Zyxel PMG3000-D20B firmware image files

Zyxel PMG3000-D20B firmware image files.md

Zyxel PMG3000-D20B firmware image files

The firmware of this GPON ONT SFP module can be updated using the web interface (Management | Update Software):

The web interface only accepts image files with a special header. These can be created by adding the header to a flash dump.

Firmware collection

.img unmodified mtd2 / mtd3 flash dump
.upf with header (can be installed using the web interface)

V1.00 is based on OpenWrt 12.09. Deutsche Telekom (Germany) seems to stick with this branch.

V1.00(ABVJ.0)b3s (2020-12-23)

V1.00(ABVJ.0)b3v (2021-05-08)

V1.00(ABVJ.1)b1e (2023-07-26) (no ssh)

V1.00(ABVJ.1)b1i (2026-02-06) (no ssh, known compatibility issues)

V2.50 is based on OpenWrt 14.07. Wind Tre (Italy) upgraded to this branch at the end of 2022.

V2.50(ABVJ.1)b1d (2023-04-21)

V2.50(ABVJ.1)b1f (2023-07-14)

Both branches are maintained separately, so a 1.00 image can have a later build date than a 2.50 image.

Please leave a comment if you have any other flash dumps.

Creating image files

Create flash dump of mtd2 or mtd3 (Image A / Image B):

dd if=/dev/mtd2 of=/tmp/mtd2

Download flash dump from SFP (e. g. using TFTP).

Download header file and add it to flash dump:

cat header mtd2 > firmware.upf

Copy software version string from flash dump to header:

dd if=firmware.upf of=firmware.upf bs=1 skip=632 seek=124 count=32 conv=notrunc

Get CRC32 of firmware.upf:

v=$(cat firmware.upf | gzip | tail -c 8 | head -c 4 | hexdump -e '1/4 "%08x"')

Convert CRC32 to binary and write it to header:

echo -e -n "\x${v:0:2}\x${v:2:2}\x${v:4:2}\x${v:6:2}" | dd of=firmware.upf bs=1 seek=104 conv=notrunc

header

Zyxel_PMG3000-D20B_V1.00(ABVJ.0)b3s_2020-12-23.zip

Zyxel_PMG3000-D20B_V1.00(ABVJ.0)b3v_2021-05-08.zip

Zyxel_PMG3000-D20B_V1.00(ABVJ.1)b1e_2023-07-26.zip

Zyxel_PMG3000-D20B_V1.00(ABVJ.1)b1i_2026-02-06.zip

Zyxel_PMG3000-D20B_V2.50(ABVJ.1)b1d_2023-04-21.zip

Zyxel_PMG3000-D20B_V2.50(ABVJ.1)b1f_2023-07-14.zip

@maurice-w Sorry, I'm an idiot, it's all good!

@maurice-w Thanks for providing those firmwares! Did you notice any difference with ipv6 support in these firmware versions?

Hey @bentau, IPv6 works fine in all of them, >99% of my traffic is IPv6. GPON shouldn't really care about layer 3, it handles Ethernet frames regardless of their contents.

My ISP does use PPPoE though, so any potential bugs regarding plain IPv6-over-Ethernet would have gone unnoticed.

Or do you mean the management (web interface / ssh)? Unfortunately, that's IPv4-only in all versions.

I noticed that this GPON module does not work with my provider with IPv6. I don't get any IPv6 IP with it. v4 just works.
However, the one that I bought from fs.com actually does work with IPv6 (same router and provider).

Also, https://hack-gpon.org/ont-zyxel-pmg3000-d20b/ says that someone also had problems with IPv6.

@bentau Do you use PPPoE or plain IP over Ethernet?

A different SFP working with the same router and ISP might indeed indicate an issue with the Zyxel SFP. Have you tried all firmware versions?

@maurice-w I think I use plain IP over Ethernet. At least I didn't have to configure PPPoE on my mikrotik router

I haven't tested the firmware versions yet. Since I have a working module, getting the Zyxel to work is low priority now.

@bentau That makes sense. Since my module doesn't ever see "naked" IPv6 packets (everything is encapsulated in PPPoE), I wouldn't notice potential bugs with that.

