Zyxel One Network Utility (ZON) and SecuExtender on Linux: open-source versions

rainpwn

I manage client networks built on Zyxel equipment from a Linux workstation, and two tools I use every day only exist for Windows: ZON and SecuExtender.

So I wrote Linux versions of both. Each one is a single Python file that needs only the standard library, and both are on GitHub under the MIT license.

ZON for Linux (zon.py) speaks the same layer 2 protocol as ZON, so like ZON it finds the Zyxel devices on its own LAN or VLAN: model, firmware, IP, MAC and name. Discovery needs no password. With the admin password it can read protected fields such as the serial number, reboot a device, blink the locator LED, set the IP, name and location, and save the configuration. There is a command line version and a GUI (zon-gui.py) that looks like the Windows tool.

SecuExtender for Linux (zyxel_sslvpn.py) connects to the SSL VPN on a Zyxel firewall running ZLD (USG FLEX, ATP, VPN series). It logs in, brings up a tun interface with the routes and DNS servers the firewall pushes, and logs out on Ctrl+C. The firewall certificate is pinned by its SHA-256 fingerprint, since Zyxel firewalls ship a self-signed one. It also has a GUI (secuextender_gui.py).

What I have tested on real hardware:

• VPN client: ATP700
• ZON discovery: ATP700, XGS1930, XGS1935, WAX650S, WAC6503D-S
• ZON authenticated reads and reboot: WAC6503D-S (V6.28)

The other write commands, password change included, have only run against a simulated device so far.

If you run other models (USG FLEX, GS switches, NWA access points), I would like to know what works and what does not. Start with discover, show and get, which change nothing on the device. An issue on GitHub with the model, the firmware version and the output of "show N" is enough.

Write-up with usage examples:
https://rainpwn.blog/blog/zyxel-tools-on-linux/

Repositories:
https://github.com/rainpwn/zyxel-zon-linux
https://github.com/rainpwn/zyxel-secuextender-linux