TP-Link TL-WR810N

  • Same form factor as the TL-WR710N.
  • Powered from AC electric wall-socket, so the USB port delivers 5V, 1A and can power and charge a device.

Beware: ath79 Image for the TL-WR810N v1.1 (EU) is currently broken and will result in a soft-bricked device. Use the ar71xx image ( instead! See thread: Update: OpenWRT 19.07.7 ath79 now does not result in a boot-loop on this device, but USB will not provide power. Snapshots from 27.2.2021 onward have USB-power-issue fixed, 21.02-rc2 should also have it fixed, see: ?p=openwrt/openwrt.git;a=commitdiff;h=62099d98e4746d8a4e9ee79360314c1900c8974e.

Recovery after this soft-brick may be possible via the tftpd method (see below).

Flashing using the factory firmware web interface

  • Install the OpenWrt factory image by doing a “firmware upgrade” through the web interface of the factory firmware.
  • After the installation completes, point your web browser to, the IP address OpenWrt uses by default.

Flashing using TFTP only (without serial console)

  • Connect one of the ethernet ports to a host computer.
  • Change your host computer's IP address to Note that the WR810N will have the IP address
  • Run a TFTP server on your host computer.
  • Rename the OpenWrt factory image to wr810nv1_tp_recovery.bin and make it available via the TFTP server.
  • Press the 'WPS/Reset' button while powering up the device.
  • The bootloader will now load and flash the image from the TFTP server.

Flashing using the serial console

  • Gain serial access to the bootloader.
  • Connect one of the LAN ports to a host computer via an ethernet cable.
  • Change your host computer's IP address to
  • Run a TFTP server on your host computer.
  • Make the OpenWrt factory image available via the TFTP server.
  • Enter the following commands into the bootloader prompt:
    tftp  0x80800000 openwrt-ar71xx-generic-tl-wr810n-squashfs-factory.bin
    erase 0x9f020000 +${filesize}
    cp.b  0x80800000 0x9f020000 ${filesize}
    bootm 0x9f020000

Revert to the original factory firmware

Download this file (kernel + rootfs partitions extracted from the original firmware + empty config partion) and flash it as described above using a TFTP server with or without a serial console.

The US version is not as “open” as the EU version, see this forum post for information on how to flash OpenWrt onto the device.

Model TL-WR810N(EU) TL-WR810N(US)
Version 1.1 1.0
Architecture: MIPS 24Kc
Manufacturer: Qualcomm Atheros
Bootloader: U-Boot
System-On-Chip: Qualcomm Atheros QCA9531-BL3A
CPU Frequency: 650MHz
Flash chip: Winbond 25Q64FVSIG
Flash size: 8 MiB
RAM chip: Zentel A3R12E40CBF-8E
RAM size: 64 MiB
Wireless: SoC integrated
Antenae(s) 2 On-Board
Ethernet: 1 WAN 10/100, 1 LAN 10/100
USB: 1 x 2.0
Control Elements: Reset button, operation mode switch Reset button


Opening the Case

Opening this device exposes
parts under high voltage (110/230 VAC)!

  • Risk of deadly electrical shock
  • Risk of irreversable damage to other components attached, e.g. your PC connected via serial

Make sure to keep your fingers, conductive tools and serial cables away from the high voltage at all times!

Capacitors can still retain dangerous voltages
after disconnection from mains!

Continue at your own risk!

Start by inserting a pry tool above the ethernet connectors. Lift the lid, work in counterclockwise direction. Don't be afraid to apply quite some force, in particular at the corners of the case.

Removing the PCB from the Case

Remove the light pipe above the LED. The light pipe is melted with the plastic of the case to fixate it, and you have to break away the melted parts to get the light pipe loose. (But it can later be put back without any noticable damage from the outside.) Then remove the dots of ductile glue that hold the PCB to the case, use a knife or some other narrow tool and cut/press it slowly through the glue. Finally, start lifting the PCB out at the edge opposite to the ethernet connectors.


The serial console can be accessed through the following test points on the top of the PCB:

Test Point Function Note
TP_TX1 TX Reaches only a maximum of ~2.5V because of pull-down resistor R64.
TP_RX1 RX This test point is not directly connected to the SoC, next to it is an unpopulated jumper (R107) that needs to be closed. This can easily be done by soldering not the end of a piece of enamelled wire to the test point, but letting about 1mm of wire stand out of the solder joint over the pads of the jumper, and then pulling solder from the solder joint over the jumper.

Board voltage is 3.3V. The parameters of the serial console are 115200 8N1. To access the U-Boot prompt, type tpl quickly when the bootloader is about to autoboot. For the factory firmware the password for root is sohoadmin.

Operation Mode Switch

The operation mode switch on the top of the device is wired to the GPIOs 0 and 1 as follows:

Position GPIO 0 (BTN_1) GPIO 1 (BTN_0) slide-switch script name
Router/AP 0 1 mode-router-ap
Repeater 1 0 mode-repeater
Client 1 1 mode-client

GPIO 1 and GPIO 0 are mapped to the key codes BTN_0 and BTN_1, respectively. See here on how to attach functions to them directly or use slide-switch with the names in the table above.

The US version has the same internal hardware as the EU version, but is slightly smaller and does not have the operation mode switch at the top.

The version 2.0 no longer provides an USB port.

TL-WR810N(EU) 1.1 Flash Layout factory firmware
Layer0 raw flash 8192KiB
Layer1 mtd0 u-boot 128KiB mtd1 kernel 1024KiB mtd2 rootfs 6912KiB mtd3 config 64KiB mtd4 art 64KiB
Mountpoint none none / none none
Filesystem none none SquashFS none none
TL-WR810N(EU) 1.1 Flash Layout OpenWrt
Layer0 raw flash 8192KiB
Layer 1 mtd0 u-boot 128KiB mtd5 firmware 8000KiB mtd4 art 64KiB
Layer 2 mtd1 kernel ~1200KiB 1) mtd2 rootfs sizeof(firmware - kernel)
Layer 3 mtd3 rootfs_data sizeof(rootfs - /rom) 2)
Mountpoint none none /rom /overlay none
Filesystem none none SquashFS JFFS2 none

TL-WR810N(EU) 1.1 U-Boot Log

TL-WR810N(EU) 1.1 Factory Firmware Boot Log

TL-WR810N(EU) 1.1 OpenWrt Boot Log

Size of kernel depends on configuration
Size of /rom depends on configuration
This website uses cookies. By using the website, you agree with storing cookies on your computer. Also you acknowledge that you have read and understand our Privacy Policy. If you do not agree leave the website.More information about cookies
  • Last modified: 2024/02/12 08:58
  • by