[b][color=#0000FF]Replies to Linksys topic in Announcements[/color][/b] https://forums.openvpn.net/viewtopic.php?t=34874 [color=#0000FF]Pippin[/color] Thanks for the quick analysis, Johan. I suspect Linksys won't be in any hurry to float new firmware for these older routers. So, I am headed out to get a new one. NOT Linksys.

Hi raylo, Yeah, sorry, I understand the disappointment about this situation. Here are some personal thoughts I have on the situation, were I to own such a Linksys router, which might help you or others in the same boat in the decision making; If the router is very old and there are no firmware updates, that alone makes it probably unsafe to use. It is unlikely Linksys will want to spend time and effort on a 6 year old router, but, they might be able to provide instructions to replace the certificates without a firmware upgrade, perhaps through the console or SSH or such. That doesn't fix the safety aspect of outdated router firmware though. However all of this could be solved by using OpenWRT. And that also solves the OpenVPN problem because in OpenWRT you have control over the certificates. And OpenWRT gets regular updates too. If the hardware is still good then OpenWRT would be a great solution, and it's free. If however I wanted a new fast clean router that has full support from the OEM, then yeah, I would buy a new router too. Good luck, Johan

Yes, this is the situation we are in. I've been on the support line with Linksys for the past hour, and have explained the issue to them. Their support team is restricted from viewing this webpage unfortunately, so they will not have visibility to it, although they have tried. They seem to be understanding the issue after of course the first few rebuttals of updating the openvpn client, then telling me that I can only update the TimeZone in this router, along with the fact that this is a 3rd party software that they can't control, but I let them know that the button in the router configuration along with the settings that create the.opvn file is very much in their product team's control and that when they partnered with OpenVPN this occurred. She is now escalating this case to their supervisor at Linksys Support, and I should expect a call in 1-24 hours.

Hi JeDiOpenVPN, Thanks for checking in. Technically they didn't partner with us/OpenVPN though. The OpenVPN software is open source and anyone can use it and integrate it into their products. Linksys have done so. They don't require any type of partnership to do so, and we don't have any with them as far as I know. If there were problems in the OpenVPN software that we could solve we would obviously be interested in doing so. In this case however it's not. Let's hope they can provide a solution to the certificate problem. Edit; just for clarification, there is an OpenVPN Inc. company and I do work for them as well as contribute to the OpenVPN community like I'm doing here. The company OpenVPN Inc. does sell software like OpenVPN Access Server and OpenVPN Cloud, and those are based on the open source OpenVPN project as well. Any other company is also free to do so. In this case Linksys integrated the open source OpenVPN project into their products, like OpenVPN Inc have done in OpenVPN Access Server and OpenVPN Cloud. For OpenVPN Access Server and OpenVPN Cloud, OpenVPN Inc is responsible for support. For Linksys router products, Linksys is responsible for support. Good luck, Johan

Thank you for that clarification, Johan. This is good to know as I continue to work with them, and this also means that more is under their control than they are probably aware with I'm sure the Support team just being directed to issue that standard response about it being 3rd party software. I got lucky and got an agent who actually listened and continued to try to understand the situation. I'll provide everyone here an update once I do hear back from them. Thank you for being so responsive in this forum. I must say that I am impressed, as some forums go several hours, days without follow-up.

Yeah, OpenWRT... been there done that once upon a time with a NetGear router. Worked well once I got it set up. But it wasn't very straightforward... unless maybe you are doing it every other week or so... and I just don't have time to go down that rabbit hole again right now. Maybe I'll do that as a side project when I do have time. But for now it'll be a new ASUS wifi 6 router.

