Buffalo WZR-HP-G300NH

→ Install OpenWrt (generic explanation)

For OpenWRt 21.02 and up, please make sure you choose the right image for your device. To do that, you need to first lookup the specific model code from the label on the back of your device in order to choose the right firmware. The model code is a 4-charactor alphanumerical number (e.g., B0B0, A0D0, etc) on the right hand side of the sticker.

• A0D0: Use “wzr-hp-g300nh-rb”-type images. (“wzr-hp-g300nh-s”-type images will boot, but will enter failsafe mode without network support. If you did that, you will have to use serial terminal to flash firmware and recover).
• B0B0: Use “wzr-hp-g300nh-s”-type images. (“wzr-hp-g300nh-rb”-type images will boot, but will constantly enter failsafe mode).
• B0C0: Use “wzr-hp-g300nh-s”-type images.

If your model code is not listed above, you may:

• If you have DD-WRT installed, SSH/telnet into your device and check the boot log using command dmesg and see which switch is used under the hood.
• Check http://mkplan.com/memo/2024/07/24/6933/

See this thread for more details: https://forum.openwrt.org/t/buffalo-wzr-300hp-and-21-02/107521/8

→ WZR-HP-AG300H - Installation using the TFTP method

NOTE #1: The bootloader of the WZR-HP-G300NH has a very short time frame in which it will accept a new firmware transfer over TFTP: it is about 4 sec long, approximately 10-20 sec after powering it on. Here is a video showing the console output of the boot process, with all LEDs in view for reference. The usable time window gets even shorter when your OS starts negotiating the network connection before it allows you to send data over it. And your OS is going to do that every time, when the other device gets powered on! So to be able to use the entire time span available you need to either add a static arp route or put a switch between the router and you host machine. In case you do not have a switch, in Windows try turning off Media Sensing and in Linux prefer a static network configuration over the NetworkManager. It is further recommended to make a static ARP entry for the router (see below). Users have found that 'smart' or managed switches sometimes will not allow flashing even with static arp entries sometimes – the simpler the switch the better here. NOTE #2: As the Windows stack can interfere with the process, see forum post, it is recommended to use some Linux to perform the upload! FYI: The OEM version of uboot on the G300NH always uses the IP address 192.168.11.1 and the MAC address 02:aa:bb:cc:dd:20 when listening for a new firmware. It also expects the sending IP address to be 192.168.11.2. Values belong to the bootloader and are independent of the ones used by OEM firmware or OpenWrt! The computer used for the install must be connected to the LAN port on the router closest to the WAN port. On my device this is labeled LAN 4, and it corresponds to port 0 per the information below.

1. Download
   either
   1. A suitable OpenWrt firmware image, e.g. OpenWrt-19.07.4-ar71xx-generic-wzr-hp-g300nh-squashfs-tftp.bin or latest trunk (NOTE: Name must contain “tftp”).
      or
   2. A suitable “revert to stock” image. This forum thread has links and information about these.
      or
   3. The U-Boot recovery TFTP server can also receive original Buffalo stock firmware images and flash them.
2. Connect the LAN port next to the WAN port of the router with some network switch and that switch with your host machine. Leave the router powered off.
3. Buffalo WZR-HP-G300NH's U-Boot defaults to IP 192.168.11.1 with MAC 02-aa-bb-cc-dd-1a (confirmed for: old hardware rev B0 B0 with U-Boot 1.06, newer hardware rev A0 D0 with U-Boot 1.07).
   NOTE: Its MAC address is printed on the label of the router as “SSID” ⇒ SSID: 1122334455FF ≙ MAC: 11:22:33:44:55:FF but you may need to use the MAC address 02:AA:BB:CC:DD:1A instead of the one on the label!
4. The TFTP recovery time frame will open roughly 12 seconds after the Diag LED lights up on boot (there's roughly a 2 secs delay after plugging in power) and waits for 4 seconds before closing (note the shorter time window on newer hardware). See video Buffalo WZR-HP-G300NH U-Boot boot sequence with timer.
   If you have serial access to the router then start the TFTP PUT when you see the last line of

   tftp server(receive) go, waiting:4[sec]
   Trying eth1
   eth1 link down
   FAIL
   Trying eth0
   eth0 is duplex
   ag7100_check_link: _100BASET
   Load address: 0x81f00000

To send the firmware to the device, you can use either `curl` or a TFTP client.

