OpenWrt on KTDEVX

Automatically Update Onamae.com DNS Records from OpenWrt Using DDNS

ktdevx@gmail.com (Kaito Takemura) — Sun, 11 May 2025 22:33:36 +0900

# Introduction

The Onamae.com Dynamic DNS (DDNS) client supports only Windows. However, using ddns-scripts-onamae, you can update Onamae.com DNS records from a router running OpenWrt.

ddns-scripts-onamae is a submodule of the ddns-scripts package, which supports DDNS management on OpenWrt. It provides a function for automatically updating DNS records for Onamae.com, a widely used domain registrar in Japan.

This allows you to keep a hostname registered with Onamae.com synchronized with the latest IP address using an OpenWrt router, even when your internet connection does not have a static IP address.

This article explains how to automatically update Onamae.com DNS records from OpenWrt using DDNS and ddns-scripts-onamae.

# Install ddns-scripts-onamae

Visit the ddns-scripts-onamae download site and check the latest package version. In this example, v1.0.2 is used.

Access OpenWrt over SSH and download the package with wget.

wget -O /tmp/ddns-scripts-onamae.ipk https://github.com/ktdevx/ddns-scripts-onamae/releases/download/v1.0.2/ddns-scripts-onamae_1.0.2-r1_all.ipk

The ddns-scripts-onamae package is saved as ddns-scripts-onamae.ipk in /tmp. Install it with opkg install.

opkg update
opkg install /tmp/ddns-scripts-onamae.ipk

The ddns-scripts-onamae installation is complete.

# Configure DDNS

Open /etc/config/ddns in a text editor and append the following configuration.

config service "example_com"
option service_name "onamae.com"
option lookup_host "example.com"
option domain "@example.com"
option username "<Onamae.com Navi ID>"
option password "<Onamae.com Navi password>"
option interface "wan"
option ip_source "network"
option ip_network "wan"
option use_ipv6 "0"
option enabled "1"

This adds a service named example_com that updates the example.com domain with the IP address of wan. Change the following settings for your environment.

Setting	Details
lookup_host	Domain name (FQDN) whose IP address is updated
domain	Domain name to update (`subdomain@domain`)
username	Onamae.com Navi ID
password	Onamae.com Navi password
interface / ip_network	Network from which to read the IP address

For a subdomain, configure lookup_host and domain as follows.

 option lookup_host "sub.example.com"
option domain "sub@example.com"

After configuring the service, restart it with the following command.

service ddns restart

The DDNS configuration is complete. DNS records are now updated automatically.

Build a VPN Server on OpenWrt with WireGuard for Remote Access to Your Home Network

ktdevx@gmail.com (Kaito Takemura) — Sat, 03 May 2025 19:26:18 +0900

This article explains how to build a VPN server using WireGuard on a router running OpenWrt and securely access your home network while away from home.

WireGuard is a lightweight, fast, and secure VPN protocol that makes it easy to build a VPN environment at home.

# Install the Package

Log in to the OpenWrt web management interface (LuCI) and install luci-proto-wireguard. This also installs required packages such as wireguard-tools.

Restart the router after the installation is complete.

# Add a Network Interface

In LuCI, go to Network > Interfaces and select Create a new interface… Create an interface with the following settings.

Item	Setting
Name
Protocol	WireGuard VPN

Choose an easy-to-understand name such as vpn or wg. In this example, vpn is used.

Next, configure the following settings on the General Settings tab.

Item	Setting
Listen Port	51820
IP Addresses

Unless you have a specific reason, choose an IP address that does not overlap with an existing network segment. In this example, 10.0.0.1 is used.

Finally, select Generate new key pair to generate the server’s private and public keys.

After configuring the settings, select Save.

# Configure the Firewall

In LuCI, go to Network > Firewall and configure the zones on the General Settings tab.

To apply the same settings as the lan interface, edit the lan zone and add the vpn interface to Covered networks.

Next, open the Traffic Rules tab and add a rule to allow WireGuard connections. Communication from the wan side is disabled by default, so allow communication from wan to the VPN server (OpenWrt).

Select Add and create a rule with the following settings.

Item	Setting
Name	Allow-WireGuard
Protocol	UDP
Source zone	wan
Destination zone	Device (input)
Destination port	51820

After configuring the rule, select Save & Apply.

# Add a Peer

Add information for the client (peer) that is allowed to connect to the VPN server.

In this example, the client’s key pair is generated on the server and the configuration file is shared with the client. Be aware that this temporarily stores the client’s private key on the server.

In LuCI, go to Network > Interfaces and edit the vpn interface created earlier. Open the Peers tab and select Add peer.

