20/2/2015

UnbrickingaTPLinkTLWR841NDgiannoug.gr

Blog

About

UnbrickingaTPLinkTLWR841ND
OMG,it'sgiannoug
Jaime 542

Brainstorm(3)

deltaHacker(43)

Howto(29)

Projects(15)

(18)

(12)

(56)

IN,

Some say that youlearn by your mistakes. Well, yes, that timeI learned I shouldnt
messwithroutingonarouter.SomeweeksagoIwastryingtoconvertaTPLinkTL

byaatrox
Discuss

WR841ND I own to a pure network bridge. NOT routed mode, just forwarder. Well,

"
"

evething was fine in my brain until I managedto configure the router the way I had

INPESTAOLA.GRNOMORE

imagined. After some lines of iptables rules everything worked perfectly and I was

byNikolas

happywithituntilIrealizedIwaslockedoutoftherouteritself.Everythingcomingfrom
theWANportwasblindlyforwardedtotheLANports(WiFiwasoffbecauseitisoffby

Discuss

".
."

default).IcouldnotlongeraccesstherouterswebUIandSSHserverandallIgotwas
asimplenetworkhubwithtwoantennasfordecoration.

IforgottomentionthattherouterrunsOpenWRTandthatIhadpreviouslybeenunder

2014

2014

2014

2014

2013

2013

2013

2013

2013

2013

30/30/30reset

2013

2012

2012

2012

This is the first attempt to reset the hardware if you get locked out or if you

2012

2012

misconfiguretherouter.The30/30/30resetissupportedbyalmostanyrouter.Actually,

2012

2012

Imnotreallysureifthatis100%correctbutitdoesnttakemuchtimetotestandthats

2012

2012

2012

2012

2012

2011

2011

2011

2011

2011

pressedfor another thirty seconds. If you do this correctly, the router should be

2010

2010

reseted and ready to be bricked again. As I mentioned earlier, I didnt have any

2010

2010

successwiththismethodsoImjustreferencing.Itdefenitelyworksthetry.

2010

2010

2010

2009

2009

2009

2009

2009

2009

2009

2009

2009

2008

2008

thecoversasIwastryingtoaddUSB functionalitytoit.Whatdoesthatmean?Ihad
spottedwheretheTTLserialpadsareandIwasreadyforeverything.Aroutersserial
interfaceisthelastpossiblewayforyoutocommunicatewithit.Well,beforeJTAG,but
whohasthenecessaryhardwareathomeforit?

why I tried it and Im posting it here. Its called the 30/30/30 reset because you will
needtopresstheroutersresetbuttonforthirtysecondsforthreeperiod.Firstly,while
therouterispluggedinandrunning,presstheresetbuttonandkeeppressingforthirty
seconds.Afterthethirtysecondspass,removethepowerjackbutkeeppressingthe
reset button. After another thirty seconds, plug in the router and keep the button

Easyfailsafemode
EveryOpenWRTrouterhasafailsafemode.Infailsafe,therouterattemptstobypass
almostallconfigurationinfavorofafewhardcodeddefaults,resultinginarouterthat
bootsupas192.168.1.1/24. Yes,thatwasaverbatimcopy oftheofficialexplanation.
So,ifwebootourrouterinfailsafemode,willwebeabletorecoverit?Yes.

https://giannoug.gr/unbrickingatplinktlwr841nd/

1/5

20/2/2015

UnbrickingaTPLinkTLWR841NDgiannoug.gr
Entering the recovery mode is done by simply pressing a hardware button on the

2008

2008

deviceduring bootup.In theTPLink TLWRxxxseriesit isdone byholding theQSS

2008

2008

buttonwhilethesystemisbooting(whiletheSystemLEDisflashing).Ifdonecorrectly,

2008

2008

the System LED will start blinking alot faster and the device should be pingable on
192.168.1.1.NoDHCPandsorceryhere,youwillneedtosetyourcomputermanually

2008

toIP192.168.1.2(oranythingelseinthe/24subnet),subnetmask255.255.255.0and
gatewayastheroutersIP.Ifeverythingwentright,fromenteringthefailsafemodeto

TAGS

manuallyassingingtheIPtoyourcomputer,theroutershouldbepingableandtelnet
ableoveritsIP.SkiptoUsingfailsafemode,youaresounluckyyouarenotgoingto
seetheinsidesofyourrouter!

Hardfailsafemode
Thisisthehardestandlastwaytocommunicatewiththerouter.Youwillneedtoopen

arduino

androidandroidrom

avrbackupbasicstampbitcoin

attiny

bitcoinminingblog cyanogenmodddwrt
dnstunneleeepceeepc1000hfacebook

homeserverhowto

gmailguide

linux

therouterhousing,somesolderingskills(level70ormore),aTTLadapterandlotsof

JXDS7300Blcd

luck.Iassumeyou haveopenedyourrouter,ifyouhavent,ask ayoungerrelativeto

openvzopenwrtprojectRaspberry

doitforyou,theyareseemtobeabletocrackthingsopenalotfasterthanadults.

