Reboot TP-Link router remotely or automatically

Standard

using cURL or wget, it’s easy to reboot a TP-Link router from a terminal or command line. Put it in a script and schedule it to run automatically if your router overheats or is flaky:

in OSX (using cURL):

curl --user username:password http://192.168.1.1/userRpm/SysRebootRpm.htm?Reboot=Reboot > /dev/null

If you have wget by default instead of cURL (i.e. most *nix):

wget -qO- --user=username --password=password http://192.168.1.1/userRpm/SysRebootRpm.htm?Reboot=Reboot > /dev/null

Replace username and password with the admin username and password of your router. Replace 192.168.1.1 with the IP address of your router.

If you have Windows, with neither of the above, and don’t want to download wget, try using bitsadmin to create a download job.

46 thoughts on “Reboot TP-Link router remotely or automatically”

  8. I all the time used to study article in news papers but now as I am a user of
    internet therefore from now I am using net for content, thanks to web.

  11. nick

    Hi,
    is there any way to restore my backup configuration on TP LINK W8950ND by using script/CLI? I’m not familiar with scripting.

  12. Thomas

    Hello,
    I have tried the curl command on Mac OS X 10.9 and TP-Link TL-MR3020. With the Firmware version TL-MR3020_v1_130226 i have no problem. Then i made a Firmware update (TL-MR3020_V1_130929) and i get the Message “You have no authority to access this router!”. Back to Firmware TL-MR3020_v1_130226 and the command work again.

  13. Thomas

    I have fixed the Problem with the Firmware update (TL-MR3020_V1_130929). At the side from openWRT i have found the answer. Here is my solution:

    curl –user admin:admin –user-agent ‘Mozilla/5.0 (X11; Ubuntu; Linux i686; rv:12.0) Gecko/20100101 Firefox/12.0′ –referer ‘http://192.168.0.254/userRpm/SysRebootRpm.htm’ http://192.168.0.254/userRpm/SysRebootRpm.htm?Reboot=Reboot

    If you have an other Port than 80 you must add :8888 (or something else) after the IP-Addresses.
    I have tested this with all Firmwareversions from TP-Link for the TL-MR3020.

  16. Nour Imam

    I was able to reboot the TL-5120 remotely using the curl command above, before the command was taking effect but now it is not working. I have tried the same command on TL-ER6120 using a Linux machine but still it is not taking effect.

    Can someone help me with issue?

    Thanks

  19. I come here baucase i know how to do, but my new TPLink is not accepting it. This may be about new models are using sightly modified htm files on their firm. I have solved it by myself watching code. I used cURL, but you can do the same using wGet for sure.

    Problem IS NOT the user. You can use at leat 3 syntax using curl for user AUTH:
    -u user:pass URL // shortcommand
    –user user:pass URL // longcommand
    user:pass@URL // obviously not working that example

    Using simple GET you may success with
    user:pass@URL but when you tried to use get directly it warns with the same messagen when you miss the passw. That’s the obscure thing here.

    I have inspect source htm code of reset router page and just found the trick; even if it’s a clear GET response, they have put into multipart/form-data like a post, wich is NOT.

    How to solve? I guest we can only do using cURL or wGET, never using plain url method(user:pass@URL). I got using cURL by doing the following:

    curl -L admin:admin@192.168.1.1/userRpm/SysRebootRpm.htm?Reboot=Reboot –data “” –get > nul

    or

    curl -L -u admin:admin http://192.168.1.1/userRpm/SysRebootRpm.htm?Reboot=Reboot –data “” –get > nul

    Explain -L: follow redirects. When you use IP, certain models will send you to a “faked” url wich is really your mapped ip router. Always use a -L is a time saver.

    Explain–data “”: By default, using –data=”myvalue=1″ will change cURL to POST mode, also set the “multipart/form-data” for data manipulation. We put empty values just to call form-data mode. POST is encoded while GET not.

    Now again, wtf?, because the form is using GET…
    Explain: –get: That forces the form to GET mode but still maintains “multipart/form-data”.