When the peer settings screen opens, configure it as follows.

Item	Setting
Description
Allowed IPs
Route Allowed IPs	Enabled
Persistent Keep Alive	25

Give Description a name that identifies the peer. Under Allowed IPs, specify the IP addresses that the peer is allowed to use.

Normally, one peer is created for each public key, so this does not require much consideration. However, the Allowed IPs setting applies subnet masks as follows.

Allowed IPs	Addresses the peer may use
10.0.0.2	10.0.0.2
10.0.0.2/32	Same as above
10.0.0.0/24	10.0.0.0 to 10.0.0.255
10.0.0.2/24	Same as above

In this example, 10.0.0.2 is used.

After configuring the settings, select Generate new key pair and Generate preshared key to generate the keys.

At this point, Generate configuration… under Configuration Export becomes available. Select it.

Item	Setting
Connection endpoint	<VPN-server-IP-address/domain-name>
Allowed IPs

For Connection endpoint, specify the VPN server’s IP address or domain name. Since the VPN server is running on OpenWrt in this example, the IP address assigned by the ISP to wan is used.

For Allowed IPs, specify the IP addresses that should use the VPN. By default, 0.0.0.0/0 and ::/0 are specified, which routes all traffic through the VPN. Change Allowed IPs as needed.

A QR code and the client configuration are displayed near the bottom of the settings screen. The client can easily apply the configuration by importing these.

After applying the configuration on the client, the client’s private key is no longer needed on the server. Delete it and save the peer settings.

Select Save & Apply to apply the settings, then restart the vpn interface as well.

# Connect from the Client

Connect to the VPN server from Android. Write the configuration displayed earlier to a file such as wg.conf and send it to the client.

Search for WireGuard in the Play Store and install the app.

Open the installed app.

Select the plus icon in the lower-right corner, then select Import from file or archive. Select and import the configuration file downloaded from the server.

The configuration has been added. The VPN is disabled immediately after adding it. Select the switch on the right to enable the VPN.

After enabling it, use the SMB client app Network Browser to access the home file server and verify the connection.

The connection works successfully. The VPN server setup is complete.

Build an OpenVPN Server on OpenWrt for Remote Access to Your Home Network

ktdevx@gmail.com (Kaito Takemura) — Wed, 30 Apr 2025 23:28:18 +0900

OpenVPN is an open-source VPN technology that provides an encrypted VPN tunnel and secure access to your home network while away. This article explains how to build an OpenVPN server on an OpenWrt router and connect multiple clients.

Audience: Users with OpenWrt installed and SSH access
Prerequisites: OpenWrt installation, administrator access, and basic terminal/SSH knowledge

# Environment

Item	Value
OS	OpenWrt 24.10.0 or later
VPN protocol	OpenVPN UDP 1194
VPN network	10.8.0.0/24
Encryption	AES-128-CBC
Authentication	SHA256
CA validity	3650 days (10 years)
Certificate validity	825 days

# Install the Packages

Update the OpenWrt package list and install the OpenVPN packages.

opkg update
opkg install openvpn-openssl openvpn-easy-rsa

Package	Description
openvpn-openssl	Main OpenVPN package with SSL/TLS support
openvpn-easy-rsa	Tool for generating and managing the CA and certificates
luci-app-openvpn (optional)	Interface for managing OpenVPN in the LuCI web UI
luci-i18n-openvpn-ja (optional)	Japanese OpenVPN localization for LuCI

# Set the Environment Variables

Edit /etc/profile.d/50-openvpn-easy-rsa.sh in a text editor.

# default PKI dir
export EASYRSA=${EASYRSA:-/etc/easy-rsa}
export EASYRSA_PKI=${EASYRSA_PKI:-$EASYRSA/pki}
export EASYRSA_VARS_FILE=${EASYRSA_VARS_FILE:-$EASYRSA/vars}
export EASYRSA_TEMP_DIR=${EASYRSA_TEMP_DIR:-${TMPDIR:-/tmp/}}

Save the file. The contents of profile.d are applied at login, so log in again or run . /etc/profile.d/50-openvpn-easy-rsa.sh to apply the settings. This sets the Easy-RSA base directory and PKI path in the environment variables.

