TP-Link EAP235-Wall v1

The EAP235-Wall is an 802.11ac 2×2:2 Gigabit PoE+ MediaTek-based wall mount access point. Aside from the PoE+ Ethernet port that powers the device, it offers three additional gigabit ports, with the last one offering PoE passthrough. So far, EU and US versions have been spotted (differences are probably in software rather than hardware).

EAP235-Wall angled view

Due to an issue with the driver for the MT7613BE chip, 5Ghz Wi-Fi is not stable in the current 21.02.0 release. A workaround is available. In order to have stable 5Ghz Wi-Fi you need to build 21.02.0 with the patch applied. This page has a good description of how to build OpenWrt. Just apply the patch after you did the git checkout v21.02.0 using:

wget -O package/kernel/mt76/patches/002-clearPending.patch
ModelVersionSoCCPU MHzFlash MBRAM MBWLAN HardwareWLAN2.4WLAN5.0100M portsGbit portsModemUSB
EAP235-Wallv1MT7621DAT88016128MT7603, MT7613BEb/g/na/n/ac-4--
TP-Link EAP235-Wall v1 flash layout
Layer0 raw NOR flash memory chip (W25Q128 spi0.0: w25q128) 16384 KiB
Layer1 mtd0 u-boot mtd1 partition-table mtd2 product-info mtd3 firmware 13440 KiB mtd7 user-config mtd8 mutil-log mtd9 oops mtd10 radio
Layer2 mtd4 kernel 2230 KiB* mtd5 rootfs 11210 KiB*
mountpoint /
filesystem OverlayFS
Layer3 mtd6 rootfs_data 4480 KiB*
Size in KiB 512 KiB 64 KiB 64 KiB 2230 KiB 6730 KiB* 4480 KiB* 192 KiB 512 KiB 256 KiB 64 KiB
Name u-boot kernel rootfs_data
mountpoint none none none none /rom /overlay none none none none
filesystem none none none none SquashFS JFFS2 none none none none

* These seemingly irregular values are the result of the dynamic mtd splitter resizing the OpenWrt kernel and rootfs 'partitions' as needed. Sizes are extracted from a personalised build, so kernel, rootfs and rootfs_data values may vary on stock OpenWrt builds. Other partition sizes should be identical.

Taken from the git commit adding support. The EAP235-Wall will listen on when there is no DHCP server on the network. If there is one, it will obtain an IP through DHCP and be reachable on This goes for both the web interface and SSH (once you enabled the latter).

Flashing instructions

  • Enable SSH in the web interface, and SSH into the target device.
  • Run cliclientd stopcs, this should return “success”.
  • Upload the factory image via the web interface.
  • Once the firmware update is done, the device will reboot and OpenWrt will listen on

Modern TP-Link devices often carry a bootloader with a TFTP client on-board. So far, TFTP recovery on the EAP235-Wall v1 has not been verified or tested. Values below are the ones the EAP235-Wall v1 u-boot uses by default when manually interrupted over serial.

Specific values needed for tftp

Bootloader tftp server IPv4 address*
Bootloader MAC address (special) N/A
Firmware tftp image Unsupported; only use with TP-Link OEM images
TFTP transfer window ?
TFTP window start ?
TFTP client required IP address*

* Default values unless changed manually in u-boot.

See TFTP flashing for generic instructions and background information.

The EAP235-Wall supports OpenWrt's generic sysupgrade framework. As such, you can just syupgrade through the OpenWrt web UI or on the command line.

Do make sure to verify checksums prior to flashing, whatever method you use.

For this, you need serial access and a TFTP server listening on and serving the RAM disk (initramfs) image. Serial connection parameters are 57600 baud, 8N1. U-boot can be interrupted during boot. This allows you to boot the OpenWrt RAM disk image, from which you can install the OpenWrt sysupgrade image, or fix the device in another way.

  • Access serial header from the side of the board, close to ETH3. Pin-out is as follows (with pin 1 closest to ETH3):
    • Pin #1: TX
    • Pin #2: RX
    • Pin #3: GND
    • Pin #4: 3.3V
  • Interrupt bootloader by holding '4' during boot, which drops the bootloader into its shell.
  • If desired, change default 'serverip' and 'ipaddr' variables. They default to and, respectively.
  • Download initramfs: # tftpboot 84000000 openwrt-initramfs.bin
  • Boot the RAM disk image: # bootm

See generic debricking instructions for more info and background.

Returning to the stock TP-Link firmware from the OpenWrt installation is a two-stage process. You need the following:

  • A Linux system or VM (WSL2 e.g.).
  • A recent TP-Link firmware image (EU or US, depending on the version you have!).
  • The OpenWrt SDK, or, if you compiled your own image, the OpenWrt buildroot.

