This device is NOT RECOMMENDED for future use with OpenWrt due to low flash/ram. DO NOT BUY DEVICES WITH 4MB FLASH / 32MB RAM if you intend to flash an up-to-date and secure OpenWrt version (18.06 or later) onto it! See 4/32 warning for details.
1) This device does not have sufficient resources (flash and/or RAM) to provide secure and reliable operation.
This means that even setting a password or changing simple network settings might not be possible any more, rendering the device effectively useless. See OpenWrt on 4/32 devices what you can do now.
2) OpenWrt support for this device will end after 2019.
19.07 will be the last official build for 4/32 devices. After 19.07, no further OpenWrt images will be built for 4/32 devices. See OpenWrt on 4/32 devices what you can do now.
TL-WR741ND is a lowcost (15€/25$) b/g/n wireless router, capable of running OpenWrt.
For clarity and ease of use we should consider trimming below list. I have rebooted the hardware list which should help clearing the duplicates. For example, judging from the details available at WikiDevi, the v1.6 and v1.9 seem already identical. The fact OpenWrt images only cover major updates (ie v1, v2, v4) should be a further indicator. – Bernini 2015-01-06
Version 4.x and above utilise the AR9331 chipset (Confirmed on UK v4.3 model). Chinese models may differ - TP-Link appear to have started using vxWorks and reducing the flash to 2MB and RAM to 16MB on some of their newer versions for the Chinese market.
This section deals with how you install OpenWrt from a device freshly opened. Plus the steps required such as reset to factory defaults if the device has already been configured
Note: Reset router to factory defaults if it has been previously configured.
Note: Newer TP-Link retail firmwares (confirmed on v2.4 devices, but definitely not on v2.0) include a crude mechanism to prevent you uploading unsuitable firmware. It does this by checking the filename, so you may need to rename the *-factory.bin file to the name of a TP-Link retail firmware file. e.g. wr741nv1_en_3_12_4_up(100910).bin (not necessary with firmware V4_120320)
Browse to your router at http://192.168.1.1/ or test with TP-LINK Simulator first. (Version 4.20 uses http://192.168.0.1 out of the box.)
Login with user name: admin password: admin
Use left navigation panel and go to System Tools
Navigate to - Factory Defaults and click on Restore if it has been previously configured.
Confirm the pop-up dialog.
Then navigate to - Firmware Upgrade
Upload previously chosen -factory.bin file to router
Click on Upgrade button and wait for it to reboot
Do NOT turn off the power during upgrade
Wait about 120 seconds to start up, see SYS LED activity.
If the router's IP (192.168.1.1) doesn't repond to ping, try clear ARP cache on your machine
Don't clear your browser cache! Please report here what you installed, if do http://192.168.1.1/ work anyway and which link let you get in. Successful ones have removed. This only happen once, so your input is important.
Alternate links that theoretically should work
Clear your browser cache if you are sure some web interface is installed, but can't access to http://192.168.1.1/
Set a root password
Browse to http://192.168.1.1/ if LuCI, X-Wrt or Gargoyle web interface is installed.
Only for Gargoyle login with defaults user name: root password: password
After password has been setup login with user name: root password: previusly entered
Enter your new password twice.
Once password has been setup Telnet is no longer available, use SSH instead to connect.
OEM installation TFTPBOOT + RS232
Using the serial console, new firmware versions can be loaded via TFTP and flashed as follows. This assumes your TFTP server is reachable at 192.168.1.100. You can change IP addresses with:
setenv ipaddr a.b.c.d
setenv serverip e.f.g.h
Type “tpl” to escape automatic boot when “autoboot” appear.