1. Find your computer's network interface:

   ip link

   1. You should see something like `enp3s0`, or if using an older system something like `eth0`
2. Prepare your computer's network interface (“Ethernet port”) to use the right IP address

   sudo ip address add dev enp3s0 192.168.11.2/24

   1. If using an older system, you may need to use:

      ifconfig eth0:1 192.168.11.2

3. Temporarily add a static arp entry for the router's MAC address:

   sudo arp -s 192.168.11.1 02:aa:bb:cc:dd:1a

   1. You may need to install some tools if `arp` isn't already installed:

      sudo apt install net-tools

4. Then, prepare sending the upgrade file:
   1. If using curl:

      curl -T openwrt-ar71xx-generic-wzr-hp-g300nh-squashfs-tftp.bin tftp://192.168.11.1

   2. Or, if using a TFTP client:
      1. Install a TFTP client, if you don't already have one installed

         sudo apt-get install tftp

      2. Now you must be quick:

         tftp -m binary 192.168.11.1 -c put openwrt-ar71xx-generic-wzr-hp-g300nh-squashfs-tftp.bin

         and immediately after hitting enter...

5. Power on the G300H!

The advantage of the curl approach is that it uses a more generic tool (and does't timeout as easily?). It also works on OSX.

This was tested on a Windows 7 multi-homed PC with several private networks: 10.0.0.0/24 (with DNS/Gateway), 192.168.0.0/24, 192.168.1.0/24, 192.168.2.0/24, 192.168.11.0/24. Realtek Gigabit NIC 1GBit/s with 1GBit/s switch. Additional VirtualBox network/NIC. Windows 7 Firewall enabled, all default (not even inbound ICMPv4 enabled!).

1. Install a TFTP client, e.g. Tftpd32 or Windows' TFTP client via Add Windows Features (Vista, Windows 7).
2. Start the TFTP client once to allow it for private networks in the Windows firewall.
3. Prepare the network card which is connected to the switch by adding the IP 192.168.11.2 with subnet mask 255.255.255.0 to it.
4. Setup a temporary ARP route to the router on the network card which is connected to the switch. “route print” will show all active NICs in your PC at the top of the output, use the relevant device number (1st value of line) (“11” is used in the example below). For unknown reasons there may be already a wrong ARP route to the router's MAC, so check and remove if present.

   set ROUTERIP=192.168.11.1
   set ROUTERMAC=02-aa-bb-cc-dd-1a
   
   cls & arp -a & echo. & echo Look for %ROUTERMAC% and delete all ip addresses which are not %ROUTERIP% with arp -d ip
   
   @REM On newer Windows (e.g. 7) use netsh. Have to get interface number of LAN network card first.
   route print
   set INTERFACE=11
   netsh interface ipv4 add neighbors %INTERFACE% %ROUTERIP% %ROUTERMAC%
   
   @REM On older Windows (e.g. XP) use arp
   arp -s %ROUTERIP% %ROUTERMAC%

5. Prepare the TFTP client for flashing.
   For Tftpd32 go to the “Tftp Client” tab, enter the router's IP address as “Host”, select the wanted TFTP image as “Local File”, place the mouse over the “Put” button.
   For Windows' TFTP client type the command inside the console:

   tftp -i %ROUTERIP% PUT openwrt-ar71xx-generic-wzr-hp-g300nh-squashfs-tftp.bin

6. Now you must be quick: immediately after starting the TFTP PUT (e.g. by clicking or hitting enter)...
7. power on the G300H!
8. After a succesfull transfer/flash remove the temporary ARP route:

   arp -d %ROUTERIP%

1. If the red “DIAG”-LED begins to flash rapidly then the router has received the image and is flashing the new firmware. If flashing stops then router will boot the new firmware.
2. Obtain IP address per DHCP and follow the First Login steps to complete installation.

