TP-Link TL-WR941ND

The WR941ND comes in many different hardware revisions and it has a different case and 450Mbps-WiFi since v6.

This article covers the international version. The Chinese v6 and v7 are quite different in hardware. There is no v7 on the international market, yet and it will definitely not have the same hardware as the Chinese version.

Known clone of this device: Mercury MWR300T+.

Historic Info

The above spec for v5.x is valid only if the FCC ID of your device is TE7WR941NXV5. If the FCC ID of your device is not TE7WR941NXV5 but the hardware version is v5.x, then the above spec doesn't apply to your device and you should proceed with caution.

Only flash v2 after backing up ART, see section below

Installing LEDE erased the ART partition and thus killed wifi for me. The speculated cause is that it has 8MB flash, but was equipped with a 4MB firmware and ART residing in the lower half. LEDE probably assumes that the ART is at the very end, and is more than happy to erase everything before that.

Others had also observed that a given TL-WR941ND (v1 or v2) had 4MB firmware installed on 8MB flash with ART in the lower half as well, although they did not realize this. Browsing through the topic, the logs indicate that one of the v2.x devices mentioned has 8MB flash (prisma, RoundSparrow), while others had 4MB (juhosg (?), erreterr, sam.vanratt, _bbb_).

• https://forum.lede-project.org/t/art-of-tl-wr941-v2-0-destroyed-by-17-01-4/14609
• https://forum.openwrt.org/viewtopic.php?id=18354
• https://forum.dd-wrt.com/phpBB2/viewtopic.php?p=231233#231233
• https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=32715
• https://forum.dd-wrt.com/phpBB2/viewtopic.php?p=552424#552424
• https://forum.dd-wrt.com/phpBB2/viewtopic.php?p=450886#450886
• https://forum.openwrt.org/viewtopic.php?id=36858

Thus I recommend that before you install LEDE on such a device, you should root it or use a serial cable to back up ART, otherwise you will lose wireless forever!

TODO: We need to test whether an older version of OpenWrt (15.05?) would keep the flash intact. If yes, we could back up the ART from that before sysupgrading to the newest version.

→ Install OpenWrt (generic explanation)

The stock firmware has filename length limitations when processing a submitted “Firmware Upgrade” filename,​ but will complain “no file chosen” suggesting you haven'​t selected a file rather than tell you the filename is too long. Just rename the downloaded image to something shorter and it'll flash just fine.

Otherwise, installation is generic for international v1 to v5 ; see Installing OpenWrt.

WARNING ! For international v6, you have to build your own firmware from trunk snapshots by following the instructions below. Please verify if this is still the case in 05/2018 --- tmomas 2018/05/04 10:07

This tutorial helps you to build a working firmware for your WR941ND v6 router including Luci web management interface.
Note : PPP (Point-to-Point Protocol) support is disabled due to the small amount of storage in this device. You can't have both PPP and Luci at the same time.

1. Get the ImageBuilder for your device right there : https://archive.openwrt.org/snapshots/trunk/ar71xx/generic/OpenWrt-ImageBuilder-ar71xx-generic.Linux-x86_64.tar.bz2
2. Untar the downloaded archive and cd into the root of the extracted folder
3. Run the following command : make image PROFILE=TLWR941 PACKAGES="luci nano -ppp -ppp-mod-pppoe -luci-proto-ppp". Make sure to have all the dependencies required to compile the firmware. For further informations, please visit this page : imagebuilder
4. You'll be able to find your custom working firmware in the subdirectory /bin/ar71xx
5. Go to the TP-Link web interface, select Firmware Upgrade and choose this file : openwrt-ar71xx-generic-tl-wr941nd-v6-squashfs-factory.bin.
6. Click on Upgrade and wait until the device reboot. It's done ! You can now connect your PC to the router (Wifi or RJ45, both working), browse to 192.168.1.1, and enjoy OpenWrt!

Since this part is identical for all devices, see OpenWrt Sysupgrade.

A 3.3v TTL serial connection is required ! (Forum post) Do not try this method unless you're really sure what you're doing.

Set your serial terminal at 115200 8n1. Set your computer ip address as a static one of 192.168.1.254 netmask 255.255.255.0. Install and configure a tftp server, put the firmware on it. The Windows firewall may get in the way.

During UBOOT “1-second” message, quickly key sequence: tpl to stop UBOOT from loading the kernel and go into uboot mode proper.

ar7100> setenv serverip 192.168.1.254; setenv ipaddr 192.168.1.1
ar7100> tftp 0x80800000 openwrt-ar71xx-tl-wr941nd-v3-squashfs.sysupgrade.bin
ar7100> erase.b 0xbf020000 +0x3c0000
ar7100> cp.b 0x80800000 0xbf020000 0x3c0000
ar7100> reset

Note #1: 0x3c0000 is the size of the firmware, be aware that you may have a different size thus bricking your router.

Note #2: 0xbf020000 is the from addr, for your device version you can get it by issuing the command: “printenv bootcmd”, not doing so will turn your router into a brick.

You can download the original firmware from the TP-LINK support section and flash it without modification.

Optionally cut first 0x20200 bytes from original firmware containing boot in the filename:

dd if=orig.bin of=tplink_boot.bin skip=257 bs=512

Flash via uboot or mtd, you cannot flash via WebGUI otherwise you will turn your router into brick.

First you need to get the firmware file onto your box. If you are able to connect to your OpenWrt console and you have your network configured properly, you can use wget or scp to copy the firmware binary into the /tmp folder.

To start flashing via mtd you have to call (wr.bin is the file containing the firmware you previously downloaded):

root@OpenWrt:/tmp# mtd -r write wr.bin firmware
Unlocking firmware ...

