Brand | Model | Version | Current Release | OEM Info | Forum Topic | Technical Data |
---|---|---|---|---|---|---|
Buffalo | WZR-HP-G300NH | v1 | 18.06.5 | https://forum.openwrt.org/viewtopic.php?id=24052 | View/Edit data |
![]() | NOTE: More recent versions of the WZR-HP-G300NH have had a hardware change without bumping the revision number or changing the hardware label.The newer hardware appears to have the rtl8366rb Ethernet switch while older hardware had the rtl8366s switch. New hardware with rtl8366rb switch is supported in OpenWrt trunk since at least r28133. |
Model | Version | SoC | CPU MHz | Flash MB | RAM MB | WLAN Hardware | WLAN2.4 | WLAN5.0 | 100M ports | Gbit ports | Modem | USB |
---|---|---|---|---|---|---|---|---|---|---|---|---|
WZR-HP-G300NH | v1 | Atheros AR9132 rev 2 | 400 | 32 | 64 | Atheros AR9103 | b/g/n | - | - | 5 | - | 1x 2.0 |
→flash.layout has an example flash layout and all explanations required to understand this. Here the naked hex-values for the WZR-HP-G300NH:
Start | End | Description |
---|---|---|
0x000000000000 | 0x000000040000 | “u-boot” |
0x000000040000 | 0x000000060000 | “u-boot-env” |
0x000000060000 | 0x000000160000 | “kernel” |
0x000000160000 | 0x000001fc0000 | “rootfs” |
0x000000880000 | 0x000001fc0000 | “rootfs_data” |
0x000001fc0000 | 0x000001fe0000 | “user_property” |
0x000001fe0000 | 0x000002000000 | “art” |
0x000000060000 | 0x000001fc0000 | “firmware” |
→ WZR-HP-AG300H - Installation using the TFTP method
![]() | NOTE #1: The bootloader of the WZR-HP-G300NH has a very short time frame in which it will accept a new firmware transfer over TFTP: it is about 4 sec long approximately 10-20 sec after powering it onThe usable time window gets even shorter when your OS starts negotiating the network connection before it allows you to send data over it. And your OS is going to do that every time, when the other device gets powered on! So to be able to use the entire time span available you need to put a switch between the router and you host machine. In case you do not have a switch, in Windows try turning off Media Sensing and in Linux prefer a static network configuration over the NetworkManager. It is further recommended to make a static ARP entry for the router. Users have found that 'smart' or managed switches sometimes will not allow flashing even with static arp entries sometimes- the simplest switch is the best to use. Here is a link to the console output of the boot process, with all led's in view for reference http://www.youtube.com/watch?v=8xfSzR2Mu-8. NOTE #2: As the Windows stack can interfere with the process, see forum post, it is recommended to use some Linux to perform the upload!FYI: The OEM version of uboot on the G300NH always uses the IP address 192.168.11.1 and the MAC address 02:aa:bb:cc:dd:20 when listening for a new firmware. It also expects the sending IP address to be 192.168.11.2 . Values belong to the bootloader and are independent of the ones used by OEM firmware or OpenWrt! The computer used for the install must be connected to the LAN port on the router closest to the WAN port. On my device this is labeled LAN 4, and it corresponds to port 0 per the information below. |
NOTE:
Name must contain “tftp”).NOTE:
Its MAC address is printed on the label of the router as “SSID” ⇒ SSID: 1122334455FF ≙ MAC: 11:22:33:44:55:FF but you may need to use the MAC address 02:AA:BB:CC:DD:1A
instead of the one on the label! tftp server(receive) go, waiting:4[sec] Trying eth1 eth1 link down FAIL Trying eth0 eth0 is duplex ag7100_check_link: _100BASET Load address: 0x81f00000
sudo apt-get update sudo apt-get install tftp
sudo ifconfig eth0:1 192.168.11.2
sudo arp -s 192.168.11.1 02:aa:bb:cc:dd:1a
tftp -m binary 192.168.11.1 -c put openwrt-ar71xx-generic-wzr-hp-g300nh-squashfs-tftp.bin
and immediately after hitting enter…
Instead of using the old tftp program you may use curl, this approach also works on OSX. Replace the two last steps by these steps.
curl -T openwrt-ar71xx-generic-wzr-hp-g300nh-squashfs-tftp.bin tftp://192.168.11.1
This was tested on a Windows 7 multi-homed PC with several private networks: 10.0.0.0/24 (with DNS/Gateway), 192.168.0.0/24, 192.168.1.0/24, 192.168.2.0/24, 192.168.11.0/24. Realtek Gigabit NIC 1GBit/s with 1GBit/s switch. Additional VirtualBox network/NIC. Windows 7 Firewall enabled, all default (not even inbound ICMPv4 enabled!).