# Build the Certificate Authority (CA)

Build the CA with Easy-RSA’s build-ca command.

root@router:~# easyrsa build-ca
* Using Easy-RSA configuration:
/etc/easy-rsa/vars
* Using SSL: openssl OpenSSL 3.0.16 11 Feb 2025 (Library: OpenSSL 3.0.16 11 Feb 2025)
Enter New CA Key Passphrase:<passphrase>
Confirm New CA Key Passphrase:<passphrase-confirmation>
Using configuration from /tmp//2f994ff4/temp.5.1
...omitted...
Enter PEM pass phrase:<passphrase>
Verifying - Enter PEM pass phrase:<passphrase-confirmation>
-----
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Common Name (eg: your user, host, or server name) [Easy-RSA CA]:<common-name>
Notice
------
CA creation complete. Your new CA certificate is at:
* /etc/easy-rsa/pki/ca.crt

This creates the CA certificate ca.crt in /etc/easy-rsa/pki and the CA private key ca.key in /etc/easy-rsa/pki/private/. Copy the CA certificate to /etc/openvpn.

root@router:~# cp /etc/easy-rsa/pki/ca.crt /etc/openvpn

The CA setup is complete.

# Create the Server Certificate and Private Key

Generate the server certificate and key with Easy-RSA’s build-server-full command. In this example, the server is named server; nopass is used because no passphrase is configured.

root@router:~# easyrsa build-server-full <server-name> nopass
* Using Easy-RSA configuration:
/etc/easy-rsa/vars
* Using SSL: openssl OpenSSL 3.0.16 11 Feb 2025 (Library: OpenSSL 3.0.16 11 Feb 2025)
...omitted...
-----
Notice
------
Keypair and certificate request completed. Your files are:
* req: /etc/easy-rsa/pki/reqs/<server-name>.req
* key: /etc/easy-rsa/pki/private/<server-name>.key
You are about to sign the following certificate.
Please check over the details shown below for accuracy. Note that this request
has not been cryptographically verified. Please be sure it came from a trusted
source or that you have verified the request checksum with the sender.
Request subject, to be signed as a server certificate
for '825' days:
subject=
commonName = <server-name>
Type the word 'yes' to continue, or any other input to abort.
Confirm request details: yes
Using configuration from /tmp//d5a3377e/temp.4.1
Enter pass phrase for /etc/easy-rsa/pki/private/ca.key:<passphrase>
Check that the request matches the signature
Signature ok
The Subject's Distinguished Name is as follows
commonName :ASN.1 12:'<server-name>'
Certificate is to be certified until Aug 4 09:43:06 2027 GMT (825 days)
Write out database with 1 new entries
Database updated
Notice
------
Certificate created at:
* /etc/easy-rsa/pki/issued/<server-name>.crt
Notice
------
Inline file created:
* /etc/easy-rsa/pki/inline/<server-name>.inline

This creates the server certificate server.crt in /etc/easy-rsa/pki/issued and the server private key server.key in /etc/easy-rsa/pki/private/. Move them to /etc/openvpn.

root@router:~# mv /etc/easy-rsa/pki/issued/server.crt /etc/easy-rsa/pki/private/server.key /etc/openvpn

# Generate the DH Parameters

Generate the random parameters required for encryption with Easy-RSA’s gen-dh command.

root@router:~# easyrsa gen-dh
* Using Easy-RSA configuration:
/etc/easy-rsa/vars
* Using SSL: openssl OpenSSL 3.0.16 11 Feb 2025 (Library: OpenSSL 3.0.16 11 Feb 2025)
Generating DH parameters, 2048 bit long safe prime
...omitted...
DH parameters appear to be ok.
Notice
------
DH parameters of size 2048 created at:
* /etc/easy-rsa/pki/dh.pem

After a while, dh.pem is created in /etc/easy-rsa/pki. Move it to /etc/openvpn.

root@router:~# mv /etc/easy-rsa/pki/dh.pem /etc/openvpn

# Generate the TLS-Auth Key

Generate a TLS-Auth key to use the TLS-Auth feature. It authenticates packets at the start of a VPN session with HMAC and discards unauthorized packets.

openvpn --genkey secret /etc/openvpn/ta.key

This creates ta.key in /etc/openvpn.

# Create the Server Configuration

Create /etc/openvpn/server.conf and configure routes for client connections.

port 1194
proto udp
dev tun
# SSL/TLS certificates and keys
ca /etc/openvpn/ca.crt
cert /etc/openvpn/server.crt
key /etc/openvpn/server.key
dh /etc/openvpn/dh.pem
tls-auth /etc/openvpn/ta.key 0
# VPN client network
server 10.8.0.0 255.255.255.0
ifconfig-pool-persist /var/lib/openvpn/ipp.txt
# Push a route to the home network to VPN clients
push "route 192.168.1.0 255.255.255.0"
push "dhcp-option DNS 8.8.8.8"
push "dhcp-option DNS 8.8.4.4"
# Encryption and authentication
cipher AES-128-CBC
auth SHA256
tls-version-min 1.2
# Keepalive and logging
keepalive 10 120
user nobody
persist-key
persist-tun
status /var/log/openvpn-status.log
log /var/log/openvpn.log
verb 3
explicit-exit-notify 1