Firmware links are down, anybody has a mirror?

@AyrtonRicardo The links were never down, just a bit... special. But since you're the third person asking for assistance with the download, I've decided to change the way the binaries are embedded in the gist. Should be easier now.

Thank you very much for maintaining this open. I took the file from one of your comments, I honestly appreciate the dedication.

@maurice-w
xvzf/zyxel-gpon-sfp#41
ssh not available on V1.00(ABVJ.1)b1i 😿

@github-tomster
You mean V1.00(ABVJ.1)b1i doesn't have ssh? That's not surprising, given that they already removed it in V1.00(ABVJ.1)b1e.
If you want to provide an image of V1.00(ABVJ.1)b1i, you can install a version with ssh to the other partition, boot it and then create an image of the inactive partition. You always have access to both partitions (mtd2 / mtd3) from ssh.
Thanks!

@maurice-w
indeed no ssh available [i edited my comment].
so i guess it is not possible for me to
provide a dump. just the info about that new version.

@github-tomster
The module has two firmware partitions, an active and an inactive one. Performing an upgrade / downgrade writes the new image to the inactive partition and then makes it active. So there are always two images installed and you can dump both of them, no matter which one is currently active.

Example:
V1.00(ABVJ.1)b1i is in mtd2 (Image A) and currently active. You then downgrade to V1.00(ABVJ.0)b3v using the web interface, which will write the image to mtd3 (Image B). After the reboot, mtd3 (Image B) is active and V1.00(ABVJ.0)b3v is running. But V1.00(ABVJ.1)b1i is still in mtd2 and can be dumped.
Of course it can be the other way around (V1.00(ABVJ.1)b1i in mtd3 and V1.00(ABVJ.0)b3v in mtd2), this you'll have to check.

omci
show me classid 7

@maurice-w
if it works i can provide the dump next week. 🤞

@maurice-w
let us know if this is the right data:
https://nowtransfer.de/ac7846389c90

@github-tomster
Looks good, thanks a lot! I added it to the collection. Didn't test it yet though. I'm a bit worried I might lock myself out.

@github-tomster
I updated my module and it works fine in a MikroTik hEX S (first generation).

@maurice-w
happy to see it was useful 🥳

you wrote you are using the 2.50 branch. so can you confirm these
have ssh and can be cross-flashed with the 1.00 ❓

I was using V2.50(ABVJ.1)b1f, yes. This has SSH and worked just fine (Deutsche Telekom infrastructure / ISP Telefonica o2). Switching between V1.00 and V2.50 images works just like any other update.

I've now switched to V1.00(ABVJ.1)b1i and will probably keep using this. Works fine for me and I don't really need SSH (although it would be nice of course).

I was using V2.50(ABVJ.1)b1f, yes. This has SSH and worked just fine (Deutsche Telekom infrastructure / ISP Telefonica o2). Switching between V1.00 and V2.50 images works just like any other update.

I've now switched to V1.00(ABVJ.1)b1i and will probably keep using this. Works fine for me and I don't really need SSH (although it would be nice of course).

Does V1.00(ABVJ.1)b1i handle 2.5G ? Currently running V1.00(ABVJ.0)b3v and trying to get 2.5G working which does not seem to work correctly on that version.

Also strange that I am still on V1.00(ABVJ.0)b3v even though Telekom is my ISP.

@digaus I never tried 2.5G since I use the module in a "traditional" SFP slot (1G only).
But I think 2.5G needs to be enabled via SSH and since b1i doesn't have this, your chances are probably better with b3v.
Or you could try a V2.50 image.

Who gets automatic updates and who doesn't does indeed seem to be somewhat random.

@digaus I never tried 2.5G since I use the module in a "traditional" SFP slot (1G only). But I think 2.5G needs to be enabled via SSH and since b1i doesn't have this, your chances are probably better with b3v. Or you could try a V2.50 image.

Who gets automatic updates and who doesn't does indeed seem to be somewhat random.

Used last 2.50 firmware which now works nicely with 2.5G out of the box. No settings changes necessary👍🏻

Now getting full bandwidth of my 1000/500 connection 🙂