set ROUTERIP=192.168.11.1 set ROUTERMAC=02-aa-bb-cc-dd-1a cls & arp -a & echo. & echo Look for %ROUTERMAC% and delete all ip addresses which are not %ROUTERIP% with arp -d ip @REM On newer Windows (e.g. 7) use netsh. Have to get interface number of LAN network card first. route print set INTERFACE=11 netsh interface ipv4 add neighbors %INTERFACE% %ROUTERIP% %ROUTERMAC% @REM On older Windows (e.g. XP) use arp arp -s %ROUTERIP% %ROUTERMAC%
tftp -i %ROUTERIP% PUT openwrt-ar71xx-generic-wzr-hp-g300nh-squashfs-tftp.bin
arp -d %ROUTERIP%
/tmp
and download OpenWrt firmware image file:cd /tmp wget http://downloads.openwrt.org/barrier_breaker/14.07/ar71xx/generic/openwrt-ar71xx-generic-wzr-hp-g300nh-squashfs-sysupgrade.bin
mtd -r write openwrt-ar71xx-generic-wzr-hp-g300nh-squashfs-sysupgrade.bin linux
After flashing, the router should go down for a reboot and return running OpenWrt.
Newer versions (HW v2, U-Boot 1.07) and Japanese versions of WZR-HP-G300NH are shipped with a locked u-boot by default, preventing from flashing any unofficial firmware via TFTP. It is possible to flash DD-WRT via buffalo's WebInterface and then flash OpenWrt via mtd
, as explained in previous section, but then you loose the ability to re-flash via TFTP if anything goes wrong. After messing a bit with the u-boot via serial console and comparing u-boot variables with non-Japanese WZR-HP-G300NH, found out an interesting fact. Simply typing:
ar7100> setenv accept_open_rt_fmt 1 ar7100> saveenv ar7100> reset
This forces u-boot to accept any firmware via TFTP. Confirmed with OpenWrt 10.03. (Not checked with newer hardware yet).
Additionally newer versions (e.g. HW v2 with U-Boot 1.07) have only a TFTP time window of 1 (ONE!) second. It will be easier to hit when setting it to 4 seconds like the older versions:
ar7100> setenv tftp_wait 4 ar7100> saveenv ar7100> reset
Also, there is a way to set u-boot variables without serial access. Japanesse and other languages OAM “user frendly” firmware have special hidden maintenance page, accessible at http://your.router.ip.address/cgi-bin/cgi?req=frm&frm=py-db/55debug.html, with special username (bufpy) and password (otdpopy+<root password if any>) log-in required. Make sure you don't have the usual root athenticated WEB session active (clear the browser cache), otherwise you would receive an empty page saying “—- UNDER CONSTRUCTION — ”. Now, one can activate telnetd by clicking the link, and access the OAM OS by telnet. Once there, one can use a command “ubootenv” to set above mentioned variables without trouble (tested & confirmed OK on Japanese WZR-HP-G300NH A0 A1, u-boot 1.02).
# ubootenv -h Usage: ubootenv [option] [item] [value]... [option]: {set, get, del,list}.... [item]: Uboot environment variable name [value]: Value of Uboot environment variable
If something goes wrong, and the red diag light goes on immediately at boot time and stays on indefinitely, your flash may have failed or you have a G300NH2 (A1 A0) version! You can use the TFTP method to recover the router, but you have to use the buffalo factory image that has the file extension 'enc'. This will bring you back the the factory firmware, but you won't have to solder anything or buy a new router.
Note that the WAN port is connected to eth1 and not eth0, and that the LUCI web interface does not list eth1 for VLANs.
To tag the WAN port create the VLAN ID under “Network ⇒ Switch” and assign it to “CPU”.
Under “Network ⇒ Interface” edit the “WAN” interface and use for its “Physical Settings” the “Custom Interface”: eth1.<VLAN ID>
Example: VLAN ID 7 for German Telekom VDSL would be eth1.7
This configuration demonstrates configuring a single port (LAN 1 / Port 3) on the WZR-HP-G300NH as a DMZ using the rtl8366s switch.
