Buffalo WZR-HP-G300NH

FIXME Please see template_device to finish article.

Supported Versions

Version/Model Launch Date S/N OpenWrt Version Supported Model Specific Notes
200?-? - 10.03 :?: -
200?-? - trunk :!: -
NOTE: More recent versions of the WZR-HP-G300NH have had a hardware change without bumping the revision number or changing the hardware label.
The newer hardware appears to have the rtl8366rb Ethernet switch while older hardware had the rtl8366s switch. As a result, this newer hardware is NOT supported in OpenWrt 'Backfire' 10.03.1-RC5 but it is supported in OpenWrt trunk since at least r28133

For WZR-HP-G300NH related questions and issues use the "WZR-HP-G300NH Support" forum thread. Please read the complete thread first then ask. Thanks. Here's the thread.

Hardware Highlights

CPU Ram Flash Network USB Serial JTag
Atheros AR9132@400MHz 64MiB 32MiB 4 x 1 Yes Yes (3.3V, no header) ?

Installation

Flash Layout

Flash Layout has an example flash layout and all explanations required to understand this. Here the naked hex-values for the WZR-HP-G300NH:

Start End Description
0x000000000000 0x000000040000 "u-boot"
0x000000040000 0x000000060000 "u-boot-env"
0x000000060000 0x000000160000 "kernel"
0x000000160000 0x000001fc0000 "rootfs"
0x000000880000 0x000001fc0000 "rootfs_data"
0x000001fc0000 0x000001fe0000 "user_property"
0x000001fe0000 0x000002000000 "art"
0x000000060000 0x000001fc0000 "firmware"

Internal Architecture

OEM installation using the TFTP method

→ cf. oem.installation.using.the.tftp.method

NOTE #1: The bootloader of the WZR-HP-G300NH has a very short time frame in which it will accept a new firmware transfer over TFTP: it is about 4 sec long approximately 10-20 sec after powering it on
The usable time window gets even shorter when your OS starts negotiating the network connection before it allows you to send data over it. And your OS is going to do that every time, when the other device gets powered on!
So to be able to use the entire time span available you need to put a switch between the router and you host machine. In case you do not have a switch, in Windows try turning off Media Sensing and in Linux prefer a static network configuration over the NetworkManager. It is further recommended to make a static ARP entry for the router. Users have found that 'smart' or managed switches sometimes will not allow flashing even with static arp entries sometimes- the simplest switch is the best to use.
Here is a link to the console output of the boot process, with all led's in view for reference http://www.youtube.com/watch?v=8xfSzR2Mu-8.
NOTE #2: As the Windows stack can interfere with the process, see forum post, it is recommended to use some Linux to perform the upload!
FYI: The OEM version of uboot on the G300NH always uses the IP address 192.168.11.1 and the MAC address 02:aa:bb:cc:dd:20 when listening for a new firmware. It also expects the sending IP address to be 192.168.11.2. Values belong to the bootloader and are independent of the ones used by OEM firmware or OpenWrt!
The computer used for the install must be connected to the LAN port on the router closest to the WAN port. On my device this is labeled LAN 4, and it corresponds to port 0 per the information below.

Preparation

  1. Download
    either a) a suitable OpenWrt firmware image, e.g. latest trunk (NOTE: Name must contain "tftp").
    or b) a suitable "revert to stock" image. This forum thread has links and information about these.
    or c) the U-Boot recovery TFTP server can also receive original Buffalo stock firmware images and flash them.
  2. Connect the LAN port next to the WAN port of the router with some network switch and that switch with your host machine. Leave the router powered off.
  3. Buffalo WZR-HP-G300NH's U-Boot defaults to IP 192.168.11.1 with MAC 02-aa-bb-cc-dd-1a (confirmed for: old hardware rev B0 B0 with U-Boot 1.06, newer hardware rev A0 D0 with U-Boot 1.07).
    NOTE: Its MAC address is printed on the label of the router as "SSID" ⇒ SSID: 1122334455FF ≙ MAC: 11:22:33:44:55:FF but you may need to use the MAC address 02:AA:BB:CC:DD:1A instead of the one on the label! FIXME
  4. The TFTP recovery time frame will open roughly 12 seconds after the Diag LED lights up on boot (there's roughly a 2 secs delay after plugging in power) and waits for 4 seconds before closing (note the shorter time window on newer hardware). See video Buffalo WZR-HP-G300NH U-Boot boot sequence with timer.
    If you have serial access to the router then start the TFTP PUT when you see the last line of
    tftp server(receive) go, waiting:4[sec]
    Trying eth1
    eth1 link down
    FAIL
    Trying eth0
    eth0 is duplex
    ag7100_check_link: _100BASET
    Load address: 0x81f00000

