Setting Up OpenVPN with Forwarding on a Zyxel Keenetic Giga II Router · English

Zyxel Keenetic Giga II router

Want to turn your router into a nearly full-fledged Linux server with a basic set of programs, running on NDMS? Back in the day, I chose the “Zyxel Keenetic Giga”: it is affordable and easy to configure, and overall, it hasn’t disappointed me.

However, two years ago I never got around to writing an article about turning it into a full-fledged Linux system. Now we’ve bought ourselves the second version of this router, the “Zyxel Keenetic Giga II,” and I’ve finally made myself write an article about setting it up. Let’s go!

About the Firmware

I’ll say right away that I tried hard to work with the V2 firmware (specifically 2.04), but no matter what I tried, I couldn’t get dropbear running.

After reading about the “V2” firmware online, I concluded that it was immature and unsuitable for extending. Eventually, I came across a comment on 4pda and installed the “V1.11” firmware on my Giga II (I got it here and installed “Firmware-KEENETIC_GIGA_II-V1.11.RU.NDMS_140108210221.bin”). If the file is no longer available, let me know and I’ll share it. You can find some details about running V1 on the Giga II here. You can change the firmware under “System > Configuration”; more details are available here.

Since we installed firmware V1.11, the instructions below also apply to the first version of the Giga.

Extending the Keenetic: Adding sshd and opkg

Take a USB flash drive of at least 1 GB and format it as ext3 (in GParted, for example). You can check the official USB storage requirements.

Next, go to the opkg system documentation, follow their instructions, and download the appropriate archive here. In my case, it was “ext_init.sh-r2.tar.gz”.

Now create the directories and copy the contents of the archive:

cd </path/to/you/flash/drive>
mkdir -p system/bin
cd system/bin
wget https://zyxel-keenetic-packages.googlecode.com/files/ext_init.sh-r2.tar.gz
tar -xzf ext_init.sh-r2.tar.gz
chmod +x ext_init.sh

Check the permissions on “ext_init.sh”; the important thing is that it is executable (which we took care of in the last line).

Now insert the flash drive into the first USB port (it will be detected as “DISK_A1”). Our flash drive should appear in the “USB Storage” section on the main page of the Zyxel administration panel. Go to “System > Log” and wait for an entry something like this:

root    Starting opkg/linux install
root    All errors are logged in a file /media/DISK_A1/tmpinstall/err.log
root    Extracting busybox
root    Unpacking busybox
root    Extracting system
root    Unpacking system
root    Generating rsa/dss keys for dropbear
root    Starting dropbear
dropbear[2428]  Running in background
root    Connect to keenetic using ssh and run finish_install.sh to finish installation

You can now connect over SSH.

Finishing the Installation

Connect over ssh:

ssh root@192.168.1.1
пароль "zyxel"

First things first, let’s change the password:

# passwd
Enter new UNIX password: 
Retype new UNIX password: 
passwd: password updated successfully

Run finish_install.sh to finish the installation:

# finish_install.sh
Creating swap file. Please wait...
128+0 records in
128+0 records out
Setting up swapspace version 1, size = 134213633 bytes
Loading current packages list
Downloading http://zyxel-keenetic-packages.googlecode.com/svn/binary-packages-r2/Packages.gz.
Inflating http://zyxel-keenetic-packages.googlecode.com/svn/binary-packages-r2/Packages.gz.
Updated list of available packages in /media/DISK_A1/system/var/opkg-lists/packages.

Updating the System and Installing the Applications We Need

Update the installed packages:

# opkg update
# opkg upgrade

And install the additional ones we need:

# opkg list | grep <нужный пакет>
# opkg install mc screen nano htop openvpn-openssl

Now Let’s Configure OpenVPN

Create the file /media/DISK_A1/system/etc/firewall.d/fw.sh containing iptables rules, with the following contents:

#!/bin/sh
iptables -A INPUT -p icmp -j ACCEPT
iptables -A INPUT -p tcp -j ACCEPT
iptables -A INPUT -p udp -j ACCEPT
iptables -A INPUT -i lo -j ACCEPT
iptables -t nat -F
iptables -I FORWARD 1 -i br0 -o tun0 -j ACCEPT
iptables -I FORWARD 2 -i tun0 -o br0 -j ACCEPT
iptables -I FORWARD 3 -s 192.168.1.0/24 -j ACCEPT
iptables -t nat -A POSTROUTING -o tun0 -j MASQUERADE

