TP-Link TL-WR941ND

This device is NOT RECOMMENDED for future use with OpenWrt due to low flash/ram.
DO NOT BUY DEVICES WITH 4MB FLASH / 32MB RAM if you intend to flash an up-to-date and secure OpenWrt version onto it! See 4/32 warning for details.

1) This device does not have sufficient resources (flash and/or RAM) to provide secure and reliable operation.
This means that even setting a password or changing simple network settings might not be possible any more, rendering the device effectively useless. See OpenWrt on 4/32 devices what you can do now.

2) OpenWrt support for this device has ended in 2022.
19.07.10 was the last official build for 4/32 devices.

The WR941ND comes in many different hardware revisions and it has a different case and 450Mbps-WiFi since v6.

This article covers the international version. The Chinese v6 and v7 are quite different in hardware. There is no v7 on the international market, yet and it will definitely not have the same hardware as the Chinese version.

(2016-03-24) Unfortunately the OpenWrt-image for v6 in Barrier Breaker & Chaos Calmer was built for the Chinese version. A working patch for adding support to the current OpenWrt-trunk can be found here. The patch didn't made it into the CC 15.05 or 15.05.1 release, see here. Trunk snapshots and custom builds of the current 15.05 branch work fine.

Known clone of this device: Mercury MWR300T+.

Historic Info

Ver CPU RAM Flash Network Wireless USB Serial JTag Wiki FCC
v1 Atheros AR9132 400MHz 32MB 8MB 1 WAN + 4x LAN (100 Mbit) AR9132 [bgn 3×3:2] + AR9103 [bgn 3×3:2] No Yes N/A Link FCC ID TE7WR941NX
v2 Atheros AR9132 400MHz 32MB 4/8MB 1 WAN + 4x LAN (100 Mbit) AR9132 [bgn 3×3:2] + AR9103 [bgn 3×3:2] No Yes N/A Link
v3 Atheros AR9132 400MHz 32MB 4MB 1 WAN + 4x LAN (100 Mbit) AR9132 [bgn 3×3:2] + AR9103 [bgn 3×3:2] No Yes N/A Link
v4 Atheros AR7240 400MHz 32MB 4MB 1 WAN + 4x LAN (100 Mbit) No Yes N/A
v5.x Atheros AR9341 535MHz 32MB 4MB 1 WAN + 4x LAN (100 Mbit) AR9341 [bgn 2×2:2] No Yes N/A Link FCC ID TE7WR941NXV5
v6 Qualcomm TP9343 750MHz 32MB 4MB 1 WAN + 4x LAN (100 Mbit) QCA9561 [bgn 3×3:3] No Yes N/A Link FCC ID TE7WR941NXV6

Important! The above spec for v5.x is valid only if the FCC ID of your device is TE7WR941NXV5. If the FCC ID of your device is not TE7WR941NXV5 but the hardware version is v5.x, then the above spec doesn't apply to your device and you should proceed with caution.

Important! Only flash v2 after backing up ART, see section below

Installing LEDE erased the ART partition and thus killed wifi for me. The speculated cause is that it has 8MB flash, but was equipped with a 4MB firmware and ART residing in the lower half. LEDE probably assumes that the ART is at the very end, and is more than happy to erase everything before that.

Others had also observed that a given TL-WR941ND (v1 or v2) had 4MB firmware installed on 8MB flash with ART in the lower half as well, although they did not realize this. Browsing through the topic, the logs indicate that one of the v2.x devices mentioned has 8MB flash (prisma, RoundSparrow), while others had 4MB (juhosg (?), erreterr, sam.vanratt, _bbb_).

Thus I recommend that before you install LEDE on such a device, you should root it or use a serial cable to back up ART, otherwise you will lose wireless forever!

TODO: We need to test whether an older version of OpenWrt (15.05?) would keep the flash intact. If yes, we could back up the ART from that before sysupgrading to the newest version.

Install OpenWrt (generic explanation)

The stock firmware has filename length limitations when processing a submitted “Firmware Upgrade” filename,​ but will complain “no file chosen” suggesting you haven'​t selected a file rather than tell you the filename is too long. Just rename the downloaded image to something shorter and it'll flash just fine.

Otherwise, installation is generic for international v1 to v5 ; see Installing OpenWrt.

WARNING ! For international v6, you have to build your own firmware from trunk snapshots by following the instructions below. FIXME Please verify if this is still the case in 05/2018 --- tmomas 2018/05/04 10:07

This tutorial helps you to build a working firmware for your WR941ND v6 router including Luci web management interface.
Note : PPP (Point-to-Point Protocol) support is disabled due to the small amount of storage in this device. You can't have both PPP and Luci at the same time.