Writing from wr.bin to firmware ...
Rebooting ...
Terminated

For a normal bin file downloaded (so no boot in the name) a normal sysupgrade worked for me (user cybermaus). I did this, because other TP-Link routers (WR1043ND, WR841ND) also worked like that.

root@OpenWrt:/tmp# sysupgrade wr.bin

Setup a TFTP server on your computer with the static address 192.168.0.66 - Put the image (without UBoot!) into the TFTP root directory and rename it to wr941ndv6_tp_recovery.bin

Now connect the WAN port of the router with your computer's ethernet port, power up the router and hold the reset button pressed (stop pressing the reset button when the lock symbol led turned on).

Sample serial log excerpt

(...)

is_auto_upload_firmware=1
Trying eth1
eth1 link down
FAIL
Trying eth0
enet0 port4 up
dup 1 speed 100
Using eth0 device
TFTP from server 192.168.0.66; our IP address is 192.168.0.86
Filename 'wr941ndv6_tp_recovery.bin'.
Load address: 0x80800000
Loading: #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         ######################################################
done
Bytes transferred = 3932160 (3c0000 hex)
original_product_id = 155254790, original_product_ver = 1
recovery_product_id = 155254790, recovery_product_ver = 1
Firmware recovery: product id verify sucess!
Firmware recovery: filesize = 0x3c0000.
Erasing flash... 
First 0x2 last 0x3d sector size 0x10000                                                                                                                                 61
Erased 60 sectors
Copy to Flash... write addr: 9f020000
done

(...)

→failsafe_and_factory_reset

NETWORKING IN FAILSAFE MODE IS CURRENTLY BROKEN - See https://dev.openwrt.org/ticket/10436

• While the SYS LED is on immediately press the QSS button.
• If done right the SYS LED will start flashing very quickly.

This photo was taken from a WR940N v1, but it seems to have the same PCB.

This photo was taken from a WR940N v3, but I confirmed that it has the same PCB.

Note: This will void your warranty! These instructions are not very good! (yet...)

1. There are two screws underneath the rubber feet at the back (were the RJ45 jacks are) of the device. Remove those.
2. Remove the front plastic piece.
3. Try to open the white plastic cover at the top only a little bit.
4. Unhinge the plastic cover at the front.

There is also an easy way to do it

1. Remove those two screws underneath the rubber feet at the back
2. Get your nails in the grooves underneath the router and lift the panel
3. Use your nails and slowly go around the case to Unhinge the plastic cover at the front

Main PCB (not V3.2)

Look at the PCB picture. Serial port is located were the 4 wires are soldered to the board. The left one (green) is soldered to the pad labeled “P1”.
Pinout of the port is : |TX|RX|GND|VCC(3.3)| (direction as seen in PCB picture above; Pad “P1” is TX)
Before you can use the serial port you have to bridge R356. (A smd pad right underneath the serial port pad “P1”).

It is not possible to directly connect the serial port to one of your computer (voltage mismatch). You have to use a converter (i.e. a Nokia CA-42 cable, serial to USB converter or something similar. An Arduino MEGA with a simple serial bridge also works).

On the ver3 board, there is a 4.7k pull-down resistor on the RX pin. To interface with 5V devices (such as the Arduino MEGA), use a 2k2 resistor in series with the RX pin (Arduino's TX pin). Arduino's RX pin can be connected directly with the router's TX pin.

Note the serial port on the right part of the board, approx. in the middle. Four pins next to the two large capacitors.

The serial port pinout is TX, RX, GND, NC. (in the picture from bottom to top)

Port settings are 115200, 8n1, no flow control.

Note: The console output may have garbage characters in it, as well as it will not take input. In this case pulling TX high with a 15K resistor from 3.3 volt resolves this

Serial pin ver: 5.1

Once the OEM firmware has booted up completely, you can press return to activate the Linux login prompt.

The username/password combination to get a root Shell access is root:sohoadmin

This device does not have a programmable switch and require special configuration (only v3.x hardware). Each port is presented with a different interface (lan1, lan2, lan3, lan4, wan).

First, set the main port (eth0) with an MTU of at least 1504 in /etc/config/network : config interface 'eth' option ifname 'eth0' option mtu '1504' option proto 'none' Then just create different interfaces for each port.

Example:

• lan1.1: [VLAN] VID 1 in lan1 interface
• lan1: Untagged traffic in lan1 interface
• wan.5: [VLAN] VID 5 in wan interface

Example config:

config interface 'public' option proto 'static' option ifname 'wan.3' option netmask '255.255.255.240' option ipaddr '10.1.1.4' config interface 'public2' option proto 'static' option ifname 'lan4.5' option netmask '255.255.255.240' option ipaddr '10.1.1.33'

Setting up VLAN is a bit different from other devices:

First, you have to edit /etc/rc.local (sample config for VLAN 100 and 200 on trunk port lan4): # Put your custom commands here that should be executed once # the system init finished. By default this file does nothing. vconfig add lan4 100 vconfig add lan4 200 ifconfig lan4.100 up ifconfig lan4.200 up exit 0

Then, you have to edit /etc/config/network and reboot the device (that /etc/rc.local is executed): config interface vlan100 option ifname “lan1 lan2 lan3 lan4.100” #[...] config interface vlan200 option ifname “lan4.200”

The device has 2 buttons:

• the reset button at the back
• the “QSS” labeled button at the front

Since this part is identical for all devices, see Basic configuration.

If you have an USB port, please see Connect stuff to the USB port.

WR941n Ver.5.1

• Unpowered USB header on board
• lark´s wr941nd files