Hardware Router VPN

[EEVblog]

I want to set up a hardware (router) based VPN at the lab and at home (plus my Android phone).
What do I need?

I know I could just get any of the dozen software based VPN's that are advertised constantly, but I think that having hardware just do it at the router level is way cooler.
I presume my phone will need one of those software options though.

My home router supports OpenVPN and PPTP
https://www.tp-link.com/us/user-guides/Archer-AX6000_V1/chapter-11-vpn-server#ug-sub-title-1

My lab router is an old TP-Link C1200 and Google Gemini seems to think it's capable using OpenVPN via tplinkwifi.net ? 

I also have my dedicated server in the US, so can potentially set up a VPN via that server box I presume?

I asked this on Twitter and Linus himself responded with their video:

[Halcyon]

OpenVPN would be the way to go, it can be a little fiddly to set up initially, but it's very well supported across multiple platforms.

Are you looking to establish a point-to-point VPN so the two networks are connected, or do you just want to be able to remote into one or the other from your devices, as required? Are you wanting to use the gear you already have, or are you open to new hardware?

Feel free to shoot me an email, happy to help.

[EEVblog]

OpenVPN would be the way to go, it can be a little fiddly to set up initially, but it's very well supported across multiple platforms.
Are you looking to establish a point-to-point VPN so the two networks are connected, or do you just want to be able to remote into one or the other from your devices, as required? Are you wanting to use the gear you already have, or are you open to new hardware?

Don't really need to connect the two networks, as I don't have that at the moment, but it might be handy to access my NAS at the lab from home.
Happy to buy new routers if needed, although my AX6000 at home is very nice in terms of WiFi range, which I need to have.
My only goal is to have an IP address on all machines at home and the lab (plus phone) that is not Australia.

[EEVblog]

Not a good start with OpenVPN
Tried to sign up, didn't send the code but sent an email sayign to finish setup, and the password doesn't work 
EDIT: worked after restarting the login a third time
EDIT2: Ran the supplied command on my dedicated server box but there were errors. Penguin support called.

[abeyer]

My only goal is to have an IP address on all machines at home and the lab (plus phone) that is not Australia.

imho, if that's the main goal, then the vpn services are actually a pretty good option. They know their customers rely on them for that and will work to keep their IP addresses "clean" if they want to keep customers. Rolling your own vpn is great for point-to-point or even mesh setups among your own networks/devices, but relying on an ip assigned from some datacenter or cloud provider on your gateway node tends to make for a bad experience on a lot of sites/services.

[EEVblog]

My only goal is to have an IP address on all machines at home and the lab (plus phone) that is not Australia.

imho, if that's the main goal, then the vpn services are actually a pretty good option. They know their customers rely on them for that and will work to keep their IP addresses "clean" if they want to keep customers. Rolling your own vpn is great for point-to-point or even mesh setups among your own networks/devices, but relying on an ip assigned from some datacenter or cloud provider on your gateway node tends to make for a bad experience on a lot of sites/services.

Well, I have three dedicated bare metal boxes that run this site and other things, so I figured I might as well try that first and get some experience with this stuff.

[EEVblog]

Just found out my router with OpenVPN support is not the required client access type I need.
New WiFi routers I guess, or an additional box before my existing routers?

[Halcyon]

I'm not familiar with these third-party VPN services like what TP link are doing. Usually the server is hosted on the router itself, and you just connect back to your home IP address. But TP Link might be doing some kind of Dynamic DNS type stuff, especially if you don't have a static public IP address at both ends. CG-NAT might also cause problems (as you can't connect directly to the WAN IP address on your router).

If you're looking to build a new router, pfSense is my recommendation. Runs on normal Intel-based hardware. Supports Wireguard as well.

But then this opens the question, what kind of internet connections do you have? FTTP is the easiest to work with as it's just Ethernet out of the NTD. If it's FTTN, you need a modem. You *could* double-NAT, but I don't recommend it. Do it once, do it properly.

Personally, this is one of those things where I like to be on-site, see your existing set up, talk it through, rather than going back/forth via messages. There is more than one way to do this, but what is right for you depends on several things.

[gnif]

OpenVPN doesn't require any kind of payment/registration to use it, it's FOSS and can be setup for free, we actually already use it to manage the EEVBlog servers over a secure tunnel.

