Router Firmware Update Fails – Connection Error Fix

You're sitting there watching the router admin page, the firmware update progress bar hits maybe 5% or 10%, then stops. A message pops up: "Connection failed" or "Cannot connect to update server." This happens most often on ASUS RT-AC68U, TP-Link Archer C7, and Netgear Nighthawk R7000 models. The trigger is almost always a recent change — maybe you just switched ISPs, changed DNS settings, or enabled a VPN on the router itself. It can also happen if the router's DHCP lease just expired and it didn't renew properly.

What's actually going on

The router's firmware update process works like this: your router tries to reach a specific server — something like update.asus.com or firmware.netgear.com — to download the new firmware file. When you see "connection failed," it means the router couldn't complete the TCP handshake with that server. Nine times out of ten, the culprit is DNS. Your router is using a DNS server that either doesn't know where the update server is, or blocks it. Sometimes it's the ISP's DNS that's the problem — they might cache a stale or incorrect IP for the update server. Other times it's your own Pi-hole or AdGuard setup blocking the domain. Less common but real: the router's internal DNS cache got corrupted after a power outage.

The fix: step by step

Step 1: Switch to a hardwired connection

I know it sounds basic, but skip the wireless for this. Plug a computer directly into one of the router's LAN ports with a Cat5e or Cat6 cable. Wireless connections drop packets, and firmware updates are sensitive to that. If you're already wired, move to step 2.

Step 2: Change the router's DNS servers to public ones

1. Log into your router's admin panel. Usually that's 192.168.1.1 or 192.168.0.1. If you changed it, use your custom IP.
2. Find the WAN or Internet settings page. On ASUS routers, it's under WAN > Internet Connection. On TP-Link, it's Network > WAN. On Netgear, it's Internet > WAN Setup.
3. Look for a field labeled DNS Server or Primary DNS and Secondary DNS.
4. If it's set to Get automatically from ISP, change it to Use the following DNS servers.
5. Enter these two addresses:
   Primary DNS: 1.1.1.1
Secondary DNS: 8.8.8.8
6. Hit Apply or Save. The router will restart its WAN connection — you'll see the status light blink for about 30 seconds. After that, the router should show Connected under WAN status.

What to expect: After applying, the router will briefly drop the internet connection (15-30 seconds). That's normal. Wait for the WAN status to show connected again before moving on.

Step 3: Clear the router's DNS cache

Some routers keep a local DNS cache. If it's stale, pointing to the old server IP, the update fails even with new DNS settings. Here's how to clear it:

1. Still in the admin panel, find System Tools or Administration.
2. Look for Reboot or Restart. Click it. This clears the cache on most consumer routers.
3. Wait 2 minutes for the router to fully reboot. You'll hear the fans spin down and back up (if it has fans), or the lights cycle through and settle.

If you want to be thorough, also clear the DNS cache on the computer you're using. Open Command Prompt (Windows) or Terminal (Mac/Linux) and run:
ipconfig /flushdns (Windows)
sudo dscacheutil -flushcache; sudo killall -HUP mDNSResponder (Mac)

Step 4: Disable any VPN or proxy on the router

If you're running a VPN client directly on the router (like OpenVPN or WireGuard), the firmware update can't reach the server. The update request goes through the VPN tunnel and either times out or gets blocked by the VPN provider. Turn it off temporarily:

1. Go to the VPN settings page — on ASUS, it's under VPN; on TP-Link, it's Advanced > VPN Server/Client.
2. Disable the VPN client. If the option is Enable VPN + DHCP connection, uncheck it.
3. Apply the change.

What to expect: Your internet connection will drop briefly as the VPN disconnects. After it comes back, the router will use your regular ISP connection.

Step 5: Manually download and install the firmware

If the automatic update still fails after the steps above, the real fix is to do it manually. This bypasses the router's broken update mechanism entirely.

1. On your computer, open a browser and go to your router manufacturer's support site:
   • ASUS: https://www.asus.com/support/ — search your model number
   • TP-Link: https://www.tp-link.com/us/support/download/
   • Netgear: https://www.netgear.com/support/
2. Find the latest firmware file for your exact model and hardware version (e.g., Archer C7 v2 vs v5 — they use different firmware files). Check the label on the router if you're not sure.
3. Download the file. It'll be a .trx, .bin, or .chk file. Save it to your desktop.
4. Go back to the router admin panel. Find Firmware Update or Advanced > Administration > Firmware Upgrade.
5. Look for a button that says Choose File or Browse. Select the downloaded firmware file.
6. Click Upload or Start Upgrade.
7. The router will upload the file (this takes 30-60 seconds), then start flashing. Do not turn off the router during this process. It'll reboot automatically when done.

What to check if it still fails

If you've done all the steps above and the update still won't work, here's what to check next:

• Firewall or security software: Some suite antivirus programs (like Norton, McAfee, or Bitdefender) block firmware downloads. Temporarily disable the firewall on the computer you're using to download the manual file.
• ISP-level blocks: Some ISPs block certain update servers. Try tethering your computer to a mobile hotspot (phone's cellular data) and download the firmware that way. Then switch back to your home network to upload it.
• Router's storage is full: If the router's internal flash memory is full of logs or saved configs, it can reject the update. Factory reset the router (hold the reset button for 10 seconds with power on), then try the manual update again. Back up your settings first if you need them.
• Hardware failure: Rare, but if the router's flash storage is failing, no update will ever succeed. The symptom is that the update starts, gets to 50-80%, then fails with a checksum error or just stops. In that case, it's time to replace the router.

The manual download route fixes 95% of these connection failure cases. It's the most reliable method because it doesn't rely on the router's own DNS or network stack — it just needs the file to be uploaded cleanly.