Please see template_device to finish article.

Version/Model	Launch Date	S/N	OpenWrt Version Supported	Model Specific Notes
	200?-?	-	10.03	-
	200?-?	-	trunk	-

NOTE: More recent versions of the WZR-HP-G300NH have had a hardware change without bumping the revision number or changing the hardware label. The newer hardware appears to have the rtl8366rb Ethernet switch while older hardware had the rtl8366s switch. As a result, this newer hardware is NOT supported in OpenWrt 'Backfire' 10.03.1-RC5 but it is supported in OpenWrt trunk since at least r28133

For WZR-HP-G300NH related questions and issues use the "WZR-HP-G300NH Support" forum thread. Please read the complete thread first then ask. Thanks. Here's the thread.

→Flash Layout has an example flash layout and all explanations required to understand this. Here the naked hex-values for the WZR-HP-G300NH:

→ cf. oem.installation.using.the.tftp.method

NOTE #1: The bootloader of the WZR-HP-G300NH has a very short time frame in which it will accept a new firmware transfer over TFTP: it is about 4 sec long approximately 10-20 sec after powering it on The usable time window gets even shorter when your OS starts negotiating the network connection before it allows you to send data over it. And your OS is going to do that every time, when the other device gets powered on! So to be able to use the entire time span available you need to put a switch between the router and you host machine. In case you do not have a switch, in Windows try turning off Media Sensing and in Linux prefer a static network configuration over the NetworkManager. It is further recommended to make a static ARP entry for the router. Users have found that 'smart' or managed switches sometimes will not allow flashing even with static arp entries sometimes- the simplest switch is the best to use. Here is a link to the console output of the boot process, with all led's in view for reference http://www.youtube.com/watch?v=8xfSzR2Mu-8. NOTE #2: As the Windows stack can interfere with the process, see forum post, it is recommended to use some Linux to perform the upload! FYI: The OEM version of uboot on the G300NH always uses the IP address 192.168.11.1 and the MAC address 02:aa:bb:cc:dd:20 when listening for a new firmware. It also expects the sending IP address to be 192.168.11.2. Values belong to the bootloader and are independent of the ones used by OEM firmware or OpenWrt! The computer used for the install must be connected to the LAN port on the router closest to the WAN port. On my device this is labeled LAN 4, and it corresponds to port 0 per the information below.

1. Download
   either a) a suitable OpenWrt firmware image, e.g. latest trunk (NOTE: Name must contain "tftp").
   or b) a suitable "revert to stock" image. This forum thread has links and information about these.
   or c) the U-Boot recovery TFTP server can also receive original Buffalo stock firmware images and flash them.
2. Connect the LAN port next to the WAN port of the router with some network switch and that switch with your host machine. Leave the router powered off.
3. Buffalo WZR-HP-G300NH's U-Boot defaults to IP 192.168.11.1 with MAC 02-aa-bb-cc-dd-1a (confirmed for: old hardware rev B0 B0 with U-Boot 1.06, newer hardware rev A0 D0 with U-Boot 1.07).
   NOTE: Its MAC address is printed on the label of the router as "SSID" ⇒ SSID: 1122334455FF ≙ MAC: 11:22:33:44:55:FF but you may need to use the MAC address 02:AA:BB:CC:DD:1A instead of the one on the label!
4. The TFTP recovery time frame will open roughly 12 seconds after the Diag LED lights up on boot (there's roughly a 2 secs delay after plugging in power) and waits for 4 seconds before closing (note the shorter time window on newer hardware). See video Buffalo WZR-HP-G300NH U-Boot boot sequence with timer.
   If you have serial access to the router then start the TFTP PUT when you see the last line of

   tftp server(receive) go, waiting:4[sec]
   Trying eth1
   eth1 link down
   FAIL
   Trying eth0
   eth0 is duplex
   ag7100_check_link: _100BASET
   Load address: 0x81f00000

1. Install a TFTP client, when running some Linux distribution, do e.g.

   sudo apt-get update
   sudo apt-get install tftp

2. Prepare the interface of your PC:

   sudo ifconfig eth0:1 192.168.11.2

3. Temporarily add a static arp entry for the router's MAC address:

   sudo arp -s 192.168.11.1 02:aa:bb:cc:dd:1a

4. Now you must be quick: Type in

   tftp -m binary 192.168.11.1 -c put openwrt-ar71xx-generic-wzr-hp-g300nh-squashfs-tftp.bin

   and immediately after hitting enter…
5. power on the G300H!