One thing that nobody is saying in the video, is that the DIY VPNs come with access limitations too. Many sites and service such as banking, and most things behind CloudFlare proxies will reject or flag your connection as suspicious if you're coming from an IP that belongs to a major data centre. This can be a real hassle.

Point to point VPN setups to connect your lab to the home makes sense, but for general daily browsing it has little to no benefit.

If you're looking to use a VPN to bypass network restrictions imposed by the AU government, it's far simpler to just change your local system to use a DNS server such as 8.8.8.8 (google) to avoid the poisoned records the AU government mandate our ISPs must respond with for blacklisted/blocked websites. With the global adoption of SSL (HTTPS), this is the only viable way these sites can be restricted by a government without resorting to filtering on the scale of the great firewall of china. And before someone states IPs can be blocked, yes, they can, but that's becoming extremely ineffective with the number of sites using reverse proxy services (ie, CloudFlare) where blocking the IP would also block many thousands of other websites too.

Edit: I also agree, use pfSense for your home and office gateways instead of the ISP provided router's inbuilt software. Unless you're paying for a Cisco class router, any VPN client software in your router will be very primitive/basic or proprietary.

[gnif]

FTTP is the easiest to work with as it's just Ethernet out of the NTD.

Just FYI, I have FTTP via TPGTelecom on a business plan and it still requires PPPoE for authentication.

[Whales]

Question: Is the following what you are envisaging?

All devices on LAN A accessing any website -> router A -> VPN tunnel -> server B -> rest of internet

Router A = some SOHO router you already own
Server B = some VPS overseas on a static IP


Some problems to be aware of that you might encounter:

(1) SOHO routers with "OpenVPN" support often don't let you edit the OpenVPN, routing & NAT configs directly yourself (because that's complicated and they want to shield you from that), so you are stuck with whatever config they thought you might want.  Sometimes they only support a config designed for external internet devices (eg mobile phone on mobile broadband) to pretend they are inside your LAN, eg so you can check your LAN security cameras on your mobile phone whilst across the country.  This is not the config I describe above and so is probably not what you want.  YMMV, depends on the device and vendor.

(2) SOHO routers with "OpenVPN" support tend to ship outdated versions or (in one case I encountered) delete their OpenVPN support after a couple of years because it's easier than supporting it.  I had a customer call me up to tell me his VPN stopped working, I had a look at his router and discovered the feature was magically gone.  Turns out his router had auto-updated its firmware and the vendor had removed it because of security issues.


If you pay an external provider then your need to configure things & deal with the frustrating complexity of computer network are heavily reduced.  If you do it all yourself then it's best to get help from a friend for the first time, a second set of eyes can point out lots of things.  +1 that this is hard to advise on using only text over the internet, there are dozens of small back-and-forth questions that will probably need answering.

N.B. As a backup plan, if your SOHO router's software ends up infuriating you:
(1) Setup an old computer on your lan as the VPN gateway.  Put it on a static IP and tell it to use the router as its gateway.  Any Linux distro will work, whatever is easiest.
(2) Change the DHCP config on your router so that it tells everyone on your network to use that old computer as the gateway out.

[bingo600]

Warning ... Security/Network nerd alert below.

My suggestion would be to:
With Halycon's blessing  - He'd have to help setting the 'senses up.

I could help here (If pfSense) .... But the time diff could be somewhat "challenging".

0:
If possible at all ... Get a "Static/Fixed" ip address on your Home internet connection.
Else setup some kind of DynDNS registration, if you're not behind CGNAT.

1:
Get two pfSense/OPNsense capable "'x86 boxes" w. Intel netcards.
Maybe some low-power N100 like these  - 8G Ram / 128G Disk would be sufficient:
https://www.aliexpress.com/item/1005006427348753.html?

Use those as Internet routers.
Will give you much better "Firewall protection" , and "great" OpenVPN possibilities.
Both OpenVPN "Dial-in" and Lan-to-Lan (L2L) / Site-to-Site (S2S) capabilities.


2:
If you're happy with your current WiFi ...
Convert your current WiFi units to Accespoints , instead of routers.
Quite easy .... Primarily disable DHCP server , and just "drop the wan-ports on those.


