Restoring a bricked TP-Link router with TFTP

Restoring a bricked TP-Link router with TFTP

Comments 33

If you accidentally brick (install wrong firmware or misconfigure) your TP-Link router (in this case a TP-Link TL-WR740N v5), you can easily restore it without UART access by utilizing the built in bootloader's recovery feature.

This works by setting your computer's IP to 192.168.0.66 and then holding the Reset button while the router is turning on. It will pull the recovery image from TFTP and install it and then reboot.

Resources

Step by step instructions

Note: You will loose Internet access while performing this guide, so make sure you download the resources linked above before proceeding.

Step 1: Setup your Computer's IP to 192.168.0.66

Open Control Panel (Start -> type in "Control Panel").

Control Panel

Click Network and Internet

Network and Internet

Click Network and Sharing Center

Network and Sharing Center

Click Change adapter settings on the left

Change adapter settings

Right click on your network adapter (either LAN or WiFi) and click Properties.

Network adapter context menu

Select Internet Protocol Version 4 (TCP/IPv4) and click Properties

LAN properties

Enter the settings as is shown in the picture below

IPv4 Properties

When you want to return to the default settings (after you've restored the router, repeat the steps but set the configuration to Obtain an IP address automatically and Obtain DNS server address automatically).

Step 2: Set up TFTP daemon

Extract tftpd64.461.zip on the Desktop, and place wr740nv5_en_ipv6_3_16_9_up_boot(160715).bin inside the folder (rename it to wr740nv5_tp_recovery.bin). Then, start tftpd64.exe.

tftpd64

If you're using a different router, i.e. TL-WR840N v5, rename the file accordingly, i.e. wr840nv5_tp_recovery.bin.

In tftpd64 click Settings:

Tftpd64 interface

Set it up according to the picture below:

Tftpd64 Settings

Click on the Global tab and set it up according to the picture

Tftpd64 Global Settings

Step 3: Restore the router

Firstly, connect your computer and only your computer with a LAN cable to LAN 1 port, then unplug the router from the power, wait a few seconds, press and hold the reset button (either with a paperclip if it's recessed or with your finger if it sticks out). It might be labeled WPS/Reset. While holding the button, plug in the power adapter into the router. Release the button after 5 seeconds.

The router will boot the recovery bootloader and try to pull the firmware from TFTP. You will see activity in TFTPD window:

Router pulling firmware from TFTP

During the uploading, you will see a progress window appear. Do not turn off the router or the computer while this is happening!

Progress bar in TFTPD

After the firmware is uploaded, the router will write it into Flash memory and will then reboot. You can check it's succeeded by accessing 192.168.0.1 in the browser.

If everything is OK, restore your Network adapter's IPv4 settings to the default ones, plug in the WAN cable and setup your router according to your preferences.

1
❤️
0
👍
0
😲
0
😢
2
😠
1

Comments (33)

Please be civil when commenting. Think before writing, don't spam, self promote, bully, harass or harm anyone. Please read the Comment Policy before posting. Comments are moderated.
See all 33 comments

Joel Pliskin

Joel Pliskin

I am trying to unbrick an Archer C7 v4 (DD-WRT installation gone wrong) from a new Mac running MacOS Catalina (10.15.6). I have downloaded the current firmware and renamed it ArcherC7v4_tp_recovery.bin. Other than that, I followed all your instructions to the letter.

I used the internal Mac TFTP server with the recovery file in the correct directory, I set my mac to 192.168.0.66 and disconnected all other network connections, I connected the router by a short cable to Port 1 and held the reset button until the WPS light came on (this is supposedly how the C7 v4 indicates that it is looking for the recovery file).

Unfortunately, none of that worked. I would be grateful for any other suggestions you may have.

Thanks.

Reply · 8 months ago · #465

Milan Kragujevic

...replying to Joel Pliskin

Milan Kragujevic Admin

Hi Joel,

it is possible that the mac OS tftpd is incompatible or misconfigured which prevents the router to connect and download the recovery file.

You should try it with the file named “tp_recovery.bin”, just in case, as newer TP-Link bootloaders always request “tp_recovery.bin”, no matter the router model.

If it doesn't work, try to get Windows running in a VM with a bridge interface and try to boot the router that way, or try with a different TFTP server.

Regards,

Milan

Reply · 7 months ago · #466

Joel Pliskin

...replying to Milan Kragujevic

Joel Pliskin

Hi Milan,

Got a Windows 10 laptop and followed your instructions exactly. The file got sent, per the TFTP log. However, the router did not reflash and remains bricked. Any other ideas?

Thanks,

Joel

Reply · 7 months ago · #490

Liviu

Liviu

Hi Milan,
Your explanations are the most clear I've found on the subject! Thank you so very much for allowing me to unbrick a TP-Link TL-WR841ND v. 10 router! Greetings and best regards from RO!

