TP-Link TL-WR1043ND

One of the first cheap devices with an gigabit Ethernet switch. Manufacture advertised features: 3 removable omni antennas (RP-SMA connectors) and 24 dBm (251 mW, v1.x, v2.x) maximal TX power output. Note: maximal TX power and available channels are limited in some countries!

WARNING: These routers seem to have unstable wifi in 12.09. They're hit by bugs 9654, 12372 and 13966.

Supported Versions

This router has the following versions/models.

Version/Model S/N Release Date Bootloader Date 1) 2) Supported since version 3) Model Specific Notes
(DE)v1.0 - Backfire 10.03.1 Similar, German WebUI
v1.1 - Backfire 10.03.1 Similar to WR941ND.
(DE)v1.1 - Attitude Adjustment 12.09-beta2 German WebUI, V1.1 in S/N sticker
(RU)v1.1 - 2013-09-27 Attitude Adjustment 12.09 Upgraded to stock 3.13.13 first before flashing OpenWRT, no switch leaking
(DE)v1.2 - 2013-03 :?: Attitude Adjustment 12.09-rc1 Backfire 10.03.1 = BRICK:!:
v1.4 - Backfire 10.03.1 Same v1 board as v1.1
v1.5 - Backfire 10.03.1 Same v1 board as v1.1
v1.6 - Backfire 10.03.1
v1.7 - Backfire 10.03.1
v1.8 - 2010-08-04 (and probably other versions prior to 2012-02-02) Backfire 10.03.1
- 2012-02-02, 2012-03-31 (and probably later versions) Attitude Adjustment 12.09-rc1 Tested OK with Backfire 10.03.1 but require bootloader downgrade. Suspect of hardware bug that bring down WiFi after a while.
v1.9 - 2012-03-31 Tested OK with Backfire 10.03.1 but require bootloader downgrade.
v1.10 - Attitude Adjustment 12.09-rc1 Similar v1.1 board. Backfire 10.03.1 = BRICK:!:.
v1.11 - Attitude Adjustment 12.09 Backfire 10.03.1 = BRICK:!:
v2.1 - 2013-06-18 Barrier Breaker (trunk R38958)
HW V1.x HW V2.x

Hardware Highlights

HW Version CPU Ram Flash Network Gigabit USB Serial JTag
1.x Atheros AR9132@400MHz 32MB 8MB 4x1 Yes Yes Yes Yes
2.x Qualcomm Atheros QCA9558@720MHz 64MB 8MB 4x1 Yes Yes Yes No

See paragraphs Hardware or Tags for more details.

Warnings / Gotchas

This section is mess and needs clean up.

Due to numerous reports that WAN bug does not occur with stock uboot, doing uboot downgrade may be possibly obsolete.

:!: WAN port disable bug (newer models v1.8+ with U-boot 2012-02-02 and later). It has been reported that recent TP-Link stock firmware packages include a new bootloader revision, which disables the WAN (port 0) at boot. This was an unhelpful fix to deal with the switch leakage, which has been implemented in trunk between r32942 - r32944 (45-46 fixes the leakage).

:!: WAN port disable bug in 1.10 As of today (20130529) installing Attitude Adjustment 12.09 on a 1.10 device works flawless and do not exhibit the WAN port disable bug.

:!: WAN port disable bug in (DE)v1.2 As of today (20130902) installing Attitude Adjustment 12.09 on a (DE)v1.2 device works flawless and do not exhibit the WAN port disable bug.

:!: WAN port disable bug in 2.1 As of today (20131230) installing Barrier Breaker (trunk) on a v2.1 device works flawless and do not exhibit the WAN port disable bug.

ALL newer hardware models v1.8 or above (from ~April 2012) is affected by this WAN port bug. Below is the code for the affected bootloader that disables the WAN port at boot after flashing.

root@tpl2:~# grep -a U-Boot /dev/mtd0ro | cut -d'I' -f1
U-Boot 1.1.4 (Feb  6 2012 - 17:03:51)

  • Check of the TP-LINK firmware, ver. TL-WR1043ND_V1_120405 with a published date 2012/4/5: This firmware updates the bootloader code to a March 31, 2012 release date but has the same WAN port disabled on boot behavior as the Feb. 6, 2012 firmware, and so routers shipping with this firmware need the boot loader downgrade described below

U-Boot 1.1.4 (Mar 31 2012 - 10:40:21)

Bootloader downgrade

:!: WAN port disable bug (inelegant) workaround. The older german stock firmware (v3.9.17/100331) does not feature this bug. The work around involves webreverting/downgrading to this older version and then reflashing OpenWrt.

  • Step 1 (optional, only required if OpenWrt is installed): If your WAN port is now disabled follow the guide here to web revert back to stock firmware.
  • Step 2: Install german stock firmware (v3.9.17) through the TP-Link web interface. Download the firmware file "wr1043nv1_de_3_9_17_up_boot(100331).bin". ( mirror). After the German firmware flash, the u-boot code on a v1.9 router should be downgraded to the Nov. 17, 2009 version:

grep -a U-Boot /dev/mtd0ro | cut -d'I' -f1

U-Boot 1.1.4 (Nov 17 2009 - 11:56:26)

  • Step 3: Flash the correct OpenWrt firmware image according to your router model/version:!:. This should re-enable the WAN port.