Thanks for the updates on this to all. I am replacing the router with the issue (WRT 1900ACS) with a TP-LInk product. Note I verified the generation of Certs on the TP-Link product and they are produced on the router and have a 10 yr expiration from the date you produce them. I have a TP-link at home etc. Works well has all the features of the 1900ACS....only better implementation. The Router will give you an openvpn config file just like the Linksys, Not a plug for in anyway for TP-Link, but in my experience but they are very stable and have good features etc. Running the cert produced on the TP link gives (from the handy link supplied earlier - https://www.sslshopper.com/certificate-decoder.html using the cert generated by Model - AC2300 as of yesterday... It gives.... Common Name: client Organization: TP-Link Organization Unit: SOHO-I18N Locality: ShenZhen State: GD Country: CN Valid From: October 9, 2022 Valid To: October 6, 2032 Issuer: TP-Link CA, TP-Link Serial Number: 2 (0x2) Certs can be regenerated as required. So if your looking for a quick replacement then they are worth a look etc.

raylo32 wrote: > Yeah, OpenWRT... been there done that once upon a time with a NetGear > router. Worked well once I got it set up. But it wasn't very > straightforward... unless maybe you are doing it every other week or so... > and I just don't have time to go down that rabbit hole again right now. > Maybe I'll do that as a side project when I do have time. But for now > it'll be a new ASUS wifi 6 router. * I completely agree. I'm contemplating the easier path... Installing OpenWRT and reconfiguring the router, OR just purchasing a new router. chris_h_uk wrote: > I am replacing the router with the issue (WRT 1900ACS) with a TP-LInk product. > Note I verified the generation of Certs on the TP-Link product and they are > produced on the router and have a 10 yr expiration from the date you produce them. > I have a TP-link at home etc. Works well has all the features of the 1900ACS.... > only better implementation. The Router will give you an openvpn config file just like > the Linksys, not a plug for in anyway for TP-Link, but in my experience but they are > very stable and have good features etc. Running the cert produced on the TP link > gives - from the handy link supplied earlier > https://www.sslshopper.com/certificate-decoder.html > > [...] Certs can be regenerated as required. > So if your looking for a quick replacement then they are worth a look etc. * Thank you for the update here and the recommendation as well. I believe the time saved here is far worth doing the OpenWRT and maybe, just maybe Linksys will resolve the issue because I did really like all the aspects of this router, most of all how simple it was to use and configure. Edit: post cleaned up by moderator a bit

I went with ASUS RT-AX3000. Easy to transfer the wifi and LAN ip range settings for the network. Up and running again, including VPN. I almost got a TP Link. They make good products, too and I really like their web interfaces. I'll need to get used to the ASUS but they are all pretty similar except for presentation.

One downside to ASUS routers, I just learned, is that there is no way to schedule a reboot in the firmware. I usually have mine set to do that once a month just to clear out any junk. Not really critical, but I will need to find a workaround one of these days. I haven't seen a router that lacked this feature in a long time.

"Glad" to see others facing the same issue with Linksys - been talking to their support for ages. supposedly, they have escalated this but i have little hope it will be addressed as the router has reached it's EoS. my problem is that i don't have physical access to the router at this point, so i cannot test connecting to the router through SSH and see if i can update the certificates myself (doubt it). definitely OpenWRT is a solution, but again, requires physical access to the router. i will let everyone know if linksys gets back to me.

Replies to Linksys topic in Announcements

wombatus

I've done a similar thing with Linksys support. I've provided them screenshots, etc. Most of their questions are not relevant to the issue but hopefully they will get there eventually. In the interim, I stood up a Ubuntu client with OpenVPN server running on it. There are some simple articles on how to do this. I still have not heard back from Linksys on a resolution.

JeDiOpenVPN

Yeah, I spent a couple hours configuring OpenWRT on my Linksys router. The steps I followed to get it up were super fast...
https://sorenpoulsen.com/install-openwrt-on-linksys-wrt3200acm - Had it running and connected to the internet in 20 minutes.

It was the OpenVPN piece that was a struggle for about an hour. Then, I recalled that upon trying to get OpenVPN support to assist, I opened an OpenVPN Cloud account. I basically followed this, https://openvpn.net/cloud-docs/using-openvpn-cloud-profile-to-configure-openwrt/, but literally didn't have to follow any of the Configuring OpenWRT steps in that section since I had first attempted this one: https://www.ivpn.net/setup/router/openwrt-openvpn/ then this one, https://openwrt.org/docs/guide-user/services/vpn/openvpn/server, using this video: https://www.youtube.com/watch?v=P8JZnmXlzBw ← This helped me create 3 client profiles, which was all that I needed.

