How to Unbrick or Repair Bricked TP-LINK Router Easily

Few days back, I bricked TP-LINK router named as TL-WR740N v4.23 when I tried to restore stock firmware from OpenWRT. Unfortunately the restoring process wasn’t work as I expected, the router dead and when I powered up, all lights are on and off simultaneously after few seconds. I waited about 1 hour but router did not respond any ip address and does not show any connections on Network And Control Center.

How to Unbrick or Repair Bricked TP-LINK Routers Easily
How to Unbrick or Repair Bricked TP-LINK Routers Easily

If your WiFi router is bricked, the very hard way to unbrick is to use a serial cable and solder it to some points on the router’s circuit board. But lucky for you, after a lot of research, I found out that TP Link has provided a default anti-brick method to let users re-flash the firmware via TFTP even when the router is bricked. It’s very easy method to unbrick my TL-WR740N router and this method works with your other version of TP-LINK router too. Let’s see how to work with it.

Requirements

  • Search for your router model and Download the latest firmware for your router from the TP-Link Download Center.
  • TFTP Server if you’re using Windows or tftp-hpa on Linux (there are several other tftp packages but I prefer tftp-hpa because it worked reliably for me on two different PC and Laptop). And luckily there’s a built in TFTP daemon that you can use in a pinch on Mac OS, by default tftpd uses the following folder: /private/tftpboot.
  • A computer, LAN cable and a bricked TP-Link router, of course.

What is TFTP?

TFTP is a simple protocol used to transfer files, and therefore was named the Trivial File Transfer Protocol or TFTP. This protocol offers only the ability to upload or download a file and uses UDP over IP instead of the more standard TCP/IP stack. It cannot list directories content or change the working directory, and currently has no provisions for user authentication, so a TFTP server must have a dedicated working directory that’s used to send and receive files.

What is anti-brick method of TP-LINK

Some routers have a built-in TFTP client running and looking for a TFTP server in the local network to download a firmware and debrick itself. To unbrick them, we need a TFTP server to send the correct firmware to re-flash router.
Here is how you can unbrick your TL-WR740N (and others) router in a few seconds without needing any serial or JTAG cable:

Step-by-step instructions for restore a Bricked TP-LINK Router

  1. Power off the WiFi router, make sure it connected with your PC via LAN cable.
  2. Set a fixed IP address on the PC with the same network as your router, e.g. Change your computer’s IP address to 192.168.0.66 and gateway as 255.255.255.0. To do this, right click on the the networking icon in the system tray of Windows 10. Next, choose Change Adapter Settings, select Microsoft TCP/IP 4 from the list, it’s properties and enter 192.168.0.66 as the IP address of the computer and 255.255.255.0 as the gateway.
    The TP-Link router will recognize this IP address as that of the TFTP server. Hence, we run the TFTP server next on the computer.
  3. Set up a standby TFTP server on your PC and make sure it works correctly (configuration, permissions, firewalls, etc.). You can read how to do it on Windows↓, Linux↓ and MacOS↓. (click to see more detail below)
  4. Rename your target firmware to firmwarename_tp_recovery.bin (my router is TL-WR740N so the file name is wr740v4_tp_recovery.bin) and copy it to your base folder of TFPT server. The firware name can find easily on label of your router. If you’re not sure about the firmware name on a different model, start a packet sniffer on your PC tcpdump -i eth0 -n -l and look for the name in the RRQ message. In some case, you need a older version of router firmware, but you can upgrade it late after succesful.
  5. Press and hold the reset button (using a paper-clip or pin).
  6. Power on the router, and as soon as the asterisk/star/wheel symbol to the right of the power/IO image starts to flash, hold down the WPS/Reset button that is on the back of the device for about 10 seconds. The asterisk symbol should begin to flash much faster than before. Let the device continue to fit and do this until it reboots.
    TL-WR740N Leds
  7. The router will now identify as 192.168.0.66, finish upgrading using its built-in tftp client and reboot in less than half a minute.
  8. Wait for the firmware transfer (about 20s), firmware flash (about 90s) and subsequent reboot (about 30s). After the firmware is uploaded, the router will write it into Flash memory and will then reboot. You can check it’s succeeded by accessing 192.168.0.1 in the browser. If everything is OK, restore your Network adapter’s IPv4 settings to the default ones, plug in the WAN cable and setup your router according to your preferences.
  9. You need to find similar message at the log view of tftpd as seen below. (Once the process is successfully finished, you may close tftpd.)
    How to Unbrick or Repair Bricked TP-LINK Router Easily 1
    Restore bricked TP-LINK Router

Note: In case of failure, it retries multiple times and gives up in about 5-10 seconds to resume normal booting. No configuration is erased, so it’s safe to experiment.