    Question? omg, are we using POST and GET at time? NO!
    You’ve activaded the url encode for the GET method by calling both. Once you call –get, POST feature from –data is avoided.

    I will made a better explanation of this on my blog, but not now… i spend my free time making a single bat line to reboot router.

    Thank you :)

  20. I am sorry, but my last message has no code wrappers… also text has changed from mine.

    curl -L -u admin:admin http://192.168.1.1/userRpm/SysRebootRpm.htm?Reboot=Reboot --data “” --get > nul

    --data and --get params has to use two of -- not just one... Please admin edit if you can, and lelete that one.

    Regards.

  21. Please remove all my last comments.
    I have digging a lote more and now im not sure how i did, but is not what i explain.

    Srry :D i will come back asi i do and just need to know to reproduce again!.

  22. Digging and digging, finally you have the hole!

    Here is how it works, forgot my lasts comments. Just need to use same url as referer then will work again :D

    Using cURL:
    curl -L --user admin:admin http://192.168.1.1/userRpm/SysRebootRpm.htm?Reboot=Reboot --referer "http://192.168.1.1/userRpm/SysRebootRpm.htm/"

    Using wGet:
    wget --user=admin --password=admin --referer=http://192.168.1.100/userRpm/SysRebootRpm.htm http://192.168.1.100/userRpm/SysRebootRpm.htm?Reboot=Reboot 2>/dev/null 1>&2

    To avoid file creation, Linux user has to put 2>/dev/null 1>&2 at end of the line. Windows users can put > nul or just nothing.

    Regards.

  25. Oddly enough you could create an attack script out of that.
    I did some research into TP link routers, and even the cookie exploit that was found in late 2014.
    You could technically use a similar command and scan an entire range of IP addresses for TP link routers and issue a ChangeDNS query to it. I’m guessing that attack is already seen in the wild.

    You could also do this from a web browser and an iframe. If you know the exact IP address in the WLAN the TPLink router is at, you don’t even need an HTTP response back.

    IP addresses are going to be:
    192.168.x.1
    10.0.x.1

    i haven’t typically seen any others in the wild (unless the DHCP went haywire)

    Some people told me that i order to test all of those IPs would take too long. But i think most people don’t realize just HOW low the latency is between someone’s browser and the WLAN gateway. It’s usually only a few MS.
    So for this and all those blind requests, i’ve used self-spawning web workers to handle all of those requests. It would just require someone to be on a page for around 5 seconds.

  26. If someone wanted to be evil, they could modify a router firmware and brick a router in the same way. It would be evil, but i’m sure someone could do it.
    Since these things use Uboot, just null-byting out the first 1kb of data on the firmware image would likely cause the firmware to not let the router boot up again on reboot.

    it’s a wild west world we live in ;-)

  27. Iliyan

    Hi ERM3NDA,

    Your wGet method works for my TL-WR841N – thanks alot!!!
    Naturally the IP and the PORT on which one would be able to access the web interface of the router should be correct. The rest works as a charm!!!

  28. Nicolas Giese

    Working Update for WR841ND, v9, newest firmware (TL-WR841N_V9_150310).

    Authentification now works via Cookie, not Basic Authentification (even though it still uses it in the inside).

    How to generate your Cookie content
    Easy Way: Log in and look up the code in your browser.
    Dynamic Way:
    1. Generate an MD5 Hash of your password.
    2. Encode the string “[username]:[md5 password]” via base64.
    3. URL-Encode the string “Basic [base64-string]”
    => Thats your cookie code

    Use Cookie for accessing
    Important: You need to set the path to “/”, otherwise it wont work!!

    curl_setopt($ch, CURLOPT_COOKIE, "Authorization=[cookie];path=/"); //PHP

    (As i have no experience on wget and console – curl it’d be a pleasure if you use this code to generate both wget & curl request and append it :)

  29. pradeep kumar

    If u can suggest a command for rebooting the tplink only when internet disconnects, this will help a lot..

  30. Nicolas Giese

    Just take my snippet from above and navigate to the path for redirection.