This was tested on a Windows 7 multi-homed PC with several private networks: 10.0.0.0/24 (with DNS/Gateway), 192.168.0.0/24, 192.168.1.0/24, 192.168.2.0/24, 192.168.11.0/24. Realtek Gigabit NIC 1GBit/s with 1GBit/s switch. Additional VirtualBox network/NIC. Windows 7 Firewall enabled, all default (not even inbound ICMPv4 enabled!).

1. Install a TFTP client, e.g. Tftpd32 or Windows' TFTP client via Add Windows Features (Vista, Windows 7).
2. Start the TFTP client once to allow it for private networks in the Windows firewall.
3. Prepare the network card which is connected to the switch by adding the IP 192.168.11.2 with subnet mask 255.255.255.0 to it.
4. Setup a temporary ARP route to the router on the network card which is connected to the switch. "route print" will show all active NICs in your PC at the top of the output, use the relevant device number (1st value of line) ("11" is used in the example below). For unknown reasons there may be already a wrong ARP route to the router's MAC, so check and remove if present.

   set ROUTERIP=192.168.11.1
   set ROUTERMAC=02-aa-bb-cc-dd-1a
   
   cls & arp -a & echo. & echo Look for %ROUTERMAC% and delete all ip addresses which are not %ROUTERIP% with arp -d ip
   
   @REM On newer Windows (e.g. 7) use netsh. Have to get interface number of LAN network card first.
   route print
   set INTERFACE=11
   netsh interface ipv4 add neighbors %INTERFACE% %ROUTERIP% %ROUTERMAC%
   
   @REM On older Windows (e.g. XP) use arp
   arp -s %ROUTERIP% %ROUTERMAC%

5. Prepare the TFTP client for flashing.
   For Tftpd32 go to the "Tftp Client" tab, enter the router's IP address as "Host", select the wanted TFTP image as "Local File", place the mouse over the "Put" button.
   For Windows' TFTP client type the command inside the console:

   tftp -i %ROUTERIP% PUT openwrt-ar71xx-generic-wzr-hp-g300nh-squashfs-tftp.bin

6. Now you must be quick: immediately after starting the TFTP PUT (e.g. by clicking or hitting enter)…
7. power on the G300H!
8. After a succesful transfer/flash remove the temporary ARP route:

   arp -d %ROUTERIP%

1. If the red "DIAG"-LED begins to flash rapidly then the router has received the image and is flashing the new firmware. If flashing stops then router will boot the new firmware.
2. Obtain IP address per DHCP and follow the First Login steps to complete installation.

1. Enable SSH on the router
2. Login to the router via SSH
3. Change directory to /tmp and download OpenWrt firmware image file:

   cd /tmp
   wget http://downloads.openwrt.org/backfire/10.03.1-rc6/ar71xx/openwrt-ar71xx-wzr-hp-g300nh-squashfs-sysupgrade.bin

4. Overwrite current firmware with the downloaded one:

   mtd -r write openwrt-ar71xx-wzr-hp-g300nh-squashfs-sysupgrade.bin linux

After flashing, the router should go down for a reboot and return running OpenWrt.

Newer versions (HW v2, U-Boot 1.07) and Japanese versions of WZR-HP-G300NH are shipped with a locked u-boot by default, preventing from flashing any unofficial firmware via TFTP. It is possible to flash DD-WRT via buffalo's WebInterface and then flash OpenWrt via mtd, as explained in previous section, but then you loose the ability to re-flash via TFTP if anything goes wrong. After messing a bit with the u-boot via serial console and comparing u-boot variables with non-Japanese WZR-HP-G300NH, found out an interesting fact. Simply typing:

ar7100> setenv accept_open_rt_fmt 1
ar7100> saveenv
ar7100> reset

Makes U-Boot accept any firmware via TFTP! Confirmed with OpenWrt 10.03. (Not checked with newer hardware yet).

