Setting up VPN/VLAN and Dual NIC

[tech_junkie]

example 2 router ip scheme
IP address 10.11.13.1
Subnet mask 255.255.254.0
IP range 10.11.12.1-10.11.13.255

That's better. I don't have all of those subnet masks memorized to do all of them in my head.

 

[duplo]

I would suggest stop listening to @tech_junkie
I get headache from what he writes
I dont understand why someone would plan a network like him, but everyone does things different. some people like problems, others not. there is no final solution.
You should think about these:

Cellular and wifi bridge connection are things you use when its impossible or too expensive to run a cable. It will never ever outperform a cable.
Cellular has horrible latency. wifi still has bad latency, better than cellular. Many things can make the connection worse, like weather.
You dont want latency when you can avoid it. You dont want unreliable connections.

Most providers only allow one connection. Then you wont be able to establish two for two routers. You end up connection them together. New cascade, new problems.
Connecting 2 routers together is a bad idea. People still do because they dont know better.
You get a nice thing called double nat.
You can get over some problems you get, but its hard to configure correctly.


You should think what your plan was at first.
2 NIC solutions are for people who have small networks. Some cameras around the house, short cable ways.
Can simply add another switch, connect all cams to it and connect the nvr/bi system onto it.
Simple, works, people are happy that they are safe from bad china cams.

You already have a complex network with converters, multiple switches, 2.5G/10G etc.
To troubleshoot this is already difficult. You already saw it in your old thread.
If you dont use managed switches with webinterface its impossible to monitor a specific port. It will be always a pain in the ass to troubleshoot problems.
You always come to the point ... it is the converter? it is the camera ? it is switch XY ? a connector ? cable ? wifi bridge? cellular network ?
You will waste hours and days to test manually.

Looks like @tech_junkie having fun with troubleshooting this


I dont even get your point.
You already have 2 managed switches in your house. There is only one which is not. You simply get another 8 port like SG2210 connect it at the pole and you can use vlans if you want to seperate your cameras from your home network. You dont use vlans because @tech_junkie dont like them ? aha. then just add wifi bridges and cellular connections.. oh boy!

You already have an advanced firewall, heck you can simply block the internet for the cameras if you are obsessed with the plan.
Why even did you bought the expensive network equipment at first when you now want to step back to a dumb network ?
Your provider may give you a dumb basic router for free. why even use omada stuff when you dont want to use most of the features ?

The majority simple connect everything to the internet, dont even think about all these things. Use alexa, share all their data with google, amazon and microsoft. dont give a shit.
There are even people using port forwarding.

What do you think will happen if you connect your camera to the internet ?
XI will watch you ?
Some weirdo will watch your driveway?
Someone hack into your network because you are so interesting like Taylor Swift?
I dont get it.
To my knowledge there are no proofs that ever happen somewhere


Keep it simple and think about how to troubleshoot problems in future.

 

[MTL4]

@duplo may be surprised but I actually agree with most of what he’s saying in here. I have no idea what @tech_junkie is trying to do so I can’t comment on that at all. The original plan didn’t require internet at the entryway from what we knew but now that’s obviously changed as more details come out. Bottom line is you should really have a plan so you know what problem you’re trying to solve before looking for the solution. As an example using cellular (latency and all) to open a gate remotely isn’t a big deal but if you later decided you wanted a video intercom, then suddenly that solution would be a really bad idea. Again I totally agree hardwired is always better than a wireless connection. So if you need bandwidth and low latency then managed switches with VLANs would definitely work to separate your camera network from your internet network over the same fiber connection to bring access to the pole with plenty of capability to run video all day long. VLANs do require some more advanced networking knowledge which is why I try not to use them in a residential situation unless they are absolutely necessary (but they may end up the best solution). I also absolutely advocate for managed switches when troubleshooting, makes life way easier. I definitely do not advocate ever using port forwarding or giving cameras internet access but as @duplo mentioned many folks do (I’ve dealt with hackers before, definitely not fun). Again you really need to know what the plan is first before going down any rabbit holes on this. Your network is currently set up well and not super complicated yet but before any next steps it definitely needs a plan of what you’re really looking to do.

 

[tech_junkie]

Most providers only allow one connection. Then you wont be able to establish two for two routers.

Obviously you never had set up multiple IPs from the same ONT or cable modem. Leasing IP address is not a big deal. The only thing with ISPs is that they might upgrade the service to a business account for billing purposes.
I should post how this system could be altered to have multiple IP outside addresses with some equipment suggestions.

BTW, I get hired to set up networks with multiple IP + WAN splits and network redundancies. Last client was a bank. Before that was a bugler/fire alarm monitoring center.

Cellular and wifi bridge connection are things you use when its impossible or too expensive to run a cable. It will never ever outperform a cable.

How much bandwidth does one device need?
Chiming in with general statements without considering what the situation is, much less the needs of the network, is like cliff diving in the grand canyon.

