[b][color=#0000FF]Replies to Linksys topic in Announcements[/color][/b] https://forums.openvpn.net/viewtopic.php?t=34874 [color=#0000FF]Pippin[/color] Thanks for the quick analysis, Johan. I suspect Linksys won't be in any hurry to float new firmware for these older routers. So, I am headed out to get a new one. NOT Linksys.

Hi raylo, Yeah, sorry, I understand the disappointment about this situation. Here are some personal thoughts I have on the situation, were I to own such a Linksys router, which might help you or others in the same boat in the decision making; If the router is very old and there are no firmware updates, that alone makes it probably unsafe to use. It is unlikely Linksys will want to spend time and effort on a 6 year old router, but, they might be able to provide instructions to replace the certificates without a firmware upgrade, perhaps through the console or SSH or such. That doesn't fix the safety aspect of outdated router firmware though. However all of this could be solved by using OpenWRT. And that also solves the OpenVPN problem because in OpenWRT you have control over the certificates. And OpenWRT gets regular updates too. If the hardware is still good then OpenWRT would be a great solution, and it's free. If however I wanted a new fast clean router that has full support from the OEM, then yeah, I would buy a new router too. Good luck, Johan

Yes, this is the situation we are in. I've been on the support line with Linksys for the past hour, and have explained the issue to them. Their support team is restricted from viewing this webpage unfortunately, so they will not have visibility to it, although they have tried. They seem to be understanding the issue after of course the first few rebuttals of updating the openvpn client, then telling me that I can only update the TimeZone in this router, along with the fact that this is a 3rd party software that they can't control, but I let them know that the button in the router configuration along with the settings that create the.opvn file is very much in their product team's control and that when they partnered with OpenVPN this occurred. She is now escalating this case to their supervisor at Linksys Support, and I should expect a call in 1-24 hours.

Hi JeDiOpenVPN, Thanks for checking in. Technically they didn't partner with us/OpenVPN though. The OpenVPN software is open source and anyone can use it and integrate it into their products. Linksys have done so. They don't require any type of partnership to do so, and we don't have any with them as far as I know. If there were problems in the OpenVPN software that we could solve we would obviously be interested in doing so. In this case however it's not. Let's hope they can provide a solution to the certificate problem. Edit; just for clarification, there is an OpenVPN Inc. company and I do work for them as well as contribute to the OpenVPN community like I'm doing here. The company OpenVPN Inc. does sell software like OpenVPN Access Server and OpenVPN Cloud, and those are based on the open source OpenVPN project as well. Any other company is also free to do so. In this case Linksys integrated the open source OpenVPN project into their products, like OpenVPN Inc have done in OpenVPN Access Server and OpenVPN Cloud. For OpenVPN Access Server and OpenVPN Cloud, OpenVPN Inc is responsible for support. For Linksys router products, Linksys is responsible for support. Good luck, Johan

Thank you for that clarification, Johan. This is good to know as I continue to work with them, and this also means that more is under their control than they are probably aware with I'm sure the Support team just being directed to issue that standard response about it being 3rd party software. I got lucky and got an agent who actually listened and continued to try to understand the situation. I'll provide everyone here an update once I do hear back from them. Thank you for being so responsive in this forum. I must say that I am impressed, as some forums go several hours, days without follow-up.

Yeah, OpenWRT... been there done that once upon a time with a NetGear router. Worked well once I got it set up. But it wasn't very straightforward... unless maybe you are doing it every other week or so... and I just don't have time to go down that rabbit hole again right now. Maybe I'll do that as a side project when I do have time. But for now it'll be a new ASUS wifi 6 router.

Thanks for the updates on this to all. I am replacing the router with the issue (WRT 1900ACS) with a TP-LInk product. Note I verified the generation of Certs on the TP-Link product and they are produced on the router and have a 10 yr expiration from the date you produce them. I have a TP-link at home etc. Works well has all the features of the 1900ACS....only better implementation. The Router will give you an openvpn config file just like the Linksys, Not a plug for in anyway for TP-Link, but in my experience but they are very stable and have good features etc. Running the cert produced on the TP link gives (from the handy link supplied earlier - https://www.sslshopper.com/certificate-decoder.html using the cert generated by Model - AC2300 as of yesterday... It gives.... Common Name: client Organization: TP-Link Organization Unit: SOHO-I18N Locality: ShenZhen State: GD Country: CN Valid From: October 9, 2022 Valid To: October 6, 2032 Issuer: TP-Link CA, TP-Link Serial Number: 2 (0x2) Certs can be regenerated as required. So if your looking for a quick replacement then they are worth a look etc.