USB 3G Modems

:!: USB 3G modem issue (insufficient power). TL-WR1043ND v1.x does NOT deliver enough power for most USB 3G modems, which can lead to erratic behavior such as droped/failed connections. If a 3G USB modem is to be used, consider other routers with a USB port that delivers enough Amperes. (e.g. Buffalo WZR-HP-AG300H)

Compatible USB 3G modems
  • e.g. Huawei E1550
Note for TL-WR1043ND v2:

I got a stable 3g connection on my router! I don't see any erratic behavior! I tested the router with the following 3g modems:

  • TCT Mobile One Touch X500D
  • TCT Mobile X220L
  • ZTE MF632


  1. obtain.firmware and Latest OpenWrt Release - required image file is "openwrt-ar71xx-generic-tl-wr1043nd-v1-squashfs-factory.bin" for v1.x routers, "openwrt-ar71xx-generic-tl-wr1043nd-v2-squashfs-factory.bin" for v2.x routers. Files can be found in the "ar71xx" directory. You can use the quick links from the table below.
  2. generic.flashing Now write this firmware-file onto the flash-chip of your device

:!: NOTE: If case you have a revision > v1.10, you need to flash an elder OEM firmware release first, and only then flash OpenWrt; tested and works credits go to sayboon for his tutorial

The trunk, code named Barrier Breaker, contains bleeding edge source code for OpenWrt.

The development branch contains everything from documentation to experimental patches! Bleeding edge OpenWrt supports additional hardware; however, it's considered unstable, and sometimes won't compile.
  • Download Factory image if you want to install OpenWrt on router with OEM firmware.
  • Download Update image if you already have OpenWrt installed.

Downloads for TL-WR1043ND v1.x

Downloads for TL-WR1043ND v2.x

Flash Layout

Please read the article Flash Layout for a better understanding. It contains a couple of explanations. Then let's have a quick view at flash layout of this particular device:

TP-Link WR1043ND Flash Layout stock firmware
Layer0 m25p80 spi0.0: m25p64 8192KiB
Layer1 mtd0 u-boot 128KiB mtd1 firmware 8000KiB mtd3 art 64KiB
mountpoint none / none
filesystem none SquashFS none
TP-Link WR1043ND Flash Layout
Layer0 m25p80 spi0.0: m25p64 8192KiB
Layer1 mtd0 u-boot 128KiB mtd5 firmware 8000KiB mtd4 art 64KiB
Layer2 mtd1 kernel 1280KiB mtd2 rootfs 6720KiB
mountpoint /
filesystem overlayfs
Layer3 1536KiB mtd3 rootfs_data 5184KiB
mountpoint none none /rom /overlay none
filesystem none none SquashFS JFFS2 none

ART = Atheros Radio Test - it contains mac addresses and calibration data for the wifi (EEPROM). If it is missing or corrupt, ath9k won't come up anymore.

OEM mass flashing

Flashing hundreds of devices using the web interface can be a real pain. You can use this shell script to automate it:

# Pass the firmware image file to be flashed as the first and only
# command line argument.
# The second curl call will time out, but it is expected. Once the
# script exits, you can unplug the ethernet cable and proceed to the
# next router, but do KEEP each router ON POWER until the new image is
# fully written! When flashing is done the router reboots
# automatically (as shown by all the leds flashing once).
curl \
  --user admin:admin \
  --user-agent 'Mozilla/5.0 (X11; Ubuntu; Linux i686; rv:12.0) Gecko/20100101 Firefox/12.0' \
  --referer '' \
  --form "Filename=@$1" -F 'Upgrade=Upgrade' \ > /dev/null
sleep 1
curl \
  --max-time 2 \
  --user admin:admin \
  --user-agent 'Mozilla/5.0 (X11; Ubuntu; Linux i686; rv:12.0) Gecko/20100101 Firefox/12.0' \
  --referer '' \ >  /dev/null

OEM installation using the TFTP and RS232 method

If you want to upgrade using TFTP you follow these steps (as an alternative to the above install process).

Quick howto recover from bad flash. (full log)


  • terminal program (e.g. minicom) set to 115200 8N1, no flow control
  • file named code.bin containing openwrt firmware.
  • tftpd server with an address (configurable with setenv command, printenv first if unsure)

The simplest tftpd server to use is dnsmasq. Install and run with dnsmasq –enable-tftp –tftp-root=/code.bindirectory


After you see Autobooting in 1 seconds type tpl and hit enter to get into command prompt.

tftpboot 0x81000000 code.bin
erase 0xbf020000 +7c0000 # 7c0000: size of the firmware (be aware that you may have a different size thus bricking your router)
cp.b 0x81000000 0xbf020000 0x7c0000
bootm 0xbf020000

For version 2.1 you must use the following

tftp 0x80060000 openwrt-ar71xx-generic-tl-wr1043nd-v2-squashfs-factory.bin
erase 0x9f020000 +0x7c0000
cp.b 0x80060000 0x9f020000 0x7c0000
boot.m 0x9f020000

OEM installation using the Kermit and RS232 method

If you do not want to bother with running a tftpd server on your computer, especially considering the security concerns, you can also use a Kermit client to transfer the new image. It may take forever and a half (15-20min) to copy, but it's easier and more secure than running a tftpd server. These instructions assume you're using a Linux system, but they will give you all you need to do the same on a Windows box.