Reply · 9 months ago · #427

Dratas

Dratas

hello does this guide works and with wdr 3500 from tp-links,because i tried from openwrt put in stock firmware and now blinking al,ost all leds except solid power led,is necessary turn-off antivirus firewall when doing actions with tftpd server/client?

Reply · 9 months ago · #424

RGQ2020

RGQ2020

Thanks a lot for this very helpful instruction!II I was able to fix my bricked TpLink AC1200 router.

Reply · 10 months ago · #383

Fox Mulder

Fox Mulder

I flashed the latest TP-Link firmware over a botched OpenWrt install using TFTP daemon on an Archer A6. I had tried PuTTY and something went wrong. The router had some lights on before PuTTY. Afterwards, there was only a solid power LED. I was able to use WinSCP to put the firmware in the router's /tmp folder. I got a fatal error when I ran the .bin firmware file. Might have been the .bin extension, I think it needed to be an .img. TFTP was easy for me to use but I followed the directions EXACTLY. I didn't extract to the desktop and couldn't get the TFTP GUI to show up, it was running though. I even went back and made sure I put the firmware update into the folder first then renamed it to ARCHER A6(US)_V2_tp_recovery.bin. Not sure if I used the _V2. I think if you could probably call it 1_tp_recovery.bin.

Fox

Reply · 10 months ago · #377

Axlagusti

Axlagusti

I´ve a TP Link archer C60 v2 US bricked.

It was with a white label hot spot firmware on 192.168.99.1 before I´ve tryed to recover it to the original firmware.

I configured my Win 10 notebook ethernet port as described on 192.168.0.66

also the TFTP server by Ph Jounin with the same described settings.

But I never have success to enter in the reset / recover mood.

The only light I see on the router is the Power (first one) and never change to others two or three ....

I know the procedure is for another model ... but I´m still trying to figure out how to solve it.

Any help or idea?

Thanks in advance

Reply · 11 months ago · #355

Carlos

...replying to Axlagusti

Carlos

Did you solved it? I have the same problem :(

Reply · 10 months ago · #367

SuperCow

SuperCow

Thanks for your guide.

I used it for my Archer C6 v2 to flash it with custom firmware (openWRT)

Worked perfect

Reply · 11 months ago · #354

Aleksandar Rakic

Aleksandar Rakic

I did all as described with my 740N but nothing was happening.
Only message in log is "Message truncated (length was 8) [04/11 23:26:19.604]"
Any idea?

Reply · 1 year ago · #202

Milan Kragujevic

...replying to Aleksandar Rakic

Milan Kragujevic Admin

The most certain problem is that you did not set the PC's IP address correctly, or set it on wrong interface. Disable ALL! network interfaces except for Ethernet (verify you are using correct Ethernet adapter, if there are multiple, or if VirtualBox or a VPN is installed). Additionally, disconnect all Internet from PC, and disconnect all cables from router. Connect PC to router (LAN1) using a single short cable. NO SWITCHES!

Reply · 1 year ago · #203

Aleksandar Rakic

...replying to Milan Kragujevic

Aleksandar Rakic

Everything like you said, one interface, no other network, no virtualbox or vpn... but nothing is happening, seems like tft does not see it :(
Router was working but I was reverting to stock firmware and now it is brick :(

Reply · 1 year ago · #204

Milan Kragujevic

...replying to Aleksandar Rakic

Milan Kragujevic Admin

What version of WR740N? Be precise. Also, how do the LEDs on the router blink? They should all light up for a second then blink continuously. Also, did you try holding the reset button while the router is unplugged, connected to PC with tftpd32 open, AND THEN plug it in while still holding the reset button. It should rapidly blink "lock" LED (last one) or Power (first one) or the LAN port (depending on the model and revision of the router and bootloader)...

Reply · 1 year ago · #205

Aleksandar Rakic

...replying to Milan Kragujevic

Aleksandar Rakic

4.23

Reply · 1 year ago · #206

Milan Kragujevic

...replying to Aleksandar Rakic

Milan Kragujevic Admin

Try this firmware: https://milankragujevic.com... Additionally, can you describe the behaviour of the LEDs, and if you followed procedure for TFTP boot (unplug power, hold reset button, plug in power, release button when LEDs start to blink)=

Reply · 1 year ago · #207

Aleksandar Rakic

...replying to Milan Kragujevic

Aleksandar Rakic

When I plug in router, all led blink once, than power led and setup led stay on, while lock led blink once. After a while wireless is blinking fast, setup blinking slow, and input 1 is constant.

1 year ago · #208

Milan Kragujevic

...replying to Aleksandar Rakic

Milan Kragujevic Admin

It is not bricked. That is absolutely normal behaviour during initialization. Did you try the proper procedure for TFTP boot like in the previous comment? How did you try to boot from TFTP? You MUST hold the button to enter the recovery mode, else the router WILL NOT even try to boot from TFTP!

1 year ago · #209

Aleksandar Rakic

...replying to Milan Kragujevic

Aleksandar Rakic

Yes I did, and the same is happening. I tried to hold reset button for 2, 3, even 6 seconds but the same everytime.