Parameter	Value	Description
`port`	1194	UDP port on which OpenVPN listens
`proto`	udp	Protocol (UDP or TCP)
`dev`	tun	VPN tunnel device
`server`	10.8.0.0/24	IP address range for VPN clients
`push "route ..."`	192.168.1.0/24	Notifies clients of the route to the home LAN
`push "dhcp-option DNS"`	8.8.8.8	DNS server used by clients
`cipher`	AES-128-CBC	Encryption method
`auth`	SHA256	HMAC authentication algorithm
`tls-version-min`	1.2	Minimum TLS version
`keepalive`	10 120	Sends keepalives every 10 seconds and considers the connection lost after 120 seconds without a response
`user nobody`	-	Runs OpenVPN as an unprivileged user
`persist-key`	-	Retains key files when restarting
`persist-tun`	-	Retains the virtual interface when restarting
`status`	`/var/log/openvpn-status.log`	Log of connected clients
`verb`	3	Log detail level

## Check the Home LAN Address

Change push "route 192.168.1.0 255.255.255.0" to the address range of your home network. Check it with the following command.

root@router:~# ip a

# Example output
2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP qlen 1000
 link/ether xx:xx:xx:xx:xx:xx brd ff:ff:ff:ff:ff:ff
 inet 192.168.1.1/24 bcast 192.168.1.255 scope global eth0
 valid_lft forever preferred_lft forever

In this example, the home LAN is 192.168.1.0/24. Replace it with the address used in your environment.

# Start and Verify the OpenVPN Server

Start OpenVPN after saving the server configuration.

root@router:~# /etc/init.d/openvpn start
root@router:~# /etc/init.d/openvpn status
running
root@router:~# /etc/init.d/openvpn enable

Check that port 1194 is listening.

root@router:~# netstat -tlnup | grep 1194

# Example output
udp 0 0 0.0.0.0:1194 0.0.0.0:* 1234/openvpn

The setup is successful if the openvpn process is listening on port 1194.

# Add the Network Interface

Check the tun device added by OpenVPN.

root@router:~# ip a
...omitted...
12: tun0: <POINTOPOINT,MULTICAST,NOARP,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UNKNOWN qlen 500
link/[65534]
inet 10.8.0.1 peer 10.8.0.2/32 scope global tun0
valid_lft forever preferred_lft forever
inet6 fe80::7ef9:4674:b626:2a37/64 scope link flags 800
valid_lft forever preferred_lft forever
...omitted...

The device named tun0 has been added. Add it to the network interfaces as vpn by appending the following to /etc/config/network.

config interface 'vpn'
option proto 'none'
option ifname 'tun0'

Restart the network.

root@router:~# service network restart

# Configure the Firewall

Edit /etc/config/firewall. Place the vpn interface in the same zone as lan by adding list network 'vpn' to the lan zone.

config zone
 option name 'lan'
 option input 'ACCEPT'
 option output 'ACCEPT'
 option forward 'ACCEPT'
 list network 'lan'
 list network 'vpn'

Add a rule to allow OpenVPN connections from wan.

config rule
 option name 'Allow-OpenVPN'
 option src 'wan'
 option dest_port '1194'
 option proto 'udp'
 option target 'ACCEPT'

Restart the firewall.

root@router:~# service firewall restart

# Create a Client Certificate and Private Key

Generate the client certificate and key with Easy-RSA’s build-client-full command. In this example, the client is named client and uses nopass.

root@router:~# easyrsa build-client-full <client-name> nopass
* Using Easy-RSA configuration:
/etc/easy-rsa/vars
* Using SSL: openssl OpenSSL 3.0.16 11 Feb 2025 (Library: OpenSSL 3.0.16 11 Feb 2025)
...omitted...
-----
Notice
------
Keypair and certificate request completed. Your files are:
* req: /etc/easy-rsa/pki/reqs/<client-name>.req
* key: /etc/easy-rsa/pki/private/<client-name>.key
You are about to sign the following certificate.
Please check over the details shown below for accuracy. Note that this request
has not been cryptographically verified. Please be sure it came from a trusted
source or that you have verified the request checksum with the sender.
Request subject, to be signed as a client certificate
for '825' days:
subject=
commonName = <client-name>
Type the word 'yes' to continue, or any other input to abort.
Confirm request details: yes
Using configuration from /tmp//23e0cc20/temp.4.1
Enter pass phrase for /etc/easy-rsa/pki/private/ca.key:
Check that the request matches the signature
Signature ok
The Subject's Distinguished Name is as follows
commonName :ASN.1 12:'<client-name>'
Certificate is to be certified until Aug 5 10:10:15 2027 GMT (825 days)
Write out database with 1 new entries
Database updated
Notice
------
Certificate created at:
* /etc/easy-rsa/pki/issued/<client-name>.crt
Notice
------
Inline file created:
* /etc/easy-rsa/pki/inline/<client-name>.inline