  • terminal program (e.g. minicom) set to 115200 8N1, no flow control
  • file named code.bin containing openwrt firmware.
  • Kermit client (these instructions will involve using C-Kermit under Linux)

In your terminal program you type:

erase 0xbf020000 +7c0000 # 7c0000: size of the firmware (be aware that you may have a different size thus bricking your router)
loadb 0x81000000

Hint: After you see Autobooting in 1 seconds type tpl and hit enter to get into command promt.

Fire up C-Kermit and run the following commands (or configure your Kermit client to these parameters):

set line /dev/ttyUSB0 # Just make sure you got the right USB interface
set speed 115200
set carrier-watch off
set handshake none
set flow-control none
set file type bin
set file name lit
set rec pack 1000
set send pack 1000
set window 5
send code.bin # Make sure you include a proper path to the file. That's why I just kept it in /home/$user

After the 15-20min file transfer, the new firmware should be on your router and you can continue in terminal:

cp.b 0x81000000 0xbf020000 0x7c0000
bootm 0xbf020000

Upgrading OpenWrt


:!: WARNING: Recent versions of trunk are reported to brick the 1043ND and other devices:

Unless you know what you're doing, use the latest stable version.

Back to original firmware


This section describes actions that might damage your device or firmware. Proceed with care!

With the WR1043ND router, there is a catch: the stock firmware is obtained from the OEM:

  • in case the file name of this firmware file does not contain the word "boot" in it, you can simply revert back to original firmware
  • in case the file name of this firmware file does contain the word "boot" in it, you need to cut off parts of the image file before flashing it:

The following method applies both for the V1 and V2 since the bootloader is the same size.

An example of an image file with the word "boot" in it is wr1043nv1_en_3_9_17_up_boot(091118).bin.

Cut the first 0x20200 (that is 131,584 = 257*512) Bytes from original firmware:

dd if=orig.bin of=tplink.bin skip=257 bs=512

You should transfer the firmeware image to the /tmp folder and revert back to original firmware (if availlable you can flash the firmware via the webinterface as well):

Via the safer method using sysupgrade:

sysupgrade /tmp/tplink.bin

Or alternatively use the mtd method:

mtd -r write tplink.bin firmware

This has been confirmed by supertom64 (for the V1) and by akirkby (for the V2, flashing using the webinterface)

OEM TP-Link firmware for the TL-WR1043nd with the boot part removed to revert to the original OEM firmware:

Basic configuration

After flashing, proceed with Basic configuration.
Set up your Internet connection, configure wireless, configure USB port, etc.

OEM firmware features

In case you want to have the same features with OpenWrt as the OEM firmware, look this up: TP-Link OEM firmware features

Specific configuration


The OpenWrt default configuration of the network interfaces is as follows:

Interface Name Description Default configuration
br-lan LAN & WiFi
eth0 LAN ports (1 to 4) + WAN none
wlan0 WiFi disabled

Switch Ports (for VLANs)

Gigabit Media Independent Interface is the internal connection to the router itself.

Port Switch port on v1.x Switch port on v2.x
Internet (WAN) 0 5
LAN 1 1 4
LAN 2 2 3
LAN 3 3 2
LAN 4 4 1
GMII 5 (marked as CPU) 0 (marked as CPU) Switch0 CPU Port
- 6 Switch0 CPU Port

FIXME There is a port 6 on v2.x I haven't found it's purpose yet!

Theory (may be wrong):
The v2.x get's the lan and wan interface not via eth0.1/eth0.2 but via eth0 (wan) and eth1 (lan). The eth0 in the same vlan as port 5 on the switch. Because of that, I think that port 6 on the v2.x routers may be an aditional CPU port - used for wan traffic only.

Wan has VLAN 2, that shouldn't be touch,as you lose the WAN port. Start you VLANs from 3 , attaching them to the eth1.x sub-interfaces.

Some issues with 10.03.1-rc4 on Hardware Ver.1.8 see this post for workaround.

There is a problem with VLAN-IDs > 9 (at least on v1.4 with 10.03.1-RC6 r28680 and v1.8 with 12.09-rc1 r34185). Using a VLAN-ID > 9 makes the router inaccessible on this interface.

