Dual Band (concurrent) and Gigabit Ethernet. Advertised as 900 Mbps it has simultaneous Triple-Stream (3x3) radios on both 2.4GHz and 5 GHz Bands.

There are two very different revisions

• V1.x: target: mpcC85xx 800Mhz Freescale PPC P1014 CPU 3 internal antennas (2.4Ghz) and 3 external antennas (5Ghz), available world-wide
• V2.x: target: ar71xx 720Mhz Qualcomm/Atheros SoC and 6 external antennas, available in PRC only

Manufacturer's website:

• http://www.tp-link.com/en/products/details/?model=TL-WDR4900 (V1.x)
• http://www.tp-link.com.cn/product_double_292.html (V2.x)

• Price: AliExpress - about 100 USD

• Forum https://forum.openwrt.org/viewtopic.php?id=42062

As of May 2014, TP-Link appear to be discontinuing the TL-WDR4900 in Great Britain.

Serial console is available on the JP2 (v1.x) or J1 (v2.0) connector - see PCB photos above.

DO NOT CONNECT VCC. Use only TX/RX/GND.

Baud Rate: 115200
Data Bits: 8
Parity: No
Stop Bits: 1

Factory firmware login credentials: (v1.x only)
* username: root
* password: 5up

Note: be extremely careful when soldering a serial console on TP-Link TL-WDR4900 - the design of the PCB is not well suited for soldering and important paths/connections are near the soldering points. We have now 3 Routers which are dead, just because we used too much solder…

An OpenWRT factory image may be installed via the OEM firmware on both versions. See the generic installation guide for further information. Download the latest stable release of the following firmware images:

• TL-WDR4900 v1.x: mpc85xx/generic/openwrt-mpc85xx-generic-tl-wdr4900-v1-squashfs-factory.bin

• TL-WDR4900 v2.x: ar71xx/generic/openwrt-ar71xx-generic-tl-wdr4900-v2-squashfs-factory.bin

If you do not speak Chinese and are not familiar with the standard TP-Link firmware, please see the screen shots below for help.

After installation you will want to proceed with first login, basic configuration. You may also wish to install the web user interface LuCI, after which you can manage your router at http://192.168.1.1

• a serial connection (e.g. TTL, RS232) from your machine to the router.
• a terminal program (e.g. minicom, screen) set for 115200 Baud, 8 data bits, no parity, 1 stop bit, no flow control.
  • It is strongly recommended not to connect the 3.3V (or any) voltage line - use the router's own power supply instead.
• a factory OpenWrt firmware image into your TFTP server folder (see Installation above)
• a wired ethernet connection from your computer to one of the router's LAN ports.
  • IP address on this connection should be statically set to 192.168.1.x/24.
• a TFTP server started on your local machine
  • must be listening on the same link/IP address as the wired ethernet connection to the router
  • v1.x models prefer the server address 192.168.0.66, v2.0 prefers 192.168.1.100

This section applies to v1.x only! (version 2.0 method)

1. Router should be unplugged (power off), your serial line connected, terminal open and TFTP server installed not yet running.
2. Copy your desired openwrt image for the TPlink-WDR4900 into your TFTP server folder and rename it into openwrt.bin (to save some typing within the flash procedure).
3. First goal is to get the command prompt from the U-Boot bootloader on your router.
4. Plug in your router and be ready to type "vl" just after you see the line Autobooting in 1 seconds (Spamming "vl" around this point helps):

U-Boot 2010.12-svn15934 (Dec 11 2012 - 16:23:49)

CPU:   P1014, Version: 1.0, (0x80f10110)
Core:  E500, Version: 5.1, (0x80212151)
Clock Configuration:
       CPU0:800  MHz, 
       CCB:400  MHz,
       DDR:333.333 MHz (666.667 MT/s data rate) (Asynchronous), IFC:100  MHz
L1:    D-cache 32 kB enabled
       I-cache 32 kB enabled
Board: P1014RDB 
SPI:   ready
DRAM:  128 MiB
L2:    256 KB enabled
Using default environment

