@Joseph-TP Connecting my PC directly to the Internet through the modem, even for a short period of time, is not an option for obvious security reasons. Besides, it is evident from the syslog that it is the router and not the ISP that disrupts the WAN connection. It is very unlikely the PC would do exactly the same.

Yes, I contacted TP-Link tech support and have had extensive email communication with them over the past few months. Their only "solution" is to keep sending me replacement routers (I am expecting another one now). But all of them have the same bug.

Basically, even if the WAN connection is up, some service in the router periodically pings various "well known sites," probably including TP-Link's own. When some of those pings are unsuccessful, the service forces the connection teardown and releases the WAN IP address. Then the connection is unstable because as soon as it is established, the pinging service tears it down again. This oscillation eventually stops after 9 minutes. So, the bug is likely in that "detector" process that declares that some reference sites are unreachable (perhaps due to their scheduled maintenance or other activities?) and erroneously kills the WAN connection.

I do have a relevant ticket ID, but cannot publish it here. If you are TP-Link representative, you can look it up by email associated with my handle.

@Joseph-TP Your suggestion to connect the PC directly to the "modem" and expose it to hacking from the Internet is simply ridiculous.

How about stopping to blame everything else but the TP-Link router? The "modem" is a fiber ONT. The connection it provides is stable. If it was not, the router would not be able to send the DHCP messages, such as DHCP release or discover shown in the syslog, because the Ethernet link between the ONT and router would be down. BTW, TP-Link tech support also tried to blame that Ethernet cable. So, the Ethernet cable fails at 9:51AM every Friday and otherwise it is OK. Yeah, right.

I have already lost dozens of hours on the back-and-forth emails with tech support. They refuse to investigate what causes the router to tear down the WAN connection without any explanation in the syslog.

  @mrk6 

I do not think that the router is the issue because you have the same issue with multiple routers.

As far as your fear of being hacked, a ten minute test starting at 9:45 does not expose you very much unless you are a very high profile person. Also does the router report haching attacks? Also how much security is the router providing? If you have an old pc, use it and reload the operating system after the test.  

If it was a TP Link router issue, I would think there would be hundreds if not thousands of reports in this forum on the two different models of router you have that had the issue reporting the same issue.
 

Another test to do is disconnect the modem from the router and see if anything changes on your network such as can you link between pcs or print from a pc to a network printer during the down time. 

Also you can use one of those routers set up to have only one pc attached durring the test. Example: Ethernet connect the pc and no wifi.