Linux

  1. Install a TFTP client, when running some Linux distribution, do e.g.
    sudo apt-get update
    sudo apt-get install tftp
  2. Prepare the interface of your PC:
    sudo ifconfig eth0:1 192.168.11.2
  3. Temporarily add a static arp entry for the router's MAC address:
    sudo arp -s 192.168.11.1 02:aa:bb:cc:dd:1a
  4. Now you must be quick: Type in
    tftp -m binary 192.168.11.1 -c put openwrt-ar71xx-generic-wzr-hp-g300nh-squashfs-tftp.bin
    and immediately after hitting enter…
  5. power on the G300H!

Instead of using the old tftp program you may use curl, this approach also works on OSX. Replace the two last steps by these steps.

  1. curl -T openwrt-ar71xx-generic-wzr-hp-g300nh-squashfs-tftp.bin tftp://192.168.11.1
  2. power on the G300H

</code>

Windows

This was tested on a Windows 7 multi-homed PC with several private networks: 10.0.0.0/24 (with DNS/Gateway), 192.168.0.0/24, 192.168.1.0/24, 192.168.2.0/24, 192.168.11.0/24. Realtek Gigabit NIC 1GBit/s with 1GBit/s switch. Additional VirtualBox network/NIC. Windows 7 Firewall enabled, all default (not even inbound ICMPv4 enabled!).

  1. Install a TFTP client, e.g. Tftpd32 or Windows' TFTP client via Add Windows Features (Vista, Windows 7).
  2. Start the TFTP client once to allow it for private networks in the Windows firewall.
  3. Prepare the network card which is connected to the switch by adding the IP 192.168.11.2 with subnet mask 255.255.255.0 to it.
  4. Setup a temporary ARP route to the router on the network card which is connected to the switch. "route print" will show all active NICs in your PC at the top of the output, use the relevant device number (1st value of line) ("11" is used in the example below). For unknown reasons there may be already a wrong ARP route to the router's MAC, so check and remove if present.
    set ROUTERIP=192.168.11.1
    set ROUTERMAC=02-aa-bb-cc-dd-1a
    
    cls & arp -a & echo. & echo Look for %ROUTERMAC% and delete all ip addresses which are not %ROUTERIP% with arp -d ip
    
    @REM On newer Windows (e.g. 7) use netsh. Have to get interface number of LAN network card first.
    route print
    set INTERFACE=11
    netsh interface ipv4 add neighbors %INTERFACE% %ROUTERIP% %ROUTERMAC%
    
    @REM On older Windows (e.g. XP) use arp
    arp -s %ROUTERIP% %ROUTERMAC%
  5. Prepare the TFTP client for flashing.
    For Tftpd32 go to the "Tftp Client" tab, enter the router's IP address as "Host", select the wanted TFTP image as "Local File", place the mouse over the "Put" button.
    For Windows' TFTP client type the command inside the console:
    tftp -i %ROUTERIP% PUT openwrt-ar71xx-generic-wzr-hp-g300nh-squashfs-tftp.bin
  6. Now you must be quick: immediately after starting the TFTP PUT (e.g. by clicking or hitting enter)…
  7. power on the G300H!
  8. After a succesful transfer/flash remove the temporary ARP route:
    arp -d %ROUTERIP%

TFTP image received by router

  1. If the red "DIAG"-LED begins to flash rapidly then the router has received the image and is flashing the new firmware. If flashing stops then router will boot the new firmware.
  2. Obtain IP address per DHCP and follow the First Login steps to complete installation.

Migrate from DD-WRT to OpenWrt

  1. Enable SSH on the router
  2. Login to the router via SSH
  3. Change directory to /tmp and download OpenWrt firmware image file:
    cd /tmp
    wget http://downloads.openwrt.org/backfire/10.03.1/ar71xx/openwrt-ar71xx-wzr-hp-g300nh-squashfs-sysupgrade.bin
  4. Overwrite current firmware with the downloaded one:
    mtd -r write openwrt-ar71xx-wzr-hp-g300nh-squashfs-sysupgrade.bin linux

After flashing, the router should go down for a reboot and return running OpenWrt.