PCIe1: Root Complex of mini PCIe Slot, x1, regs @ 0xffe0a000
  01:00.0     - 168c:abcd - Network controller
PCIe1: Bus 00 - 01
PCIe2: Root Complex of PCIe Slot, x1, regs @ 0xffe09000
  03:00.0     - 168c:0033 - Network controller
PCIe2: Bus 02 - 03
In:    serial
Out:   serial
Err:   serial
Net:   initialization for Atheros AR8327/AR8328
AR8327/AR8328 v1.1 is found!
eTSEC1
Autobooting in 1 seconds

In case you failed the right timing just reboot again until the prompt appears

=>

1. (optional) Now lets check what kind of parameters the u-boot loader expects (e.g file name of firmware, IP via TFTP & load address).

Type tftpboot & press ENTER …

=> tftpboot
Check for phy link status
Speed: 1000, full duplex
Using eTSEC1 device
TFTP from server 192.168.0.104; our IP address is 192.168.0.136
Filename 'uImage'.
Load address: 0x1000000
Loading: T T T T T T T T T T 
Retry count exceeded; starting again

1. As you can see, uboot expects a firmware image file name "uImage" at TFTP server address 192.168.0.104,

then, just change you local ip into 192.168.0.104 and start your TFTP server.

1. Start the uBoot's TFTP client to download the image from your local machine by typing: tftpboot 0x1000000 openwrt.bin + ENTER

=> tftpboot 0x1000000 openwrt.bin
Check for phy link status
Speed: 1000, full duplex
Using eTSEC1 device
TFTP from server 192.168.0.104; our IP address is 192.168.0.136
Filename 'openwrt.bin'.
Load address: 0x1000000
Loading: #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         ###
done
Bytes transferred = 16252928 (f80000 hex)

1. The last line needs to show a size of f80000 hex, otherwise your image is unsuitable.
2. To select the SPI flash memory type: sf probe 0

=> sf probe 0
SF: Detected S25FL128S_65k with page size 256, total 16 MiB
16384 KiB S25FL128S_64K at 0:0 is now current device

1. Now we need to erase parts of the flash memory to be able to copy your fresh loaded firmware into it,

just type in the prompt sf erase 0x60000 0xf80000:

=> sf erase 0x60000 0xf80000
SPI flash erase successful

1. Now just copy the image to the right place by typing sf write 0x1000000 0x60000 0xf80000

=> sf write 0x1000000 0x60000 0xf80000
SPI flash write successful

1. So, in case your image is the correct one, you should do just a single reboot to have a working TL-WRD4900 back on your desk.

Type reset or just un-plug and re-plug the power of your router and watch the boot process.

=> reset

This section applies to v2.0 only! (version 1.x method)

1. Be sure the router is powered off (there's a handy power switch beside the power line).
2. Connect your serial and ethernet cables to your computer.
3. Open your terminal for the serial connection.
4. Power on the router
5. When you see Autobooting in 1 seconds, quickly type "tpl" to access the command line.
   • there is no harm at all typing "tpl" repeatedly from the moment you power on, I often start when I see the U-Boot bootloader header.
6. Start the TFTP server running on your computer.
7. At the ap135> prompt, type the following commands:
   1. tftpboot 0x81000000 openwrt.bin (where openwrt.bin is the name of your firmware image)
   2. erase 0x9f020000 +0x7c0000
   3. cp.b 0x81000000 0x9f020000 0x7c0000
   4. bootm 0x9f020000
8. Congratulations!

