How to recover a TP-Link router with a faulty firmware flash?

This guide is valid for TP-Link routers only on which you attempted to flash ChilliWRT or OpenWRT. This guide does not apply to TP-LINk TL-WR941ND models up to 3.2 as for them the failsafe mode is confirmed not working. Newer models (5+) may work, but untested.

Preparatory steps:

- If working on MS Windows, download and install WinSCP program from, if working on Linux make sure that scp is installed
- Download a stable OpenWrt firmware image from for your specific TP-Link model. It must be the file with phrase 'factory' in its file name. The ones with the phrase 'sysupgrade' can NOT be used.
- Rename the downloaded firmware file to 'firmware.bin' (without the apostrophes).


Recovery process:

- Reboot the router
- Just when the 'SYS' LED starts flashing press the QSS button in the front or the reset button in the back
- The 'SYS' LED will start to flash very fast. The firmware is now in recovery mode
- Connect your computer to the router's LAN port number 1
- Give your computer a fixed IP address in the 192.168.1.x range, say
- You should now be able to 'ping' your computer on
- Open a command terminal and type the command:
- You should now see the OpenWrt welcome logo and a prompt
- Type the following commands:
touch jffs2
touch root
/etc/init.d/dropbear start

- Now start winscp and connect with the following settings:
Protocol: SCP
Port: 22
User: root
Password: shae-4
- WinSCP will log you into the router and you will see the router's file-system on the right hand site and your local disk on the left
- You will be on the router's directory /root, go one level up to /, and from there got to /tmp
- You can then simply transfer the firmware file over from your local file to /tmp directory on the router
- If working on Linux in a terminal window in lieu of WinSCP use the command scp firmware.bin root@ from the directory the file is located in)

- Log back into the router and type the following commands
cd /tmp
mtd -r write /tmp/firmware.bin firmware 

- The system will load the new firmware and reboot
- Remove the fixed IP address from your router to receive an IP address automatically from the router (via DHCP), disconnect the LAN cable and reconnect it to the router
- Once the router has fully rebooted you can ping the router on again
- Make sure the WAN port of the router is connected to the LAN with Internet access
- Open a command terminal and type the command: telnet
- Type the following command:
- Enter a new password of your choice twice
- Type the following commands:
cd /tmp
opkg update
opkg install luci
/etc/init.d/uhttpd enable
/etc/init.d/uhttpd start

You now have a working firmware with graphical interface on The router is recovered.

If you want to retry loading the Chillifire firmware do the following: 

We recommend you download the Chillifire Firmware again from our website to make sure you have a clean and uncorrupted firmware file. You can install the Chillifire firmware by logging into the router with user root and the password you chose during the above process. Go to 'System'->'Backup / Flash Firmware'. Under the heading 'Flash new firmware image' load the Chillifire firmware file, make sure you UNTICK the 'Keep settings' box. If you fail to do that your router could be broken again requiring the same recovery. Click on the 'Flash image' button. Confirm to proceed on the next page.

You are done.




- If you get an error after the mount_root command such as:
root@(none):/# mount_root mount: mounting /dev/mtdblock3 on /tmp/overlay failed: Input/output error switching to jffs2 root@(none):/

then you have to run the following command first:

mtd -r erase rootfs_data
Wait until the router starts rebooting and when the SYS LED just starts blinking, press the QSS button again. Now continue with the above script.
- If you cannot get a connection to the router via telnet, check whether you get a ping response by typing
on the Windows or Linux command line.
If you do not get a response, make sure you really have given yourself a fixed IP address such as and set the gateway to
If that is all good, briefly disconnect and reconnect your computer again to the device. You should now have a ping response.
Have more questions? Submit a request


Please sign in to leave a comment.
Powered by Zendesk