Port Mirroring

Port mirroring is supported since r36847


config switch
        option name 'switch0'
        option reset '1'
        option enable_vlan '1'
        option enable_mirror_rx '1'
        option enable_mirror_tx '1'
        option enable_monitor_isolation '1'
        option enable_mirror_pause_frames '1'
        option mirror_monitor_port '4'
        option mirror_source_port '3'
config switch_vlan
        option device 'switch0'
        option vlan '1'
        option ports '1 5t'
config switch_vlan
        option device 'switch0'
        option vlan '5'
        option ports '2 3'

The port numbers are shown here:


Use the WAN-Port as a LAN-Port

remove to following lines, to remove the wan specific configuration (vlan and interface)

V1.x /etc/config/network

config interface 'wan'
	option ifname 'eth0.2'
	option proto 'dhcp'
config switch_vlan
	option device 'switch0'
	option vlan '2'
	option ports '0 5t'

and add the port 0 to the existing Vlan

config switch_vlan
	option device 'switch0'
	option vlan '1'
# add port 0 to the line below
	option ports '0 1 2 3 4 5t'

V2.x /etc/config/network

config interface 'wan'
	option ifname 'eth0'
	option proto 'dhcp'
config switch_vlan
	option device 'switch0'
	option vlan '2'
	option ports '5 6'

and add the port 5 to the existing Vlan

config switch_vlan
	option device 'switch0'
	option vlan '1'
# add port 5 to the line below
	option ports '0 1 2 3 4'

Add VLAN and Second Wan on v.2.x


Each Port is a VLAN

Physical Port 1 is the WAN2

Adapt to your needs

config interface 'loopback'
        option ifname 'lo'
        option proto 'static'
        option ipaddr ''
        option netmask ''

config globals 'globals'
        option ula_prefix 'fd30:0c4a:0bba::/48'

config interface 'lan1'
        option ifname 'eth1.1'
        option type 'bridge'
        option proto 'static'
        option ipaddr ''
        option netmask ''

config interface 'lan2'
        option ifname 'eth1.3'
        option proto 'static'
        option ipaddr ''
        option netmask ''
        option type 'bridge'

config interface 'lan3'
        option ifname 'eth1.4'
        option proto 'static'
        option ipaddr ''
        option netmask ''
        option type 'bridge'

config interface 'lan4'
        option ifname 'eth1.5'
        option proto 'static'
        option ipaddr ''
        option netmask ''
        option type 'bridge'

config interface 'wan'
        option ifname 'eth0'
        option proto 'static'
        option ipaddr ''
        option netmask ''

config interface 'wan6'
        option ifname '@wan'
        option proto 'dhcpv6'

config switch
        option name 'switch0'
        option reset '1'
        option enable_vlan '1'

config switch_vlan
        option device 'switch0'
        option vlan '1'
        option ports '0t 1'
        option vid '1'

config switch_vlan
        option device 'switch0'
        option vlan '3'
        option ports '0t 4'
        option vid '3'

config switch_vlan
        option device 'switch0'
        option vlan '4'
        option ports '0t 3'
        option vid '4'

#This should stay untouched
config switch_vlan
        option device 'switch0'
        option vlan '2'
        option ports '5 6'
        option vid '2'

config switch_vlan
        option device 'switch0'
        option vlan '5'
        option ports '0t 2'
        option vid '5'

Failsafe mode

See OpenWrt Failsafe Mode for general information.

  • Power up your router. When the 'SYS' LED starts to blink, press the QSS push button repeatedly until the blinking of 'SYS' LED gets faster. Done = You made OpenWrt boot into OpenWrt failsafe mode. Proceed with In OpenWrt Failsafe Mode

Recovery via serial console

You will see something like this:

No valid address in Flash. Using fixed address
: cfg1 0xf cfg2 0x7114
eth0 up
Autobooting in 1 seconds


during this 1 second period. Then continue with OEM installation using the TFTP and RS232 method

WiFi: Using other country regulations

Per default the WLan-"Country Code" is set to US. That means users of OpenWRT worldwide are limited to Channel 1-11.

To unlock the specific channels of your country, it is possible to compile OpenWRT with "ATH_USER_REGD" set (recommended), or by patching the kernel modules (see:

WARNING: Do this only if you know what you're doing! Using the wrong frequencies can result in interfering with other radio services.



TP-Link naming scheme is, that numbers behind the comma, refer to changes in the firmware only, the hardware is identical.

Type HW ver. 1.x HW ver. 2.x
Instruction set: MIPS32
Vendor: Qualcomm Atheros
Bootloader: U-Boot 1.1.4
System-On-Chip: AR9132 rev 2 QCA9558
CPU/Frq 24Kc V7.4 400 MHz 74Kc V5.0 720 MHz
Target name ar71xx
Flash-Chip: ST 25P64V6P Winbond 25Q64FV
Flash size: 8192 KiB
RAM: 32 MiB 64 MiB
Wireless: Atheros AR9103 2.4 GHz 802.11bgn QCA9558 2.4 GHz 802.11bgn
Wireless Power: Maximal power output is 24 dBm (251 mW)
802.11n: 3 x 3 : 2 3 x 3 : 3
Switch: RealTek RTL8366RB Atheros AR8327N-BL1A
swconfig: yes, rtl8366rb yes, ar8216
USB: Yes 1 x 2.0 (OHCI platform; device name 1-1)
Power: 12V DC 1.5A
Serial: Yes
JTAG: Yes No?