Make all OpenVPN server & clients certificate based:
pfSense cert mgmt. & OpenVPN Client exporter makes it quite easy.
Root (CA) certificates minimum 10yr lifetime.
L2L certificates i'd also make 10yr lifetime.

Dial'in (RoadWarrior) Certs i'd make 2'yr lifetime.

Since you can make firewall rules per OpenVPN instance (interface) , i'd run several OpenVPN instances.

For the L2L connection :
Make the "home" firewall OpenVPN Server , and the "Lab firewall" OpenVPN Client (connection initiator).
On Home: Route Lab lans towards the "remote" OpenVPN gateway.
On Client:  (Lab) route "Home Lans" towards the "remote" OpenVPN gateway ... Will allow Inet traffic, to exit locally on Lab inet.

For the dial-in connection(s):
I chose to make 3 OpenVPN Server instances for "dial-in":
ADM      - Practically no firewall limits  (Dave mode)
INT       - Internal trusted users
EXT      - External untrusted users.

I use both Certs  & uid/pwd VPN login.
Certs are for verifying i trust the client , uid/pwd is for verifying that it's the correct user.

I just have dial-in on my home fwall, and just use the L2L to access the summerhouse.

This is somewhat how i have been running my home/summerhouse setup for 10+ years.


I would do just about anything to NOT run a TP-Link (Or D-Link or ....) box with "Original" firmware as my directly internet connected device.
They all habe some nasty track records.


NB:
Now is the time to think about Vlan enabling your network. 
If you think Vlan's into the design now, your (firewall) life would be soo much easier, going forward.

1Gb managable switches are cheap...
I like the D-Link DGS-1210 (fanless) series , and the DGS-1100-08 ($50) for small sattelites (tv-bench) etc ....



Edit:
Remember to set your OpenVPN Certs w the right properties.
Server needs the server property ticked ....



Edt2:
I use OpenVPN Connect" on my Apple devices
https://apps.apple.com/us/app/openvpn-connect/id590379981

Just "Export" the pfSense OpenVPN def file - e-mail it to the phone , and import it .... done

[EEVblog]

But then this opens the question, what kind of internet connections do you have? FTTP is the easiest to work with as it's just Ethernet out of the NTD. If it's FTTN, you need a modem. You *could* double-NAT, but I don't recommend it. Do it once, do it properly.

I have FTTP at the lab going into my Archer C1200 wifi router (then into a 16 way switch that goes everywhere)
Home is Telstra cable NBN into a AX6000 Wifi Router

[gnif]

But then this opens the question, what kind of internet connections do you have? FTTP is the easiest to work with as it's just Ethernet out of the NTD. If it's FTTN, you need a modem. You *could* double-NAT, but I don't recommend it. Do it once, do it properly.

I have FTTP at the lab going into my Archer C1200 wifi router (then into a 16 way switch that goes everywhere)
Home is Telstra cable NBN into a AX6000 Wifi Router

The next question then is, do you have a real IP at either location or are you on CGNAT (https://en.wikipedia.org/wiki/Carrier-grade_NAT). Unless you specifically required a real IP, most broadband plans in AU give you CGNAT where you're router also has a private IP and doesn't get even a dynamic real IP address. In which case double-NAT would become triple-NAT, which is even worse.

[bingo600]

The El' Cheapo method would be two of these
https://www.aliexpress.com/item/1005007298039666.html

I have two of these , but "just" use them as "dumb AP's" WiFi-6 AX1800
Draws 12v ~300mA ...

They can be converted to run stock OpenWRT latest (24.10.2) - They come w. some "other" OpenWRT ... I'd never trust.
Only thing not working on "stock openWRT" is the Box LED ... Ether leds do work.

On home :
Portforward the OpenVPN port you want , from the AX6000 to the OpenWRT box.

On lab:
You could do the same , or even replace the 1200 w. the EDUP.


OpenWRT is quite capable wrt. OpenVPN.


I have no idea what they can forward w. OpenVPN Encryption - Guestimate .... 50Mbit maybe
But as a "pure" Internet box , they can almost forward the full 1Gb, if you enable hw nat
Hint .... They use same SoC as the Ubi ER-X router


Edit:
The Stock OpenWRT mixes up the LAN ports ...
Phys     Owrt
3          1
2          2
1          3

So once converted , use phys Lan3  as "Lan1"

[Halcyon]

Just to add into the mix of things... You mentioned you would like to access your NAS. I assume you're using normal Windows/Samba/SMB shares? If so, latency will be a killer here. SMB is a very "chatty" protocol and high latency links will absolutely demolish your speeds to these shares, unless you can keep latency to a minimum (this means, no sending data via an overseas VPS).

