tplink-ax53

name	tplink-ax53
description	Manage TP-Link Archer AX53 (WiFi 6) router via Python API and web UI. Use when the user mentions their router, WiFi settings, WireGuard VPN, DNS, guest network, connected devices, bandwidth, wireless configuration, or anything related to their home network.
allowed-tools	Bash, Read, Write, Edit

TP-Link Archer AX53 Router Management

Model: TP-Link Archer AX53 (V1) — Qualcomm IPQ5018, WiFi 6 (802.11ax)
Admin URL: http://192.168.0.1
API Library: tplinkrouterc6u (Python)

Quick Setup

# Create venv and install (do this once)
cd /tmp && mkdir -p tplink-api && cd tplink-api
python3 -m venv .venv && source .venv/bin/activate
pip install tplinkrouterc6u

API Connection Pattern

Always use this pattern. The router only allows one active session — always logout when done.

from tplinkrouterc6u import TplinkRouterProvider

ROUTER_HOST = "http://192.168.0.1"
ROUTER_PASS = "<admin-password>"  # Prompt user or retrieve from keychain

router = TplinkRouterProvider.get_client(ROUTER_HOST, ROUTER_PASS)
try:
    router.authorize()
    # ... do work ...
finally:
    try:
        router.logout()
    except:
        pass

⚠️ If the user gets "already logged in" errors, wait 1-2 minutes for the session to expire, or ask them to close the browser tab with the router UI.

---

The request() Method — Undocumented API

This is the core method for reading/writing any router setting. The high-level library methods (get_status(), etc.) are limited — request() gives full access.

# READ a setting
result = router.request("admin/<section>?form=<form>", "operation=read")

# WRITE a setting
result = router.request("admin/<section>?form=<form>", "operation=write&key=value&key2=value2")

# For endpoints that may return errors
result = router.request("admin/<section>?form=<form>", "operation=read", ignore_errors=True)

---

API Endpoint Reference

WiFi Settings

# Read 5 GHz settings
r = router.request("admin/wireless?form=wireless_5g", "operation=read")
# Returns: ssid, psk_key, encryption, channel, current_channel, htmode, txpower, hidden, hwmode, enable, ...

# Read 2.4 GHz settings
r = router.request("admin/wireless?form=wireless_2g", "operation=read")
# Same fields as 5 GHz

Key fields:

Field	Example Values	Description
ssid	"My Network"	Network name
psk_key	"MyPassword123"	WiFi password
encryption	psk, psk_sae, sae, none	WPA2 / WPA2+WPA3 / WPA3 / Open
channel	"auto", "36", "1"	Channel selection
current_channel	"36"	Actual channel in use
htmode	"80", "160", "auto"	Channel width (MHz)
txpower	"high", "mid", "low"	Transmit power
hidden	"on", "off"	Hidden SSID

Change WiFi Password

router.request("admin/wireless?form=wireless_5g", "operation=write&psk_key=NewPassword123")
router.request("admin/wireless?form=wireless_2g", "operation=write&psk_key=NewPassword123")

Always change BOTH bands — they share the same SSID with Smart Connect.

Enable WPA2/WPA3 Mixed Mode

router.request("admin/wireless?form=wireless_5g",
    "operation=write&encryption=psk_sae&psk_version=rsn&psk_cipher=aes")
router.request("admin/wireless?form=wireless_2g",
    "operation=write&encryption=psk_sae&psk_version=rsn&psk_cipher=aes")

Encryption values:

• psk = WPA2 only
• psk_sae = WPA2/WPA3 mixed (recommended for most homes)
• sae = WPA3 only (breaks many IoT devices)
• none = Open network

DNS Configuration

# Set static DNS (Cloudflare)
router.request("admin/network?form=wan_ipv4_pppoe",
    "operation=write&dns_mode=static&static_pridns=1.1.1.1&static_snddns=1.0.0.1")

# Revert to ISP DNS
router.request("admin/network?form=wan_ipv4_pppoe",
    "operation=write&dns_mode=dynamic")

# Read current DNS
r = router.request("admin/network?form=wan_ipv4_pppoe", "operation=read")
# r['dns_mode'], r['static_pridns'], r['static_snddns']
# r['wan_ipv4_ipaddr'] = public IP, r['wan_ipv4_gateway'] = gateway

For DHCP connections (not PPPoE), use form wan_ipv4_dhcp instead.

WireGuard VPN Server

# Read WireGuard config (read-only via API)
r = router.request("admin/wireguard?form=config", "operation=read")
# r['enable'], r['listen_port'], r['public_key'], r['address'], r['access']

⚠️ WireGuard writes return encrypted/non-JSON responses. Manage WireGuard accounts (add peers, export configs) through the web UI only at: Advanced → VPN Server → WireGuard.