raylo32 wrote: > Yeah, OpenWRT... been there done that once upon a time with a NetGear > router. Worked well once I got it set up. But it wasn't very > straightforward... unless maybe you are doing it every other week or so... > and I just don't have time to go down that rabbit hole again right now. > Maybe I'll do that as a side project when I do have time. But for now > it'll be a new ASUS wifi 6 router. * I completely agree. I'm contemplating the easier path... Installing OpenWRT and reconfiguring the router, OR just purchasing a new router. chris_h_uk wrote: > I am replacing the router with the issue (WRT 1900ACS) with a TP-LInk product. > Note I verified the generation of Certs on the TP-Link product and they are > produced on the router and have a 10 yr expiration from the date you produce them. > I have a TP-link at home etc. Works well has all the features of the 1900ACS.... > only better implementation. The Router will give you an openvpn config file just like > the Linksys, not a plug for in anyway for TP-Link, but in my experience but they are > very stable and have good features etc. Running the cert produced on the TP link > gives - from the handy link supplied earlier > https://www.sslshopper.com/certificate-decoder.html > > [...] Certs can be regenerated as required. > So if your looking for a quick replacement then they are worth a look etc. * Thank you for the update here and the recommendation as well. I believe the time saved here is far worth doing the OpenWRT and maybe, just maybe Linksys will resolve the issue because I did really like all the aspects of this router, most of all how simple it was to use and configure. Edit: post cleaned up by moderator a bit

I went with ASUS RT-AX3000. Easy to transfer the wifi and LAN ip range settings for the network. Up and running again, including VPN. I almost got a TP Link. They make good products, too and I really like their web interfaces. I'll need to get used to the ASUS but they are all pretty similar except for presentation.

One downside to ASUS routers, I just learned, is that there is no way to schedule a reboot in the firmware. I usually have mine set to do that once a month just to clear out any junk. Not really critical, but I will need to find a workaround one of these days. I haven't seen a router that lacked this feature in a long time.

"Glad" to see others facing the same issue with Linksys - been talking to their support for ages. supposedly, they have escalated this but i have little hope it will be addressed as the router has reached it's EoS. my problem is that i don't have physical access to the router at this point, so i cannot test connecting to the router through SSH and see if i can update the certificates myself (doubt it). definitely OpenWRT is a solution, but again, requires physical access to the router. i will let everyone know if linksys gets back to me.

Replies to Linksys topic in Announcements

RichB-WI

Here is the link to the beta firmware for the WRT3200ACM:

https://linksysca-public.s3.us-west-2.amazonaws.com/beta-firmware/FW_WRT3200ACM_1.0.9.211585_prod.img

Best of luck!

openvpn_inc

Hello everyone,

While I appreciate the sentiment of posting firmwares, I do want to add a note of caution to the above post:

This was posted by a volunteer visiting the public OpenVPN forums, and the authenticity of the URL cannot be proven. That means it could contain viruses or dragons or whatever. So just beware.

Kind regards,
Johan

jaakdaniels

Indeed, be carefull! Linksys support doesn't know anything about a Beta release!

wombatus

I decided to jump in the deep end and try the "beta" firmware on an isolated segment of my network. After doing a hard reset with the red button I downloaded the firmware from the link above and flashed a test 3200ACM with it. The router updated without issue, and rebooted as normal. The Linksys logo on the main admin page has changed to the new version on their website. Plugging in the WAN cable, I enabled OpenVPN server and generated a config file, which was empty, no certificates. I've had that happen before on new installs, so I hard reset it once again and generated a new config file, and ran the CA through the geocerts parser and got the following result:

Certificate Information:
Common Name: Mamba

Subject Alternative Names (SANs): N/A

Organization: Linksys

Locality: Irvine

State: CA

Country: US

Valid From: 2022-11-24 00:28:49 UTC

Valid To: 2032-11-21 00:28:49 UTC

Issuer: Mamba

Serial Number: 16611423669438468672

Algorithm: sha1WithRSAEncryption

Key size: 1024

I proceeded to connect to the router with the new confg file and it worked just fine, no errors on the handshake.
I don't know where the firmware came from, so caution is in order. I asked Linksys support to verify the link to the firmware and they were not able to do so, but still assert that a beta release is coming out this week (but its Thanksgiving long weekend in US beginning tomorrow).
Whatever this firmware is, it worked for me. I will wait for Linksys to release the beta and test that.