Locked U-Boot, too short time TFTP window

Newer versions (HW v2, U-Boot 1.07) and Japanese versions of WZR-HP-G300NH are shipped with a locked u-boot by default, preventing from flashing any unofficial firmware via TFTP. It is possible to flash DD-WRT via buffalo's WebInterface and then flash OpenWrt via mtd, as explained in previous section, but then you loose the ability to re-flash via TFTP if anything goes wrong. After messing a bit with the u-boot via serial console and comparing u-boot variables with non-Japanese WZR-HP-G300NH, found out an interesting fact. Simply typing:

ar7100> setenv accept_open_rt_fmt 1
ar7100> saveenv
ar7100> reset

This forces u-boot to accept any firmware via TFTP. Confirmed with OpenWrt 10.03. (Not checked with newer hardware yet).

Additionally newer versions (e.g. HW v2 with U-Boot 1.07) have only a TFTP time window of 1 (ONE!) second. It will be easier to hit when setting it to 4 seconds like the older versions:

ar7100> setenv tftp_wait 4
ar7100> saveenv
ar7100> reset

Also, there is a way to set u-boot variables without serial access. Japanesse and other languages OAM "user frendly" firmware have special hidden maintenance page, accessible at http://your.router.ip.address/cgi-bin/cgi?req=frm&frm=py-db/55debug.html, with special username (bufpy) and password (otdpopy+<root password if any>) log-in required. Make sure you don't have the usual root athenticated WEB session active (clear the browser cache), otherwise you would receive an empty page saying "—- UNDER CONSTRUCTION — ". Now, one can activate telnetd by clicking the link, and access the OAM OS by telnet. Once there, one can use a command "ubootenv" to set above mentioned variables without trouble (tested & confirmed OK on Japanese WZR-HP-G300NH A0 A1, u-boot 1.02).

# ubootenv -h
Usage:
ubootenv [option] [item] [value]...

    [option]: {set, get, del,list}....
    [item]:   Uboot environment variable name
    [value]:  Value of Uboot environment variable

Failed upgrade ( solid red diag light ) on newer versions

If something goes wrong, and the red diag light goes on immediately at boot time and stays on indefinitely, your flash may have failed or you have a G300NH2 (A1 A0) version! You can use the TFTP method to recover the router, but you have to use the buffalo factory image that has the file extension 'enc'. This will bring you back the the factory firmware, but you won't have to solder anything or buy a new router.

Upgrade OpenWrt

Basic Configuration

Specific Configuration

Sample Single DMZ Port Configuration

This configuration demonstrates configuring a single port (LAN 1 / Port 3) on the WZR-HP-G300NH as a DMZ using the rtl8366s switch.

:!: Do not forget to follow the Firewall DMZ setup guide if you want your DMZ to be of any use.

config 'interface' 'loopback'
	option 'ifname' 'lo'
	option 'proto' 'static'
	option 'ipaddr' '127.0.0.1'
	option 'netmask' '255.0.0.0'

config 'interface' 'lan'
	option 'ifname' 'eth0.1'
	option 'type' 'bridge'
	option 'proto' 'static'
	option 'ipaddr' '192.168.1.1'
	option 'netmask' '255.255.255.0'

config 'interface' 'wan'
	option 'ifname' 'eth1'
	option 'proto' 'pppoe'
	option 'username' '-------'
	option 'password' '-------'

config 'switch'
	option 'name' 'rtl8366s'
        option 'enable' '1'
        option 'enable_vlan' '1'
        option 'reset' '1'

config 'switch_vlan' 'eth0_1'
	option 'device' 'rtl8366s'
	option 'vlan' '1'
	option 'ports' '0 1 2 5t'

config 'switch_vlan' 'eth0_2'
	option 'device' 'rtl8366s'
	option 'vlan' '2'
	option 'ports' '3 5t'

config 'interface' 'dmz'
       option 'ifname' 'eth0.2'
       option 'proto' 'static'
       option 'ipaddr' 192.168.2.1
       option 'netmask' 255.255.255.0

Network Port Assignments

port 0 LAN 4
port 1 LAN 3
port 2 LAN 2
port 3 LAN 1
port 4 Unpopulated/unusable
port 5 CPU

Hardware

Info

Architecture: MIPS
Vendor: Qualcomm Atheros
Bootloader: crippled U-Boot
System-On-Chip: AR9132
CPU/Speed MIPS 24Kc V7.4 400 Mhz
Flash-Chip: ST 25P64V6P
Flash size: 32 MiB
RAM: 64 MiB
Wireless: Atheros AR9160 BB/MAC and AR9103 2.4 GHz 3x3 MIMO radio b/g/n
Ethernet: ?
Internet: n/a
USB: Yes 1 x 2.0
Serial: Yes, 3.3V, no header
JTAG: ?

