Updates, upgrades and uninstall on OpenWrt

What you get

The steps for the four things that happen to a router over its life: updating ForestVPN, upgrading the router's firmware, taking ForestVPN off, and replacing this router's identity.

Before you start

• Device: an OpenWrt router with ForestVPN installed.
• Access: the administrator password.
• Time: five minutes for an update. A firmware upgrade takes as long as OpenWrt's.
• What can break: during an update protected devices have no internet for about a minute. After a firmware upgrade ForestVPN installs itself again when the router is online, which takes a few minutes.

Steps

1. Update ForestVPN. ForestVPN looks for updates twice a day and tells you on the Updates page. You press Update. Protected devices have no internet for about a minute during an update.

2. Before a firmware upgrade, read this. A firmware upgrade removes added software, including ForestVPN. Kept: your ForestVPN settings and this router's place on your account.

   After the upgrade ForestVPN installs itself again when the router is online. This takes a few minutes. Under Standard your devices are not protected until then, and no ForestVPN page is there to say so. Strict stays blocked through the upgrade: devices that ForestVPN protects have no internet until ForestVPN is back.

3. If you use Attended Sysupgrade (System > Attended Sysupgrade): the upgrade stops with "Error building the firmware image" and "Server response: Error: Impossible package selection: missing (forestvpn)". Turn on Advanced Mode on its Configuration tab, take forestvpn out of the Packages list of the request, and upgrade again. ForestVPN installs itself again afterwards.

4. If you use the owut command: owut check says "1 packages missing in target version, cannot upgrade" and owut upgrade stops. Run owut upgrade -r forestvpn instead. ForestVPN installs itself again afterwards.

   Upgrades the firmware without the ForestVPN package in the request

   owut upgrade -r forestvpn

5. Do not reset the settings. A reset makes this router a new device. Sign out first if you plan to reset or sell it.

6. A settings backup (System > Backup) holds this router's key. This file lets someone act as this router on your account. Keep it private. If a backup file from this router got out, press Replace this router's identity.

7. To take ForestVPN off, remove the package. This puts back the network and firewall settings the install added and takes out the software source and key it added. Your other sources and keys stay.

   Removes ForestVPN

   if command -v apk >/dev/null; then apk del forestvpn; else opkg remove forestvpn; fi

Step 8. The update said it worked, then the old version is back (reverted, rolled back), or the page shows 0.3.10

The updater reports success, but a rollback means the new version did not connect within a minute: the updater undid the update, so it reverts to the previous version. The usual cause on a router with passwall2 is that passwall2 holds back ForestVPN's own connection while it restarts. Read the real version from the package manager: ForestVPN 0.3.13 and older show the version of their core, 0.3.10, whatever package is installed. Turn passwall2 off, update, switch to Let another app route, then turn passwall2 on again.

Shows the installed version and the updater's last word

apk list -I 2>/dev/null | grep forestvpn; opkg list-installed 2>/dev/null | grep forestvpn
/usr/libexec/forestvpn/update/run status

In the answer, "progress":"rolled_back" means the update was undone.

Step 9. The update was undone and the Update now button is not working (does nothing)

On ForestVPN 0.3.13 and older, first run rm -f /etc/forestvpn/update_bad, because that version remembers the undone update and otherwise will not offer it again. With passwall2 turned off (the usual cause, see step 8), press Update now on the Updates page, or run:

Updates ForestVPN from the terminal and waits for the result

/usr/libexec/forestvpn/update/run check && /usr/libexec/forestvpn/update/run apply --wait

In the answer of update/run status, "undone" (newer versions) or "latest" (0.3.13 and older) names the version that was tried. "retry" with "network_blocked" means neither version could connect, usually for the same reason.

Check it worked

After an update, the Updates page shows the installed version equal to the latest. After a firmware upgrade, ForestVPN is back: same account, same settings, protection on. If Services > ForestVPN is missing 10 minutes after the upgrade, install it again from the download page. Your settings are still on the router.

Undo it

Removing the package keeps this router's key, so a reinstall is the same device on your account. To end that, press Sign out on the Account page before you remove it. Replace this router's identity signs the router out, makes a new identity key and asks you to link it again. A copy of an old backup file then no longer speaks for this router. This cannot be undone.

If something is wrong

Limits

• The messages in steps 3 and 4 were recorded on OpenWrt 25.12.5. Other releases may word them differently.
• ForestVPN's own update button installs a package only if it passes two checks, see who you trust when you update. Updates run when you press the button.
• No update promise or time limit is published for any router.