This creates client.crt in /etc/easy-rsa/pki/issued and client.key in /etc/easy-rsa/pki/private/.

# Create and Place the Client Configuration

Create a client configuration file (.ovpn) using the certificate and key generated by Easy-RSA.

Copy the client files generated on the server to /tmp.

root@router:~# cp /etc/easy-rsa/pki/issued/client.crt /tmp/
root@router:~# cp /etc/easy-rsa/pki/private/client.key /tmp/
root@router:~# cp /etc/openvpn/ca.crt /tmp/
root@router:~# cp /etc/openvpn/ta.key /tmp/

Create client.ovpn with the following template.

client
dev tun
proto udp
remote <OpenWrt-global-IP-address> 1194
resolv-retry infinite
nobind
# Security settings
remote-cert-tls server
cipher AES-128-CBC
auth SHA256
tls-version-min 1.2
tls-auth ta.key 1
# Client logging
persist-key
persist-tun
verb 3
# CA certificate (inline)
<ca>
-----BEGIN CERTIFICATE-----
(Paste the contents of /etc/openvpn/ca.crt here)
-----END CERTIFICATE-----
</ca>
# Client certificate (inline)
<cert>
-----BEGIN CERTIFICATE-----
(Paste the contents of /etc/easy-rsa/pki/issued/client.crt here)
-----END CERTIFICATE-----
</cert>
# Client private key (inline)
<key>
-----BEGIN PRIVATE KEY-----
(Paste the contents of /etc/easy-rsa/pki/private/client.key here)
-----END PRIVATE KEY-----
</key>
# TLS-Auth key
<tls-auth>
(Paste the contents of /etc/openvpn/ta.key here)
</tls-auth>

Display and copy each file’s contents on the server with the following commands.

root@router:~# cat /etc/openvpn/ca.crt
root@router:~# cat /etc/easy-rsa/pki/issued/client.crt
root@router:~# cat /etc/easy-rsa/pki/private/client.key
root@router:~# cat /etc/openvpn/ta.key

Paste each output into the corresponding section of the .ovpn file.

For a fixed global IP, use remote 203.0.113.1 1194; for a dynamic IP, use a DDNS hostname such as remote example.ddns.jp 1194.

# Test Connections from Clients

Transfer client.ovpn to the client and test the connection.

## Linux and macOS

# Ubuntu/Debian
sudo apt install openvpn

# macOS (Homebrew)
brew install openvpn

sudo openvpn --config client.ovpn

A successful connection displays Initialization Sequence Completed. In another terminal, run ip a and confirm tun0, then use ping 192.168.1.1 to test routing to the home network. Press Ctrl+C to disconnect.

## Windows

Download OpenVPN GUI from the official OpenVPN download page and install it with the default settings.
Copy client.ovpn to C:\Users\<username>\OpenVPN\config\.
Launch OpenVPN GUI, right-click its taskbar icon, select client.ovpn, and select Connect.
In PowerShell, run ipconfig and confirm that a 10.8.0.x address was assigned to the TAP-Win32 Adapter for OpenVPN. Test with ping 192.168.1.1.

## iOS and Android

Install OpenVPN Connect from the App Store or Google Play, transfer client.ovpn to the device, import it in the app, and tap the imported connection profile to connect.

# Troubleshooting

Problem	Cause	Solution
Timeout while connecting	Insufficient firewall or router configuration	Check the firewall configuration and port forwarding
Authentication error (TLS Handshake failed)	Certificate or key mismatch	Recheck the `<ca>`, `<cert>`, and `<key>` sections
Cannot reach the home network	Invalid `push "route ..."` setting	Confirm that the server’s `push "route"` matches the home LAN address
DNS does not work	DNS settings are not being sent	Check `push "dhcp-option DNS"` or configure DNS manually on the client
No internet access after VPN connection	Conflicting default route	Add `redirect-gateway def1` to `client.ovpn`

Check server logs with tail -f /var/log/openvpn.log and cat /var/log/openvpn-status.log. For verbose client logs, use --verb 4 with OpenVPN.

