Prepare TFTP recovery over Ethernet for OpenWrt

TFTP recovery over Ethernet is only the host preparation part. The router's bootloader decides the IP address, filename, button, port, and flash procedure; not every model supports TFTP. The OpenWrt page describes two directions: the router can run a TFTP client and download from the computer, or the router can run a TFTP server and receive an upload. This guide prepares the TFTP host and does not invent a model-specific trigger.¹

Warning: Enable TFTP only on the LAN interface, allow UDP 69 only from a private LAN, shut the server down after recovery, and do not leave unintended firmware files in the serving directory.¹

Common procedure

1. Download the correct OpenWrt or stock firmware, rename it to the exact filename required by the Device Page, and place it in the TFTP directory.
2. Set the computer's Ethernet address exactly as the Device Page requires.
3. Start the TFTP server.
4. Connect the computer and router with Ethernet.
5. Power up the router and press the model-specific button or enter its bootloader recovery mode.
6. Wait for the transfer and flash operation to complete.
7. Stop the TFTP server.

TFTP recovery often leaves the bootloader intact after OpenWrt is flashed, but the source insists on checking the exact model page. This generic page does not describe each vendor's write-to-flash step.¹

Required firewall boundary

• Allow TFTP UDP 69 only when both source and destination are private LAN addresses.
• Deny traffic from or to 127.0.0.1 and lo.
• Deny public/Internet source addresses.
• Use a direct cable or isolated switch when helpful; do not expose the server on WAN.

macOS

dnsmasq

The source provides two possible dnsmasq paths. Use the one installed on the Mac, the correct enX interface, and the correct TFTP directory:

1

sudo /usr/local/opt/dnsmasq/sbin/dnsmasq -i enX -p 0 -z --enable-tftp --tftp-root /tmp

Or:

1

sudo /opt/local/sbin/dnsmasq -i enX -p 0 -z --enable-tftp --tftp-root /tmp

Native command-line tftpd

Copy the file into the default TFTP directory with the exact name the router expects, then load the daemon:

1
2

sudo cp path/to/file/to/serve.bin /private/tftpboot/the_name_the_device_is_looking_for.bin
sudo launchctl load -F /System/Library/LaunchDaemons/tftp.plist

Check UDP 69:

1
2

$ netstat -an | fgrep \*.69
udp4       0      0  *.69                   *.*

Unload the daemon when finished:

1

sudo launchctl unload -F /System/Library/LaunchDaemons/tftp.plist

TftpServer.app and PumpKIN

With TftpServer.app, obtain the app from a trusted author source, put the app and a tftpfiles directory together, set the macOS IP according to the Device Page, open the app, verify the file, and click Start TFTP. The status should become Running; after the router retrieves the file, click Stop TFTP or quit. If the app reports permissions, use its Fix buttons rather than widening system permissions. PumpKIN must also be firewalled to the LAN and stopped after use.¹

When installing tools through MacPorts, the source lists:

1

sudo port install inetutils dnsmasq

Windows

Windows TFTP and firewall

Enable the TFTP feature:

1

Dism /online /Enable-Feature /FeatureName:TFTP /All

Allow UDP 69 with LAN/interface/profile limits:

1

netsh advfirewall firewall add rule name="TFTP" dir=in action=allow protocol=udp localport=69 remoteip=localsubnet interfacetype=lan profile=private,public

Disable media sensing during recovery when the Device Page calls for it:

1
2

netsh interface ipv4 set global dhcpmediasense=disabled
netsh interface ipv6 set global dhcpmediasense=disabled

Tftpd64, Tiny PXE, and SolarWinds

With Tftpd64 or Tiny PXE, set the correct root directory, enable only the required server mode, and rename the firmware for the exact model. For SolarWinds, the source shows how to make the service manual and stop it:

1
2

sc config "Solarwinds TFTP Server" start=demand
sc stop "Solarwinds TFTP Server"

In Tftpd64, restrict security to Send files when the router is the TFTP client; use a switch between host and router if a reboot would otherwise make Windows lose its link. With SolarWinds, the default directory may be C:\TFTP-Root; open File | Configure | Security and make “Send files” the only permitted action. Set a static LAN address, trigger recovery from the Device Page, and watch the console to confirm that the file was fetched.¹

Linux

dnsmasq

Create the directory and copy the image:

1
2

mkdir /srv/tftp
cp ~/tp_recovery.bin /srv/tftp

Start dnsmasq in TFTP mode:

1

dnsmasq --listen-address=0.0.0.0 --port=0 --enable-tftp --tftp-root=/srv/tftp --tftp-no-blocksize --user=root --group=root

Check that it is listening:

1

netstat -lunp | grep 69

atftpd

Install the package for the distribution:

1

apt install atftpd

Or:

1

yum install atftpd

Prepare the file, ownership, and daemon:

1
2
3
4

mkdir /srv/tftp
cp ~/tp_recovery.bin /srv/tftp
chown nobody:nogroup -R /srv/tftp
atftpd --daemon --no-fork --logfile - /srv/tftp

Verify with either command:

1

netstat -lunp | grep 69

1

ss -lunp | grep 69

The source also demonstrates reading a file with a TFTP client:

1
2
3
4

tftp 192.168.0.66
tftp> get tp_recovery.bin
Received 8152633 bytes in 0.8 seconds
tftp> quit

Treat the file as ready only after its size, name, permissions, and hash are correct; never use a partial transfer for recovery.¹

Troubleshoot in order

When the router does not fetch the file, check:

1. Is the TFTP server running and listening on UDP 69?
2. Is the TFTP directory in the correct location with correct permissions?
3. Does the firmware have the exact name, location, and permissions?
4. Are the Ethernet cable and router port correct?
5. Is the server IP the address the router is searching for?
6. Does the host use the static IP and subnet mask expected by the bootloader?
7. Does the host firewall allow UDP 69 from the local subnet?
8. Did you restart the TFTP server after changing the host IP?
9. Use Wireshark or tcpdump with a TFTP filter to see BOOTP/TFTP requests.
10. Try another cable, crossover cable, switch, or link speed.
11. Try another router or switch port.
12. Read console output or watch LEDs when the model provides them.
13. Inspect the ARP cache; remove stale entries with arp -d or add a static mapping with arp -s when appropriate.
14. Use a third host to ping the router in the same subnet and separate L2 from L3 faults.
15. Try another server/client application or transfer mode.
16. Adjust the timing of the power cycle and start the transfer earlier or later within the bootloader window.
17. Confirm that the filename includes tftp when the Device Page requires it, then rename it to the expected OEM filename.¹

After success, stop the server, remove the image from the serving directory when no longer needed, close UDP 69, and record the filename, IP, and recovery method in the model notes. A TFTP server should not run continuously on a HomeLab host.¹

Sources