Calc Size of firmware:
-rw-r--r-- 1 root root 3350532 Nov 1 01:22 openwrt-ar71xx-tl-wr740n-v1-squashfs-sysupgrade.bin
Dec 3350532 to Hex 0x332004
TFTP loading and flashing is done by issuing:
tftpboot 0x80000000 openwrt-ar71xx-tl-wr740n-v1-squashfs-sysupgrade.bin
erase 0x9f020000 +0x332004 # 0x332004: size of the firmware (be aware that you may have a different size thus bricking your router)
cp.b 0x80000000 0x9f020000 0x332004 # 0x332004: size of the firmware (be aware that you may have a different size thus bricking your router)
If successful, the firmware can now be started with
If you have already installed OpenWrt and like to reflash for e.g. upgrading to a new OpenWrt version you can upgrade using the mtd command line tool. It is important that you put the firmware image into the ramdisk (/tmp) before you start flashing.
Web Upgrade Process
Browse to Upgrade URL for your Web interface package installed:
luci and luci-light http://192.168.1.1/cgi-bin/luci/mini/system/upgrade/ LuCI Essentials
luci and luci-medium http://192.168.1.1/cgi-bin/luci/admin/system/upgrade/ LuCI Administrative
WARNING: Only perform the dd action below if your original firmware has the word “boot” in it, for example, wr741nv4_en_3_17_0_up_boot(140410).bin.
Please do not dd your original firmware if it has no “boot” in its name, for example, wr741nv4_en_3_17_0_up(140410).bin, because if you do, you will brick your router! This was confirmed by supertom64
Cut first 0x20200 bytes from original firmware
If you already mv the original .bin (previous steep) it now is named tplink.bin so the code below will trow the “file not found” error. Please make sure to SCP your binary again (as in step 4) before executing the next code lines.
WARNING: If you get the error “Writing from /tmp/tplink.bin to firmware … [e]Failed to erase block” after flashing via the mtd command, do not reboot or shutdown or you will brick your device! In tp-link site they say that if you have 110825 you should update to 111130 before upgrading to 120320, so it could be better to restore to 110914 and then upgrade “gradually” as they say.
The latest TP-Link firmware for V1 revision (wr741nv4_en_3_12_11_up(120320).bin) doesn't have the word 'boot' in it. However, the 120320 firmware has also the bootloader (bigger file, 4063744 vs 3932160, it's 131584 bytes larger, equals to 0x20200 in hex, the amount you have to trim when flashing those files as described in wiki!) They used to add the word “boot” in the filename, now you have to pay attention to the file size.
Case and board:
Case and board:
Serial port is the two round joints just above the small surface mount chip in the centre. Take power from elsewhere.
v2.3 and v2.4
Case and board:
nearly same case as v2.0
nearly same PCB as v2.0
Case (nearly the same case as v2.0) and board (Note the AR9331 chipset):
Opening the case
Note: This will void your warranty!
These instructions will hopefully help you crack open your wr741nd without cracking it.
If you turn your wr741nd upside down you will see 4 rubber legs.
Under each of the 4 rubber legs is a screw.
Now unscrew the 4 screws.
Unscrew the aerial, and then the nut and washer.
Use a flat object such as the head of a flat screwdriver and gently try to pry open the top and bottom covers. Gently push upwards where the red arrows are and you can lift the top lid off.
To remove the LED cover, pull it out in the direction of the arrows.
Remove the black strip and now you can lift the board out.
In OpenWrt system there are 18 GPIOs available. However gpio0, gpio1 are used by system to control LEDs and gpio11, gpio12 as input buttons. To be able control these IOs directly it is necessary to unload modules leds_gpio (gpio0,gpio1) and gpio_buttons (gpio11,gpio12).
Next step is to export control files of each pin:
echo N > /sys/class/gpio/export
Where N is GPIO number. This will create directories with control files in /sys/class/gpio/gpioN
GPIO HIGH = 2.47 V, GPIO LOW = 0 V
software controlled LEDs
multiplexed, connected to the SPI flash memory chip
multiplexed, R425 pulldown resistor
multiplexed, not connected
multiplexed, R426 pulldown resistor
multiplexed, serial IN, R612 pulldown resistor
multiplexed, serial OUT, direct to SoC
software controlled buttons
LAN 1 LED
software controlled LEDs, can be hardware controlled if multiplexed
LAN 2 LED
LAN 3 LED
LAN 4 LED
Multiplexed pins cannot be software controlled. We can undo the multiplexing by writing some memory registers, allowing to recover the GPIO functionality.