If you want to de-brick/upgrade your router using TFTP without a serial cable follow these steps:

• Copy a working & full OpenWrt sysupgrade image into your TFTP server folder (e.g: https://downloads.openwrt.org/barrier_breaker/14.07/mpc85xx/generic/openwrt-mpc85xx-generic-tl-wdr4900-v1-squashfs-sysupgrade.bin) so it will be found under the path /wdr4900v1_tp_recovery.bin You can also use the image used for reverting to stock firmware if you prefer to do so, but it has to be placed under the same path.
• A TFTP server started on your local machine on LAN address 192.168.0.66/24.
• Connect your LAN-port to one of the routers LAN

1. Router should be unplugged (power off) and TFTP server installed not yet running.
2. Copy your desired openwrt image for the TPlink-WDR4900 into your TFTP server folder and rename it into wdr4900v1_tp_recovery.bin (as the router will search for this file).
3. Make sure your card has address 192.168.0.66.
4. Start the tftp server and make sure it is listening on 192.168.0.66
5. Plug in your router and keep the WPS/Reset button pressed until the tftp server confirms the transfer is done
6. Wait for the router to reboot, the new image will then be loaded
7. A pack ready for doing this, containing TFTPD32 server and the latest TP-Link firmware, can be found here: https://forum.openwrt.org/viewtopic.php?pid=236428#p236428
8. Also there's a video of the process: http://www.youtube.com/watch?v=54PAS0gvW2k

On the v1 units, the only way that I have been able to get the router into failsafe mode is to quickly and repeatedly press the WPS/Reset button starting before the front panel "star" LED started flashing. When that LED finally lit, it appeared to go directly into the rapid-flashing "failsafe" indication. If the WPS LED lights (rightmost, "yin-yang arrows"), it may be that you started clicking the button a little early in the boot sequence.

For what you can do in failsafe, go to the OpenWrt Failsafe Mode page.

Another user writes:

After all else failed, I found http://www.binaryfriend.ru/2012/10/how-to-hard-reset-openwrt-on-tp-link-1043nd. Extremely simple. Please see the original page for more info. Summary:

- Power the router up;
- After powering up track the SYS light when it starts to blink, when it does press and hold the QSS button till SYS lights starts to blink faster – router goes to recovery mode;
- Telnet to the router on 192.168.1.1 – no password needed (if your computer doesn’t gets IP address from DHCP assign it manually for i.e. 192.168.1.200 with netmask of 255.255.255.0);
- In telnet terminal type `mtd -r erase rootfs_data` to reset OpenWRT to it’s defaults.

You can revert to stock firmware by following these steps:

• Download / copy with SCP this firmware to the /tmp folder of the router: https://www.dropbox.com/sh/g8dyafqrato12pc/AADtSjx_MVot7asdqeRtvVVza?dl=0
• Optionally check MD5 hash: 1148EFD09C6D9B07E6A01259A4EBEF72
• Rename to firmware.bin (less chance for spelling errors and unsupported characters)
• Open a SSH session to the router, cd to /tmp
• Execute the following command: mtd -r write firmware.bin firmware
• Wait until the router reboots

Note: You can only flash this firmware version because it has no BOOT in the filename. This image and OpenWRT images are the exact same size. Other images from TP-Link do have BOOT in the filename and these files are also more bytes than this one, then to create your own flashable image, follow the below method:

In order to create your own bootable file download firmware from TP-Link and execute the following command (change the if= filename in case you downloaded a different version):

• dd if=wdr4900nv1_en_3_14_3_up_boot\(130320\).bin of=wdr4900nv1.bin skip=769 bs=512

You can then transfer the resulting file and flash this using the mtd method described elsewhere in this document.

• mtd write wdr4900nv1.bin firmware

Using the same switch port for both tagged and untagged traffic works on this router (used for instance in IP-TV). Previous versions of OpenWRT required a patch for the switch driver (see the related ticket). In 15.05 this is no longer needed; VLAN works out of the box.

Numbers 2-5 are Ethernet Ports 1-4 as labeled on the unit, number 1 is "Internet" (WAN) on the unit, 0 is the internal connection to the router itself.

Numbers 2-5 are Ethernet Ports 1-4 as labeled on the unit, number 1 is "Internet" (WAN) on the unit, 6 is the internal connection to the router itself, and 0 is another CPU, because this router has two.