Preparing the image

Use the tplink-safeloader utility present in the buildroot or the SDK to convert TP-Link's firmware image to an OpenWrt compatible sysupgrade image. Replace EAP235-WALLv1_XXX_up_signed.bin with the name of the TP-Link firmware you downloaded.

$ ./staging_dir/host/bin/tplink-safeloader -B EAP235-WALL-V1 -z EAP235-WALLv1_XXX_up_signed.bin -o eap235-sysupgrade.bin

Replacing OpenWrt

  1. Flash the prepped sysupgrade image using the OpenWrt sysupgrade interface. The image will appear to be incompatible and must be force flashed, without keeping the current configuration.
  2. Once the AP has booted into the OEM firmware, flash the clean TP-Link firmware image through the TP-Link web interface, so the OEM settings get added. The first stage sysupgrade image does not contain these.

Failsafe mode can be triggered by pushing the LED button on top of the device during the boot sequence.

For generic failsafe instructions and background, see Failsafe Mode, Factory Reset, and Recovery Mode.

Basic configuration After flashing, proceed with this.
Set up your Internet connection, configure wireless, configure USB port, etc.

The default network configuration is:

Interface Name Description Default configuration
br-lan LAN & WiFi
wlan0 WiFi Disabled

M7621 being a DSA target as of 21.02 means you can manipulate every LAN port directly by specifying lan0 (first port) through lan3 (fourth port).

The PoE-PD port on the back is labeled as eth0. Eth3 offers PoE+ passthrough. OpenWrt numbering follows manufacturer numbering.

Port Switch port
Eth0 (PoE-PD) lan0
Eth1 lan1
Eth2 lan2
Eth3 (PoE passthrough) lan3

Aside from the receded reset button, the EAP235-Wall v1 offers a single button on top of the device, which stock firmware uses to turn the LED on or off.

LED toggle lights_toggle
Reset reset

You can replicate the behaviour of the LED button by dropping the script below into /etc/rc.button/ and making it executable:


[ "$(cat /tmp/sysinfo/board_name)" = "tplink,eap235-wall-v1" ] || exit 0

[ "${ACTION}" = "pressed" -a "${BUTTON}" = "lights_toggle" ] || exit 0

[ "$(cat /sys/class/leds/white\:status/brightness)" = "255" ] && \
	echo "0" > /sys/class/leds/white\:status/brightness || \
	echo "255" > /sys/class/leds/white\:status/brightness

See this forum topic and Attach functions to a push button on how use and configure the hardware button(s).

Brand TP-Link
Model EAP235-Wall
Versions v1
Device Type WiFi AP
Availability Available 2021
Comments - general Comes in EU and US versions, but differences are probably software rather than hardware.
OpenWrt Support
Supported Since Commit;a=commit;h=1e75909a35a2b361cdfdfcf18a26ad61271b174e
Supported Since Release 21.02.0
Supported Current Release 21.02.0
Bootloader U-Boot
Target ramips
System-On-Chip MT7621DAT
CPU MHz 880
Flash MB 16
RAM MB 128
Ethernet 100M ports -
Ethernet Gbit ports 4
Switch MT7621
Modem -
Comments - network ports
WLAN 2.4GHz b/g/n
WLAN 5.0GHz a/n/ac
WLAN Hardware MT7603, MT7613BE
Detachable Antennas -
Comments - WLAN MU-MIMO Wave 2
USB ports -
SATA ports -
Serial Yes
Comments - USB & SATA ports
LED count 1
Button count 1
Power supply 42-57 VDC, 0.6 A, PoE+ powered, PoE+ passthrough on port 3
Forum Topic URL
WikiDevi URL
OEM device homepage URL
Firmware OEM Stock URL http://¿
Firmware OpenWrt Install URL http://¿
Firmware OpenWrt Upgrade URL http://¿
Edit the underlying data View/Edit data

Insert photo of front of the casing

Insert photo of back of the casing

Backside label:

Remove the two screws that fixate the backplate onto the outer shell. After that, gently wedge some opening picks into the small gap between the outer shell and the backplate, and work your way around the backplate. See a pic of the backplate below to locate the clips.

Note: This will void your warranty!

Main PCB:

port.serial general information about the serial port, serial port cable, etc.

Serial headers (by default unsoldered):

Serial connection parameters for TP-Link EAP235-Wall v1 57600, 8N1

port.jtag general information about the JTAG port, JTAG cable, etc.

How to connect to the JTAG Port of this specific device:
Insert photo of PCB with markings for JTAG port

None so far.



Space for additional notes, links to forum threads or other resources.

This website uses cookies. By using the website, you agree with storing cookies on your computer. Also you acknowledge that you have read and understand our Privacy Policy. If you do not agree leave the website.More information about cookies
  • Last modified: 2021/09/25 19:44
  • by elcovv