Do not forget to follow the Firewall DMZ setup guide if you want your DMZ to be of any use.
config 'interface' 'loopback' option 'ifname' 'lo' option 'proto' 'static' option 'ipaddr' '127.0.0.1' option 'netmask' '255.0.0.0' config 'interface' 'lan' option 'ifname' 'eth0.1' option 'type' 'bridge' option 'proto' 'static' option 'ipaddr' '192.168.1.1' option 'netmask' '255.255.255.0' config 'interface' 'wan' option 'ifname' 'eth1' option 'proto' 'pppoe' option 'username' '-------' option 'password' '-------' config 'switch' option 'name' 'rtl8366s' option 'enable' '1' option 'enable_vlan' '1' option 'reset' '1' config 'switch_vlan' 'eth0_1' option 'device' 'rtl8366s' option 'vlan' '1' option 'ports' '0 1 2 5t' config 'switch_vlan' 'eth0_2' option 'device' 'rtl8366s' option 'vlan' '2' option 'ports' '3 5t' config 'interface' 'dmz' option 'ifname' 'eth0.2' option 'proto' 'static' option 'ipaddr' 192.168.2.1 option 'netmask' 255.255.255.0
port 0 | LAN 4 |
port 1 | LAN 3 |
port 2 | LAN 2 |
port 3 | LAN 1 |
port 4 | Unpopulated/unusable |
port 5 | CPU |
Architecture | MIPS |
---|---|
Vendor | Qualcomm Atheros |
bootloader | crippled U-Boot |
System-On-Chip | AR9132 |
CPU/Speed | MIPS 24Kc V7.4 400 MHz |
Flash-Chip | S29GL256P11TFI01 cfi-flash |
Flash size | 32 MiB |
RAM | 64 MiB |
Wireless | Atheros AR9160 BB/MAC and AR9103 2.4 GHz 3×3 MIMO radio b/g/n |
Ethernet | ? |
Internet | n/a |
USB | Yes 1 x 2.0 |
Serial | Yes, 3.3V, no header |
JTAG | ? |
Pinout (J3 header):
Pin 1 | VCC +3.3V |
Pin 2 | GND |
Pin 3 | TX |
Pin 4 | RX |
Settings | 115200,8,N,1 |
Physical button | Name of button |
---|---|
Reset | reset/BTN_0 (pressed,released) |
AOSS | wps/BTN_1 (pressed,released) |
USB Eject | BTN_2 (pressed,released) |
Movie Engine (on) | BTN_3 released, BTN_4 pressed |
Movie Engine (off) | BTN_3 pressed, BTN_4 released |
Router (on) | BTN_5 released, BTN_6 released |
Router (off) | BTN_5 pressed, BTN_6 released |
Router (auto) | BTN_5 released, BTN_6 pressed |
gpio_button_hotplug (added into table: r30753) | |
Router (on⇒off) | BTN_5 pressed |
Router (off⇒auto) | BTN_5 released, BTN_6 pressed |
Router (auto⇒off) | BTN_6 released, BTN_5 pressed |
Router (off⇒on) | BTN_5 released |
To make the USB eject button functional, first modify /etc/hotplug.d/button/00-button
as shown here and activate the USB LED.
Next add a system config for the button with the following commands:
uci add system button uci set system.@button[-1].button=BTN_2 uci set system.@button[-1].action=pressed uci set system.@button[-1].handler=/usr/bin/usb-umount uci commit system
Then create /usr/bin/usb-umount
and paste the following:
# Assumes possibility of up to 1 mounted partition and 1 swap - you will need to modify this if you have more umount `mount | grep sda | cut -f 1 -d ' '` swapoff `cat /proc/swaps | grep sda | cut -f 1 -d ' '` # Check that no sda partitions are in use, then turn off USB LED sdainuse=0 sdamount=`mount | grep sda | cut -f 1 -d ' '` sdaswap=`cat /proc/swaps | grep sda | cut -f 1 -d ' '` if [ -n "$sdamount" ]; then sdainuse=1 fi if [ -n "$sdaswap" ]; then sdainuse=1 fi if [ $sdainuse -lt 1 ]; then echo 0 > /sys/class/leds/wzr-hp-g300nh\:blue\:usb/brightness fi
You need to reboot for the button config to take effect. When you press the button, it will dismount and swapoff any partitions on the SD card, and turn off the USB LED if successful.
