OpenVPN, Must Router be Inline to Modem?

[Jose R.]

Quick note, I have discovered that if I am on the new Wi-Fi network provided by the ASUS, I can no longer stream to the TV or the receiver. They are hardwired and not using any Wi-Fi. It seems now they are on different networks since they are on a switch fed by the ATT router but shared by the ASUS. Now we are seeing the headaches of 2 routers... Didn't take long, huh?

What's the best way to fix this? I'm sure there's some IP work I can try but am unaware of. Or I can also just go the guaranteed gorilla route and just wire everything off the ASUS by running a wire back to the AV center and feeding the A/C Center switch from it. This way the ASUS is inline and upstream of everything, instead of at the end of the line the way I have it now.

Maybe static IP the TV to something in the ASUS DHCP pool? Would that force it to connect to the ASUS and ignore the ATT?

Thirdly, I could also just relocate the ATT router into the VMS closet by extending the WAN feed from ATT to that location and run it all from one spot. Downside there is not having all the IPTV equipment in one place for simplicity and/or checking status. Tho moving it here requires one less UPS to keep the system up and online...

So! What should I try first?

Thanks, all!

 

[NoloC]

I think you are describing what would be expected since the ASUS is in the DMZ.

Just run one more wire or move the ASUS so everyting is downstream of it and the ATT modem is passthrough to the ASUS WAN port.

If bridge mode is not easy to set, have ATT send you the BGW210-700. I believe the main difference is no coax but looks like you are not using that connection anyway.

 

[Jose R.]

I think you are describing what would be expected since the ASUS is in the DMZ.

Just run one more wire or move the ASUS so everyting is downstream of it and the ATT modem is passthrough to the ASUS WAN port.

If bridge mode is not easy to set, have ATT send you the BGW210-700. I believe the main difference is no coax but looks like you are not using that connection anyway.

Yep, sounds like I may have to do that. Unfortunately I read the IPTV's need to still be connected to the ATT router so I'm essentially going to need to run 2 physical separate networks in the house if I want to hardwire the TV's.

The new diagram should solve my issue. Note the new red backfeed wire. This isolates the IPTV traffic from the home network and has the ASUS upstream of everything so it can do it's job.

 

[IAmATeaf]

Are you not over thinking/complicating things?

Your BI server has 2 network cards, so it can effectively bridge (or even route) 2 networks. So on your internet side reserve an IP address on your router so that that network card will always be assigned the same when restarted. On the CCTV side, assign a static IP address on a separate network and assign all the cams to be on that same network with then all being static. On this network don’t assign a default gateway, unless there’s a good reason none of the devices on that network need access to the internet.

Once you have this setup, then think about getting remote access via VPN. You might to run the Asus in AP mode in order to keep to a single network, running in AP mode will disable DHCP and NAT so your main router will need to provide these but as I pointed out above running in AP mode does mean that VPN capabilities aren’t available. I’m currently looking into running a VPN server on another device or even hacking this into the Asus in AP mode.

 

[Jose R.]

Are you not over thinking/complicating things?

Every damn day.

Once you have this setup, then think about getting remote access via VPN. You might to run the Asus in AP mode in order to keep to a single network, running in AP mode will disable DHCP and NAT so your main router will need to provide these but as I pointed out above running in AP mode does mean that VPN capabilities aren’t available. I’m currently looking into running a VPN server on another device or even hacking this into the Asus in AP mode.

That's the issue tho: The whole point of the ASUS router is for the VPN and the Wi-Fi. As it stands now, I think I have successfully placed the ATT router in pass-thru mode to the ASUS. So I just need to refeed the A/V center from the ASUS and I should be good to go.

 

[IAmATeaf]

If you’ve put the ATT router into pass thru mode then normally the network ports on the back won’t work so you’ll have to move the devices from it to the switch.

 

[Jose R.]

That would normally be correct. But as stated before, this gateway can't be properly set to pass-thru. You can only do a pseudo pass thru by jumping thru some DMZ hoops. The end result is that it still routes so the IPTV equipment is still run directly off it. It's been working that way just fine for a few days.

 

[TL1096r]

How are you doing with this? I am looking to do a similar setup but I do not need to have the bridge router and can just replace my router I have now with asus which seems to make things easier.
What steps did you have to do to setup the BI server with dual nic?
Is a 8 port switch necessary and what is the purpose?

 

[Jose R.]