Photos

wzr-hp-g300nh_back.jpg wzr-hp-g300nh_down.jpg wzr-hp-g300nh_up.jpg

Serial Pinout (J3 header)

Pin 1 VCC +3.3V
Pin 2 GND
Pin 3 TX
Pin 4 RX
Settings 115200,8,N,1

Buttons

Physical button Name of button
Reset reset/BTN_0 (pressed,released)
AOSS wps/BTN_1 (pressed,released)
USB Eject BTN_2 (pressed,released)
Movie Engine (on) BTN_3 released, BTN_4 pressed
Movie Engine (off) BTN_3 pressed, BTN_4 released
Router (on) BTN_5 released, BTN_6 released
Router (off) BTN_5 pressed, BTN_6 released
Router (auto) BTN_5 released, BTN_6 pressed
gpio_button_hotplug (added into table: r30753)
Router (on⇒off) BTN_5 pressed
Router (off⇒auto) BTN_5 released, BTN_6 pressed
Router (auto⇒off) BTN_6 released, BTN_5 pressed
Router (off⇒on) BTN_5 released

There is a slight bug (at least as of r23643) where if a button is already "pressed" when the unit boots then the first transition from pressed to released will not generate a hotplug event. All subsequent transitions will be recognized correctly. This only really affects the slide switches, Router and Movie Engine in this case.

With r30753 Movie engine and Router buttons work as excepted. FIXME Is it possible to read state of the switch?

USB Eject Button

To make the USB eject button functional, first modify /etc/hotplug.d/button/00-button as shown here and activate the USB LED.

Next add a system config for the button with the following commands:


uci add system button    
uci set system.@button[-1].button=BTN_2
uci set system.@button[-1].action=pressed
uci set system.@button[-1].handler=/usr/bin/usb-umount
uci commit system

Then create /usr/bin/usb-umount and paste the following:


# Assumes possibility of up to 1 mounted partition and 1 swap - you will need to modify this if you have more
umount `mount | grep sda | cut -f 1 -d ' '`
swapoff `cat /proc/swaps | grep sda | cut -f 1 -d ' '`
# Check that no sda partitions are in use, then turn off USB LED
sdainuse=0
sdamount=`mount | grep sda | cut -f 1 -d ' '`
sdaswap=`cat /proc/swaps | grep sda | cut -f 1 -d ' '`
if [ -n "$sdamount" ]; then
	sdainuse=1
fi
if [ -n "$sdaswap" ]; then
        sdainuse=1
fi
if [ $sdainuse -lt 1 ]; then
	echo 0 > /sys/class/leds/wzr-hp-g300nh\:blue\:usb/brightness
fi

You need to reboot for the button config to take effect. When you press the button, it will dismount and swapoff any partitions on the SD card, and turn off the USB LED if successful.

LEDs

To turn on the blue LED when a USB device is attached you can modify /etc/hotplug.d/usb/10-usb (tested with 10.03.1-RC5):

case "$ACTION" in add) # update LEDs echo 255 > /sys/class/leds/wzr-hp-g300nh\:blue\:usb/brightness ;; remove) # update LEDs echo 0 > /sys/class/leds/wzr-hp-g300nh\:blue\:usb/brightness ;; esac

Note: Future versions may allow the use of triggers, see this check-in for uci defaults

Troubleshooting/Bugs

uboot-envtools missing config by default

For some reason, uboot-envtools config is not present after the package is installed. It is fairly easy to create it manually by accessing the command line:

# cat /proc/mtd
dev:    size   erasesize  name
mtd0: 00040000 00020000 "u-boot"
mtd1: 00020000 00020000 "u-boot-env"
mtd2: 00100000 00020000 "kernel"
mtd3: 01e60000 00020000 "rootfs"
mtd4: 01a40000 00020000 "rootfs_data"
mtd5: 00020000 00020000 "user_property"
mtd6: 00020000 00020000 "art"
mtd7: 01f60000 00020000 "firmware"

