface of Padavan is all in Chinese, which is much more friendly than OpenWrt. By the way, what is a bypass router and why it cannot be used as a main router? I have written about it before using a 100M port machine ( That article is here ).

The first step is to open SSH. Old models have old channels.

To flash a third party, you must first obtain the system key, which is SSH. The official channels of those new AX3000T machines are welded together, so we have to change to community tools ( I wrote about opening SSH ) ； For old machines like R3 and mini, the official channel is still alive today, and it can be completed in five steps.:

• Restore the machine to factory settings first, then return to the official firmware before proceeding. ；
• Connect your phone to Mijia and log in with your account ；
• Open the SSH page of miwifi on your computer browser and log in to the same Xiaomi account. The page will display the root password of this machine. Copy it down. ；
• Download the official toolkit, format the USB flash drive into FAT32, and rename the files in the package into miwifi.bin Put the U disk root directory ；
• Power off the router and plug in the USB flash drive. Press the pin against the reset pin and plug it in again. When the indicator light starts flashing orange, let go. After a few minutes of flashing, SSH will be enabled.

Let’s talk about the two pitfalls first. The root password is a string for each machine. It is useless to copy it from the Internet. ； Try to use an old USB flash drive with a small capacity. If you buy a new large drive with FAT32 format, you need to use tools. Don’t get stuck at this step for a long time. Once done, use the terminal to type ssh root@192.168.31.1 , the password is the string I copied just now, you can log in.

The second step is to farm Breed and repair the back roads first.

Breed is the fuse in the machine flashing industry. If the firmware is deleted, it can get you back. I also relied on it to save the money when I flashed the AX3000T ( The six-step process is here ). First download the Breed package of the corresponding model. R3 and mini are not the same package. Check the model number on the download page before clicking.

Use WinSCP or scp to transfer the package to the router's /tmp directory, and then type this line:

mtd -r write /tmp/breed.bin Bootloader

Just write Bootloader as the partition name. Don't play with any letters. If you flash the wrong partition, it will be a real brick. How to enter Breed after restarting: Power off, hold the reset button and plug in the power, the indicator light will flash wildly and then let go, the computer will manually match the IP 192.168.1.2 , open the browser 192.168.1.1 You can go in.

The first thing to do when entering Breed is not to flash the phone, but to back it up. Export one copy of the programmer firmware and EEPROM in the console, and save one copy each in the computer network disk. The EEPROM stores the MAC and calibration parameters of the wireless network card. If this thing is lost, half of the machine's WiFi will be disabled, and the programmer will be unable to save it. My backup took less than two minutes, and those two minutes were the best value of the whole thing.

The third step is to brush Padavan in Breed and put it into a bypassing posture.

Padavan, called Lao Maozi in the forum, is an established third-party firmware alongside OpenWrt ( I have written about the OpenWrt road ), a full Chinese interface, and the tuning of small memory platforms such as MT7620 is the most mature among all firmware companies. The mini's 16MB flash memory has a streamlined version of the firmware, and the R3's 128MB NAND can be installed at will.

In the firmware update of the Breed console, select regular firmware, select Padavan's trx package and upload it, and it will automatically restart in a few minutes. After brushing the management address, it changed to 192.168.123.1 , the account and password are both admin, the first thing to do when entering is to change the password.

Then put it in a bypass position, four steps:

• Change the LAN IP to the same network segment as the main router but stagger it by one. I set it to 192.168.31.3 ；
• The DHCP server is turned off and there can only be one IP address in a room. ；
• Both gateway and DNS are filled in as the main router. 192.168.31.1 ；
• Plug both ends of a network cable into the LAN port and one end into the main router.

The principles of this connection method, why DHCP must be turned off, and what are the symptoms of dual DHCP fights are discussed in detail in the bypass article, so I won’t repeat them here.

Received from my mother’s TV, the actual measurement and rollover are recorded here

In the WiFi settings of the TV, change the IP to manual, fill in the gateway column with 31.3, and other devices will not move and still point to 31.1. This is called device level. If one device uses it, the whole family will not be buried with it. The 100M port is only suitable for this job. I have said this more than once.

In Padavan, I turned on the Adbyby switch in the ad blocking of the extended function, and added a block list of TV advertising domain names in the DNS hosts, which is the same way as the router blocks websites ( That article is here ). Actual measurement: There is a switch for turning on advertisements hidden in the settings of that TV. Turn it off halfway first. ； What's left is unstoppable. After R3, the wait time for booting up was reduced from 90 seconds to more than ten seconds, and the paused patch at the beginning basically flashed past with a black screen. My mother's exact words were that she no longer had to sit and wait for her sentence.

Let’s start with the ugly words, don’t expect to be 100% clean. Nowadays, most of the traffic of apps and TVs goes through HTTPS. Solutions like adbyby mainly block HTTP and domain name layer advertisements. If it cannot block advertisements, it is normal. I hope it can block them all with DNS solutions like AdGuard Home. Also note down the three things that happened when the car rolled over.: The list of rules will expire and become invalid every few months. You have to go to Enshan to replace it with a new one. ； There is a TV app that directly displays a blank screen. Just add it to the whitelist in the rules. ； Also, don’t let the entire family’s traffic pass through it. The MT7620 has a single core of 580MHz and can easily filter a TV’s 20MB bit stream. If the entire family’s traffic reaches 500MB, it will sit down first.

I also paid for the electricity bill. The standby time is just over 4 watts, which costs 20 to 30 yuan a year ( The same algorithm as the network equipment at home ), it is better than eating ashes no matter how you calculate it. If your home is not lacking in advertising, it will be more worry-free to use it as a 2.4G small AP.: The WiFi list is sent to 2.4G, the camera, speaker, sweeper and all are nailed on, and the 5G on the main router is clear and refreshing.

If you want to revert to the official website or sell a second-hand product, don’t reverse the order.

It’s easy to go back to the official website when you get tired of using it.: Or to update the firmware in Breed, just upload the official bin. The official firmware can be obtained by model on the download page ( Check the model and hardware version ), after ten minutes of cleaning, all Padavan’s belongings were gone. Remember to change the TV's gateway back to 31.1, otherwise the TV will be disconnected on the spot.

The order of selling second-hand is: Flash back to the official website, restore to factory settings (turn off SSH by the way), unbundle Mijia, and then it’s time to ship. If the order is reversed and the buyer binds, an error will be reported. I have experienced this ( The article on factory reset has details. ). Leave the Breed untouched, and the backup of the EEPROM should be kept. If you want to mess with it someday, it is the life of this machine.

Final word: It's an old 100-megabit machine. Before you start using it, think about what you want it to do. If you think about it clearly, these five steps are enough in one night. The one at my mom’s house is still working quietly behind the TV cabinet.