Hi @Filip009 

Thanks for posting in our business forum.

Filip009 wrote

  @Filip009 

 

I tried to remove and re-create the tunnel and still the same.

I use ol .ovpn and still get connected.

 

I wonder,

I suspect,

 

             all the TP-Link routers share the same key ?

 

I have no way to prove it since I have no more devices.

 

But if all the tunnels I create share the same keys, I am a bit scared of what the feature really looks like under cover.

 

Is there a way hot to re-generate "master" key to invalidate old tunnels ?

So, you bring it up in the Reddit? I came across this today. Someone replied something similar to my answer that is not possible and not a problem with the router?

Since I have had some models from the warehouse recently. Tested on ER605 V2 with very old firmware. It does not have the same hash value.

Generated 1 server and export, delete. Generate the second one. Different name. It is another set of hash values.

Every time you create a server, it is a different set of hash values. I don't think it is possible to have a bug like this.

You can paste your first two lines of the cert which you can find from the .ovpn. With the screenshots, put both notepad windows in the same place. Mosaic the rest of the parts.

I should see the first two lines of your cert. Your file names.

Hi @Filip009 

Thanks for posting in our business forum.

Filip009 wrote

@Clive_A 

good coincidence you found my post at reddit :-)

I was hoping someone could know the answer

I am worried, after making OpenVPN work, to share the key to someone, after I found the key works also for other created tunnels, not just the one. This experiment is very simple to do.

 

During experiment, I did not test to change the name to some different. I rather used the same tunnel name even for new created tunnel. If it behaves like "for the same name--->generate same key-cert" that would be possible explanation but I have to test it.

 

I also could not believe there would be some bug like this. But my experiments proved that the sinlge .ovpn worked for other tunnles. This scared me a little and made me ask the questions.

 

I will repeat said bunch of experiments when I have some time and let you know.

So I did it again. Same in every parameter. I don't think you are correct on this matter. I think you did not compare the whole cert.

I mosaiced some parts. Highlighted parts are different. Blank parts are identical.

This is the partial and I am showing you the certificate for the encryption. The private keys are different as well. But the identification cert is the same.

Is that part what you referring to as hardware coded? As long as the private and encryption cert are different, they should not connect to your VPN server as they will fail at these key exchange phases.