New internet service coming - VPN options

Self hosted VPNs require a "service" to be running on the network. This is a small software application that handles the VPN connections. IMHO, it's easiest to run this service on your firewall/router (because it's already on 24/7 and the routing is easier since it's the first device on the network), but you can actually run it on just about any machine on your network. Most modern firewall/routers have this service available in their software. You'll just need to turn it on and then set it up correctly to work. It doesn't require a IT professional to set up, but there are a lot of "moving parts" (ie different addresses, settings, encryption keys, etc) to set a VPN up and I wouldn't say the process is very intuitive - at least it wasn't for me. It took me watching/reading a lot of "how to" guides to get mine set up the first time.

There is no problem in having your cameras on a separate VLAN/subnet and still be able to access if over the VPN, but it does require that you include that set of network addresses in your VPN setup. By default, a VPN connection will only be able to access the network subnets that you specify. If you don't specifically include the camera subnet in the VPN setup, you won't be able to access it over the VPN connection. (This is part of the "moving parts" that can complicate the VPN setup process).

Again, none of this is rocket science, but I also don't want to give you the false impression that it will take just 5 minutes to implement a VPN connection your first time out. It will probably take much longer than that and there may be a lot of colorful language spoken while you figure it out. At least that was my experience......

OpenVPN is simple, but we make it way more difficult than it needs to be lol.

I was there too once with OpenVPN...tried to do all this research to find directions and got to the point I said screw it and just enabled it and kinda of followed what it was asking and it worked.

Just go to OpenVPN and enable it and see what it says - probably asks you to create a user/PW, DDNS name, encryption method, and create certificate. Then copy and paste that certificate on your mobile device. Then install the OpenVPN app and select the certificate and then connect and you are on your home network.

It really is simpler than our minds make it out to be.

A big mistake people make is installing OpenVPN on their computer and trying to host it there, yet they are trying to follow the steps on enabling it on a router and screw it all up. Only install it on the computer to host if your router does not have it built-in.

This is for an Asus router, but the steps are kinda the same.

builder said:

If it were easy, where would be the fun in it. Hanging out in this forum is not for the faint of heart.

To get started on a VLAN, I started to follow this ink:
How to Setup and Secure UniFi VLAN — LazyAdmin
After setting up the first firewall rule as described, took a pause.
Now wondering if it is smart to blindly follow directions, and hope for the best.
A leap of faith will be involved for sure, how much is another matter.
It would be unrealistic for me to hope to have an IT level understanding of the topic.

Click to expand...

VLANs can be a whole different animal LOL.

Dual NIC in the BI machine is much simply and cheaper LOL.

Buy another NIC (under $20ish)

Turn off Computer

Open up computer

Insert new NIC

Put case back on computer

Turn on computer

Assign it an IP address that is different than you LAN and assign your cameras the IP address subnet of this NIC and plug into this NIC.

Beat me to it, @wittaj

Oh in that case use the wifi for the internet connection and use the port for the cameras.

wittaj said:

A big mistake people make is installing OpenVPN on their computer and trying to host it there, yet they are trying to follow the steps on enabling it on a router and screw it all up. Only install it on the computer to host if your router does not have it built-in.

Click to expand...

The caveat being that consumer routers often don't get security updates automatically and remain in service after EOL'd by the mfg. If there's ever a vulnerability in their implementation of OpenVPN or their key generation you won't be a happy camper.

Personally I'm kind of on the fence as to which is more desirable from a security standpoint: a vpn server on a consumer router or a service like zero tier / tail scale.