Connected Devices

status = router.get_status()
for d in status.devices:
    print(f"{d.hostname} — {d.ipaddr} — {d.macaddr} — {d.type} — signal:{d.signal}")
    # d.type: '2.4G', '5G', 'wired'
    # d.up_speed, d.down_speed: current bandwidth usage

Full Endpoint Table

Endpoint	R/W	Description
admin/wireless?form=wireless_5g	R/W	5 GHz WiFi settings
admin/wireless?form=wireless_2g	R/W	2.4 GHz WiFi settings
admin/network?form=wan_ipv4_pppoe	R/W	WAN PPPoE settings (IP, DNS, gateway)
admin/network?form=wan_ipv4_dhcp	R/W	WAN DHCP settings
admin/wireguard?form=config	R only	WireGuard server status
admin/status?form=all	R only	Full router status
admin/firmware?form=upgrade	R only	Firmware version info

---

WireGuard VPN — Setup Checklist

When the user wants to set up VPN:

1. Check for CGNAT — WAN IP in router must match whatismyip.com. If not, user needs to call ISP for a real public IP.
2. Enable WireGuard — Web UI: Advanced → VPN Server → WireGuard → ✅ Enabled
3. Create accounts — One per device. Click ➕ Add, name it (e.g., "iPhone", "MacBook").
4. Export configs — Click 🔗 link icon → QR code (phones) or Export (desktop)
5. Set up DDNS — TP-Link DDNS is free with a cloud account. Hostname like my-home.tplinkdns.com.
6. Enhance exported config — Add DNS = 1.1.1.1, 1.0.0.1 to [Interface] and replace IP with DDNS hostname in Endpoint.

Common VPN Issues

Symptom	Cause	Fix
"Data sent" but no "Data received"	Wrong private key, or testing from home WiFi	Each device needs its OWN config. Never test VPN from the same network as the router.
ERR_NAME_NOT_RESOLVED	DNS not set in WireGuard config	Add DNS = 1.1.1.1, 1.0.0.1 to [Interface] section
IP shows iCloud Private Relay	Apple's private relay intercepting	Disable: Settings → iCloud → Private Relay → Off
VPN connects but no internet	AllowedIPs too restrictive	Use AllowedIPs = 0.0.0.0/0, ::/0 for full tunnel
Handshake never completes	Port 51820 blocked by ISP	Try changing listen port in router WireGuard settings

WireGuard Config Template

[Interface]
PrivateKey = <from-router-export>
Address = <from-router-export>/32
DNS = 1.1.1.1, 1.0.0.1

[Peer]
PublicKey = <from-router-export>
AllowedIPs = 0.0.0.0/0, ::/0
Endpoint = <ddns-hostname>:51820
PersistentKeepalive = 25

---

WiFi Best Practices

When the user asks about optimizing WiFi:

Setting	Recommended	Notes
Smart Connect	On	Auto-steers devices to best band
OFDMA	On	WiFi 6 multi-user, no downside
TWT	On	Battery saver for phones/tablets
Encryption	psk_sae (WPA2/WPA3)	WPA3-only breaks IoT devices
DNS	Cloudflare 1.1.1.1	Faster than ISP defaults
5 GHz channel width	80 MHz	160 MHz can be unstable in apartments
2.4 GHz channel width	20 MHz	More reliable in dense environments

Guest Network

• Isolated from main network (guests can't see your devices)
• Set up via web UI: Advanced → Wireless → Guest Network
• Bandwidth limit: Advanced → QoS / Bandwidth Control → cap at ~50 Mbps

---

OpenWrt Compatibility

NOT supported. V1 uses Qualcomm IPQ5018 with no mainline Linux kernel support. V2 has only 256 MB RAM. Don't attempt it.

---

Probing for New Endpoints

If you need to discover more API endpoints:

sections = ['wireless', 'network', 'firewall', 'nat', 'wireguard',
            'openvpn', 'pptp', 'guest_network', 'iot_network', 'qos',
            'system', 'status', 'firmware', 'led', 'cloud']
forms = ['config', 'setting', 'status', 'all', 'wireless_2g', 'wireless_5g',
         'guest_2g', 'guest_5g', 'wan_ipv4', 'wan_ipv4_pppoe', 'wan_ipv4_dhcp']

for section in sections:
    for form in forms:
        try:
            r = router.request(f"admin/{section}?form={form}",
                             "operation=read", ignore_errors=True)
            if r and 'errorcode' not in str(r).lower():
                print(f"✅ admin/{section}?form={form} → {list(r.keys())}")
        except:
            pass

---

Useful Reference

• Router manual: https://www.tp-link.com/support/download/archer-ax53/
• Python library: https://github.com/AlexandrErohin/TP-Link-Archer-C6U
• WireGuard guide: https://www.tp-link.com/support/faq/3772/
• GitHub repo with full guide: https://github.com/Mahir-Isikli/tplink-archer-ax53-guide