Setting up VPN/VLAN and Dual NIC

[Sonnie]

I have installed an additional gigabit NIC, but I have not set it up yet. It's working with the defaults at present.

I am trying to wrap my head around the proper way to run the cameras thru the network. Below is my current network diagram.

There are TWO cameras coming in thru the fiber that is run to the service pole at the gate. Will be adding a third PTZ camera soon. I plan on replacing the TP-Link SS108GP switch at the service pole with a managed switch simply to have control over the switch.

There will be several more cameras with Ethernet cables already running from their location to the office/room where the Blue Iris computer is located. I have dual NIC in this computer and two Ethernet cables ran from the utility room.

Looking for advice on how to set it up and run it all. Do I need to run any new wires, add any other switches or is it all done with software?

 

[The Automation Guy]

If you expect to segregate the data coming over the fiber link into two VLANs - one for camera use and another for the devices connected on the WiFI AP, then you'll definitely need a switch that supports VLANs (usually some sort of managed switch) at the driveway gate (I didn't research to know if the current switch has that capability or not). Once the switch tags the different traffic with the applicable VLAN number, traffic it will be segregated, but sent over the same fiber bridge to the main house.

That being said, since these cameras are going to have to use VLANs and not be on a completely separate network, there is really no reason to add the second network card in the BI machine. People typically add a second card when they can put all of their cameras on a separate network (physically) and one port goes to that camera network and the other port goes to the regular home network. You'll effectively accomplish the same thing over VLANs, but the requirement to have two network cards in the BI doesn't exist when you use VLANs. Therefore I would remove the nic/direct connection to the router and just hook the BI machine up to the switch.

So, you'll need to create a VLAN for camera use only, and at least one more VLAN for all the other traffic on your network. You'll need to set the VLANs up in your router/firewall device as well as the individual switches. (This assumes your firewall/router is going to handle all of the routing tasks on the network. If you are going to set up the switches to act as a true layer 3 devices, you set everything up in the switches and you won't even have a separate router/firewall. This is NOT what most people do unless they are trained IT professionals and deal with layer 3 switches regularly).

I would also connect the switches directly to each other and not solely through the router. Any traffic between VLANs is going to have to pass through the router, but all traffic passing on the same VLAN could be handled at the switch level. But if you have only connected the switches to the router and not to each other, you are forcing all of the traffic to go through the router which could potentially create a bottleneck. I don't think these TP-lInk switches can "stack" but higher end enterprise switches can generally be linked together via "stacking". This creates just a single user interface vs three different ones (so example if all of your switches had 24 ports, you would have a single 72 port switch with regard to the GUI/management interface. These stacking ports area also generally rated for higher data transfers. 10gb or higher stacking ports are very common and the ports are SFP+ a lot of times which means you wouldn't even need a fiber converter because you could use SFP+ fiber connectors to directly link the switches together - including the gate and hose. Now as I type this, I realize you probably need a fairly small switch at the gate location, but there are a lot of smaller 4, 6,and 8 port managed switches that have one or two 10gb SFP+ ports on them to link to other devices/switches. Now even if you can't stack your switches together (which is completely just for management purposes), you might consider switches with a couple 10gb SFP+ ports so that you can connect the switches together to help prevent any bottlenecks. Even better would be if your router supported a faster LAN port (2.5gb or 10gb, etc) so that you could use a fast connection between the router and the switches.

Hopefully that's not too much information thrown at you. You can skip all of the SFP+ information if you want, I just thought it might be something to consider because you wouldn't need the fiber converters if your switches already supported a fiber connection via a SFP+ port.

 

[Sonnie]

To clarify, if it makes a difference, the switch at the gate that is running back thru fiber is separate from my ISP (Internet) fiber. That fiber only carries the two cameras. I do have an AP out there, but it does not need Internet... it's will be used (if even needed) to communicate with the gate camera in the gate keypad. He said we may use a mobile app or Bluetooth, but it won't need Internet. So... I could come in with that fiber to a separate switch that goes directly to my camera switch in the office, and it would never see the router.