# hexdump -C /dev/mtd1 | head
00000410  63 72 63 3d 44 38 42 32  45 30 41 31 00 73 74 64  |crc=D8B2E0A1.std|
00000420  69 6e 3d 73 65 72 69 61  6c 00 73 74 64 6f 75 74  |in=serial.stdout|
00000430  3d 73 65 72 69 61 6c 00  73 74 64 65 72 72 3d 73  |=serial.stderr=s|
00000440  65 72 69 61 6c 00 6c 6f  61 64 61 64 64 72 3d 38  |erial.loadaddr=8|
00000450  31 46 30 30 30 30 30 00  65 74 68 61 63 74 3d 65  |1F00000.ethact=e|
00000460  74 68 30 00 61 63 63 65  70 74 5f 6f 70 65 6e 5f  |th0.accept_open_|
00000470  72 74 5f 66 6d 74 3d 31  00 00 00 00 00 00 00 00  |rt_fmt=1........|
00000480  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
*

By running above commands, we had confirmed that uboot environment is indeed at /dev/mtd1, starting at offset 0x40000 and having size of 0x20000 bytes. Now, use these values to create configuration:

# opkg install uboot-envtools
# TAB=$(echo -e "\t")
# cat > /etc/fw_env.config << EOF
#MTD device name${TAB}Device offset${TAB}Env. size${TAB}Flash sector size
/dev/mtd1${TAB}${TAB}0x40000${TAB}${TAB}0x20000${TAB}${TAB}0x20000
EOF
# fw_printenv
bootargs=console=ttyS0,115200 root=31:03 rootfstype=jffs2 init=/sbin/init mtdparts=ar9100-nor0:256k(u-boot),128k(u-boot-env),1024k(uImage),31104k(rootfs),128k@32640k(ART),128k@32512k(properties)
bootcmd=bootm 0xbe060000
bootdelay=4
baudrate=115200

 . . .

Also, fw_setenv symbolic link doesn't seem to be deployed by the uboot-envtools package, one can set it by:

ln -sf /usr/sbin/fw_printenv /usr/sbin/fw_setenv

After VLAN setup, router is inaccessible

Do not use VLAN0 if there is another tagged VLAN; use another number. See ticket 7168.

Unable to transfer image via TFTP (transfer times out then router boots normally)

I was unable to transfer the image using my PC with a gigabit network interface. My laptop, which only has a 100Mb network card worked. It may be possible to transfer the image by switching the port down to 100Mb speed.

On linux, use (As root):

ethtool -s [network interface name. e.g. eth0] speed 100 duplex full autoneg off

Wireless network down after a period of time (10sec ~ 5min)

My wireless connection always shuts down automatically after a period of time, disable 802.11n capability solves the problem.

uci set wireless.radio0.hwmode=11g
uci commit wireless
wifi

The solution above didn't work for me, I've filed a ticket 8343

SSH does not start after changing the password

https://dev.openwrt.org/ticket/7047

When you login into the router for the first time via telnet and change the password, telnet will be disabled and ssh will be enabled. However, due to a bug in backfire 10.03 this takes 2-3 minutes to happen. If you restart openssh before this is completed you will not have telnet access or ssh access! I would leave the telnet connection open until you can confirm that you can login via ssh.

WAN DHCP Won't Renew

On OpenWrt the WAN port and LAN ports do not share the same MAC address (printed on the back of the router), the MAC of the WAN port is set to 1 increment higher than the LAN. Example: Printed MAC (00:1D:2C:3B:4A:00), LAN (00:1D:2C:3B:4A:00), WAN (00:1D:2C:3B:4A:01). A hard reset of the cable modem should* allow the router to receive a new lease. Some modems are finicky to what types of devices they hand leases to, so one may try setting the MAC of a PC to the WAN address for OpenWrt, connecting the PC in place of the router, receiving a lease from the modem and then connecting the router again.

U-Boot Console

When you see the following, press CTRL-C to interrupt.

tftp server(receive) go, waiting:4[sec]
Trying eth1
eth1 link down
FAIL
Trying eth0
eth0 is duplex
ag7100_check_link: _100BASET
Load address: 0×81f00000

Then you’ll get this:

Abort
no file was loaded.
### main_loop entered: bootdelay=4
### main_loop: bootcmd=”bootm 0×81f00000″
Hit any key to stop autoboot: 0

At this point Hit CTRL-C again.

Fail safe mode

In the event that you mess up the configuration, lose your password or otherwise need to reset your device, you need to use failsafe mode.

The fail safe mode is the same as the WHR-G125 router. http://wiki.openwrt.org/toh/buffalo/whr-g125#failsafe.mode

Tags

For some Help with the Tags, please have a look here: tags

Back to top

toh/buffalo/wzr-hp-g300h.txt · Last modified: 2014/10/12 13:06 by theoradicus