Few days back, I bricked TP-LINK router named as TL-WR740N v4.23 when I tried to restore stock firmware from OpenWRT. Unfortunately the restoring process wasn’t work as I expected, the router dead and when I powered up, all lights are on and off simultaneously after few seconds. I waited about 1 hour but router did not respond any ip address and does not show any connections on Network And Control Center.
If your WiFi router is bricked, the very hard way to unbrick is to use a serial cable and solder it to some points on the router’s circuit board. But lucky for you, after a lot of research, I found out that TP Link has provided a default anti-brick method to let users re-flash the firmware via TFTP even when the router is bricked. It’s very easy method to unbrick my TL-WR740N router and this method works with your other version of TP-LINK router too. Let’s see how to work with it.
- Search for your router model and Download the latest firmware for your router from the TP-Link Download Center.
- TFTP Server if you’re using Windows or
tftp-hpaon Linux (there are several other tftp packages but I prefer
tftp-hpabecause it worked reliably for me on two different PC and Laptop). And luckily there’s a built in TFTP daemon that you can use in a pinch on Mac OS, by default
tftpduses the following folder:
- A computer, LAN cable and a bricked TP-Link router, of course.
What is TFTP?
TFTP is a simple protocol used to transfer files, and therefore was named the Trivial File Transfer Protocol or TFTP. This protocol offers only the ability to upload or download a file and uses UDP over IP instead of the more standard TCP/IP stack. It cannot list directories content or change the working directory, and currently has no provisions for user authentication, so a TFTP server must have a dedicated working directory that’s used to send and receive files.
What is anti-brick method of TP-LINK
Some routers have a built-in TFTP client running and looking for a TFTP server in the local network to download a firmware and debrick itself. To unbrick them, we need a TFTP server to send the correct firmware to re-flash router.
Here is how you can unbrick your TL-WR740N (and others) router in a few seconds without needing any serial or JTAG cable:
Step-by-step instructions for restore a Bricked TP-LINK Router
- Power off the WiFi router, make sure it connected with your PC via LAN cable.
- Set a fixed IP address on the PC with the same network as your router, e.g. Change your computer’s IP address to 192.168.0.66 and gateway as 255.255.255.0. To do this, right click on the the networking icon in the system tray of Windows 10. Next, choose Change Adapter Settings, select Microsoft TCP/IP 4 from the list, it’s properties and enter 192.168.0.66 as the IP address of the computer and 255.255.255.0 as the gateway.
The TP-Link router will recognize this IP address as that of the TFTP server. Hence, we run the TFTP server next on the computer.
- Set up a standby TFTP server on your PC and make sure it works correctly (configuration, permissions, firewalls, etc.). You can read how to do it on Windows↓, Linux↓ and MacOS↓. (click to see more detail below)
- Rename your target firmware to
firmwarename_tp_recovery.bin(my router is TL-WR740N so the file name is wr740v4_tp_recovery.bin) and copy it to your base folder of TFPT server. The firware name can find easily on label of your router. If you’re not sure about the firmware name on a different model, start a packet sniffer on your PC
tcpdump -i eth0 -n -land look for the name in the RRQ message. In some case, you need a older version of router firmware, but you can upgrade it late after succesful.
- Press and hold the reset button (using a paper-clip or pin).
- Power on the router, and as soon as the asterisk/star/wheel symbol to the right of the power/IO image starts to flash, hold down the WPS/Reset button that is on the back of the device for about 10 seconds. The asterisk symbol should begin to flash much faster than before. Let the device continue to fit and do this until it reboots.
- The router will now identify as 192.168.0.66, finish upgrading using its built-in tftp client and reboot in less than half a minute.
- Wait for the firmware transfer (about 20s), firmware flash (about 90s) and subsequent reboot (about 30s). After the firmware is uploaded, the router will write it into Flash memory and will then reboot. You can check it’s succeeded by accessing 192.168.0.1 in the browser. If everything is OK, restore your Network adapter’s IPv4 settings to the default ones, plug in the WAN cable and setup your router according to your preferences.
- You need to find similar message at the log view of tftpd as seen below. (Once the process is successfully finished, you may close tftpd.)
Note: In case of failure, it retries multiple times and gives up in about 5-10 seconds to resume normal booting. No configuration is erased, so it’s safe to experiment.
TP-LINK Routers are very popular because they are cheap and feature-packed router available in the market. They are very durable, my router is 12 years old at the time it’s bricked. After unbricked, it can be used for a long time. That’s why I always recommend them to my friends and family.
While there is a command line TFTP server/client feature in windows, it’s easier to use a third party one that has a proper graphical interface. Tftpd32 is an immensely popular open source TFTP server for Windows (Tftpd64 is the 64-bit version and will be used in this example).
Place the file you want to send (the firmware file usually) in the same folder where you find the Tftpd64 program file. You can confirm it exist via 3 steps below.
The folder exposed through TFTP can be changed by clicking on Browse button, but in most situations you don’t need to do that.
It will ask for Firewall permissions which you should grant for it to work. Check both options, to allow Tftpd64 to communicate over both home/work and public networks. This is very important, if the Windows Firewall blocks your TFTP server you won’t be able to access it from the device you want to recover.
Change the server interface to 192.168.0.66., click on the drop-down menu called Server Interfaces and select your PC’s ethernet port.
tftpd-hpa by: H. Peter Anvin as TFTP server and
tftp as TFTP client. You’ll find the configuration file in
$ cat /etc/default/tftpd-hpa #/etc/default/tftpd-hpa TFTP_USERNAME="tftp" TFTP_DIRECTORY="/var/lib/tftpboot" TFTP_ADDRESS=":69" TFTP_OPTIONS="--secure"
This configuration only uses IPv4 addressing, changes its root directory to
/srv/tftp on startup and logs TFTP operations to syslog.
The server will serve files from the
/var/lib/tftpboot directory. You need to create it and give it the proper permissions.
$ sudo mkdir /var/lib/tftpboot $ sudo chmod -R 777 /var/lib/tftpboot $ sudo chown -R nobody /var/lib/tftpboot
Now, start TFTP service and check if your TFTP server is listening
$ netstat -lunp|grep 69
Locate the folder of TFTP on MaxOS at
/private/tftpboot which is hidden in finder, but can be accessed by using “go to folder”. Then put
firmwarename_tp_recovery.bin file here. The configuration with which the daemon is lauched is in /System/Library/LaunchDaemons/tftp.plist and the the identifier is com.apple.tftpd.
To launch the daemon run the following commands:
$ sudo launchctl load -F /System/Library/LaunchDaemons/tftp.plist $ sudo launchctl start com.apple.tftpd
and provide your password when prompted. You can use something like
netstat to confirm it is running:
$ netstat -n | grep *.69 udp4 0 .69 .* udp6 0 .69 .*
The TFTP server is now running on port 69 waiting for connections. You can use any TFTP client to connect to the server and upload or download files.
If the TFTP server cannot sent file to your router. Be sure Read/Write/eXecute permissions are set on the
tftpboot folder and any files you wish to transfer:
$ sudo chmod 777 /private/tftpboot/*
To shut down the TFTP server, simply use the unload command:
$ sudo launchctl unload -F /System/Library/LaunchDaemons/tftp.plist
If you’d like a graphical front end for launching tftp then check out the great TftpServer. It places a pleasing GUI on top of the native OSX
That’s it. Now you have an unbricked working WiFi router without actually needing any serial cables. This method works for many models of the TP-Link WiFi routers. You have to rename the firmware file for your router according to your router model and version (in step 3 given above).