PirouterserverSetVPS

LocatethefourpadstotheleftofthePCB,alittlehigherfromtheWiFimodule(thatbig
metalthingistheRFshieldoftheWiFimodule).Nowforgetaboutthepads,wearenot
goingtousethem.LocatetheresistorsR356andR537bellowthem,youshouldattach
twocablesonthem.Itisextremelydifficultbutpossibleifdonecorrectly.Alsoattacha

microcontroller

slavepcturbopctwitter

ubuntuusbfanvistavodafone
vpsweekly
updateswordpress

vodafoneinternet

cableontheWiFishield,wearegoingtouseitasGND.
I forgot to mention that my router is V3.4 (thats printed on the label) with a board
versionthatIcant recallrightnow.Icouldntfindinformation aboutthatspecificPCB
versionon theInternet.Ifyour routerisanother version,morelikelyV5.0 andabove,
youshouldconsulttheofficialOpenWRT documentation.Theonlythingthatdiffersis
thelocationoftheTTLpads.
ConnectthethreewirestoyourTTLadaptor. ThecablefromR356isroutersTXline
and should go to adaptors RX line. Resistor R537 is routers RX and should go to
adaptorsTX.GNDshouldbethesameonbothsides.
Connect the adaptor to your computer and start your favorite serial monitor. I used
PuTTY.Whentherouterboots,Ubootbeginstransmitingat98008N1andthenkernel
switchesto1152008N1.YoushouldsetPuTTYto115200baudrate.Youwontbeable
to see the Uboot boot sequence but that doesnt matter, its cool though. Boot the
router and soon a lotof messages will show up on the window.You will have to be
quick,pressfandthenEnter.Theroutershouldstartatfailsafeandyouwillbegiven
arootshelltoit.

Usingfailsafemode
https://giannoug.gr/unbrickingatplinktlwr841nd/

2/5

20/2/2015

UnbrickingaTPLinkTLWR841NDgiannoug.gr
Nowthatyouhave accesstoyourrouterandfeelthewarmth oftherootconsole,its
timetorevertthechangesthathavebeenmade.IwontgointomuchdetailbecauseI
supposeonecanfigureouthowtorevertthewrongsettings.Inmycase,Ijustwiped
the whole JFFS2 partition. That can be easily done by running the following
commands.
1
2

mount_root
firstboot

The first one will mount the JFFS2 partition of the router and the second one will
restoreall thesettings. Finally,either runreboot for unplugthe powerto rebootthe
router.Thedevicenowisinitsinitialstatewithallthesettingsreset.Havefun!

Relatedposts

Tags: openwrt

tplink

1,2012

domains,

namecoin

backup

tpwr841nd

giannoug

14Comments

Braublei

01/08/201203:48

WhatiftheSystemLEDisnotflashing.AndalltheotherLEDsexcepttheWIFI
areonsolidgreen?Anyofthissuggestedsolutionscouldfixtheproblem?I
dontevenaccesstheWebUI.Nothinghappens,thehardwareseemstobe
dead.

giannoug

01/08/201203:52

Well,yes.Thatmeansthatthehardwareisdead.

baidhowi

09/12/201323:29

soifhardwareisdeadcanIfixit?
itrypressqssbutton,butledqssnoton,andantorherledstillonsolid

https://giannoug.gr/unbrickingatplinktlwr841nd/

3/5

20/2/2015

UnbrickingaTPLinkTLWR841NDgiannoug.gr
notblinking

andref

22/08/201220:25

Powerled=ON
Systemled=OFF
LAN1led=ON
allothersleds=OFF
isitpossibletodeclareWR841isdead?
Thnx

giannoug

22/08/201222:10

ThePowerLEDisnotcontrolledbytherouter,itsdirectlypoweredfromthe
boardpowersuply.ThisisanindicationthatthepowertotheunitisOK.The
sameappliestotheLANLEDsastheyarecontrolledbytheEthernet(LAN
switch)controller.
TheSystemLEDisdirectlycontrolledbytheSoC.Ifitdoesntlightorblink,it
indicatesthattherouterisdead.YoushouldsolderTTLpadsandseeif
anythingcomesuptotheserialconsole,justincase.

Cepera

22/10/201201:33

,841nd

giannoug

24/10/201214:42

Imgladithelped

escariao

28/12/201201:13

hello
Ihavethisproblemtoo,butIcantresolveuntilnowcanyouhelpme.
Doyouhaveanypictureaboutthissolucion,becauseIdonthaveanyidea
howIcanmakethiscable.

giannoug

28/12/201201:30

Youcantmakethiscable,youllhavetobuyanadapter.LookforaTTLto
USBadapter.MoreinformationcanbefoundontheofficialOpenWRTwiki.
Goodluck!

e_cockroach

09/03/201314:35

Arduino,TTL
Tristate.ResetGround
(
ArdrduinoUNO,ATmega328).

Raphael

15/05/201305:03

Thanksalot!Itsavedmyrouter.Idontknowthereasonwhythe303030is
notworkingformetoo

https://giannoug.gr/unbrickingatplinktlwr841nd/

4/5

20/2/2015

UnbrickingaTPLinkTLWR841NDgiannoug.gr

SERAH

17/10/201312:50

Theeasyfailsafeworkedonmywr841nv8.xbutthe30/30/30wasuseless.I
huggedmyrouterneverthoughtIdbethishappytosee192.168.1.1replying.
Thanksfortheguidemate!

Aris

28/10/201313:59

Thanksalot!Iwasntawareoftheeasyfailsafemode!
Youjustsavedmearouter(PsmyTPlinkisWR841NDanditworkedlikea
charm,pressingtheWPS/resetbutton)
!

Dratas

01/11/201303:23

Veryhelpfulltutorial,becauseibrickedmymodemwithopenwrt.

Email*

Submit
email!

giannougscomputers

Copyright2015giannoug.gr.PoweredbyWordPress.
Facebook

Twitter

Google+

YouTube

https://giannoug.gr/unbrickingatplinktlwr841nd/

GitHub

5/5