TP-LINK Routers are very popular because they are cheap and feature-packed router available in the market. They are very durable, my router is 12 years old at the time it’s bricked. After unbricked, it can be used for a long time. That’s why I always recommend them to my friends and family.

Set up a standby TFTP server on your PC

Setup TFTP Server on Windows

While there is a command line TFTP server/client feature in windows, it’s easier to use a third party one that has a proper graphical interface. Tftpd32 is an immensely popular open source TFTP server for Windows (Tftpd64 is the 64-bit version and will be used in this example).
Place the file you want to send (the firmware file usually) in the same folder where you find the Tftpd64 program file. You can confirm it exist via 3 steps below.

Put original firmware to root folder
Put original firmware to root folder

The folder exposed through TFTP can be changed by clicking on Browse button, but in most situations you don’t need to do that.
It will ask for Firewall permissions which you should grant for it to work. Check both options, to allow Tftpd64 to communicate over both home/work and public networks. This is very important, if the Windows Firewall blocks your TFTP server you won’t be able to access it from the device you want to recover.
Change the server interface to 192.168.0.66., click on the drop-down menu called Server Interfaces and select your PC’s ethernet port.
TFTP Server Interface
TFTP Server Interface

Setup TFTP Server on Linux

I used tftpd-hpa by: H. Peter Anvin as TFTP server and tftp as TFTP client. You’ll find the configuration file in /etc/default/tftpd-hpa:

$ cat /etc/default/tftpd-hpa
 #/etc/default/tftpd-hpa

TFTP_USERNAME="tftp"
TFTP_DIRECTORY="/var/lib/tftpboot"
TFTP_ADDRESS=":69"
TFTP_OPTIONS="--secure"

This configuration only uses IPv4 addressing, changes its root directory to /srv/tftp on startup and logs TFTP operations to syslog.
The server will serve files from the /var/lib/tftpboot directory. You need to create it and give it the proper permissions.


$ sudo mkdir /var/lib/tftpboot
$ sudo chmod -R 777 /var/lib/tftpboot 
$ sudo chown -R nobody /var/lib/tftpboot

Now, start TFTP service and check if your TFTP server is listening

$ netstat -lunp|grep 69

Setup TFTP Server on MacOS

Locate the folder of TFTP on MaxOS at /private/tftpboot which is hidden in finder, but can be accessed by using “go to folder”. Then put firmwarename_tp_recovery.bin file here. The configuration with which the daemon is lauched is in /System/Library/LaunchDaemons/tftp.plist and the the identifier is com.apple.tftpd.
To launch the daemon run the following commands:

$ sudo launchctl load -F /System/Library/LaunchDaemons/tftp.plist
 $ sudo launchctl start com.apple.tftpd

and provide your password when prompted. You can use something like netstat to confirm it is running:

$ netstat -n | grep *.69
 udp4 0 .69 .*
 udp6 0 .69 .*

The TFTP server is now running on port 69 waiting for connections. You can use any TFTP client to connect to the server and upload or download files.
If the TFTP server cannot sent file to your router. Be sure Read/Write/eXecute permissions are set on the tftpboot folder and any files you wish to transfer:

$ sudo chmod 777 /private/tftpboot/*

To shut down the TFTP server, simply use the unload command:

$ sudo launchctl unload -F /System/Library/LaunchDaemons/tftp.plist

If you’d like a graphical front end for launching tftp then check out the great TftpServer. It places a pleasing GUI on top of the native OSX tftpd.

TFTP graphical front end for Mac OS
TFTP graphical front end for Mac OS

Conclusion

That’s it. Now you have an unbricked working WiFi router without actually needing any serial cables. This method works for many models of the TP-Link WiFi routers. You have to rename the firmware file for your router according to your router model and version (in step 3 given above).

Leave a Comment

This site uses Akismet to reduce spam. Learn how your comment data is processed.