This router gets around 180 Megabits/s WAN to LAN throughput, tested using nuttcp.


Power Consumption

With a cheap Wattmeter i measured 6.9 W idle and 9 W under load.

PSU (power supply)

My TL-WR1043ND DE (v1.0) came bundled with the following PSU:



TL-WR1043ND DE (v1.0) TL-WR1043ND v2.1
Brand/Model Leader Electronics Inc / LEI F7 TP-LINK Tech. co., ltd.
Input 100-240V~ (50/60Hz, 0.6A)
Output 12V 1.5A
Measured output 12.25V 12.40V (w/o load)
The plug (on the router side) has the following specifications:
Outer diameter 5.5mm
Inner diameter 2.1mm
Length of the shaft 9.5mm

I successfully used the ATX PSU (from my computer) to power the router. All I did was buying a plug with above specifications and soldered a Molex-plug to the other end.

Powering with different Voltages

:!: WARNING: For sure you will lose your warranty if you run the router with too high voltage and I don't guarantee it will work for you. Your router might break, so only run it with too high voltage if you know what you are doing and you don't care if the router breaks.

Because I wanted to run the router directly from solar and the 12V battery can have between 10.4V and 14.8V I tested the router with different voltages and it runs fine with voltages between 10V and 15V. Could not see any failures or loss in performance.

Power consumption on DC-Side

I have measured simultaneously voltage and current on the DC-side of the router with 2 analogue multimeters.

It looks like my AC-DC adapter is stabilized and delivers exactly 12 Volts.

  1. Without LAN Connected, without any USB device, OpenWrt Running with WLAN 10dBm (b/g AP mode) : 250mA
  2. With 1x100MBit LAN, 1xHuawei E1750 in idle (not connected) : 320 mA
  3. With HSDPA Connection active : 400mA

The HSDPA modem seems to draw a lot of power as soon as any data is transferred. In total i guess approx. 500mA. (Was NOT possible to measure exactly because my amperemeter is very slow…)


Photos of v1.X PCB:

PCB Board TP-Link TL-WR1043ND v1.6 PCB Board TP-Link TL-WR1043ND v1.4

Photos of v2.X PCB:

PCB TP-Link TL-WR1043ND v2.1 PCB TP-Link TL-WR1043ND v2.1

More photos of the v2 version: TP-Link TL-WR1043ND v2

Opening/closing the case

Note: This will void your warranty!

The case of the WR1043N v1.x is composed of 4 pieces:

  • Top cover (white, with logo)
  • Bottom cover (white, with sticker)
  • Front (transparent, black)
  • Outer frame (black, vents on the sides)

There are only two screws at the back of the device, under the rubber feet. The rest of the case is kept together by two latches at the front of the device, and a system of guides and hooks in the front.

  1. Remove the antennas.
  2. Remove the rubber feet in the back and undo the screws.
  3. Unscrew all three retaining nuts on the antenna connectors and carefully push them into the housing. If you find this hard to do, leave them in place: you'll have to pay attention and avoid pulling the outer frame, as there are wires running from the back of the device all the way to the front of the board.
  4. Push one of the bottom screws back into place to lift the top cover, and keep it that way using a finger.
  5. With the top slightly open, push the bottom cover away. Use a screwdriver if you can't reach it with your fingers.
  6. If you have unscrewed the antenna connectors, now you can remove outer frame. Otherwise just carefully slide it out of the way: this will expose the clips that keep the top and bottom covers together.
  7. With a flathead screwdriver or similar tool, gently pry the two front clips apart. Each clip has two latches and is located near the corners, next to the black front. Put your screwdriver behind the latches and push it towards the ethernet ports.
  8. Now the top cover can slide out the vertical guides on the black front.
  9. The black front also has three plastic hooks that go into matching holes in the bottom cover. To remove it, pull the front away and then push it down.

Pictures can be found here

The case of the WR1043N v2.x is composed of 2 pieces:

  • Top cover (black (bluish))
  • Bottom cover (gray)

1. Remove the four screws on the bottom cover. 2. Use a thin object to release the top cover from the bottom cover

Putting it back together


  1. Place the board on the bottom cover, so that the two plastic pins at the front keep it in place.
  2. If you undid the antenna connectors, put them back in and tighten the nuts.
  3. Place the outer frame behind the board and make sure it sits flush to the connectors.
  4. Insert the hooks of the front into the holes in the bottom cover, don't push it in yet.
  5. Make the top cover slide into the vertical guides on the front. Don't push it down yet.
  6. Push the front towards the back so the hooks are engaged, then push down the top cover.
  7. Fasten the screws and re-apply the rubber feet.


