TR Forums

I had a fun experience last night from a router that I've acquired from a customer who upgraded to something new assuming their old one was bricked (which it was). Being the frugal stubborn person that I am, I didn't want to throw the thing away knowing that its a decent enough Business Class router. So here is what I did in case this helps anyone else out with their bricked router... this can potentially work with many router brands.

Router: Linksys (Cisco tagged at the same time) WRV210 VPN Router

Symptoms: DHCP not working, can't connect to web management, wireless not showing up, WiFi light eventually comes on and blinks non-stop.

The Fix: Most routers support TFTP (Trivial File Transfer Protocol) which will allow you to transfer a .bin or .img firmware file to the router to be loaded into the ROM. However you need to do a few things first to make this transfer.

--------------------------------------------------------------------------
1.) A TFTP Client - Windows actually comes with a TFTP built into the command prompt window, BUT it is not activated by default. You will want to go in under Add/Remove programs to "Turn Windows features on or off", scroll down near the bottom and check "TFTP Client". Another option is a GUI client such as tftpd which comes in both a 32 and 64 bit flavor. For the sake of simplicity I'm going to just use what I know everyone can get, the built in Windows TFTP.

2. A valid .bin or .img file from either the manufacturer's website or alternative firmware such as Tomato or DD-WRT (read their instructions first).

3. Computer with a wired network card, wireless will not work for this fix. Depending on your NIC you may also want a wired network switch (I'll explain here shortly).

4. Your computer NIC changed to a manual IP address to match that of your routers default IP schema.

--------------------------------------------------------------------------

So first things first we want to change your network card to a static IP. Since my router's factory IP schema is 192.168.1.1 we want to put the system on that same range where it can communicate with the router.

-=-=Settings=-=-


Connect your computer directly to one of the routers wired ports (Not the Up-link/Internet Port, preferably Port 1) If you have a network switch, connect that instead to the router and your computer to the switch. This can prevent certain NICs from going through the process of connecting and disconnecting to the router during its power cycle and potentially missing its short chance to talk with the router while its able to be reached in a sort of BIOS boot mode. Again, you have a short window of opportunity, the switch may increase your window slightly for some network card models.

Next you will want to open up 2 separate CMD windows, as usual open them as Administrator.

In the first CMD window type the following. You can press enter and watch the continuous ping attempt to contact the router. You can also wait until after we have done a power cycle on the router, it wont hurt to do it either way.


In the second CMD window changed the directory to the folder housing your .bin or .img firmware file.


After changing the directory to the proper path, type the following (DO NOT PRESS ENTER YET)


This command is simply telling the tftp client to "put" your firmware file on the tftp server (ROM) of your router, which will execute it on the next auto restart. Make sure you spell the name of the file correctly with its proper file type.

The next bit is the magic that will likely bring your router out of the dark ages. We are going to do a 30-30-30 reset. This simply means we are going to hold down the reset button for 90 seconds straight while cycling the power. So hold down the reset for 30 seconds, then pull the power while still holding down the reset. Wait another 30 seconds and then plug the power in, again never letting go of the reset button. After the final 30 seconds passes with the router plugged in, let go of the reset button. For my router model, as soon as it booted up the VPN light stayed lit, which means it's in a recovery mode

If you haven't started your Ping CMD window yet, do that now. Otherwise you will want to watch your CMD ping window until you get back a positive response from your router. The moment you see response press enter on your second CMD window with the following command.


Depending on the size of the file it should only take a matter of 5-10 seconds and you should hopefully receive a message saying your transfer was successful, such as this.


Do not restart your router, give it a few minutes to restart itself and execute the new firmware. That should be it... you should now have a working router if you got that successful transfer message, congrats!

*edit* - Grammar!.?/\

Ah, tne 30/30/30 is classic old Linksys-speak. Probably why I still run a WRT-54GL with Tomato.

Just to add a note - when you're rebooting the router, you can tell if you've missed the recovery window if the TTL of the pings change dramatically

TwistedKestrel wrote:

Just to add a note - when you're rebooting the router, you can tell if you've missed the recovery window if the TTL of the pings change dramatically

Great note to add, sometimes they will go from TTL=64 to something like TTL=128

Did that one for an Ex... a landlord demanded her admin password to the router and within 2 days the router bricked... what I deduced is he had enough know how to attempt loading a 3rd party firmware and loaded the wrong one. why he would even try I have no clue.

I used the bootstrap TFTP trick to bring it back and it worked well after (further confirming the landlord bricked it)

good knowledge to have floating around out there.

Heh, somewhere in closet I have a "classic" Linksys BEFW11S4 (Cable/DSL modem + WiFI router/switch) that I bricked via a bad firmware upgrade. Even at the time I knew there was some magic steps to revive it but I just replaced it (obsolete already back then). Now I'm tempted to try this just for the hell of it. 802.11b-only FTW!

Arvald wrote:

Did that one for an Ex... a landlord demanded her admin password to the router and within 2 days the router bricked... what I deduced is he had enough know how to attempt loading a 3rd party firmware and loaded the wrong one. why he would even try I have no clue.

That's really weird -- that he tried at all, and that he tried to do it (presumably) without a wired connection.

UberGerbil wrote:

Arvald wrote:

Did that one for an Ex... a landlord demanded her admin password to the router and within 2 days the router bricked... what I deduced is he had enough know how to attempt loading a 3rd party firmware and loaded the wrong one. why he would even try I have no clue.

That's really weird -- that he tried at all, and that he tried to do it (presumably) without a wired connection.

Actually he was the only wired connection (for her to have internet access in the house they needed a wireless router that he would not provide). The router was right on his desk.

Welch wrote:

I had a fun experience last night from a router that I've acquired from a custom who upgraded to something new assuming their old one was bricked (which it was). Being the frugal stubborn person that I am, I didn't want to throw the thing away knowing that its a decent enough Business Class router. So here is what I did in case this helps anyone else out with their bricked router... this can potentially work with many router brands.

Cool stuff.

So how long did all that take you to do??

anotherengineer wrote:

So how long did all that take you to do??

Between disconnecting your existing router, changing IP to static in Network Connections, uploading the firmware, and doing the 30/30/30 reset, you might have all of 10 minutes invested in the process to the point where you play hurry up and wait to see if the router took the update or not.

Captain Ned wrote:

anotherengineer wrote:

So how long did all that take you to do??

Between disconnecting your existing router, changing IP to static in Network Connections, uploading the firmware, and doing the 30/30/30 reset, you might have all of 10 minutes invested in the process to the point where you play hurry up and wait to see if the router took the update or not.

Once everything worked properly, yeah about 10 minutes tops. It actually took me a little over an hour because even though I could receive a positive ping from the router, it wasn't alive and willing to accept TFTP requests. That is where the "magic" of the 30-30-30 reset came in handy. As soon as I did the 30-30-30 the VPN light stayed solid and it took the firmware upload in 6 seconds like I showed in the final picture.

If you'd got a project router sitting around i'd say give it a shot, I wasn't going to lose anything if it failed anyhow.

So this is essentially just a router where the firmware crashes the router and it refuses to boot? What's the ratio for bad software vs. dead hardware?