The TP-Link Jetstream switches have 10 ports... 8 x PoE+ and 2 x SFP+. It will fit in the weather-proof box where the current switch is now, and it is fully managed. Right now, I'm managing all the switches thru the Omada OC300 Controller, but it sounds like I shouldn't use it once I get all the cameras on the same switch and instead use the switches for management?

 

[Sonnie]

Should I create my VLAN or VPN first... or does it matter?

Also, should I release any device that has its IP reserved/fixed in the Omada Controller before creating a VLAN or VPN?

 

[tech_junkie]

something like this where your camera network is separate from the computing/internet network:

 

[Sonnie]

That is what I was thinking, however, I need Internet on the computer, so I'd need to connect one of the NICs to the WAN/LAN port on the ER605 router... like this.

 

[tech_junkie]

That is what I was thinking, however, I need Internet on the computer, so I'd need to connect one of the NICs to the WAN/LAN port on the ER605 router... like this.

View attachment 198295

shouldn't have to.
Wan/Lan ports on those routers is a configurable port where its either a LAN port behind the firewall or a WAN port that is an outside connection with its own firewall as a redundant WAN connection .

 

[MTL4]

Like tech_junkie said, you really don’t even need any VLANs as long as you can isolate all your cameras behind the Blue Iris machine. Then you configure the main Ethernet port on the PC to be connected to your main network switch (the side that is connected to the internet) and the additional NIC you added gets connected to the any switches with cameras. I thought the fiber needed to pass both networks through for your EAP225 access point (in that case you would need VlANs) but if it’s only using POE power and not data that simplifies things alot.

 

[MTL4]

That is what I was thinking, however, I need Internet on the computer, so I'd need to connect one of the NICs to the WAN/LAN port on the ER605 router... like this.

View attachment 198295

You could either do that or what I would do is just plug the PC right into your managed switch (TL-SG2016P) which is also carrying your main network (connected to the internet). That way if you do want to add VLANs for say VOIP or Guest networks on wireless access points then it’s all ready to go.

This is how I would do it with what you have so far.

 

[Sonnie]

Sounds like a good diagram plan... thanks!

Still curious how everything is going to obtain IP addresses, and if I need to release IP addresses for switches and item on the Omada Controller that have reserved/fixed IP addresses.

 

[MTL4]

Sounds like a good diagram plan... thanks!

Still curious how everything is going to obtain IP addresses, and if I need to release IP addresses for switches and item on the Omada Controller that have reserved/fixed IP addresses.

The camera IPs are usually static on the network and then the gateway is the NIC card on your BI PC. The Omada controller would only see what's on your main network that has internet access. Once you start setting everything up and doing the configuation it will all make sense.

 

[Sonnie]

Yes... but the Omada Controller has the camera IP addresses reserved/fixed to 192.168.0.xxx ... shouldn't they be released, and probably have the AP and switches used for the camera system "unadopted" from the Omada Controller.

 

[MTL4]

Yes... but the Omada Controller has the camera IP addresses reserved/fixed to 192.168.0.xxx ... shouldn't they be released, and probably have the AP and switches used for the camera system "unadopted" from the Omada Controller.

Yes, no need to have them in there since the Omada controller won't be able to see anything on the camera network at all.
Any managed switches on the camera network can be managed via the BI PC since it has access to both networks at once.

 

[Sonnie]

I've got everything set up and ready to go.

None of devices below can be seen on the Omada Controller.

I assume I will create static IP addresses for all these devices that were on the 192.168.0 network.

PC Home for BI - 192.168.0.x
Office Camera Switch - 192.168.0.x
Gate Camera - 192.168.0.x
Mailbox Camera - 192.168.0.x
Gate AP EAP225 - 192.168.0.x

I can still access the cameras, and Blue Iris can see the cameras at their current IP addresses.

The Office Camera Switch default IP is 192.168.0.1 ... but that is my router's IP address on the other network. I can access its webpage via the IP address is was assigned by the Omada Controller, but the default username and password are not working.

Recommendations on what I should do next?

Below is how it is wired. I have not installed a managed switch on the camera end at this point, but I have one here, just like the one in the office, that is managed if I need it.

 

[Sonnie]

Hmmm... I reset the router so that maybe I could access it directly from the computer when disconnected from the Internet (strictly on the camera network), but the default IP address of 192.168.0.1 is not found.

Lost camera connections as well.