1. Enable SSH on the router
2. Login to the router via SSH
3. Change directory to /tmp and download the OpenWrt firmware image file as linked to in the installation section above. We recommend you use the latest stable release unless recommended otherwise at the top of this page, so substitute the URL below with the latest applicable.

   cd /tmp
   wget https://downloads.openwrt.org/releases/19.07.0/targets/ar71xx/generic/openwrt-19.07.0-ar71xx-generic-wzr-hp-g300nh-squashfs-sysupgrade.bin

4. Overwrite current firmware with the downloaded one:

   mtd -r write openwrt-ar71xx-generic-wzr-hp-g300nh-squashfs-sysupgrade.bin linux

After flashing, the router should go down for a reboot and return running OpenWrt.

Newer versions (HW v2, U-Boot 1.07) and Japanese versions of WZR-HP-G300NH are shipped with a locked U-Boot by default, preventing from flashing any unofficial firmware via TFTP. It is possible to flash DD-WRT via buffalo's WebInterface and then flash OpenWrt via mtd, as explained in previous section, but then you loose the ability to re-flash via TFTP if anything goes wrong. After messing a bit with the U-Boot via serial console and comparing U-Boot variables with non-Japanese WZR-HP-G300NH, found out an interesting fact. Simply typing:

ar7100> setenv accept_open_rt_fmt 1
ar7100> saveenv
ar7100> reset

This forces U-Boot to accept any firmware via TFTP. Confirmed with OpenWrt 10.03. (Not checked with newer hardware yet).

Additionally newer versions (e.g. HW v2 with U-Boot 1.07) have only a TFTP time window of 1 (ONE!) second. It will be easier to hit when setting it to 4 seconds like the older versions:

ar7100> setenv tftp_wait 4
ar7100> saveenv
ar7100> reset

There is another way to set U-Boot variables without serial access. Japanese and other languages OAM (Operations, Administration and Maintenance) “user frendly” firmware have a special hidden maintenance page, accessible at http://your.router.ip.address/cgi-bin/cgi?req=frm&frm=py-db/55debug.html, using a special username (bufpy) and password (otdpopy+<root password if any>). Make sure you don't have the usual authenticated root web session active at the same time (clear the browser cache for your router's page), otherwise you'll get an empty page saying “---- UNDER CONSTRUCTION --- ”. Once connected to the special page, you can activate telnetd by clicking the link, and access the OAM OS using telnet. Once there, you can use the “ubootenv” command to set the above mentioned variables easily (tested & confirmed OK on Japanese WZR-HP-G300NH A0 A1, U-Boot 1.02).

# ubootenv -h
Usage:
ubootenv [option] [item] [value]...

    [option]: {set, get, del,list}....
    [item]:   Uboot environment variable name
    [value]:  Value of Uboot environment variable

If something goes wrong, and the red DIAG light goes on immediately at boot time and stays on indefinitely, your flash may have failed or you have a G300NH2 (A1 A0) version.

You can use the TFTP method to recover the router, but you have to use the buffalo factory image that has the file extension 'enc'. This will bring you back the the factory firmware, but you won't have to solder anything or buy a new router.

The red DIAG light may also flash slowly, and your router not boot properly. This appears to also be a sign of a failed upgrade.

You can also use the TFTP method to recover the router here. In this case, you just need a 'tftp' image. This will bring back the router do default state and you will lose any configuration you had before the upgrade (you had backups, right?) but you won't have to solder anything or buy a new router.

→generic.sysupgrade

→checks_and_troubleshooting

Note that the WAN port is connected to eth1 and not eth0, and that the LUCI web interface does not list eth1 for VLANs.
To tag the WAN port create the VLAN ID under “Network ⇒ Switch” and assign it to “CPU”. Under “Network ⇒ Interface” edit the “WAN” interface and use for its “Physical Settings” the “Custom Interface”: eth1.<VLAN ID>
Example: VLAN ID 7 for German Telekom VDSL would be eth1.7

This configuration demonstrates configuring a single port (LAN 1 / Port 3) on the WZR-HP-G300NH as a DMZ using the rtl8366s switch.

