Securing NVR POE cams

[KietV]

Recently bought a Lennar smart home. It was built with a Ruckus AP and a 12 port switch. I bought an Arris modem/router combo, model SBG10. This device does not have a built in VPN and is not supported by DD-WRT. I would rather not have to purchase a separate router.

Are there any other options in securing the NVR POE camera set up?

Smart door lock, thermostat, washer/dryer, doorbell, Alexa, Kasa lights ect. and all devices use the Ruckus AP. Can I use the network being broadcast by the Arris for anything?

 

[looney2ns]

You need to put the Arris in bridged mode. This will disable the wifi it use's.
Then purchase an Asus router such as the AC1900 which has OpenVpn abilities.
Plug into the Arris, and that will become your Wifi access.

 

[mat200]

Recently bought a Lennar smart home. It was built with a Ruckus AP and a 12 port switch. I bought an Arris modem/router combo, model SBG10. This device does not have a built in VPN and is not supported by DD-WRT. I would rather not have to purchase a separate router.

Are there any other options in securing the NVR POE camera set up?

Smart door lock, thermostat, washer/dryer, doorbell, Alexa, Kasa lights ect. and all devices use the Ruckus AP. Can I use the network being broadcast by the Arris for anything?

Hi KietV

Looney2ns has good advice.. that's the place to start...

"Lennar smart home" - sounds like some legacy tech in a few years... lol should become a hackers paradise soon...

 

[KietV]

Probably so.

I was really just trying to find a way to to not have to purchase another router

 

[mat200]

Probably so.

I was really just trying to find a way to to not have to purchase another router

Sometimes the equipment provided by the ISPs just do not allow that option... same with any home that they sell as a "smart home". Imho the only thing good with a smart home is the cabling they should have put in.

 

[KietV]

Sometimes the equipment provided by the ISPs just do not allow that option... same with any home that they sell as a "smart home". Imho the only thing good with a smart home is the cabling they should have put in.

right. I’ve already got Ethernet in every room via a ruckus 12-port switch which is great.

 

[spile]

I can recommend a Raspberry Pi 4 running PiVpn and Wireguard. Extremely cost effective.

 

[KietV]

I can recommend a Raspberry Pi 4 running PiVpn and Wireguard. Extremely cost effective.

Can you point me in the direction of more information please?

 

[spile]

Of course...

If you do not have a VPN router then you can set up a VPN server on a Raspberry Pi computer. This is a credit card sized, low cost ($35 / £35), fanless device that runs 24/7. The latest version is a a Pi 4 Model B that comes with 2, 4 or 8Gb of ram. gigabit ethernet, USB 2 and 3, 2 x HDMI, Wifi and Bluetooth.

PiVPN is simple to install software that runs on your Pi and provides a safe tunnel into your home network when you are away from home. This means you can turn off uPNP on your router and close ports that place your devices (cameras, NAS/NVR etc) that are at risk.

You download a VPN client (available for iOs, Android, Windows etc) on each of the devices you use when away from home. When running, all data from your device is encrypted and secure. It is as if you are using the device inside your lan.

Tips/Recommendations:
I use a Raspberry Pi 4 with a case, 32Gb SD card and power supply. I bought the complete kit off eBay for £70.
I installed the standard RPi Desktop OS and run it in headless mode (without a monitor). The only connections are the power lead and power supply. I connect to the Pi desktop using the Google VNC Viewer and Putty on my Windows 10 PC.
There is PoE adapter available that means that you could have just a single ethernet connection to your Pi!

There are two options when you set up PiVPN - I use and recommend Wireguard rather than OpenVPN. Read the links below for my reasons.

As my internet provider does not provide a static IP address, I use a Dynamic DNS updater. This runs on the Pi and automatically updates a subdomain of my website when my IP address changes. A simpler option is to use a service from a Dynamic DNS provider.

There are whole number of practical things you can do with a Pi and there is a large support community with lots of projects. It is great for tinkering without putting your other expensive components (PC/NAS NVR etc) at risk. It is also fun, addictive and educational.

More details and recommended links:

Buy a Raspberry Pi 4 Model B – Raspberry Pi

Your tiny, dual-display, desktop computer …and robot brains, smart home hub, media centre, networked AI core, factory controller, and much more.

www.raspberrypi.org

4s3ti.net

blog.4s3ti.net

PIVPN: Simplest way to setup a VPN

www.pivpn.io

Building a simple VPN with WireGuard with a Raspberry Pi as Server -

Andreas Happe sometimes blogs about development, life or security.

snikt.net

FAQ

The Simplest VPN installer, designed for Raspberry Pi - pivpn/pivpn

github.com

GitHub - swyngaard/dynamic-dns-updater: Update the IP address of a given domain using cPanel 2 API

Update the IP address of a given domain using cPanel 2 API - swyngaard/dynamic-dns-updater

github.com

The 6 Best Free Dynamic DNS Providers

A DDNS service can help you connect to your home PC while on the move. Here are the best free dynamic DNS providers you can use.

www.makeuseof.com

 

[KietV]

Thank you that is all great information and I have spent the last few days researching. I am still unsure which route I want to go:

1. Purchase new router to handle a VPN.
2. Purchase a Raspberry Pi to run the VPN on.

Would either option present reliability issues in regards to internet speed and connectivity? I work from home and have quite a few smart connected devices.

 

[mikeynags]

The Pi option is cheaper - if that's a consideration for you. No effect on Internet reliability or speed by setting up either option.

 

[KietV]

The Pi option is cheaper - if that's a consideration for you. No effect on Internet reliability or speed by setting up either option.

Cheaper is better.

where exactly does the Pi go? I have a router/modem combo that goes to a 12port rucks switch that provides Ethernet throughout.

 

[mikeynags]

You'll have to put the Pi "inside" the router. Then there will be ports that need to be forwarded on the router to the Pi for OpenVPN. I believe it is UDP/1194 - but I think there is also a TCP/443 option. Been a while since I looked into it. There is a ton of info on the web for setting up a Pi as a VPN.

 

[spile]

Just use an internet cable to connect the pi on your network either the router or a switch. Use the Wireguard Option and you will need to open a single port 51820 though you can change this if required. If you are tight for power you can even get a poe adapter. The pi will also allow you to run other options such as pihole for add blocking.

 

[catcamstar]

Actually, claiming the pi is "cheaper = better" does not apply as a "general advice" in my opinion. Except if you'd like to run homeassistant or other services on it.

My advice: if you want to do network stuff, use networking gear for it. For example, an Edgerouter X (from Ubiquity) is almost same price level, but is optimised for networking, firewalling, vlans and stuff more. If you do, for example, dual NIC setup (for whatever reason) on your PI, you're stuck at 100mbit max.

So please, write down your requirements (technical/logical), and from that list, you'll quickly discover which device is appropriate!

Happy Camming!
CC

 

[spile]

It would be hard to argue against the fun and flexibility offered by the pi which were two of the reasons I chose that route over a new router. Plus I was happy with my current router. Gigabit is no problem with the Pi 4 but I agree that you need to consider what is the right option for you.