 

[tech_junkie]

Hmmm... I reset the router so that maybe I could access it directly from the computer when disconnected from the Internet (strictly on the camera network), but the default IP address of 192.168.0.1 is not found.

Lost camera connections as well.

it shouldn't exist on the camera network.
Looking at the camera's datasheet, since their default address is 192.168.1.108 The camera network should be 192.168.1.xxx Static addressed.
Managed switches is an unnecessary pain to set up just for cameras. Should be just a 10port unmanaged switch, Which should be like:

https://a.co/d/hs1H45B

Where you would use 1-8 for cameras and 9 for the blue iris connect and port 10 downstream to other cams

I'll post an example diagram of how it could be set up w/ ip addresses. Right now, I have to go work on a different install project.

 

[Sonnie]

I got into the switch and set the IP address to match the network IP address of the NIC. Then I used the Configtool to locate the cameras, which were still showing their old IP addresses. I then set their IP addresses to be in same private IP network of the NIC and switch.

Cameras are back online in Blue Iris.

Now, I need to learn how to set up the VPN.

Is it possible to use a domain name I have to access the cameras remotely?

 

[MTL4]

I got into the switch and set the IP address to match the network IP address of the NIC. Then I used the Configtool to locate the cameras, which were still showing their old IP addresses. I then set their IP addresses to be in same private IP network of the NIC and switch.

Cameras are back online in Blue Iris.

Now, I need to learn how to set up the VPN.

Is it possible to use a domain name I have to access the cameras remotely?

Looks great on the setup/wiring and sounds like you got it figured it out. Obviously you found out the NIC, switch and cameras all need to be on the same subnet for it to work correctly. You usually want the camera network to be on a different subnet from your main network (and certainly your gateway) that sees the internet. I prefer to use something like 172.16.x.x or 10.10.10.x for my camera networks just so it’s distinctly different from my main 192.168.x.x networks. Again that’s just a personal preference thing.

Not going to comment on managed vs unmanaged switches other than to say it’s way easier to troubleshoot things later with the central managed switch setup you have installed. You don’t need a managed switch out at the pole because you are just daisy chaining cameras off the office switch (although you can always install one later if you need/want to).

I guess the next question is what will the VPN be used for? Viewing cameras on a laptop or phone using the BI app? I would probably just set up a VPN in your router using wireguard or openvpn then you have options right away for viewing. Then just install your VPN of choice on the device you want and check you have an established tunnel. Once you do you can then set up the BI app for viewing. Not sure what plans you had for using the domain in the setup?

 

[tech_junkie]

Not going to comment on managed vs unmanaged switches other than to say it’s way easier to troubleshoot things later with the central managed switch setup you have installed. You don’t need a managed switch out at the pole because you are just daisy chaining cameras off the office switch (although you can always install one later if you need/want to).

Still never found a need for a managed switch on a cam network.
For Troubleshooting, you use software. Either utilities by camera manufacturers or network utilities like coalsoft mac scanner.

 

[tech_junkie]

I got into the switch and set the IP address to match the network IP address of the NIC. Then I used the Configtool to locate the cameras, which were still showing their old IP addresses. I then set their IP addresses to be in same private IP network of the NIC and switch.

Cameras are back online in Blue Iris.

Now, I need to learn how to set up the VPN.

Is it possible to use a domain name I have to access the cameras remotely?

good to see you have it back online.
Yes you can and there are a few ways of doing it.
But the most secure way would be leasing a static IP (or two if they don't allow dhcp and static ip from the same cable modem) from the isp, then split the WAN to service the computer network and the camera network separately.
Separating the WAN so different routers are managing will prevent anyone from being able to hack into the network if the router has a security issue as well as ease of upgrading and replacement if one of the routers goes down.

On the blue iris computer side, you install a Public CA Cert for you BI machine using your Public domain name.
Then you configure the port (8080) from the BI server (on the router) to port 80 on the WAN with the dedicated router.
and finally update the name server's IP entry to point to the static ip of the blue iris' network wan IP.


The other option is to use a VPN which are hijackable, Unless its a commercial VPN that is not self signed encryption. Which would be more expensive than just leasing the appropriate outside connection because they charge for bandwidth usage.