  1. Put the top cover back on
  2. Press until it clicks back nicely to the bottom cover.
  3. Put back the screws


port.serial general information about the serial port, serial port cable, etc. How to connect to Serial Port:

Solder a header as shown in the picture or wires with a connector directly. The device uses TTL @ 3.3V and not a standard RS-232 Serial that operates between 3 and 15V, so do not try to connect it to a common serial adapter: you will certainly fry the serial circuit or even the whole board. There are plenty of USB to TTL and RS-232 to TTL available on the market, just be careful with the voltage: the standard is 5V and it may also damage your board. Look for the ones with 3.3V or with both voltages and a way to switch between them.

Don’t forget that the TX pin of the serial port must linked to the RX pin of the router and the RX to TX!

Bits per second: 115200
Data bits: 8
Parity: None
Stop bits: 1
Flow control: None

Serial Pinouts

If you use the serial connection more often or want to have a permanent modification you can build a stereo audio jack at the back of the router and use the FTDI serial cable TTL-232R-3V3-AJ. As jumper wire you can recycle an old floppy drive power cable.

Receive (RX) Disabled

Some revisions of v1.x require a jumper between the RX serial pin and the resistor R362 to enable serial writes. See this post for details:

If you find that the serial console will not accept write commands, check with a multimeter that you have continuity between RX and R362.

If you don't have continuity you will need to jumper them, here is my working example:

I went to the right hand side of the resistor for ease of soldiering, but there may be better solutions.

I also noticed that the small hole just below R362 has continuity to the RX pin so that may provide a cleaner solution with a much smaller jumper.


port.JTAG general information about the JTAG port, JTAG cable, etc.

JTAG Line:


Download EJTAG Debrick Utility 3.0.1


Backup whole flash:

tjtag3.exe -backup:custom /fc:25 /window:bf000000 /start:bf000000 /length:00800000

Backup UBoot:

tjtag3.exe -backup:custom /fc:25 /window:bf000000 /start:bf000000 /length:00020000

Backup Firmware:

tjtag3.exe -backup:custom /fc:25 /window:bf000000 /start:bf020000 /length:00800000


At the moment it is NOT possible to UNBRICK the router by JTAG (no write access to flashrom).

so be very careful not to overwrite the u-boot.


port.GPIO The AR913x platform provides 22 GPIOs. Some of them are used by the router for status LEDs, buttons and to communicate with the RTL8366RB. The table below shows the results of some investigation:

Voltage level at GPIO in output-mode gpioX/value in input-mode when GPIO is:
GPIO Common Name PCB Name gpioX/value=1 gpioX/value=0 Floating Pulled to GND Pulled to Vcc
0 →R713 3.3V 0V 1 0 1
1 USB D18=D9 0V 3.3V 1 1 1
2 SYS D19=D8 0V 3.3V 1 1 1
3 RESET SW6 3.3V 0V 1 0 1
5 QSS D31=D10 3.3V 0V 0 0 1
7 QSS-Button SW8=SW9 3.3V 0V 1 0 1
8 Setting data direction to output and value to 0 causes hard reset of the SoC
9 WLAN D11=D7 0V 3.3V 1 1 1
10 P1-Tx overriden by tty-kernel module 1 0 1
13 P1-Rx 3.3V 0V 0 0 1
15 USB PSU EN? →R711 3.3V 0V 1 0 1
16 USB PSU CHK? →R708 3.3V 0V 1 0 1
18 Data line of the RTL8366RB
19 Clock line of the RTL8366RB
20 GPIO20 3.3V 0V 1 0 1

To make the GPIOs available via sysfs, the required ones have to be exported to userspace, as it is explained on a page of the Squidge-Project. Kernel modules occupying that resource need to be removed before (e.g. "leds-gpio" and "gpio-buttons"). In output-mode, voltage levels of the GPIOs were measured against GND, after the value 1 or 0 had been written to /sys/class/gpio/gpioX/value. In input-mode, the value of the file /sys/class/gpio/gpioX/value was read when the GPIO was floating (initial state), pulled to GND or pulled to Vcc.


How to configure LEDs in general, see the LED section in the system.

The WR1043ND has 10 LEDs:

LED name LED print Internal name Trigger
Power PWR tl-wr1043nd:green:power N/A
System SYS tl-wr1043nd:green:system heartbeat
Wireless LAN WLAN tl-wr1043nd:green:wlan netdev:wlan0
LAN Port 4 4 unknown N/A
LAN Port 3 3 unknown N/A
LAN Port 2 2 unknown N/A
LAN Port 1 1 unknown N/A
Wide Area Network WAN tl-wr1043nd:green:wan N/A
Universal Serial Bus USB tl-wr1043nd:green:usb ledtrig-usbdev
Quick Security Setup QSS tl-wr1043nd:green:qss User preference

ledtrig-usbdev is only available in attitude adjustment (Trunk) and in self-built Backfire images using this set of patches.


hardware.buttons. For custom action on pressing button the easy way with 00-button script works nicely.

The TP-Link TL-WR1043ND has two buttons:

BUTTON Event Backfire ID Attitude Adjustment ID
Reset reset BTN_0 reset
Quick Security Setup QSS BTN_1 wps

The QSS button is located at the front and can be easily pressed with a finger. The Reset button is located at the back and cannot be pressed with a finger, you need a small item (pen typically) to push it in.