Example, read the memory reg for GPIO mux (address 0x18040028)
devmem 0x18040028 32
this returns the value: 0x48002. The bit0 disables the JTAG pinmux, then we must write the value 0x48003
devmem 0x18040028 32 0x48003
Now we can control the GPIOs 6, 7 and 8 via software.
Version 4.21 (similar in 4.27)
LAN 1 LED
LAN 2 LED
LAN 3 LED
LAN 4 LED (0=on,1=off)
SYS LED (0=on,1=off)
Other GPIOs are not working for me. I am able to export all of them, I even could change the direction, but when I write new value, it never changes.
Version 4.x has changed to use the AR9331 SoC, and is supported by the trunk version.
Probably the hardware of all v4.x versions is identical.
After installation of r31249 + LuCI, 604KB flash are free for additional packages.
system type : Atheros AR9330 rev 1
machine : TP-LINK TL-WR741ND v4
processor : 0
cpu model : MIPS 24Kc V7.4
BogoMIPS : 265.42
wait instruction : yes
microsecond timers : yes
tlb_entries : 16
extra interrupt vector : yes
hardware watchpoint : yes, count: 4, address/irw mask: [0x0000, 0x0ff8, 0x0ff8, 0x0ff8]
ASEs implemented : mips16
shadow register sets : 1
kscratch registers : 0
core : 0
VCED exceptions : not available
VCEI exceptions : not available
Router consumes between 0.5W and 1W, depending on the power supply voltage and load.
The power adapter is rated 9V @ 0.6A . The router can be powered from a battery.
V2 and V4.3 versions of the router contains an MP1482DS step down voltage regulator, with the voltage range from 4.75V to 18V. This are absolute maximum ratings, other components might not be able to withstand this voltage range. 5V to 15V should be a safe range (don't try this on other versions than V2 or V4.3 if you aren't sure).
Forum member pepe2k made a modification of U-Boot 1.1.4 for Qualcomm Atheros SoCs based devices (the project is still being developed, so new devices and SoCs will be supported in the future). Up to date information, binary images and sources can be found on official GitHub repository.
This modification started from wr703n-uboot-with-web-failsafe project, but supports more devices, all modern web browsers, has a lot of improvements and other modifications (like U-Boot NetConsole, custom commands, overclocking possibilities etc.).
An article (in Polish) about one of the first version of this project on www.tech-blog.pl
64MB RAM mod
Tested on v4.27 board with pepe2k U-Boot 1.1.4.
Selected memory was Hynix HY5DU121622CTP-J, ripped from 256MB PC2700S-25330 module.
Solder-and-play, no additional config needed.
16MB SPI-flash mod
Tested on v1.4 board.
Selected flash was W25Q128FVSSIG.
Backup ART partition, flash BREED uboot (using Arduino), solder, boot into uboot, flash ART, flash OpenWrt.
Passive PoE mod
There are instructions for making PoE for WR741ND V2.x (not for 4.x!) on DDWRT Forum.
Serial port mod
To access the serial console of the wr741nd, you need to solder a serial header to the labelled pins.
Or if you prefer, you can solder 4 wires to the pins on the back of the board.
Comment1: To get the serial connection work reliably, I had to connect a 10k pullup resistor between the TX and the 3.3V pin. This is because the TX pin is connected to a voltage divider (2×5.6k) and a capacitor is put between the real pin and the TX connector.
Comment2: In my case (v1.5), I had to pull down the TX pin with a 1k resistor. Also, I had to use the power cable, not the 3.3V on my serial.
Comment3: In my case (ca42 cable), the tx pullup didn't work. I had to pull the rx pin (I don't know why)
Comment4: In my case (v4.22) because of the voltage divider on the RX line I had to pull up the RX-pin to 5V using a 2,2k resistor. A 1k resistor to 3,3V isn't enough. I used the 5V supply of the USB.
Now connect a serial device (dku-5, ca-42) and away you go! The right settings for accessing the wr741nd serial console are as follows.