Do not forget to follow the Firewall DMZ setup guide if you want your DMZ to be of any use.

config 'interface' 'loopback'
	option 'ifname' 'lo'
	option 'proto' 'static'
	option 'ipaddr' '127.0.0.1'
	option 'netmask' '255.0.0.0'

config 'interface' 'lan'
	option 'ifname' 'eth0.1'
	option 'type' 'bridge'
	option 'proto' 'static'
	option 'ipaddr' '192.168.1.1'
	option 'netmask' '255.255.255.0'

config 'interface' 'wan'
	option 'ifname' 'eth1'
	option 'proto' 'pppoe'
	option 'username' '-------'
	option 'password' '-------'

config 'switch'
	option 'name' 'rtl8366s'
        option 'enable' '1'
        option 'enable_vlan' '1'
        option 'reset' '1'

config 'switch_vlan' 'eth0_1'
	option 'device' 'rtl8366s'
	option 'vlan' '1'
	option 'ports' '0 1 2 5t'

config 'switch_vlan' 'eth0_2'
	option 'device' 'rtl8366s'
	option 'vlan' '2'
	option 'ports' '3 5t'

config 'interface' 'dmz'
       option 'ifname' 'eth0.2'
       option 'proto' 'static'
       option 'ipaddr' 192.168.2.1
       option 'netmask' 255.255.255.0

→flash.layout has an example flash layout and all explanations required to understand this. Here the naked hex-values for the WZR-HP-G300NH:

Pinout (J1 header):

To make the USB eject button functional, first modify /etc/hotplug.d/button/00-button as shown here and activate the USB LED.

Next add a system config for the button with the following commands:

uci add system button    
uci set system.@button[-1].button=BTN_2
uci set system.@button[-1].action=pressed
uci set system.@button[-1].handler=/usr/bin/usb-umount
uci commit system

Then create /usr/bin/usb-umount and paste the following:

# Assumes possibility of up to 1 mounted partition and 1 swap - you will need to modify this if you have more
umount `mount | grep sda | cut -f 1 -d ' '`
swapoff `cat /proc/swaps | grep sda | cut -f 1 -d ' '`
# Check that no sda partitions are in use, then turn off USB LED
sdainuse=0
sdamount=`mount | grep sda | cut -f 1 -d ' '`
sdaswap=`cat /proc/swaps | grep sda | cut -f 1 -d ' '`
if [ -n "$sdamount" ]; then
	sdainuse=1
fi
if [ -n "$sdaswap" ]; then
        sdainuse=1
fi
if [ $sdainuse -lt 1 ]; then
	echo 0 > /sys/class/leds/wzr-hp-g300nh\:blue\:usb/brightness
fi

You need to reboot for the button config to take effect. When you press the button, it will dismount and swapoff any partitions on the SD card, and turn off the USB LED if successful.

To turn on the blue LED when a USB device is attached you can modify /etc/hotplug.d/usb/10-usb (tested with 10.03.1-RC5):

Note: Future versions may allow the use of triggers, see this check-in for uci defaults

For some reason, uboot-envtools config is not present after the package is installed. It is fairly easy to create it manually by accessing the command line:

# cat /proc/mtd
dev:    size   erasesize  name
mtd0: 00040000 00020000 "u-boot"
mtd1: 00020000 00020000 "u-boot-env"
mtd2: 00100000 00020000 "kernel"
mtd3: 01e60000 00020000 "rootfs"
mtd4: 01a40000 00020000 "rootfs_data"
mtd5: 00020000 00020000 "user_property"
mtd6: 00020000 00020000 "art"
mtd7: 01f60000 00020000 "firmware"