# Dynamic IP Support (DDNS)

If the OpenWrt external IP address changes, use DDNS so clients can connect by hostname.

Automatically Update DNS Records on OpenWrt with DDNS

Change the remote parameter to the DDNS hostname.

# Before (global IP address)
remote 203.0.113.1 1194
# After (DDNS hostname)
remote myhome.ddns.jp 1194

# Security Recommendations

## Renew Certificates Regularly

Generated certificates are valid for 825 days. Generate and deploy new certificates regularly.

openssl x509 -in /etc/openvpn/server.crt -noout -text | grep -A2 "Validity"

## Check Firewall Settings

# UFW
sudo ufw allow 1194/udp

# iptables
sudo iptables -A INPUT -p udp --dport 1194 -j ACCEPT

## Add PAM Authentication (Optional)

To add password authentication, add the following to server.conf.

auth-user-pass-verify /etc/openvpn/checkpsw.sh via-env
script-security 3
username-as-common-name

Install OpenWrt on an Aterm WG2600HP3

ktdevx@gmail.com (Kaito Takemura) — Sat, 22 Mar 2025 00:15:28 +0900

This article explains how to install OpenWrt on an NEC Aterm WG2600HP3.

# Hardware Information

Manufacturer	NEC
Model	Aterm WG2600HP3
CPU	Qualcomm Atheros IPQ8062 1GHz
Flash	32MB
Memory	512MB
Ethernet ports	5 x 1Gbps
Wireless LAN	2.4GHz: b/g/n, 5GHz: a/n/ac

# Download the Images

This example installs OpenWrt 24.10.0. Download the initramfs and sysupgrade images from the official OpenWrt download page.

nec_wg2600hp3-initramfs-uImage
initramfs image.
nec_wg2600hp3-squashfs-sysupgrade.bin
sysupgrade image.

# Set Up a TFTP Server

The initramfs image is written over TFTP, so a TFTP server must be set up.

In this example, a Windows PC and Tftpd64, a TFTP server application for Windows, are used to build the TFTP server.

Set the IP address of the TFTP server PC to 192.168.1.2/24.

Create a directory to publish over TFTP and place the initramfs image in it.

Finally, start the TFTP server in Tftpd64 and publish the initramfs image. See the following article for details.

Set Up a TFTP Server on Windows Using Tftpd64

The TFTP server setup is complete.

# Connect to the Serial Console

Connect to the serial console by exposing the UART pins on the Aterm WG2600HP3.

J3 is the UART connector. From the left, the pins are VCC (3.3V), GND on the second pin, TX on the fourth pin, and RX on the fifth pin. Connect the router to the PC using a USB-TTL serial converter cable or similar device.

Item	Setting
Baud rate	115200bps
Data bits	8bit
Parity bits	none
Stop bits	1bit
Flow control	none

Turn on the Aterm WG2600HP3 and press Esc when the u-boot output appears. The console login screen is displayed. Log in with chiron as the password.

The serial console connection is now complete.

# Install the initramfs Image

Connect the TFTP server and the Aterm WG2600HP3 with a LAN cable. Any LAN port from LAN1 through LAN4 can be used.

After connecting them, run the following commands over the serial connection to install the initramfs image.

boot> setenv bootcmd "nboot 0x44000000 1 0x860000;bootm"
boot> saveenv
Saving Environment to NAND...
Erasing Nand...
Erasing at 0x2a0000 -- 100% complete.
Writing to Nand... done
boot> setenv ipaddr 192.168.1.1
boot> setenv serverip 192.168.1.2
boot> tftpboot 0x44000000 <path-to-initramfs-image>
Using eth1 device
TFTP from server 192.168.1.2; our IP address is 192.168.1.1
Filename '<initramfs-image>'.
Load address: 0x44000000
Loading: #################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
##################################################
done
Bytes transferred = 7406686 (71045e hex)
boot> bootm

The initramfs image is installed from the TFTP server and OpenWrt boots. Wait a while, then press Enter.

BusyBox v1.36.1 (2025-02-03 23:09:37 UTC) built-in shell (ash)
_______ ________ __
| |.-----.-----.-----.| | | |.----.| |_
| - || _ | -__| || | | || _|| _|
|_______|| __|_____|__|__||________||__| |____|
|__| W I R E L E S S F R E E D O M
-----------------------------------------------------
OpenWrt 24.10.0, r28427-6df0e3d02a
-----------------------------------------------------
=== WARNING! =====================================
There is no root password defined on this device!
Use the "passwd" command to set up a new password
in order to prevent unauthorized SSH logins.
--------------------------------------------------
root@OpenWrt:~#

When this screen is displayed, the initramfs image installation is complete.