RichB-WI

I understand the caution regarding the beta firmware posting. This link was provided to me over a Linksys support chat. I have used it now for 3 days with no issues. A bit puzzling why all Linksys/Belkin support does not know about it.

Cheers.

Short update: I updated a second router. The first time that I reset it, the CA certificate still expired on 10/8/2022. I reset it again and this time the CA certificate was recreated for 2032. The first reset did clear the LAN address, etc, but I suspect that I didn't leave it connected to the internet long enough for it to update the clock before configuring the OpenVPN.

wombatus

Further to this, Linksys did send me a link to the beta firmware late Wednesday and it's the same as posted here. I've now updated another router and it worked fine with 2032 expiration dates on the CA. After upgrading, I then restored the previous config and the certicates were created with the correct dates. So if you back up your config first, reset twice, check the certificates and restore you should be in good shape. I also tried to upgrade in place, without a reset, and it failed as I suspected it would. It would have been nice to have this work as I have a a remove location that I guess I'll have to travel to. But, I'm pleased it appears that we have a repeatable solution now.

Anycolour

Unless I'm missing something there doesn't appear to be a solution for WRT1900ACS models, a bit older than the ACM i believe is being discussed here. I have the same problem and the "beta" firmware isn't compatible. I've only tried a few factory resets and things not gone crazy because I prefer the uptime over my VPN access. Definitely disappointed and it seems like alot of people are affected.

johnegates

Hi all,
Just noting success with the new firmware 1.0.9.211585. The successful procedure:
* Backup router configuration
* Install new firmware manually
* Hard reset to router
* Quick router setup after reset to get to main user interface
* Get new OpenVPN config file to verify certificate date (2022 - 2032)
* Restore router configuration
VPN now working. It also appears Linksys fixed the Guest wifi problem (blocked port).
Candidly I did not hold out much hope this firmware release would happen. I even bought a Synology router replacement, which has been a disappointingly difficult setup, and it is still not working, even in my simple network topology.
Hope this helps....

jaakdaniels

The important thing is, you need the do a factory reset (This clears all the old certificates) AFTER you installed this new version.
After this it should immediately work and generate 2032 certificates. The rest of the actions have no impact.
Leave the LAN cable connected.

Solarstar

Anycolour wrote Unless I'm missing something there doesn't appear to be a solution for WRT1900ACS models, a bit older than the ACM i believe is being discussed here. I have the same problem and the "beta" firmware isn't compatible. I've only tried a few factory resets and things not gone crazy because I prefer the uptime over my VPN access. Definitely disappointed and it seems like alot of people are affected.

Same issue with my WRT 1900ACv2, waiting for the USB cable so I can flash my bricked WRT32X.

andrej.poljak

jaakdaniels wrote The important thing is, you need the do a factory reset (This clears all the old certificates) AFTER you installed this new version.
After this it should immediately work and generate 2032 certificates. The rest of the actions have no impact.
Leave the LAN cable connected.

And what about WAN cable? Yes / No
If yes, does WAN cable use PPPoE or some other option Static/DCHP IP, or?

jaakdaniels

Oh, i mean the WAN cable 🙂 My bad!
Leave the WAN cable connected. Without it it does not update the date and time from the NTP.
Checked the logging. They changed something in the timing. The time-date gets set and after that the certificates ar egenerated, like it should have worked in the first place. This 1.0.9.xxxx version works well

CloudRX2

Thank you for posting the hard reset solution. I initially tried the soft button one, but I guess that doesn't work. I didn't have to downgrade the firmware, I was prepared to do it, but figured I'd try a hard reset first.

Mine updated to 2033, saved me the hassle and cost of getting a new router 🙂

[deleted]

MODERATOR PLEASE DELETE MY REPLY AS IT IS OFF TOPIC. READ BELOW BEFORE REMOVING MY POST.

I am a new user for this forum and I find that I do not have the permissions to post a new topic or to directly message an administrator ("more participation may be needed to use this feature"). I am impatient and I am posting a reply here to boost my participation.

Yes, I see that more than 1 year ago there is a new user forum post about an irc channel. In order to use the irc channel I have to download an irc client, learn to drive irc, create an account on "nickserve" of Libera.Chat, and after that who knows. All that I want to do is report that my new user permissions seem inadequate to post a new topic. Also my permissions are inadequate to directly message an administrator to grant the permission.

Clearly there are very many users to this forum with hundreds online at any given moment so there is something wrong with how my account was created (and possibly additional new users users). I would appreciate if you could kindly look into this issue.

Respectfully, TooTired

[deleted]

« Previous Page