Screen shot of LuCI running on WDR4900 v2 (Example VLAN tagging for Movistar FTTH Spain).

Hardware port mirroring is supported in v1/(v2?)

Here's an example of configuring port mirroring in /etc/config/network for mirroring port 1 to port 5 (You may need to restart the router for port mirroring changes to take effect):

config switch
	option name 'switch0'
	option reset '1'
	option enable_vlan '1'
	option enable_mirror_rx '1'
	option enable_mirror_tx '1'
	option mirror_source_port '1'
	option mirror_monitor_port '5'

In case you are interested to run a virtual test environment for your PPC based WDR4900 platform QEMU is a good helper. It cannot run the downloadable kernel image but at least a slightly modfied version. Here are the basic steps to get a initial setup up and runnung.

Install QEMU for your Linux distribution. It should be at least 2.1.2. The process was only tested with that version. Create a buildroot environment. If you do not want to read every single bit of information over there use these commands. We assume that we only want to build the stable Barrier Breaker version.

# cd ~
# mkdir buildroot
# cd buildroot
# git clone git://git.openwrt.org/14.07/openwrt.git
# cd openwrt
# ./scripts/feeds update -a
# ./scripts/feeds install -a

Select your target platform

# make menuconfig
Target System -> Freescale MPC85xx [*]

Save changes and leave setup. Create the default configuration for the platform

# make defconfig

Activate some essential buildroot configuration options.

# make menuconfig
Target images -> ramdisk [*]
Kernel modules -> filesystems -> kmod-fs-ext4 [*]

Save changes and leave setup. Now head over to kernel configuration and define critical settings that the kernel can run inside QEMU.

# make kernel_menuconfig
Platform support -> Freescale machine type -> qemu generic platform [*]
device drivers -> character devices -> serial drivers -> serial port on open plaform bus [ ]

If you miss one of the two your VM will not boot or have no accessible console. Have a look the open firmware serial bus must be disabled!. Additionally we should enable drivers to access QEMU disks and network cards

device drivers -> virtio drivers -> activate all menu items [*]
device drivers -> block devices -> Virtio block driver [*]
device drivers -> network device support -> virtio network driver [*]

Create the kernel image with

make -j 8

Finally we have a standalone kernel image with an initial root ramdisk included. So we could already start the VM. To get into better shape create a separate folder to hold the image and create a QCOW2 disk with a single ext4 filesystem that can be mounted inside the VM.

# cd ~
# mkdir vm
# cd vm
# cp ~/buildroot/openwrt/bin/mpc85xx/openwrt-mpc85xx-generic-zImage .
# qemu-img create -f qcow2 hdd.qcow2 4G
# su
# modprobe nbd max_part=8
# qemu-nbd --connect=/dev/nbd0 ./hdd.qcow2
# fdisk /dev/nbd0 (... create partition ...)
# mkfs.ext4 /dev/nbd0p1
# qemu-nbd --disconnect /dev/nbd0
# exit

This is what our VM folder should look like now:

ls -al ~/vm
drwx------. 7 e500 e500      4096 24. Dez 10:02 .
drwxr-xr-x. 6 e500 e500      4096 18. Dez 20:31 ..
-rw-r--r--. 1 e500 e500 136839168 24. Dez 10:03 hdd.qcow2
-rw-r--r--. 1 e500 e500   4360017 24. Dez 09:46 openwrt-mpc85xx-generic-zImage

Now the VM is ready to start.

qemu-system-ppc -kernel ~/vm/openwrt-mpc85xx-generic-zImage \
                -nographic -append "console=ttyS0" -m 1024 -M ppce500 \
                -drive file=~/vm/hdd.qcow2,if=virtio

• OpenWRT Forum Thread "Developing Support for TPLINK WDR4900"
• Hardware Information at wikidevi (v1 International version)
• Hardware Information at wikidevi (v2 PRC-only version)
• TPLINK WDR4900 v1 flash layout, full backup of the stock firmware and restoring