The updated steps that should really be followed are just by going to your Networks tab in OpenVPN Cloud, https://texasstarsmiles.openvpn.com/networks/wizard/scenario, and installing Remote Access... I followed shots steps and happened to save my subnet from my Linksys router, so I used the internal subnet of 172.19.13.0/24 to cover my range of 172.19.13.2 - 6, and uploaded the .opvn that I created in OpenWRT's OpenVPN section, and voila, I hit Save and Apply, and all was well. It was active and running unlike my previous attempts from the two OpenWRT guides above. I deleted my two failures and left it running and tested the connect with OpenVPN Client now being able to use the http://cloudaccountname.openvpn.com, and it all worked. I got my two other users to accept the invite, and their windows sessions were ready to roll.

I had figured it would take 2-3 hours of trial and error since I'd used OpenWRT in the past, but I must say that the OpenWRT setup was the fastest now that I'd ever seen. It was the OpenVPN trial and error that almost stumped me. I may unpack this one day and just create steps to exactly follow from scratch to get this working, but hopefully, I won't have to and Linksys will get a firmware upgrade to fix this by then. My case is escalated there as well, and they did already return my call twice with two more escalation points, so they do appear to be taking it seriously. We'll see though. I've got our office back up and working, so that's what I'm most happy about.

CLV

OpenWRT supported Linksys routers. WRT-1200, 1900, 3200 are all listed.

https://openwrt.org/toh/start?dataflt%5BBrand*%7E%5D=linksys

ncc1701p

Greetings fellow users. Yeah im also in this exact same boat. In my situation I'm a bit boned because my router is in a remote country and I won't have physical access to it till later November when I go back to my other home. I followed some videos on youtube listed above from "
Van Tech Corner" which made the process look super easy. I'm an IT guy but not heavy into network, its not my job. No way in hell would I have been able to figure out how to do that via CLI or even via the installed gui. Would be 'great' if Linksys made a quick firmware update but honestly I have very low hope for this to happen. Would make my life easier if they did though. I'll keep a watchful eye on this thread to see where this goes. Thanks to JeDiOpenVPN for talking to them and posting what you know. Also thanks to others on posting possible replacement routers which make the job just as easy.

Fatbadcat

Same Sinking Boat! I have 3 wrt3200ACM but only 2 have the expired VPN certificate (Oct9, 2022). The third was purchased later and I checked old .ovpn files and it has regularly updated its VPN certificate several times and currently has an expiry date of Jun 23, 2031. Opened a case with Linksys support and it sound hopeful initially. After they gathered my information and acknowledged the problem, they called me back and closed the case saying they will call or email me if and when the problem is resolved. All 3 wrt3200ACM routes are running the same firmware and are the same revision hardware. It is odd that one behaves differently. I provided Linksys support with this information, but they seemed more interested on what OpenVPN version I was running for the client and what windows operating system, as if they were trying to find a scape goat. Too bad they have been fairly reliable routers, despite their feature shortcomings compared to newer routers. No sure what I will do going forward, perhaps I will try the third party router OS. Please keep posting on how that works out for you.

Protean0

Not expecting a quick solution from Linksys for the WRT3200ACM, I bought a TP-Link AX1800 from the local Walmart, and was back up with remote OpenVPN access to my network in about 30 minutes. Disappointed to now have a $225 Linksys boat anchor.

wombatus

@fatbadcat: In addition to the 3 3200ACMs I have I also have an older 1900ACSv2. I tried that one and the certificate generated has not expired and is good until 2028. I recall when I first installed the 3200ACMs it required a hard reset (from the device not the GUI) to get the certificate to be generated. I've not tried that yet, but your experience with different 3200ACMs and my 1900ACS makes me think it's worth a try. It's been a few days since Linksys logged my case number so I'm not as hopeful as last week.