To turn on the blue LED when a USB device is attached you can modify /etc/hotplug.d/usb/10-usb (tested with 10.03.1-RC5):
case “$ACTION” in
add)
# update LEDs
echo 255 > /sys/class/leds/wzr-hp-g300nh\:blue\:usb/brightness
;;
remove)
# update LEDs
echo 0 > /sys/class/leds/wzr-hp-g300nh\:blue\:usb/brightness
;;
esac |
Note: Future versions may allow the use of triggers, see this check-in for uci defaults
For some reason, uboot-envtools config is not present after the package is installed. It is fairly easy to create it manually by accessing the command line:
# cat /proc/mtd dev: size erasesize name mtd0: 00040000 00020000 "u-boot" mtd1: 00020000 00020000 "u-boot-env" mtd2: 00100000 00020000 "kernel" mtd3: 01e60000 00020000 "rootfs" mtd4: 01a40000 00020000 "rootfs_data" mtd5: 00020000 00020000 "user_property" mtd6: 00020000 00020000 "art" mtd7: 01f60000 00020000 "firmware" # hexdump -C /dev/mtd1 | head 00000410 63 72 63 3d 44 38 42 32 45 30 41 31 00 73 74 64 |crc=D8B2E0A1.std| 00000420 69 6e 3d 73 65 72 69 61 6c 00 73 74 64 6f 75 74 |in=serial.stdout| 00000430 3d 73 65 72 69 61 6c 00 73 74 64 65 72 72 3d 73 |=serial.stderr=s| 00000440 65 72 69 61 6c 00 6c 6f 61 64 61 64 64 72 3d 38 |erial.loadaddr=8| 00000450 31 46 30 30 30 30 30 00 65 74 68 61 63 74 3d 65 |1F00000.ethact=e| 00000460 74 68 30 00 61 63 63 65 70 74 5f 6f 70 65 6e 5f |th0.accept_open_| 00000470 72 74 5f 66 6d 74 3d 31 00 00 00 00 00 00 00 00 |rt_fmt=1........| 00000480 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................| *
By running above commands, we had confirmed that uboot environment is indeed at /dev/mtd1, starting at offset 0x40000 and having size of 0x20000 bytes. Now, use these values to create configuration:
# opkg install uboot-envtools # TAB=$(echo -e "\t") # cat > /etc/fw_env.config << EOF #MTD device name${TAB}Device offset${TAB}Env. size${TAB}Flash sector size /dev/mtd1${TAB}${TAB}0x40000${TAB}${TAB}0x20000${TAB}${TAB}0x20000 EOF # fw_printenv bootargs=console=ttyS0,115200 root=31:03 rootfstype=jffs2 init=/sbin/init mtdparts=ar9100-nor0:256k(u-boot),128k(u-boot-env),1024k(uImage),31104k(rootfs),128k@32640k(ART),128k@32512k(properties) bootcmd=bootm 0xbe060000 bootdelay=4 baudrate=115200 . . .
Also, fw_setenv symbolic link doesn't seem to be deployed by the uboot-envtools package, one can set it by:
ln -sf /usr/sbin/fw_printenv /usr/sbin/fw_setenv
Do not use VLAN0 if there is another tagged VLAN; use another number. See ticket 7168.
I was unable to transfer the image using my PC with a gigabit network interface. My laptop, which only has a 100Mb network card worked. It may be possible to transfer the image by switching the port down to 100Mb speed.
On linux, use (As root):
ethtool -s [network interface name. e.g. eth0] speed 100 duplex full autoneg off
My wireless connection always shuts down automatically after a period of time, disable 802.11n capability solves the problem.
uci set wireless.radio0.hwmode=11g uci commit wireless wifi
The solution above didn't work for me, I've filed a ticket 8343
https://dev.openwrt.org/ticket/7047
When you login into the router for the first time via telnet and change the password, telnet will be disabled and ssh will be enabled. However, due to a bug in backfire 10.03 this takes 2-3 minutes to happen. If you restart openssh before this is completed you will not have telnet access or ssh access! I would leave the telnet connection open until you can confirm that you can login via ssh.
On OpenWrt the WAN port and LAN ports do not share the same MAC address (printed on the back of the router), the MAC of the WAN port is set to 1 increment higher than the LAN. Example: Printed MAC (00:1D:2C:3B:4A:00), LAN (00:1D:2C:3B:4A:00), WAN (00:1D:2C:3B:4A:01). A hard reset of the cable modem should* allow the router to receive a new lease. Some modems are finicky to what types of devices they hand leases to, so one may try setting the MAC of a PC to the WAN address for OpenWrt, connecting the PC in place of the router, receiving a lease from the modem and then connecting the router again.
When you see the following, press CTRL-C to interrupt.
tftp server(receive) go, waiting:4[sec] Trying eth1 eth1 link down FAIL Trying eth0 eth0 is duplex ag7100_check_link: _100BASET Load address: 0×81f00000
Then you’ll get this:
Abort no file was loaded. ### main_loop entered: bootdelay=4 ### main_loop: bootcmd=”bootm 0×81f00000″ Hit any key to stop autoboot: 0
At this point Hit CTRL-C again.
In the event that you mess up the configuration, lose your password or otherwise need to reset your device, you need to use failsafe mode.
The fail safe mode is the same as the WHR-G125 router.