How are you doing with this? I am looking to do a similar setup but I do not need to have the bridge router and can just replace my router I have now with asus which seems to make things easier.

I got it working perfectly. After backfeeding the A/V center from the Networking closet, it's all working as it should with everything downstream of the ASUS router.

What steps did you have to do to setup the BI server with dual nic?

That's covered on the forum many times over but basically you just install the second NIC (assigned with 192.168.3.x and no gateway) and manually assigned the cameras all 192.168.3.xxx addresses. That way they are stuck on their little IP island and can't do anything. The BI PC is assigned a 192.168.2.x address so as not to interfere with the AT&T router's IP address pool of 192.168.1.x.

Coincidentally I just dumped AT&T (expired promotion) and went with Comcast. I bought my own modem and placed it in the networking closet from the start (so now on UPS, too). While that did simplify everything, I'm leaving all my IP settings in place for when/if I go back to AT&T next year.

Is a 8 port switch necessary and what is the purpose?

It's purpose is to distribute your network/cameras. You need it if you need that many ports.

There's a Wiki with cliff notes at the top of this page. Read it, it's got everything you need.

 

[TL1096r]

I got it working perfectly. After backfeeding the A/V center from the Networking closet, it's all working as it should with everything downstream of the ASUS router.



That's covered on the forum many times over but basically you just install the second NIC (assigned with 192.168.3.x and no gateway) and manually assigned the cameras all 192.168.3.xxx addresses. That way they are stuck on their little IP island and can't do anything. The BI PC is assigned a 192.168.2.x address so as not to interfere with the AT&T router's IP address pool of 192.168.1.x.

Coincidentally I just dumped AT&T (expired promotion) and went with Comcast. I bought my own modem and placed it in the networking closet from the start (so now on UPS, too). While that did simplify everything, I'm leaving all my IP settings in place for when/if I go back to AT&T next year.



It's purpose is to distribute your network/cameras. You need it if you need that many ports.

There's a Wiki with cliff notes at the top of this page. Read it, it's got everything you need.

Thanks, looking it over now. I just did not see step by step like this so I didn't think I could accomplish it. I am unsure on my camera how to assign specific IP. Through camera app or on PC is this achieved? I would not know how to assign no gateway. I will search but if you have a link with what you are saying I think I can do it on my own.

I was asking about the 8-port switch not 8-port POE switch for cameras.

Thanks for explaining this better it is one step that makes more sense I just need to better figure out steps to actually do it now

 

[Jose R.]

No problem, you just need to learn basics of networking. I had to do the same. Assigning the manual IP to the network is achieved thru the network adapter settings, then properties on a PC, under IPv4 settings. There you can assign your IP address. Under that, it says gateway: for the camera network, leave that part blank. Now they have no internet access. On the cams, you do that thru the web client so they are under the same subnet, or the "3" in my setup for example. I don't have a link but these are networking basics you can google if you want step by step.

I have 3 subnets because of my weird AT&T problem. You will only need 2 if you're not battling ATT's router against your own like I was.

I have an 8-port switch in my setup simply because my router (with built-in 4-port switch like most) is physically in a different location from where I need the switch.

 

[TL1096r]

No problem, you just need to learn basics of networking. I had to do the same. Assigning the manual IP to the network is achieved thru the network adapter settings, then properties on a PC, under IPv4 settings. There you can assign your IP address. Under that, it says gateway: for the camera network, leave that part blank. Now they have no internet access. On the cams, you do that thru the web client so they are under the same subnet, or the "3" in my setup for example. I don't have a link but these are networking basics you can google if you want step by step.

I have 3 subnets because of my weird AT&T problem. You will only need 2 if you're not battling ATT's router against your own like I was.

I have an 8-port switch in my setup simply because my router (with built-in 4-port switch like most) is physically in a different location from where I need the switch.

Ok thanks. Yes networking basics. I would need to do it as I never touched or seen any of this before so it would be all new.

I was reading that you can remove network gateway from camera which allows any device on the same subnet access the device but doesn't know how to get back to internet. Is that different from what you said you did? I was not sure how to do that but seems like a good idea.

Thanks for additional info. And yes I searched IPCT and this thread was the closet to explaining unless I missed a different thread as I read the cliffnotes twice and did not see it so I appreciate you taking the time to explain this.

 

[Jose R.]

Yes, removing the gateway is the same as what I did. Same procedure and idea.