  1. Untar the downloaded archive and cd into the root of the extracted folder
  2. Run the following command : make image PROFILE=TLWR941 PACKAGES="luci nano -ppp -ppp-mod-pppoe -luci-proto-ppp". Make sure to have all the dependencies required to compile the firmware. For further informations, please visit this page : imagebuilder
  3. You'll be able to find your custom working firmware in the subdirectory /bin/ar71xx
  4. Go to the TP-Link web interface, select Firmware Upgrade and choose this file : openwrt-ar71xx-generic-tl-wr941nd-v6-squashfs-factory.bin.
  5. Click on Upgrade and wait until the device reboot. It's done ! You can now connect your PC to the router (Wifi or RJ45, both working), browse to 192.168.1.1, and enjoy OpenWrt!

Since this part is identical for all devices, see OpenWrt Sysupgrade.

Warning!
This section describes actions that might damage your device or firmware. Proceed with care!

A 3.3v TTL serial connection is required ! (Forum post) Do not try this method unless you're really sure what you're doing.

Set your serial terminal at 115200 8n1. Set your computer ip address as a static one of 192.168.1.254 netmask 255.255.255.0. Install and configure a tftp server, put the firmware on it. The Windows firewall may get in the way.

During UBOOT “1-second” message, quickly key sequence: tpl to stop UBOOT from loading the kernel and go into uboot mode proper.

ar7100> setenv serverip 192.168.1.254; setenv ipaddr 192.168.1.1
ar7100> tftp 0x80800000 openwrt-ar71xx-tl-wr941nd-v3-squashfs.sysupgrade.bin
ar7100> erase.b 0xbf020000 +0x3c0000
ar7100> cp.b 0x80800000 0xbf020000 0x3c0000
ar7100> reset

Note #1: 0x3c0000 is the size of the firmware, be aware that you may have a different size thus bricking your router.

Note #2: 0xbf020000 is the from addr, for your device version you can get it by issuing the command: “printenv bootcmd”, not doing so will turn your router into a brick.

Warning!
This section describes actions that might damage your device or firmware. Proceed with care!

You can download the original firmware from the TP-LINK support section and flash it without modification.

Only perform the dd action below if your original firmware has the word “boot” in it, for example, “wr941nv4_en_3_9_17_up_boot(091118).bin”. DO NOT dd your original firmware if it has no “boot” in its name, for example, “wr941nv4_en_3_11_5_up(100427).bin”, because if you do, you will brick your router ! This was confirmed by supertom64 in wr1043nd. ( NB: so if no boot in the name, skip the dd and use the bin file normally.)

Optionally cut first 0x20200 bytes from original firmware containing boot in the filename:

dd if=orig.bin of=tplink_boot.bin skip=257 bs=512

Flash via uboot or mtd, you cannot flash via WebGUI otherwise you will turn your router into brick.

First you need to get the firmware file onto your box. If you are able to connect to your OpenWrt console and you have your network configured properly, you can use wget or scp to copy the firmware binary into the /tmp folder.

To start flashing via mtd you have to call (wr.bin is the file containing the firmware you previously downloaded):

root@OpenWrt:/tmp# mtd -r write wr.bin firmware
Unlocking firmware ...

Writing from wr.bin to firmware ...
Rebooting ...
Terminated

For a normal bin file downloaded (so no boot in the name) a normal sysupgrade worked for me (user cybermaus). I did this, because other TP-Link routers (WR1043ND, WR841ND) also worked like that.

root@OpenWrt:/tmp# sysupgrade wr.bin

WR941ND v6

Setup a TFTP server on your computer with the static address 192.168.0.66 - Put the image (without UBoot!) into the TFTP root directory and rename it to wr941ndv6_tp_recovery.bin

Now connect the WAN port of the router with your computer's ethernet port, power up the router and hold the reset button pressed (stop pressing the reset button when the lock symbol led turned on).

Sample serial log excerpt

(...)

is_auto_upload_firmware=1
Trying eth1
eth1 link down
FAIL
Trying eth0
enet0 port4 up
dup 1 speed 100
Using eth0 device
TFTP from server 192.168.0.66; our IP address is 192.168.0.86
Filename 'wr941ndv6_tp_recovery.bin'.
Load address: 0x80800000
Loading: #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         ######################################################
done
Bytes transferred = 3932160 (3c0000 hex)
original_product_id = 155254790, original_product_ver = 1
recovery_product_id = 155254790, recovery_product_ver = 1
Firmware recovery: product id verify sucess!
Firmware recovery: filesize = 0x3c0000.
Erasing flash... 
First 0x2 last 0x3d sector size 0x10000                                                                                                                                 61
Erased 60 sectors
Copy to Flash... write addr: 9f020000
done

(...)

failsafe_and_factory_reset

NETWORKING IN FAILSAFE MODE IS CURRENTLY BROKEN - See https://dev.openwrt.org/ticket/10436