I have a site-to-site VPN set up between my home network and a mate in the USA. I mostly use SMB internally, but even browsing the folder structure on an SMB share over that link (which has about a 200ms latency) is unacceptably slow. It takes something like 30 seconds every time you want to change folders. Then the transfer speed itself absolutely sucks. It's not designed for these kinds of links, even if you have a lot of bandwidth (I'm on 500 Mbps this end, he is on Gigabit).

We mostly use SSH/SFTP to transfer files.

Honestly, if you can find a way to use something like pfSense on at least one end (that acts as a VPN server), then I think you'll be sweet. But replacing your existing all-in-one router with something like a pfSense box then means you need to look at how you're going to get WiFi. The quick and dirty way would be to use your existing router as the WiFi access point (disable all the routing functions etc... and just use it as a switch). The proper way would be to look at dedicated WiFi access points, which usually only come in "enterprise" flavours (Ubiquti, HP/Aruba, Cisco etc...)

Ultimately, it comes down to what equipment do you already have that can be repurposed and how much do you want to spend.

[bingo600]

you need to look at how you're going to get WiFi. The quick and dirty way would be to use your existing router as the WiFi access point (disable all the routing functions etc... and just use it as a switch). The proper way would be to look at dedicated WiFi access points, which usually only come in "enterprise" flavours (Ubiquti, HP/Aruba, Cisco etc...)

Ultimately, it comes down to what equipment do you already have that can be repurposed and how much do you want to spend.

For home usage (If the wifi-box fw is trustworthy ... WPA2(3) / AES-CCM ... No bugs) , I see no reason to switch to "real" enterprise AP's, if you're on a tight budget.
My suggestion would be give them a go'.
After all - The TP-links wo. wan/routing & dhcp server is also "just" "A few WiFi radios bridged to an ethernet interface (switch)"

I'm using Cisco C2702I (autonomous fw) as my main AP's, but just installed two of the EL-cheapo's (EDUP routers) above w. Stock OpenWRT, as dumb L2 AP's.
They will be serving my IoT WiFi vlan, as i don't want the Radio slowdown of an ESPxx - To affect my main WiFi radios.

The EDUP's are performing quite well, and draw less than half power of a Cisco.

But i do agree that UBI's or Cisco's or Aruba's are nice, but also usually "expensive" & power hungry for a home user.
And i doubt our "great master" would need the extended number of user connections, that an enterprise AP offers.

[Smokey]

I've been running wireguard on Asus router hardware for a while now.  Works great.

[Halcyon]

you need to look at how you're going to get WiFi. The quick and dirty way would be to use your existing router as the WiFi access point (disable all the routing functions etc... and just use it as a switch). The proper way would be to look at dedicated WiFi access points, which usually only come in "enterprise" flavours (Ubiquti, HP/Aruba, Cisco etc...)

Ultimately, it comes down to what equipment do you already have that can be repurposed and how much do you want to spend.

For home usage (If the wifi-box fw is trustworthy ... WPA2(3) / AES-CCM ... No bugs) , I see no reason to switch to "real" enterprise AP's, if you're on a tight budget.
My suggestion would be give them a go'.

Definitely a worthy contender for those playing along at home, but I'm also kind of catering to Dave's request. Ubiquiti is very affordable stuff, but it does require know-how to get set up (not as much as Cisco stuff). I use it at home, not because it can handle 200+ clients, but because it's fast, the coverage is excellent, it's highly configurable, and it works extraordinarily well overall.

I'm sure Dave could easily claim the cost of this equipment back as a business expense, and depreciate it accordingly. People at home buying this kind of equipment (depending on their occupation) might find it difficult claiming this stuff back on tax.

[JohanH]

Ten years ago I would have recommended Ubiquiti as router and firewall, but they have gone to the cloud now. Still running the trusty Erlite-3, and I haven't found a good replacement yet. It's still good for 1Gbit/s (hardware ASIC routing). Maybe Mikrotik, they are pretty much the only vendor for affordable, real routers. Eyeing their L009, but I don't really need speeds faster than 1Gbit.