This thread is for someone fighting with an AT&T wireless gateway and their own router (2 routers in a network which causes problems). While it contains other networking ideas and issues as I was learning along, it's meant more for the AT&T problem. Other threads will help you with other issues like isolating the cameras, dual NICs, and assigning IP's to make it all work. I learned it all here.

 

[TL1096r]

Yes, removing the gateway is the same as what I did. Same procedure and idea.

This thread is for someone fighting with an AT&T wireless gateway and their own router (2 routers in a network which causes problems). While it contains other networking ideas and issues as I was learning along, it's meant more for the AT&T problem. Other threads will help you with other issues like isolating the cameras, dual NICs, and assigning IP's to make it all work. I learned it all here.

Thanks. I will keep searching. Do you by any chance recall the threads to link here? I search but come up with 3-4 pages and yet to see a step by step guide. I learned stunnel through these great forums and tried to make it easier with a step by step thread for others as it was scattered. I will try to do the same with this once I learn it all and try to do a step by step guide too for others. I know many are in same boat reading through forms.

But this is some great steps to make everything more secure. Slowly learning something new everyday.

And apologies for newbie questions I feel once I get into it and look at settings on windows/camera app it will click.

 

[catcamstar]

Ok thanks. Yes networking basics. I would need to do it as I never touched or seen any of this before so it would be all new.

I was reading that you can remove network gateway from camera which allows any device on the same subnet access the device but doesn't know how to get back to internet. Is that different from what you said you did? I was not sure how to do that but seems like a good idea.

Thanks for additional info. And yes I searched IPCT and this thread was the closet to explaining unless I missed a different thread as I read the cliffnotes twice and did not see it so I appreciate you taking the time to explain this.

Aren't you confusing couple of things? In your other thread with BI pc with dual NICs, it doesn't even make sense to put a gateway in the cams as they will never be able to send packets to the first NIC in the BI pc in the first place. It is however not a "best practice" to leave the gateway blank, as many subsystems do know that if an IP is 10.0.0.75 there is a high probability the gateway sticks on 10.0.0.1 with a subnet mask of 255.255.255.0. If you want to make sure you don't have any "ET phone home" message, or unwanted inbound and/or outbound traffic, you are up for a firewalling task. How to do that? As I already wrote in your other thread: by implementing vlans, you can perfectly "isolate" your cams, with or without gateways, but your firewall definitions on the vlan traffic will define who can talk to what (and reverse). In my current network, all the phones are "identified" and only some can view all cameras, and others are "filtered" out. Idem for cams calling home. I am still standing behind that advice: it may not be applicable for your situation today, but it might be a solution for your future needs (and security concerns). Same for VPN, there are ample setup guides available (eg How To Set Up an OpenVPN Server on Ubuntu 16.04 | DigitalOcean) or to host them on your (home) router (eg asus).

Good luck!
CC

 

[TL1096r]

Aren't you confusing couple of things? In your other thread with BI pc with dual NICs, it doesn't even make sense to put a gateway in the cams as they will never be able to send packets to the first NIC in the BI pc in the first place. It is however not a "best practice" to leave the gateway blank, as many subsystems do know that if an IP is 10.0.0.75 there is a high probability the gateway sticks on 10.0.0.1 with a subnet mask of 255.255.255.0. If you want to make sure you don't have any "ET phone home" message, or unwanted inbound and/or outbound traffic, you are up for a firewalling task. How to do that? As I already wrote in your other thread: by implementing vlans, you can perfectly "isolate" your cams, with or without gateways, but your firewall definitions on the vlan traffic will define who can talk to what (and reverse). In my current network, all the phones are "identified" and only some can view all cameras, and others are "filtered" out. Idem for cams calling home. I am still standing behind that advice: it may not be applicable for your situation today, but it might be a solution for your future needs (and security concerns). Same for VPN, there are ample setup guides available (eg How To Set Up an OpenVPN Server on Ubuntu 16.04 | DigitalOcean) or to host them on your (home) router (eg asus).

Good luck!
CC

I could very well be confusing some thing so that is why I am reading twice prior to doing anything.

Sorry what other thread do I have? If I said something different I will change it to make it correct. I really did miss you talking about setting up vlans. I can tell you how to remove a car engine by generalizing it but without a clear step by step guide you could miss one thing and it won't come out cleanly. This is where I am at as I rather not go back and forth missing 1 thing but instead read a guide with steps. I would not know where to being to setup what you are saying not even close without photos and how to go through it step by step. I am simply trying to piece together a few threads into 1 notebook I have to get this all up and running like I did here.