 

[Sonnie]

The plan is to get Internet access to the switch at the service pole as securely as possible.
tech_junkie has offered a solution ... no one else has to this point. Maybe his solution is not good, but belittling him is no help to me. If you have a better solution, please tell me how you would accomplish the plan. Thanks!

Here it is again, with the switch at the service pole removed.

 

[MTL4]

I’ve done plenty of both corporate and residential networking myself but regardless of anyone’s qualifications the wrong solution can be problematic. Happy to help but the issue here is that simply saying I need internet to the pole can be solved several ways but the performance of it may not work depending on what you’re using it for as I mentioned earlier. You can certainly do it by placing a managed switch at both ends of the fiber, set your VLANs to have both a camera and a main network then just connect the main (18 port) office switch to the office camera switch. This will be the easiest way to pass your internet along to the pole but it requires that you have your VLANs in the switches setup right. If you do it right you can block camera internet access and prevent someone from accessing your main network at the pole while still allowing internet access for MyQ devices.

 

[tech_junkie]

tech_junkie has offered a solution ... no one else has to this point. Maybe his solution is not good, but belittling him is no help to me. If you have a better solution, please tell me how you would accomplish the plan. Thanks!

I'm looking forward to what they come up with.
Because there are a few valid ways to do all of this, I just showed you the easier ones to maintain in case of equipment failure.
Of course we can get more complicated but I don't think setting up networking redundancies is that critical compared to the Internet which I built 1/8 of that network infrastructure decades ago and hasn't gone down yet.
But let's see what they come up with. Even the rude yankees. Now you know how an internet networking engineer would set it up, now lets see what the office IT guy or the DIYer does/say.

 

[Sonnie]

In the meantime, at least I have some protection with ZeroTier, although I haven't been able to get it to work on my Android phone yet.

 

[MTL4]

But let's see what they come up with. Even the rude yankees. Now you know how an internet networking engineer would set it up, now lets see what the office IT guy or the DIYer does/say.

LOL, ok bud. You’re not the only engineer in here either but thanks for being such an adult about it. A network engineer that hates VLANs, that’s definitely a new one.

 

[tech_junkie]

LOL, ok bud. You’re not the only engineer in here either but thanks for being an adult about it.

no problem. I did notice you chiming in and it will be interesting to see what they do to get around the 3 switch limit on a network segment. Which no one here really discussed that but me.

 

[MTL4]

no problem. I did notice you chiming in and it will be interesting to see what they do to get around the 3 switch limit on a network segment. Which no one here really discussed that but me.

Managed switches and VLANs to solve this issue entirely.

 

[tech_junkie]

Managed switches and VLANs to solve this issue entirely.

I really don't see why a vlan is needed. Its just another thing to set back up after a hardware failure.
Plus everything else can't communicate to the outside and the other methods I used you can implement mac filtering so only the gate controller is allowed. So what is the point of the Vlan for one device?
Besides that, didn't they have issues when they had a vlan set up?
Also, what you trying to guard against since the cameras could not reach the internet if it wanted to?
Not like the cameras are going to do anything and the "phone home" thing I think is more of someone's paranoia than anything else.
But maybe they didn't regenerate their certificates in their cameras like they suppose to do. Because that is a standard industry practice that I never seen anyone mentioning here.

 

[MTL4]

I really don't see why a vlan is needed. Its just another thing to set back up after a hardware failure.
Plus everything else can't communicate to the outside and the other methods I used you can implement mac filtering so only the gate controller is allowed. So what is the point of the Vlan for one device?
Besides that, didn't they have issues when they had a vlan set up?
Also, what you trying to guard against since the cameras could not reach the internet if it wanted to?
Not like the cameras are going to do anything and the "phone home" thing I think is more of someone's paranoia than anything else.
But maybe they didn't regenerate their certificates in their cameras like they suppose to do. Because that is a standard industry practice that I never seen anyone mentioning here.

Glad we’re back to a civil conversation, point here is to help the OP get something that works for him.

Cameras from China have been proven to provide access to networks so much so that some governments have banned them from being used. Most of this comes from improper network setups but it definitely is a problem. VLANs are basically like highway lanes, so if you want to keep the traffic where it’s supposed to be, you can manage that right in the router/switches. Backup config files make hardware replacement very easy and painless. So if you don’t want folks being able to plug into a port at the pole and have access to your main network, then you’d create a VLAN that allows internet access to just devices (both at the pole or around the home) connected to MyQ and allow them internet access but that’s it. Camera network stays isolated as it should and has no internet access or access to your main home network. I try not to use VLANs on residential setups (physical networks are easier to understand and maintain for most folks) because it adds complexity but sometimes it becomes unavoidable like in this situation.

I don’t really understand what your plan was at all. Is it just unmanaged everything then just block devices in the router via MAC addresses? Feel free to elaborate, I’m genuinely curious.

 

[tech_junkie]

Cameras from China have been proven to provide access to networks so much so that some governments have banned them from being used.