Having separate wifi access points gives better flexibility. I prefer having the router in its own cabinet and distributing the access points around the house for better coverage. And when the router/firewall is a separate appliance, you can get the device that fits your needs, without having the wifi network in the equation.

[bingo600]

I'm sure Dave could easily claim the cost of this equipment back as a business expense, and depreciate it accordingly. People at home buying this kind of equipment (depending on their occupation) might find it difficult claiming this stuff back on tax.

I'm using Ubi AP-AC-Pro's at work, they're nice, and not as power hungry as the Cisco's.
The "Real" PoE feature is nice if you want to put several up.
I think they make some "better" wifi6 AP's today.

I run the  UBI Controller on a VM Deb-12, "mongodb" was the challenge there.


Being able to deduct the cost, ... I'd love to do that too 
It would certainly help the budget.

My main priority would be to get the 'sense boxes first, for the security they offer.
And then have a look at the WiFi later, if i'm not satisfied w. the boxes i already have.

[bingo600]

Still running the trusty Erlite-3, and I haven't found a good replacement yet. It's still good for 1Gbit/s (hardware ASIC routing).

Why not a x86' and pfSense/OPNsense ??
pfSense just got a new 2.8 release , so i hope there's still some future with the free CE edition.

pfSense 2.8.0 is still quite new "freshly released" , i'd install 2.7.2 and wait a bit of time before upgrading to 2.8.
Note: Always install the pfSense System_Patches package, in order to get/pull "inbetween release ... patches"

Do you use VRF's ? ... Then i'd look at Vyos


Just converted my "old" ER-X to OpenWRT latest ... Just because i could, and that it hasn't seen updates in a long time.
just using it for test setup's today.

[EEVblog]

The next question then is, do you have a real IP at either location or are you on CGNAT (https://en.wikipedia.org/wiki/Carrier-grade_NAT). Unless you specifically required a real IP, most broadband plans in AU give you CGNAT where you're router also has a private IP and doesn't get even a dynamic real IP address. In which case double-NAT would become triple-NAT, which is even worse.

I have a static IP at the office through AussieBB, the same one you set up the backup server with.

Home is with Exetel which seems be be carrier grade NAT, but it gives me an opt-out option:

[JohanH]

Why not a x86' and pfSense/OPNsense ??
pfSense just got a new 2.8 release , so i hope there's still some future with the free CE edition.

Do you use VRF's ? ... Then i'd look at Vyos


Just converted my "old" ER-X to OpenWRT latest ... Just because i could, and that it hasn't seen updates in a long time.
just using it for test setup's today.

I got this small 1 litre Thinkcentre with that in mind, to run VyOS (just because I like the command line and it's similar to the Vyatta based EdgeOS). Ended up running xcp-ng and virtualizing a few applications. Could as well run the router/firewall on the same box, but I'd rather not. Prefer the router to be a separate appliance. The ERlite-3 has had pretty much 100% uptime. I'm sure if I begin tinkering, there would be downtime. So I guess I'll run the Erlite-3 until it breaks down. You can still get the Edgerouter ER-4 new, but OS updates is a concern. OpenWRT isn't bad, but do you retain the hardware routing capabilities (pretty much useless on this old hardware otherwise)?

[bingo600]

OpenWRT isn't bad, but do you retain the hardware routing capabilities (pretty much useless on this old hardware otherwise)?

I can enable HW nat on my OpenWRT ER-X, so performance is the same as on EdgeOS.
Maybe they do the same for the lite-3.

In fact ER-X performance it's better than on EdgeOS... One of the "Gurus" made a linux connect hw trick on the ER-X (non SFP model).
He was able to "software" connect the WAN port directly to the CPU , and not via the switch chip.
That removed the "total combined up/down bw. 1Gb max" limit that the switch imposes.
Now you are able to do approx 1.6 Gb combined.

Edit:
I totally agree with not virtualizing my main router.
Imagine my "ear pain" if my "most important customer ... SWMBO" lost Netflix or FB for a longer period of time.
Especially if it was caused by an unnecessary complicated setup, that i made my self



Are we drifting off-topic here or ... ?