Technical Anshu
Tutorials Blog
📡 TFTP Server Setup

TFTP Server Setup on Windows with a Free GUI Tool

A switch needs its configuration backed up, or a router needs a firmware file - and the device only speaks TFTP. Here is the complete Windows setup: one small free GUI tool, one clean root folder, one firewall rule, and your first successful transfer.

✍️ Technical Anshu🪟 Windows 10 / 11⏱️ 10 minute setup
🎥 Watch the full video — TFTP server setup with the GUI tool, step by step

TFTP (Trivial File Transfer Protocol) is the small, old file-transfer protocol that network devices still depend on. Switches, routers, IP phones and PXE boot systems use it because it is tiny enough to live inside device firmware. It has no username, no password and no encryption - which is exactly why it belongs on your local network only, switched on for the job and switched off after. This guide sets up a free GUI TFTP server on a Windows PC, the same way shown in the video, and finishes with a real transfer test. The popular free tools in this class - Tftpd64 and SolarWinds TFTP Server are the common names - all follow the same layout below, so the steps stay valid whichever one you use.

TFTP Server — Status Panel (typical GUI tool layout)
Server statusRunning
Bind address192.168.1.10
PortUDP 69
Root folderC:\TFTP-Root
Transfer log — switch-config.cfg received from 192.168.1.2Completed
Security — authentication / encryptionNone / None
Example panel with sample values — your PC address and folder name will differ. Notice the last line: TFTP asks for no login at all, which is why this server stays on the LAN only.
1

What You Need Before Starting

Keep four things ready. Nothing here costs money, and skipping a step is what causes most failed first transfers.

  1. A Windows PC on the same LAN and subnet as the switch, router or phone you will transfer with
  2. A fixed IP address on that PC for the duration of the job — the device will send files to this address, so it must not change mid-transfer
  3. A free GUI TFTP server tool downloaded from its official site only — this class of tool is a favourite target for fake download sites
  4. Administrator rights on the PC, because binding to UDP port 69 and the firewall rule both need elevation
2

Step 1 — Create One Clean Root Folder

The root folder is the only folder the server can see. Every file a device downloads must sit in it, and every file a device uploads will land in it. Make it short and simple:

  1. Create a folder like C:\TFTP-Root — avoid deep paths and spaces in the name
  2. Put the firmware file or empty target file for today's job inside it
  3. Keep nothing else here. Yesterday's switch configurations contain passwords and keys — this folder is not an archive, it is a workbench
3

Step 2 — Install and Point the Tool at the Folder

Install the GUI tool and open its settings before you start the server. Two settings decide almost everything:

  1. Root / base directory: point it at the folder you just created
  2. Server interface / bind address: choose the LAN adapter's IP address (for example 192.168.1.10), not a virtual adapter or a VPN address — a very common cause of "device cannot reach the server"
  3. If the tool has a security tab, leave transfers allowed in both directions for now; you will tighten your habits in the root-folder guide, not by breaking the first transfer

Then start the server. The status should change to running / listening on UDP port 69.

4

Step 3 — Allow UDP Port 69 in Windows Firewall

The first time the tool runs, Windows Firewall usually pops up — allow it on Private networks. If no popup appeared, add the rule by hand:

  1. Open Windows Defender Firewall with Advanced Security → Inbound Rules → New Rule
  2. Rule type Port → UDP → specific port 69
  3. Allow the connection, apply it to the Private profile only — never Public

One honest detail: the device connects to port 69, but the server answers from a fresh temporary port. On a single LAN with the Windows Firewall this works automatically. Strict corporate firewalls between two subnets are where TFTP transfers go to die — if that is your network, do the transfer from a PC on the device's own subnet.

5

Step 4 — Test with a Real Transfer

Do not declare victory because the tool opened. Test with the actual job, or with the safest real job there is — backing up a switch configuration. On a Cisco-class switch the documented command is:

  1. On the switch: copy running-config tftp:
  2. Enter your PC's address (example 192.168.1.10) and a file name like switch-config.cfg
  3. Watch the tool's log window: you should see the request arrive and the blocks count up to Completed
  4. Confirm the file is sitting in C:\TFTP-Root and open it — a real config is readable text

If the transfer never starts, work through the timeout ladder in the troubleshooting guide in this series instead of randomly changing settings.

6

Step 5 — Stop the Server When the Job Is Done

This step is part of the setup, not an optional extra. TFTP has no authentication: while the server runs, anyone who can reach your PC on the LAN can read every file in the root folder and, if writes are allowed, drop files into it. Switch configuration files routinely contain password hashes and SNMP strings.

  1. Close the tool or stop its service as soon as the transfer finishes
  2. Move finished backups out of the root folder into your proper backup location
  3. Never forward UDP port 69 on your router — TFTP must never face the internet
🔴 The one rule of TFTP: no username, no password, no encryption — everything moves as plain data and anyone on the LAN can ask for it. Run the server only during the job, only on a trusted LAN, and never expose UDP port 69 to the internet.

🎥 Watch the Complete Video Guide

The full TFTP server setup — installation, root folder, firewall and a live transfer — is shown step by step in the video.

▶️ Watch Full Video
❓ Common Questions (FAQ)

Is a TFTP server free to run on Windows?

Yes. The well-known GUI tools in this class, such as Tftpd64 and SolarWinds TFTP Server, are free, and Windows itself even has an optional TFTP client feature (it is off by default and command-line only). The server side is what devices need, and the free GUI tools cover it completely for LAN work.

Why does the device contact port 69 but the transfer uses other ports?

That is how TFTP is designed. The first request goes to UDP 69, then the server replies from a new temporary port and the rest of the transfer happens there. Normal LAN setups handle this fine; strict firewalls between subnets often break it, which is why the reliable habit is to run the server on the same subnet as the device.

Can I use TFTP over the internet or a VPN to a branch office?

Do not expose TFTP to the internet — it has no login and no encryption, so anyone could read your device configurations. Over your own private VPN it will technically work on a trusted link, but for anything sensitive prefer SFTP. TFTP's honest home is one local network, for device firmware and config jobs.

This guide is based on the TFTP Server Setup video by Technical Anshu • Stuck on a step? Ask in the video comments — answers happen there 🙏