Pippin

Replies to Linksys topic in Announcements
https://forums.openvpn.net/viewtopic.php?t=34874

Scott123

FYI, I tried a hardware reset on my WRT3200ACM ("press the button") and it DID generate a new certificate with an expiration in 2032, but the CA certificate still expires on Oct 09, 2022, so that's not the solution. When I restored from a backup, it brought back my configuration and left the new certificate intact. That's good except the expired CA renders it moot.

jaakdaniels

Damn problem! It seems the date is not set correctly at the moment the certificates are generated. After a hard reset (reset button pressed 20 sec untill the lights go out on the front) there are certificates generated based on the date the system is at that time.
In the logging the Router shows that the date is being reset first (to somewhere in year 1970) and is reloaded to Oct 09, 2012, 0600h. Where does this Oct 09, 2012 coming from?
Tried during Uboot via serial to press some buttons after a 20 sec reset button-press. Sometimes the date stays the same as i've set it...

In Uboot after the Marvell prompt type:
"date reset" Enter
"date 110712002022" Enter (Set date and time to Nov 07, 12h00m, year 2022)
"date" Enter (To check if the date is properly set)
"run nandboot" enter OR "run altnandboot" enter (Starts to load the kernell and boots)
during booting i tried to press arrow-up a few times. Sometimes the date resets to year 2012, sometimes it doesn't.

Checked the "rango.img" FW in a Hex-Editor and searched for those dates, but nothing to find.
Are there some linux professionals with some ideas?

jaakdaniels

One step further. I found a way to delay the creation of the certificates untill the router is fully booted after factory reset. At this stage, the system time has been synchronized with the RTC time. The creation of certificates at this point makes a key and a private certificate with expiration year 2032. The CA.crt does not get an update and has still the expiration of year 2022. I have another way in mind, because during the manufacturing process it worked....

Stay tuned...

jaakdaniels

Well, I'VE DID IT!!!
3 new certificates untill 2032 and VPN is up again!

Did more stuff together, so i don't know if every step is going to be usefull, but as long as it works...
The thing is, try to do as if it's first time use, out of the box. Restoring configuration will not affect the certificates AFTER they have been generated, but it certainly does BEFORE the certificates are generated.

1) Make a backup of your configuration
2) Remove the WAN cable and all other cables, leave only the cable from a LAN port to your computer to login
3) Hold "reset" pressed for 20 seconds, untill the front LED's go out and allow the router reboot (Old certificates are now erased)
4) Go to http://192.168.1.1 and login with "admin"
5) Configure the router BY HAND! Follow the steps as if it's your first time using it. The settings you do are not important
6) Follow this until the router complains about the missing WAN cable, and then connect the WAN cable
7) When the configuration is completed, download the *.ovpn file and check the "ca.crt" certificate-part
8) When it is valid you can restore your configuration. It does not affect the new certificates
9) Come back to this forum and let me know if it worked

Good luck to all!

jaakdaniels

Meanwhile i tried and tried the upper procedure again on the second WRT3200ACM to generate certificates with no result but ca-2022 and the other 2 were intermittend 2022 and 2032. It strongly suspect it's a timing problem from Linksys FW.

So an idea, the certificate was still generated earlier than the clock and date were set. To slow this down, i kept on pressing the "WPS" button. It generates WPS events that slow the startup down and delay the creation of certificates. You could follow this with a serial connection and PUTTY.

So in brief:
- Keep the WAN cable connected
- Hold reset for 20 seconds
- When the WAN LED lights op, press/hold the "WPS" button during booting untill it's fully booted
- Check the CA-certificate

I can't guarantee it works every time or if i was lucky, but here it worked the first time i tried! I now have a second router with all 3 certificates up untill 2032, so it's proven that the router is able to generate them.
If you try, please note your results here, maybe others can benefit from this info. I am very curious if it works for other people and we have a stable workaround.

grtmd001

Tried it several times. No luck. Was very hopeful. By WAN led I assume you mean the blue bar on the front labeled 'Internet' which goes out on reset then re-illuminates as an blinking orange bar during boot, finally turning again to a blinking blue bar - right??

jaakdaniels

grtmd001 wrote Tried it several times. No luck. Was very hopeful. By WAN led I assume you mean the blue bar on the front labeled 'Internet' which goes out on reset then re-illuminates as an blinking orange bar during boot, finally turning again to a blinking blue bar - right??