There has to be a real logical explanation to this other than a blanket statement.
Because some of those cameras are 'cloud cameras' meaning they connect to a cloud server. You've seen them. They require the user to make a cloud account in order to set them up, But any hacking using this is going to be manufacturer specific. The cloud connect method is what NVRs use to make remote sessions as well as cloud connect VPNs.
The other way is by certificate hacking where the hacker installs a copy of the TLS certificate the OEM has (because they hacked and took it from them or was sold to them through the dark web) on their server, initiate a certificate client update and wait until the camera comes online and does its CA client request/update, it gets updated and then responds to the latest server that last updated the certificate. Which the only devices documented that was compromised this way was HP cloud connect printers. But regardless, all devices that have a self signed certificate for any reason should be regenerated with it not connected to the internet.

I understand what a vlan is, but securing the switch physically is more important. Because its game over in that situation.

Both connection schemes would serve to restrict web access from cameras. But the example with the router would do active mac filtering if it needs higher security and someone actually physically got a hold of the equipment at the gate and hacked in.

 

[MTL4]

There has to be a real logical explanation to this other than a blanket statement.

Where Dahua and Hikvision Are Banned

See dozens of government entities and organizations who have banned or barred Dahua and Hikvision.

ipvm.com

Not sure what more you’re looking for? They are banning them for a reason (ie they are a security risk if you don’t set your network up right).

I absolutely agree any networking equipment at the pole should be physically secured but worst case I wouldn’t want anyone having remote access to my home network for any reason (hence a VLAN would prevent this). They could access the internet but that’s it.

 

[Sonnie]

I should be able to use the Omada Controller and the managed 16 port switch to create a vlan for the port the pole switch is connected to, but I would need a managed switch at the service pole to set individual ports there... one port setting for the MyQ device, and appropriate port settings for the cameras. There would be no way to separate those without the managed switch if I am understanding it correctly,

For the time being, I have the unmanaged switch from the pole connected back to the managed switch so that I can have access to Blue Iris via my phone. I have ZeroTier VPN installed here on the BI machine, so at least that is some protection for now. I realize my switch at the pole is unprotected at this point and the plan is to fix that. Thankfully, where we live way out here in the boondocks, we don't have too many folks running around trying to hop on other folks' switches, or at least not that I've heard of. We are all a bunch of redneck hillbillies down here in L.A. and don't know how to steal network access from folks.

 

[MTL4]

I should be able to use the Omada Controller and the managed 16 port switch to create a vlan for the port the pole switch is connected to, but I would need a managed switch at the service pole to set individual ports there... one port setting for the MyQ device, and appropriate port settings for the cameras. There would be no way to separate those without the managed switch if I am understanding it correctly,

The the time being, I have the unmanaged switch from the pole connected back to the managed switch so that I can have access to Blue Iris via my phone. I have ZeroTier VPN installed here on the BI machine, so at least that is some protection for now. I realize my switch at the pole is unprotected at this point and the plan is to fix that. Thankfully, where we live way out here in the boondocks, we don't have too many folks running around trying to hop on other folks' switches, or at least not that I've heard of. We are all a bunch of redneck hillbillies down here in L.A. and don't know how to steal network access from folks.

Sounds like you got it.

Here's how I would do it......I just picked numbers for the VLANs, you can make them anything you wish except default is usually always VLAN 1 (I think it would be easiest for you to just make that the main home network). Both VLAN 1 and 20 have access to the internet but VLAN 10 doesn't and is also isolated from the rest of your networks. Both VLAN 10 and 20 are carried through the fiber connection to the switches on either end and routed accordingly.

 

[Sonnie]

I assume I create the VLANs (vlan 1 is already there - keep it for the home network).

Then I set the ports throughout the entire network (on each appropriate managed switch) that will be on each vlan?

Then I need to change the IP address of each device connected to vlan 10 or 20 so that it's subnet matches the vlan it is on?

For example, if a camera is now on vlan 1 with an IP address of 192.168.0.35 ... it will need to be changed to 192.168.10.xx.

Is this the correct order of steps to take?

 

[MTL4]

I assume I create the VLANs (vlan 1 is already there - keep it for the home network).

Then I set the ports throughout the entire network (on each appropriate managed switch) that will be on each vlan?

Then I need to change the IP address of each device connected to vlan 10 or 20 so that it's subnet matches the vlan it is on?

For example, if a camera is now on vlan 1 with an IP address of 192.168.0.35 ... it will need to be changed to 192.168.10.xx.

Is this the correct order of steps to take?

Yes, VLAN 1 is there by default (which makes it easy to assign the main network to that) and you’ll need to add the rest of them. The number of the VLAN doesn’t need to match the subnet at all (although some folks do like to do that as a way to stay organized). Usually you would assign IP ranges to VLANs in the router for any networks that need a path out to the internet. Then you would go into each switch and set the ports correctly depending on what data should be allowed to pass or be blocked.

 

[Sonnie]

So there is no need to change the IP addresses of any of the devices or cameras?