Bits per second: 115200
Data bits: 8
Stop bits: 1
Flow control: None*
(*Note: No flow control did not work for my version 1.3, I had to use RTS/CTS)
Hint: it is possible to have a serial connector outside your router without drilling holes through your nice case. The trick is threading the 4 serial cables through the vent on the side of the router before putting back all the parts and closing the case. Below is an example.
WR741ND ver. 2.x
For this new revision its TP4→Tx and TP5→Rx in the center of PCB. On Chipset AR7240 they are pins 86→Rx and 87→Tx. (source)
WR741ND ver. 4.x
The version 4 of the board uses the standard TP-Link pinout, however the TX pin is not connected to the CPU. In order to make the TX line working, the two points on the bottom side of the PCB must be connected with a small wire.
Version 4.20 needs the same wire for TX, even if the layout is a tiny bit different. The pin at the SOC is labeled TP18, the one at the serial connector is labeled TP28. Output level is 2.5V with good flanks (measured with digital oscilloscope). Input
is via a 1k/3k voltage divider, which does not make the RX line 5V tolerant! Connection needs a 3.3V RS232 level
shifter, or can be directly done with, e.g., the Bus Pirate. Pins on the connector in the photo are from the left TX-RX-GND-3V3, as expected.
For those who can take the risk of DESTROYING YOUR ROUTER an insane usb mod for v4 devices is available here.
USB Host mod
It is possible to attach a usb socket directly to AR7240. You need to solder directly to SoC pins and provide two 15k pulldowns on every line. D- is pin 73 and D+ is pin 74. USB power should come from somewhere else (e.g. an additional step-down 5V regulator connected to the main power source, LM2574 seems like a nice choice).
WR740/WR741 4.x USB mod
For WR741ND V4.x pins are not directly accessible so you need to use fine dremel tool get access to usb pins:
ohci_hcd: USB 1.1 'Open' Host Controller (OHCI) Driver
ar71xx-ohci ar71xx-ohci: Atheros AR71xx built-in OHCI controller
ar71xx-ohci ar71xx-ohci: new USB bus registered, assigned bus number 1
ar71xx-ohci ar71xx-ohci: irq 3, io mem 0x1b000000
usb usb1: configuration #1 chosen from 1 choice
hub 1-0:1.0: USB hub found
hub 1-0:1.0: 1 port detected
usb 1-1: new full speed USB device using ar71xx-ohci and address 2
usb 1-1: configuration #1 chosen from 2 choices
uci set system.reboot_button=button
uci set system.reboot_button.button=BTN_1
uci set system.reboot_button.action=released
uci set system.reboot_button.handler='logger reboot ; reboot ;'
uci set system.reboot_button.min=3
uci set system.reboot_button.max=90
uci commit system
Press and hold QSS button for at least 3 seconds and router will reboot on release.
WARNING: You may be unable to access even if you see fancy fast flashing of “SYS” LED due to a bug #6922
Unplug the router's power cord
Connect any router LAN port directly to your PC
Configure your PC with a static IP address: 192.168.1.2
Plug the power on to the router
Wait until the “SYS” LED starts flashing repeatedly
Press the “QSS” button (on the front of the router) – the “SYS” LED will now start flashing at a faster rate
Login to the router by using telnet to connect to the IP address 192.168.1.1 – there will be an immediate unauthenticated login to a root shell
mount_root - will mount the normal root filesystem
firstboot - all settings will be reset
reboot -f - will reboot even without a mounted filesystem
Only your changed config files will be saved to /overlay/etc/ folder. So it's that what you exactly have to copy to /files/etc/ folder in your ImageBuilder root.
SCP will not work if you didn't passwd and if you don't want to do passwd before copy files: You can do passwd and avoid SCPing passwd file or simlink /overlay inside /www and download config files at http://192.168.1.1/overlay/
List config files anyway…
Default Packages + Default Profile if what you get when downloading a image from trunk:
toh/tp-link/tl-wr741nd.txt · Last modified: 2020/03/20 14:42 by danny-source