# hexdump -C /dev/mtd1 | head
00000410  63 72 63 3d 44 38 42 32  45 30 41 31 00 73 74 64  |crc=D8B2E0A1.std|
00000420  69 6e 3d 73 65 72 69 61  6c 00 73 74 64 6f 75 74  |in=serial.stdout|
00000430  3d 73 65 72 69 61 6c 00  73 74 64 65 72 72 3d 73  |=serial.stderr=s|
00000440  65 72 69 61 6c 00 6c 6f  61 64 61 64 64 72 3d 38  |erial.loadaddr=8|
00000450  31 46 30 30 30 30 30 00  65 74 68 61 63 74 3d 65  |1F00000.ethact=e|
00000460  74 68 30 00 61 63 63 65  70 74 5f 6f 70 65 6e 5f  |th0.accept_open_|
00000470  72 74 5f 66 6d 74 3d 31  00 00 00 00 00 00 00 00  |rt_fmt=1........|
00000480  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
*

By running above commands, we had confirmed that uboot environment is indeed at /dev/mtd1, starting at offset 0x40000 and having size of 0x20000 bytes. Now, use these values to create configuration:

# opkg install uboot-envtools
# TAB=$(echo -e "\t")
# cat > /etc/fw_env.config << EOF
#MTD device name${TAB}Device offset${TAB}Env. size${TAB}Flash sector size
/dev/mtd1${TAB}${TAB}0x40000${TAB}${TAB}0x20000${TAB}${TAB}0x20000
EOF
# fw_printenv
bootargs=console=ttyS0,115200 root=31:03 rootfstype=jffs2 init=/sbin/init mtdparts=ar9100-nor0:256k(u-boot),128k(u-boot-env),1024k(uImage),31104k(rootfs),128k@32640k(ART),128k@32512k(properties)
bootcmd=bootm 0xbe060000
bootdelay=4
baudrate=115200

 . . .

Also, fw_setenv symbolic link doesn't seem to be deployed by the uboot-envtools package, one can set it by:

ln -sf /usr/sbin/fw_printenv /usr/sbin/fw_setenv

Do not use VLAN0 if there is another tagged VLAN; use another number. See ticket 7168.

I was unable to transfer the image using my PC with a gigabit network interface. My laptop, which only has a 100Mb network card worked. It may be possible to transfer the image by switching the port down to 100Mb speed.

On linux, use (As root):

ethtool -s [network interface name. e.g. eth0] speed 100 duplex full autoneg off

My wireless connection always shuts down automatically after a period of time, disable 802.11n capability solves the problem.

uci set wireless.radio0.hwmode=11g
uci commit wireless
wifi

The solution above didn't work for me, I've filed a ticket 8343

https://dev.openwrt.org/ticket/7047

When you login into the router for the first time via telnet and change the password, telnet will be disabled and ssh will be enabled. However, due to a bug in backfire 10.03 this takes 2-3 minutes to happen. If you restart openssh before this is completed you will not have telnet access or ssh access! I would leave the telnet connection open until you can confirm that you can login via ssh.

On OpenWrt the WAN port and LAN ports do not share the same MAC address (printed on the back of the router), the MAC of the WAN port is set to 1 increment higher than the LAN. Example: Printed MAC (00:1D:2C:3B:4A:00), LAN (00:1D:2C:3B:4A:00), WAN (00:1D:2C:3B:4A:01). A hard reset of the cable modem should* allow the router to receive a new lease. Some modems are finicky to what types of devices they hand leases to, so one may try setting the MAC of a PC to the WAN address for OpenWrt, connecting the PC in place of the router, receiving a lease from the modem and then connecting the router again.

When you see the following, press CTRL-C to interrupt.

tftp server(receive) go, waiting:4[sec]
Trying eth1
eth1 link down
FAIL
Trying eth0
eth0 is duplex
ag7100_check_link: _100BASET
Load address: 0×81f00000

Then you’ll get this:

Abort
no file was loaded.
### main_loop entered: bootdelay=4
### main_loop: bootcmd=”bootm 0×81f00000″
Hit any key to stop autoboot: 0

At this point Hit CTRL-C again.

In the event that you mess up the configuration, lose your password or otherwise need to reset your device, and the factory reset button in the hole at the bottom of the device (press min. 30s then power-cycle) doesn't work, you need to use failsafe mode.

The fail safe mode is the same as the WHR-G125 router.

How to add tags