Yes. I've red that someone had succes when pressing the WPS button directly after releasing the reset, and kept it pressed all time.
It's pressing, let loose, press again, hold, etc... To generate as much processor interruptions as possible.

https://forums.openvpn.net/viewtopic.php?p=109500#p109500

Fatbadcat

I got my 2 wrt3200 routers to generate new VPN certificates with the 2032 date by using the "WPS" method it took several attempts with each.
Validity
Not Before: Nov 12 20:03:03 2022 GMT
Not After : Nov 9 20:03:03 2032 GMT

Unfortunately the new certificates do not work, they still indicate expired despite the new date in the file as follows in the OpenVPN client log.

Sat Nov 12 15:30:41 2022 VERIFY ERROR: depth=1, error=certificate has expired: C=US, ST=CA, L=Irvine, O=Linksys, OU=Belkin, CN=Mamba, name=BlackMamba, emailAddress=support@linksys.com
Sat Nov 12 15:30:41 2022 OpenSSL: error:1416F086:SSL routines:tls_process_server_certificate:certificate verify failed
Sat Nov 12 15:30:41 2022 TLS_ERROR: BIO read tls_read_plaintext error
Sat Nov 12 15:30:41 2022 TLS Error: TLS object -> incoming plaintext read error
Sat Nov 12 15:30:41 2022 TLS Error: TLS handshake failed

I have one WRT3200 that works with the 2031 certificate that luckily generated it by itself earlier in the year before the Oct 9, 2022 default certificate expiry date and is VPN is fully functional.
Validity
Not Before: Jun 25 13:13:43 2021 GMT
Not After : Jun 23 13:13:43 2031 GMT

Here is its OpenVPN log showing it is not expired.
Sat Nov 12 15:49:04 2022 VERIFY OK: depth=1, C=US, ST=CA, L=Irvine, O=Linksys, OU=Belkin, CN=Mamba, name=BlackMamba, emailAddress=support@linksys.com
Sat Nov 12 15:49:04 2022 VERIFY OK: nsCertType=SERVER
Sat Nov 12 15:49:04 2022 VERIFY OK: depth=0, C=US, ST=CA, L=Irvine, O=Linksys, client OU=Belkin, CN=Mamba, name=BlackMamba, emailAddress=support@linksys.com
Sat Nov 12 15:49:05 2022 Control Channel: TLSv1.2, cipher TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384, 1024

I really don't know where to go with these 2 WRT3200 routers, hoping someone else has had more success and can provide feedback.

wombatus

Sorry to say but I got to exactly the same place. I'm now replacing these with ASUS RX-AX-3000 that have similar VPN capabilities. I'll check back here periodically to see if there are any updates. Good Luck.

wombatus

Further to this, I was just notified by Belkin (Linksys support) that a beta fix will be released next week for the 3200ACM routers.

jaakdaniels

New update guys! And i think it's great news this time!

Stay tuned!

jaakdaniels

Hi All,

Have found a stable solution, at least, it worked 2 times in a row... 🙂

Almost everybody has FW 1.0.8.199531 installed. Me 2. So i thought, why not going to the time things DID work. After all, the definition of an upgrade/update is solve the known bugs and add unknown bugs...

So this is my procedure that worked twice in a row:

- I downgraded to FW version 1.0.5.175944 and gave the router a factory reset. You can find the FW here
(Details: I flashed both partitions with the serial cable in uBoot, but i asume it should also work downgrading just 1 partition)
- Let it boot and log in at 192.168.1.1 (I normally use Google Chrome, but this old FW only worked on the old Internet Explorer)
- Make a VPN profile and download the certificate. Check it at https://www.sslshopper.com/certificate-decoder.html
- The certificate should be valid until Dec 1, 2023
- If this is the case, restore the "older" software. You can do this in the firmware update menu or switch the router 3 times on and off for about 3 seconds. The 4th time the router will switch to FW 1.0.8.199531 again and generate new certificates valid until 2032

Good luck!

« Previous Page Next Page »