Additionally newer versions (e.g. HW v2 with U-Boot 1.07) have only a TFTP time window of 1 (ONE!) second. It will be easier to hit when setting it to 4 seconds like the older versions:

ar7100> setenv tftp_wait 4
ar7100> saveenv
ar7100> reset

→generic.sysupgrade

→basic.config

This configuration demonstrates configuring a single port (LAN 1 / Port 3) on the WZR-HP-G300NH as a DMZ using the rtl8366s switch.

config 'interface' 'loopback'
	option 'ifname' 'lo'
	option 'proto' 'static'
	option 'ipaddr' '127.0.0.1'
	option 'netmask' '255.0.0.0'

config 'interface' 'lan'
	option 'ifname' 'eth0.1'
	option 'type' 'bridge'
	option 'proto' 'static'
	option 'ipaddr' '192.168.1.1'
	option 'netmask' '255.255.255.0'

config 'interface' 'wan'
	option 'ifname' 'eth1'
	option 'proto' 'pppoe'
	option 'username' '-------'
	option 'password' '-------'

config 'switch'
	option 'name' 'rtl8366s'
        option 'enable' '1'
        option 'enable_vlan' '1'
        option 'reset' '1'

config 'switch_vlan' 'eth0_1'
	option 'device' 'rtl8366s'
	option 'vlan' '1'
	option 'ports' '0 1 2 5t'

config 'switch_vlan' 'eth0_2'
	option 'device' 'rtl8366s'
	option 'vlan' '2'
	option 'ports' '3 5t'

config 'interface' 'dmz'
       option 'ifname' 'eth0.2'
       option 'proto' 'static'
       option 'ipaddr' 192.168.2.1
       option 'netmask' 255.255.255.0

There is a slight bug (at least as of r23643) where if a button is already "pressed" when the unit boots then the first transition from pressed to released will not generate a hotplug event. All subsequent transitions will be recognized correctly. This only really affects the slide switches, Router and Movie Engine in this case.

To turn on the blue LED when a USB device is attached you can modify /etc/hotplug.d/usb/10-usb (tested with 10.03.1-RC5):

Note: Future versions may allow the use of triggers, see this check-in for uci defaults

Do not use VLAN0 if there is another tagged VLAN; use another number. See ticket 7168.

I was unable to transfer the image using my PC with a gigabit network interface. My laptop, which only has a 100Mb network card worked. It may be possible to transfer the image by switching the port down to 100Mb speed.

On linux, use (As root):

ethtool -s [network interface name. e.g. eth0] speed 100 duplex full autoneg off

My wireless connection always shuts down automatically after a period of time, disable 802.11n capability solves the problem.

uci set wireless.radio0.hwmode=11g
uci commit wireless
wifi

The solution above didn't work for me, I've filed a ticket 8343

https://dev.openwrt.org/ticket/7047

When you login into the router for the first time via telnet and change the password, telnet will be disabled and ssh will be enabled. However, due to a bug in backfire 10.03 this takes 2-3 minutes to happen. If you restart openssh before this is completed you will not have telnet access or ssh access! I would leave the telnet connection open until you can confirm that you can login via ssh.

On DD-WRT, and possibly the stock firmware as well, the WAN and LAN ports share the same MAC address (printed on the back of the router). However, OpenWRT sets the WAN address to 1 increment higher than the LAN. Example: Printed MAC (00:1D:2C:3B:4A:00), LAN (00:1D:2C:3B:4A:00), WAN (00:1D:2C:3B:4A:01). A hard reset of the cable modem should* allow the router to receive a new lease. Some modems are finicky to what types of devices they hand leases to, so one may try setting the MAC of a PC to the WAN address for OpenWRT, connecting the PC in place of the router, receiving a lease from the modem and then connecting the router again.

When you see the following, press CTRL-C to interrupt.

tftp server(receive) go, waiting:4[sec]
Trying eth1
eth1 link down
FAIL
Trying eth0
eth0 is duplex
ag7100_check_link: _100BASET
Load address: 0×81f00000

Then you’ll get this:

Abort
no file was loaded.
### main_loop entered: bootdelay=4
### main_loop: bootcmd=”bootm 0×81f00000″
Hit any key to stop autoboot: 0

At this point Hit CTRL-C again.