1 year ago · #210

Milan Kragujevic

...replying to Aleksandar Rakic

Milan Kragujevic Admin

Did you unplug it first, then hold the button and WHILE holding the button plug it in. Hold the button for 15 seconds and watch if it stops the normal booting and stays with one LED.

1 year ago · #211

Aleksandar Rakic

...replying to Milan Kragujevic

Aleksandar Rakic

I was holding almost 20 seconds while only power led is on, soon as I released reset it start the same procedure like before.
I am giving up for today, it is late. Tomorrow I will see again. Thanks for help!!!

1 year ago · #212

Gordon Ullah

Gordon Ullah

Wonderful!

I used this to unbrick a TL-WR940N version 3.0 by using image "wr940nv3_wr941ndv6_en_3_16_9_up_boot(150312).bin" (from the TP support site)

HOWEVER, I had to rename the image to "wr941ndv6_tp_recovery.bin" as this was the filename the router was trying to purge.

I was also unable to run the tftp supplied on W10. I instead downloaded the v4.64 installer from https://tftpd32.jounin.net/... and put the image file into C:\Program Files\Tftpd64

Reply · 1 year ago · #157

Julian Cordeiro

Julian Cordeiro

Hi I try the procediment and this is the message:

Connection received from 192.168.0.2 on port 3828 [24/07 04:37:09.043]
Read request for file <tp_recovery.bin>. Mode octet [24/07 04:37:09.043]
File <tp_recovery.bin> : error 2 in system call CreateFile O sistema não pode encontrar o arquivo especificado. [24/07 04:37:09.044]
Connection received from 192.168.0.2 on port 1515 [24/07 04:37:12.007]
Read request for file <tp_recovery.bin>. Mode octet [24/07 04:37:12.007]
File <tp_recovery.bin> : error 2 in system call CreateFile O sistema não pode encontrar o arquivo especificado. [24/07 04:37:12.007]
Connection received from 192.168.0.2 on port 2667 [24/07 04:37:14.974]
Read request for file <tp_recovery.bin>. Mode octet [24/07 04:37:14.974]
File <tp_recovery.bin> : error 2 in system call CreateFile O sistema não pode encontrar o arquivo especificado. [24/07 04:37:14.975]
Connection received from 192.168.0.2 on port 2027 [24/07 04:37:17.938]
Read request for file <tp_recovery.bin>. Mode octet [24/07 04:37:17.938]
File <tp_recovery.bin> : error 2 in system call CreateFile O sistema não pode encontrar o arquivo especificado. [24/07 04:37:17.939]
Connection received from 192.168.0.2 on port 1064 [24/07 04:37:20.902]
Read request for file <tp_recovery.bin>. Mode octet [24/07 04:37:20.902]
File <tp_recovery.bin> : error 2 in system call CreateFile O sistema não pode encontrar o arquivo especificado. [24/07 04:37:20.902]

Reply · 1 year ago · #154

Krzysztof Trzeciak

Krzysztof Trzeciak

Hi there. I've got tl-MR3420v2. After trying to upload custom firmware the only thing I've got i constatn power led.Nothing more. Been trying all of solutions from internet and still no response from router. Can anyone help me?

Reply · 1 year ago · #153

Ken Dominguez

Ken Dominguez

hi i did complete all steps but my tplink tl-wr840n still not working. light is blinking.

Reply · 2 years ago · #84

shahbaz mughal

...replying to Ken Dominguez

shahbaz mughal

i face same problem did you solve the problem if you solve this kindly help me

Reply · 1 year ago · #144

Rahul Zain

...replying to shahbaz mughal

Rahul Zain

Guide works well. There is only a small modification to be made. You must select the firmware file that is appropriate for your router and rename it as mentioned above. The file can be taken from the tplink official website. The recovery file given above will NOT work for ALL routers.

Reply · 1 year ago · #150

Asif Hafeez

...replying to Ken Dominguez

Asif Hafeez

Did your fixed it or not I have a same router with almost same issue, its getting restart and shows lock some time get connect but can't do complete recovery process

Reply · 2 years ago · #99

Asif Hafeez

...replying to Ken Dominguez

Asif Hafeez

Have you fixed your router or not?

Reply · 2 years ago · #98

Milan Kragujevic

...replying to Ken Dominguez

Milan Kragujevic Admin

This is for 740, not for 840!

Reply · 2 years ago · #88

Timo M

...replying to Milan Kragujevic

Timo M

But the case for an 840 is described. So what is the reality now? Is this tutorial also for a 840 (or even other models) or only for the 740?

Reply · 1 year ago · #117

Milan Kragujevic

...replying to Timo M

Milan Kragujevic Admin

The files are only for TL-WR740N

Reply · 1 year ago · #121

shahbaz mughal

...replying to Milan Kragujevic

shahbaz mughal

plz bro help us by tell us how to solve wr840n problem

Reply · 1 year ago · #145


Scroll to top