To be able to access your server over the VPN, add this before the last line:

iptables -t nat -A POSTROUTING -o eth2.2 -d "АДРЕС_VPN_СЕРВЕРА" -j MASQUERADE

Make this file executable:

# chmod +x /media/DISK_A1/system/etc/firewall.d/fw.sh

In the /media/DISK_A1/system/etc/openvpn directory, create a client configuration file, openvpn.conf, and put the keys you generated beforehand (or received from a service) there. Here is one possible configuration:

client
remote <IP-адрес OpenVPN-сервера>
port 1194
dev tun
proto udp
resolv-retry infinite
nobind
pull
user nobody
group nogroup
persist-key
persist-tun
ca /media/DISK_A1/system/etc/openvpn/ca.crt
cert /media/DISK_A1/system/etc/openvpn/example.crt
key /media/DISK_A1/system/etc/openvpn/example.key
tls-client
tls-auth /media/DISK_A1/system/etc/openvpn/ta.key 1
cipher DES-EDE3-CBC
comp-lzo
mute 10
verb 0
log openvpn.log

You can read about the options and how to generate the necessary keys in my article about OpenVPN.

If you want to run openvpn without an init script, you will run into a problem with the tun device:Wed Jun 10 12:41:09 2015 ERROR: Cannot open TUN/TAP dev /dev/net/tun: No such file or directory (errno=2)I quickly solved this problem with the help of this article. To do so, create the directory /dev/net and create a device file there: # mkdir /dev/net # mknod /dev/net/tun c 10 200 But then a new problem came up: Wed Jun 10 12:41:50 2015 ERROR: Cannot open TUN/TAP dev /dev/net/tun: No such device (errno=19) I used lsmod to check for the “tun” module and couldn’t find it: # lsmod | grep tun So it needed to be loaded. Since modprobe doesn’t come with our Linux system, I used insmod. I found a suitable module and loaded it: # find / -name "*tun*.ko" /lib/modules/2.6.22-tc/tun.ko /media/DISK_A1/system/lib/modules/2.6.23-rt/tun.ko # insmod /lib/modules/2.6.22-tc/tun.ko Now everything is fine; lsmod says the module is loaded.

Starting OpenVPN

To have the OpenVPN daemon start automatically after a system restart, rename its init script from K11openvpn to S11openvpn:

# cd /media/DISK_A1/system/etc/init.d/
# mv K11openvpn S11openvpn

There is no need to add a call to /media/DISK_A1/system/etc/firewall.d/fw.sh anywhere; it will run automatically.

I ran into a problem loading the tun.ko module in the init script. The one specified there produced the following: insmod: cannot insert '/media/DISK_A1/system/lib/modules/2.6.23-rt/tun.ko': invalid module format (-1): Exec format errorEventually, I found an alternative, and it worked correctly: # find / -name "*tun*.ko" /lib/modules/2.6.22-tc/tun.ko /media/DISK_A1/system/lib/modules/2.6.23-rt/tun.ko # insmod /lib/modules/2.6.22-tc/tun.ko After that, I changed the S11openvpn file to use the alternative module: #insmod $MOUNT/lib/modules/2.6.23-rt/tun.ko insmod /lib/modules/2.6.22-tc/tun.ko ... #rmmod $MOUNT/lib/modules/2.6.23-rt/tun.ko rmmod /lib/modules/2.6.22-tc/tun.ko

That’s basically it. Restart the router, and everything should work as it should!

Upgrading from zyxware to entware

I don’t particularly recommend upgrading to entware, because when starting OpenVPN through the init script, I got Segmentation Fault (although the problem didn’t occur if I simply ran openvpn openvpn.conf). I didn’t feel like investigating it, since I didn’t see much point in upgrading for my own needs. The main difference is that entware has more packages than zyxware, so if you want to, you can still give it a try. I’ll explain how below:

To do this, remove the flash drive from the router and copy over the archive, which you can get here. Plug the flash drive back into the first USB port. Online advice recommends upgrading over telnet, but I upgraded over ssh:

# cd /media/DISK_A1
# wget http://keenetic.zyxmon.org/entware/entware_keenetic.tgz
# tar -xzf entware_keenetic.tgz
# chmod +x ./entware_keenetic_install.sh
# ./entware_keenetic_install.sh

After that, restart the router from the Zyxel web panel. In addition to the /system directory, /opt will appear on your flash drive. That’s it—you’re now the proud owner of entware!