  • While the SYS LED is on immediately press the QSS button.
  • If done right the SYS LED will start flashing very quickly.
Instruction set MIPS
Vendor Atheros
Bootloader uboot
System-On-Chip AP81
CPU Speed 400 Mhz
Flash-Chip S25FL032P (HW Ver 3.6)
Flash size 4 MiB
RAM 32 MiB
Wireless Atheros AR9103 802.11n
Ethernet Switch part of SoC
USB No, but USB port header has been discovered on the board → mod
Serial Yes
JTAG N/A

WR941ND v4

This photo was taken from a WR940N v1, but it seems to have the same PCB.
TL-WR940N v1.0 Main board

WR941ND v6

This photo was taken from a WR940N v3, but I confirmed that it has the same PCB.
TL-WR940N v3.0 Main board

Note: This will void your warranty! These instructions are not very good! (yet...)

  1. There are two screws underneath the rubber feet at the back (were the RJ45 jacks are) of the device. Remove those.
  2. Remove the front plastic piece.
  3. Try to open the white plastic cover at the top only a little bit.
  4. Unhinge the plastic cover at the front.

There is also an easy way to do it

  1. Remove those two screws underneath the rubber feet at the back
  2. Get your nails in the grooves underneath the router and lift the panel
  3. Use your nails and slowly go around the case to Unhinge the plastic cover at the front

Main PCB (not V3.2)

WR941ND v3

Look at the PCB picture. Serial port is located were the 4 wires are soldered to the board. The left one (green) is soldered to the pad labeled “P1”.
Pinout of the port is : |TX|RX|GND|VCC(3.3)| (direction as seen in PCB picture above; Pad “P1” is TX)
Before you can use the serial port you have to bridge R356. (A smd pad right underneath the serial port pad “P1”).

It is not possible to directly connect the serial port to one of your computer (voltage mismatch). You have to use a converter (i.e. a Nokia CA-42 cable, serial to USB converter or something similar. An Arduino MEGA with a simple serial bridge also works).

On the ver3 board, there is a 4.7k pull-down resistor on the RX pin. To interface with 5V devices (such as the Arduino MEGA), use a 2k2 resistor in series with the RX pin (Arduino's TX pin). Arduino's RX pin can be connected directly with the router's TX pin.

WR941ND v4

Note the serial port on the right part of the board, approx. in the middle. Four pins next to the two large capacitors.

The serial port pinout is TX, RX, GND, NC. (in the picture from bottom to top)

Port settings are 115200, 8n1, no flow control.

Note: The console output may have garbage characters in it, as well as it will not take input. In this case pulling TX high with a 15K resistor from 3.3 volt resolves this

WR941ND v5

Serial pin ver: 5.1

WR941ND v6

TL-WR941ND v6.0 UART

Once the OEM firmware has booted up completely, you can press return to activate the Linux login prompt.

The username/password combination to get a root Shell access is root:sohoadmin

This device does not have a programmable switch and require special configuration (only v3.x hardware). Each port is presented with a different interface (lan1, lan2, lan3, lan4, wan).

VLAN in Chaos Calmer+

First, set the main port (eth0) with an MTU of at least 1504 in /etc/config/network : config interface 'eth' option ifname 'eth0' option mtu '1504' option proto 'none' Then just create different interfaces for each port.

Example:

  • lan1.1: [VLAN] VID 1 in lan1 interface
  • lan1: Untagged traffic in lan1 interface
  • wan.5: [VLAN] VID 5 in wan interface

Example config:

config interface 'public' option proto 'static' option ifname 'wan.3' option netmask '255.255.255.240' option ipaddr '10.1.1.4' config interface 'public2' option proto 'static' option ifname 'lan4.5' option netmask '255.255.255.240' option ipaddr '10.1.1.33'

VLAN in old OpenWrt releases

Setting up VLAN is a bit different from other devices:

First, you have to edit /etc/rc.local (sample config for VLAN 100 and 200 on trunk port lan4): # Put your custom commands here that should be executed once # the system init finished. By default this file does nothing. vconfig add lan4 100 vconfig add lan4 200 ifconfig lan4.100 up ifconfig lan4.200 up exit 0

Then, you have to edit /etc/config/network and reboot the device (that /etc/rc.local is executed): config interface vlan100 option ifname “lan1 lan2 lan3 lan4.100” #[...] config interface vlan200 option ifname “lan4.200”

The device has 2 buttons:

  • the reset button at the back
  • the “QSS” labeled button at the front

Since this part is identical for all devices, see Basic configuration.

If you have an USB port, please see Connect stuff to the USB port.

This website uses cookies. By using the website, you agree with storing cookies on your computer. Also you acknowledge that you have read and understand our Privacy Policy. If you do not agree leave the website.More information about cookies
  • Last modified: 2024/02/12 08:58
  • by 127.0.0.1