# Back Up the Manufacturer Firmware

If you may want to return to the manufacturer firmware in the future, create a backup before writing the sysupgrade image.

First, check the flash contents in OpenWrt.

root@OpenWrt:~# cat /proc/mtd
dev: size erasesize name
mtd0: 00020000 00010000 "SBL1"
mtd1: 00020000 00010000 "MIBIB"
mtd2: 00040000 00010000 "SBL2"
mtd3: 00080000 00010000 "SBL3"
mtd4: 00010000 00010000 "DDRCONFIG"
mtd5: 00010000 00010000 "SSD"
mtd6: 00080000 00010000 "TZ"
mtd7: 00080000 00010000 "RPM"
mtd8: 00080000 00010000 "APPSBL"
mtd9: 00010000 00010000 "APPSBLENV"
mtd10: 00030000 00010000 "PRODUCTDATA"
mtd11: 00040000 00010000 "ART"
mtd12: 00040000 00010000 "TP"
mtd13: 00500000 00010000 "TINY"
mtd14: 017a0000 00010000 "firmware"
mtd15: 00200000 00010000 "kernel"
mtd16: 015a0000 00010000 "rootfs"
mtd17: 00860000 00010000 "rootfs_data"

The manufacturer firmware is stored in the firmware partition. Check the device and back it up with dd.

dd if=/dev/mtd14ro of=/tmp/mtd14.dd

After creating the backup, retrieve the manufacturer firmware on the PC with scp.

scp root@192.168.1.1:/tmp/mtd14.dd <destination-to-save-manufacturer-firmware>

The manufacturer firmware backup is complete. Store it carefully.

# Install the sysupgrade Image

Transfer the sysupgrade image from the PC to the Aterm WG2600HP3 with scp.

scp <path-to-sysupgrade-image> root@192.168.1.1:/tmp

After transferring it, write the sysupgrade image on the Aterm WG2600HP3 with sysupgrade.

sysupgrade /tmp/<sysupgrade-image>

The sysupgrade image installation starts. Wait for the installation and reboot to complete.

OpenWrt boots after the reboot. The OpenWrt installation is complete.

# Return to the Manufacturer Firmware

If you created a backup of the manufacturer firmware, you can return to it from OpenWrt.

First, transfer the backed-up manufacturer firmware from the PC to the Aterm WG2600HP3 with scp.

scp <path-to-manufacturer-firmware> root@192.168.1.1:/tmp

After the transfer completes, write the manufacturer firmware to the flash with the mtd command. Write it to the firmware partition.

mtd write /tmp/<manufacturer-firmware> "firmware"

After writing is complete, restart the Aterm WG2600HP3. It boots with the manufacturer firmware after restarting.

Install OpenWrt on a BUFFALO WSR-2533DHP

ktdevx@gmail.com (Kaito Takemura) — Thu, 20 Mar 2025 10:59:25 +0900

This article explains how to install OpenWrt on a BUFFALO WSR-2533DHP.

# Hardware Information

Manufacturer	BUFFALO
Model	WSR-2533DHP
CPU	Media Tek MT7621AT 880MHz
Flash	16MB
Memory	128MB
Ethernet ports	5 x 1Gbps
Wireless LAN	2.4GHz: b/g/n, 5GHz: a/n/ac

# Download the Images

This example installs OpenWrt 24.10.0. Download the initramfs and sysupgrade images from the official OpenWrt download page.

buffalo_wsr-2533dhpl-initramfs-kernel.bin
initramfs image.
buffalo_wsr-2533dhpl-squashfs-sysupgrade.bin
sysupgrade image.

Although the name contains wsr-2533dhpl, it can also be installed on the WSR-2533DHP.

# Set Up a TFTP Server

The initramfs image is written over TFTP, so a TFTP server must be set up.

In this example, a Windows PC and Tftpd64, a TFTP server application for Windows, are used to build the TFTP server.

First, set the IP address of the TFTP server PC to 192.168.11.2/24.

Create a directory to publish over TFTP, rename the initramfs image to linux.trx-recovery, and place it in that directory.

Finally, start the TFTP server in Tftpd64 and publish the initramfs image. See the following article for detailed Tftpd64 setup instructions.

Set Up a TFTP Server on Windows Using Tftpd64

The TFTP server setup is complete.

# Install the initramfs Image

Connect the TFTP server and the WSR-2533DHP with a LAN cable. Any LAN port from LAN1 through LAN4 can be used on the WSR-2533DHP.