    Things to consider:
    - Every page call needs a set internal referer.
    - Every page now has a session token. You can grab it from the login page and have to prepend it at every page call.

  33. Stephen

    If anyone experiences the “no authority” error message, this worked for me: add referer and user agent headers to the command:

    curl –user username:password -H “Referer: 192.168.0.1″ -H “User-agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; rv:2.2) Gecko/20110201″ http://192.168.0.1/userRpm/SysRebootRpm.htm?Reboot=Reboot

    I’m not sure if the UA is strictly necessary but I haven’t yet tested without it.

  38. Daniel

    Hi Eyal,

    the script does not work on my Synology because there is no #bash… only #ash.
    I tried to rewrite, but my knowledge here is probably too low.
    I think that it fails only at the session. I had to use a few other things because these commands are unavailable. (base64 -> python -c “import base64; print base64.b64encode OR rawurlencode(…) -> python3 -c ‘import urllib.parse; import sys; print(urllib.parse.quote(sys.argv[1], safe=””))’ “$1″
    )
    But I don’t know if it’s right. Maybe you can help to transform?
    http://pastebin.com/EPd1mR5t

  39. Olexandr

    for TL-WR841N (which I have) I used, generally, this approach:
    http://www.xeve.de/wp/2015/02/automatically-reboot-tp-link-router-wdr4300-n750-with-bash-script/

    But it works only when I put (write inside the script) the cookie manually-’statically’; Cookie can be obtained in browser (cookie for 192.186.0.1) after authorization (to router, in browser)
    (you may want to try it this way:
    1. Run:

    curl --cookie "Authorization=Basic%20Rest_of_YOUR_cookie" 192.168.0.1/userRpm/LoginRpm.htm?Save=Save > test.htm

    2. taking from test.htm dynamic part of address, here it is SAJKQLIAHMKHSJEA, run:

    curl -s --cookie "Authorization=Basic%20Rest_of_YOUR_cookie" --referer http://192.168.0.1/SAJKQLIAHMKHSJEA/userRpm/SysRebootRpm.htm?Reboot=Reboot http://192.168.0.1/SAJKQLIAHMKHSJEA/userRpm/SysRebootRpm.htm?Reboot=Reboot


    That cookie seems to be permanent (functional) after reboot and is changed with changing admin’s password (whether will that be valid for longer time, e.g. weeks/months/years, is not known yet)

  40. gwenaeld

    Hi guys,
    Personnally, i do it with the telnet command : “set reboot”

    i wrote a script on my synology executed by cron every day for that purpose. That script open a telnet session on my tp link router and send it the “set reboot” command.

    Hope this will help.

    Regards

  41. Ben

    Hi,
    any news on this topic? Currently I m runing a 1043 on latest firmware. I ve tried all you scripts but could reboot the router. I m using Windows OS and CURL … can anyone provide a final script to reboot the latest firmware remotly?
    Thx and Bgrds,
    Ben

  42. Vasilis

    Has anybody used curl or wget to reboot a ZXHN H108N router? Ijust can’t figure out how to do it

  43. Donny

    Dear all!

    I tried all the snipplets from the comments with curl but they did not work for the TL-WA801ND.
    Does anybody have another idea?
    Thx

  45. Ted Rogers

    None of this is working for me on Archer C8, mainly because I think the router has crashed so isn’t even accepting any connections. I’m trying to do this remotely; basically so I don’t have to go home just to press the power button!

    I’ve been wondering though; would it be possible to extract the relevant ‘userRpm’ (SysRebootRpm.htm), or the file which that SysRebootRpm.htm points to, from the router firmware download, and then ‘push’ it (similarly to how adb works) to the router to invoke a reboot?

    If I had a web-connected home accessible on my NAS where I could simply turn the power off and on again, then this wouldn’t be a problem!

    Thanks, this is interesting!

Leave a Reply

Your email address will not be published. Required fields are marked *

You may use these HTML tags and attributes: <a href="" title=""> <abbr title=""> <acronym title=""> <b> <blockquote cite=""> <cite> <code> <del datetime=""> <em> <i> <q cite=""> <strike> <strong>