:!: Note: you don't need to configure or activate buttons to get the Failsafe mode working, it will work by default.

:!: Note2: From versions 1.8 up to 2.x holding the reset button for more than 30' resets to OpenWRT initial settings.

:!: Note3: If you use current trunk version of OpenwRT then the reset button is controlled through /etc/rc.button/reset file. If you hold the button for longer than 5 seconds, then OpenWRT resets to initial settings. You can change the behaviour in this file: /etc/rc.button/reset



NOTE: If you accidentally bricked your router by overwriting the bootloader, try the following:

  1. Desolder the Spansion SPI-Flash (here is the datasheet) from the board. I used tin foil to "mask" out everything else which I did not want to desolder and used a heat gun. It worked quite nice.
  2. Find a way to connect the SPI flash to something with SPI interface…. I used a AVR microcontroller. Here you can download a pdf containing the layout for the adapter board I made to solder the Spansion SPI flash chip on, in order to connect it to the AVR. Attention, the PDF is mirrored and it is intended to manufacturing boards with the direct toner method.
  3. Write the bootloader into the flash. I got my bootloader out of another wr1043nd.
  4. Solder the chip back into the router.
  5. The router shall now be unbricked.

Bootloader Mods

  1. you could read about bootloader in general and about Das U-Boot/Configuration of U-Boot in particular.
  2. the uboot version you find on the 1043 is a fork of mainline U-Boot version 1.1.4 from 2005-12-17 see here. You can / you cannot FIXME take a current mainline version of uboot and simply cross-compile it for WR1043ND! TP-Link-Version: It contains the file u-boot-ap83.tar.bz2 which is about 6,06 MiB in size, deflate this as well. The deflated source code will occupy about 37MiB of space, start with reading the README.
  3. also see and compare the versions.
  4. you may be able to cross compile the code with the OpenWrt toolchain Buildroot. See build for guidance. But you may need to use other toolchain to crosscompile, like the ELDK (Embedded Linux Development Kit).
  5. :!: Problem: you cannot test your bootloader, because for some obscure reason, you don't have write access to the flash via JTAG.

Making bootloader partition writable

Look at target/linux/ar71xx/files/arch/mips/ar71xx/mach-tl-wr1043nd.c (in trunk it's target/linux/ar71xx/files/drivers/mtd/tplinkpart.c)

static struct mtd_partition tl_wr1043nd_partitions[] = {
    .name   = "u-boot",
    .offset   = 0,
    .size   = 0x020000,
    .mask_flags = MTD_WRITEABLE,
  } , {
    .name   = "kernel",
    .offset   = 0x020000,
    .size   = 0x140000,
  } , {
    .name   = "rootfs",
    .offset   = 0x160000,
    .size   = 0x690000,
  } , {
    .name   = "art",
    .offset   = 0x7f0000,
    .size   = 0x010000,
    .mask_flags = MTD_WRITEABLE,
  } , {
    .name   = "firmware",
    .offset   = 0x020000,
    .size   = 0x7d0000,
Remove the line
.mask_flags = MTD_WRITEABLE,
for the partition named "u-boot" to make it writeable.

Change MAC Address

  • Get the uboot image via the following command
    cp /dev/mtd0ro /tmp/
  • Verify is a 1 to 1 copy (expect no output)
    cmp -l /dev/mtd0ro /tmp/
  • Backup your original uboot
    tar -czf /tmp/uboot.tar.gz -C /tmp
    ln -s /tmp/uboot.tar.gz /www/uboot.tar.gz
    and download via
  • At the offset 0x1FC00 you will usually find your mac address.
    hexdump -n 6 -s 130048 -e '"%06.6_ax " 5/1 "%02X:" 1/1 "%02X""\n"' /tmp/
  • You can change it with an hex editor. I use dhex. Or use the following command
    echo $newmac | awk -v FS="[: -]" '{for (i=1; i<=NF; i++) printf "%c", ("0x" $i)+0 }' | dd conv=notrunc bs=1 count=6 seek=130048 of=/tmp/
    mv /tmp/ /tmp/uboot.mod
  • Double check your newly created, or spoof MAC Address:
    hexdump -C -n 16 -s 130048 /tmp/uboot.mod
    cmp -l /dev/mtd0ro /tmp/uboot.mod
  • After changing the MAC and making the u-boot mtd flash portion writeable, you can write the modified uboot image back to flash:
    mtd write /tmp/uboot.mod u-boot
    where "uboot.mod" is the filename of your modified uboot image.
  • If the above command fails, you missing the custom firmware step, don't go any further.
  • After reboot a new radio1 will be created with default interface. To keep current settings and prevent radio1 creation
    uci set wireless.radio0.macaddr=$newmac
    uci commit wireless
    reboot & exit
  • To get rid of wild radio1 after reboot, instead of the above prevention, get the cure:
    uci set wireless.radio0.macaddr=$(uci get wireless.radio1.macaddr)
    uci delete wireless.@wifi-iface[-1]
    uci delete wireless.radio1
    uci commit wireless
  • Your old MAC Address could be recovered from the sticker in the back of your router. Write it down securely, if in a hard to access location.