While holding down the AOSS button on the WSR-2533DHP, turn it on. Continue holding the AOSS button for a few seconds; the WSR-2533DHP then retrieves the initramfs image from the TFTP server.

After confirming that the transfer is complete, close the TFTP server and return the PC’s IP address setting to automatic.

Now connect to 192.168.1.1 over SSH. The username is root and no password is set.

When this screen is displayed, the initramfs image installation is complete.

# Back Up the Manufacturer Firmware

If you may want to return to the manufacturer firmware in the future, create a backup before writing the sysupgrade image.

First, check the flash contents in OpenWrt.

root@OpenWrt:~# cat /proc/mtd
dev: size erasesize name
mtd0: 00030000 00010000 "u-boot"
mtd1: 00010000 00010000 "u-boot-env"
mtd2: 00010000 00010000 "factory"
mtd3: 007c0000 00010000 "firmware"
mtd4: 00308a14 00010000 "linux"
mtd5: 004b75d0 00010000 "rootfs"
mtd6: 00070000 00010000 "rootfs_data"
mtd7: 007c0000 00010000 "Kernel2"
mtd8: 00010000 00010000 "glbcfg"
mtd9: 00020000 00010000 "board_data"

The manufacturer firmware is stored in the firmware partition. Check the device and back it up with dd.

dd if=/dev/mtd3ro of=/tmp/mtd3.dd

After creating the backup, retrieve the manufacturer firmware on the PC with scp.

scp root@192.168.1.1:/tmp/mtd3.dd <destination-to-save-manufacturer-firmware>

The manufacturer firmware backup is complete. Store it carefully.

# Install the sysupgrade Image

Transfer the sysupgrade image from the PC to the WSR-2533DHP with scp.

scp <path-to-sysupgrade-image> root@192.168.1.1:/tmp

After transferring it, write the sysupgrade image on the WSR-2533DHP with sysupgrade.

sysupgrade /tmp/<sysupgrade-image>

The sysupgrade image installation starts. Wait for the installation and reboot to complete.

After the reboot, access 192.168.1.1 in a browser to verify the installation. When the login screen is displayed, log in with username root and an empty password, as with SSH.

You can now log in successfully. The OpenWrt installation is complete.

# Return to the Manufacturer Firmware

If you created a backup of the manufacturer firmware, you can return to it from OpenWrt.

First, transfer the backed-up manufacturer firmware from the PC to the WSR-2533DHP with scp.

scp <path-to-manufacturer-firmware> root@192.168.1.1:/tmp

After the transfer completes, write the manufacturer firmware to the flash with the mtd command. Write it to the firmware partition.

mtd write /tmp/<manufacturer-firmware> "firmware"

After writing is complete, run reboot to restart the device. It boots with the manufacturer firmware after restarting.

OpenWrt on KTDEVX

Automatically Update Onamae.com DNS Records from OpenWrt Using DDNS

# Introduction

# Install ddns-scripts-onamae

# Configure DDNS

Build a VPN Server on OpenWrt with WireGuard for Remote Access to Your Home Network

# Install the Package

# Add a Network Interface

# Configure the Firewall

# Add a Peer

# Connect from the Client

Build an OpenVPN Server on OpenWrt for Remote Access to Your Home Network

# Environment

# Install the Packages

# Set the Environment Variables

# Build the Certificate Authority (CA)

# Create the Server Certificate and Private Key

# Generate the DH Parameters

# Generate the TLS-Auth Key

# Create the Server Configuration

## Check the Home LAN Address

# Start and Verify the OpenVPN Server

# Add the Network Interface

# Configure the Firewall

# Create a Client Certificate and Private Key

# Create and Place the Client Configuration

# Test Connections from Clients

## Linux and macOS

## Windows

## iOS and Android

# Troubleshooting

# Dynamic IP Support (DDNS)

# Security Recommendations

## Renew Certificates Regularly

## Check Firewall Settings

## Add PAM Authentication (Optional)

# Related Articles and External Links

Install OpenWrt on an Aterm WG2600HP3

# Hardware Information

# Download the Images

# Set Up a TFTP Server

# Connect to the Serial Console

# Install the initramfs Image

# Back Up the Manufacturer Firmware

# Install the sysupgrade Image

# Return to the Manufacturer Firmware

Install OpenWrt on a BUFFALO WSR-2533DHP

# Hardware Information

# Download the Images

# Set Up a TFTP Server

# Install the initramfs Image

# Back Up the Manufacturer Firmware

# Install the sysupgrade Image

# Return to the Manufacturer Firmware