I can sense some "you should read more" in your post and I understand and do apologize. I don't want to be spoonfed but only looking for a bit more confidence and understanding before I do something wrong that disables cameras and having to go back to old setup.

I tried vpn on windows10 vs setting it up through asus and gave up after watching videos that missed steps like "wABZl5tO3U8" - it has the step of name/pw and someone even else asked in the comments about it.

Thanks for your post

 

[catcamstar]

*snap*

Sorry what other thread do I have?

*snap*

I was indeed referring to the same thread you started earlier (What are you using/doing to make your camera more secure?) on which I replied back in the days before you changed the full starting post with your great step-by-step stunnel procedure.

But you are completely right: my advice (in between the lines) indeed is "you should read more", not to waste your time, but like my networking instructor always stated: each (customer) case is different, and all roads lead to Rome. So before selecting the technology layer(s) - like VPN, vlans, dual NIC - you should first note down what you want to achieve (functional and non-functional requirements), note down the constraints and limitations (money is one of them), and then start with a high level diagram (simple drawing blocks). Then, in the last cycle of this design planning, you enter the technology selection phase (eg a "simple" ASUS router with VPN, or a Win10 device, or a Cisco high-end yet refurbished edgerouter). I am more than happy to share with you how I constructed my home network (with vlans) even in step-by-step, but I'm pretty sure it will not fit your environment and it won't serve your purpose. But I can share you the decision process / flow I followed, and you can learn from it, steal (loan) the good stuff that suits your environment. And gradually, your network will become better and better.

Take a piece of paper, and draw:
- scenario 1: your current networking diagram: where's your gateway/router, where's your wifi, where's your DHCP, where's your BI, note down IPs, subnets and gateway addresses
- scenario 2: your "to-be" diagram with OpenVPN: if someone enters through OpenVPN: what are these users allowed to see? All? Only BI? Should they be able to reach the internet too (redirect gateway)?
- scenario 3: your "to-be" diagram with increased security: write down some network firewall considerations: draw arrows: inbound & outbound traffic: what would you allow? Who should be able to see your cams? Your NAS? Your wifi'd printer? Your fridge? Your smartTV?
And based on the answers of these questions, you can derive which networking capabilities you NEED versus which are "OPTIONAL". Luckily for you: there is NO ideal networking setup. It should be obvious that a banking institution has different "rules and regulations" in their datacenter than a home-user, however all these technologies are readily available too today! Which should not block you - if you would like to - from using them! Networks do change over time too, they are not designed to run for 100 years. For example, in summary, my network setup journey:
- I started years ago with my ASUS RT-AC87U - Allrounder with tons of network capabilities, expert functions (certainly when loading the Rmerlin firmware). But if you want to go "hardcore", with vlans and stuff, you'll run into "limitations", like my AC87U: it uses two different chipsets (for "maximum bandwidth" excuse, but the Debian underneath couldn't handle vlans properly anymore). OpenVPN runs like a charm on it, and you can "parental control" wise block any intranet device from phoning home. Asus is one of the best picks to "mature" your networking needs.
- But then I wanted more... More vlans (to secure my NAS (vlan 202), my domotica (vlan 203), my alarm systems (vlan 204), my cams plus nvr plus intercoms (vlan 205), intranet (200) and guest intranet (201)). This wasn't possible at all in the ASUS network. My core router functions are now running on a single Edgerouter ER-X from ubiquity: it can do ANYTHING you want, this little box is very powerful: openVPN, Vlans, firewalling, etcetc. Pricewise 1/4th of the ASUS, but worth every penny. If you have already some Ubiquity gear, do investigate the management software compatibility: not everything is "user"friendly. I still use the ASUS as "main" router for my internal (v)LAN, with guest wifi and other nice things! But than one might change to another ubiquity device (soon).

So no worries if many of the things above are "chinese" to you, but just like looking for a new car, take a moment, write down your requirements (what you want), and it becomes much more visible (easier) to actually see what you want/need.

Always welcome to go in deeper details if you want!

Hope this helps!
CC

 

[TL1096r]

Thanks for your time and explaining more. I am going to be reading this over and over and write this all down before posting more details.