Hardware Mods

  1. as a beginner, you really should inform yourself about soldering in general and then even obtain some experience!

64MB RAM Mod

The Device uses a DDR1 16Mbit x 16bit (16Mibit*16=256 mebibit. 256 mebibit/8=32MiByte) 400MHz chip. Replace it with any 32Mbit x 16bit chip. 333MHz instead of 400MHz also works fine. It's quite hard to find these chips. The best chance is to have a look at DDR-SODIMM. Since there are no 64Mbit x 16Bit DDR1 Chips available → no 128 MB mod!

Working chips:

  • Hynix HY5DU121622DTP-D43 (From Mustang DDR-SODIMM 512 MB)
  • Hynix HY5DU121622CTP-J (PC333 DDR RAM)
  • Infineon HYB25D512160BE (From Infineon DDR-SODIMM 512 MB)

Additional list that may work:

Type ID Code Vendor
DDR 32Mx16 PC400 TSOP Pb Free HY5DU121622DTP-D43-C Hynix
DDR 32Mx16 PC400 TSOP Pb Free H5DU5162ETR-E3C Hynix
DDR 32Mx16 PC400 Pb Free K4H511638G-LCCC Samsung
DDR 32Mx16 PC400 Pb Free K4H511638J-LCCC Samsung
DDR 32Mx16 PC400 A3S12D40ETP-G5 Zentel
DDR 32Mx16 PC400 NT5DS32M16BS-5T Nanya
DDR 32Mx16 PC400 PB Free P3S12D40ETP-GUTT Mira
DDR 32Mx16 PC333 CL2.5 TSOP MT46V32M16TG-6T:F Micron
DDR 32Mx16 PC333 CL2.5 TSOP MT46V32M16P-6T:F Micron
DDR 32Mx16 PC333 PB Free TSOP EDD5116ADTA-6B-E Elpida
DDR 32Mx16 PC333 PB Free TSOP HYB25D512160CE-6 Qimonda
DDR 32Mx16 PC333 PB Free TSOP HYB25D512160CEL-6 Qimonda
DDR 32Mx16 PC333 PB Free TSOP HYB25D512160DE-6 Qimonda

root@OpenWrt:~# free
total used free shared buffers
Mem: 62104 17472 44632 0 1392
Total: 62104 17472 44632

This chip from Digikey should work too, if you aren't able to obtain a DDR-module: Alliance Memory, Inc. AS4C32M16D1-5TCN


An I²C-bus can easily be added using the GPIO-lines of the AR913x-SoC. So far, the only usable ones which have been confirmed to work are GPIO 0 (the unpopulated R713 located in the bottom right corner of the SoC, using the pad facing R714), GPIO 5 (the QSS-LED, easily soldered at D10,left pin with '+') and GPIO 20 (labeled on the pcb, next to the RAM chip, easily soldered from the bottom side). Using GPIO 0 and 20 may be the best choice, as they are not used, so there are no issues about removing the LED driver(bindings) or pcb components. If GPIO 5 has to be used, it should be used for SDA (it has less level changes than SCL). There are only two pull-up resistors of 4,7k-10k needed, which have to be soldered between the appropriate GPIO line and Vcc (found at the spot labeled TP3V3, about 2 cm above the WiFi-shielding). The common ground can be obtained from the TP_GND spot (between P1 and the flash chip). Remember this bus runs at 3.3V level, when connecting I²C-devices.
To improve signal integrity (in this case namely a solid logic low level on GPIO 5), you can replace R373 with a piece of wire and remove the LED D31. R373 seems to be the current limit resistor for the LED D31.

Make sure to install package kmod-i2c-gpio-custom. To load the kernel module (with SCL=GPIO 0 and SDA=GPIO 20), do a:

insmod i2c-gpio-custom bus0=0,20,0
If your I2C-bus runs successfully, you can enable it on boot by creating a file in /etc/modules.d called "55-i2c-gpio-custom" with the options appropriate to your bus configuration. For example:
i2c-gpio-custom bus0=0,20,0

A more convenient way to add an I2C-bus to this router, without a modification of the internal hardware (and risking your warranty), is using the I²C Tiny-USB adapter. The downsides are, that it is not as cheap as the I²C-GPIO mod, and the longterm-stability is lower (temporary USB disconnects can occur randomly or due to EMI, but the I2C-subsystem is not designed for sudden disconnects). Remember this bus runs at 5V level, when connecting I²C-devices.

Flash Mod

You can install 16 MB flash Winbound 25Q128

Custom OpenWrt image with LuCi integrated

Other models with the same hardware


1) U-Boot 1.1.4 if not stated otherwise.
2) grep U-Boot /dev/mtd0ro
3) The earliest OpenWRT release to be supported. Subsequent releases should be supported unless otherwise stated.

Back to top

toh/tp-link/tl-wr1043nd.txt · Last modified: 2014/07/31 11:18 by aind