Trying to get off Port Forwarding Dependency

[Ri22o]

Ubiquity EdgeRouter X - Configuring to Isolate Surveillance Networks

Ubiquity EdgeRouter X - Configuring to Isolate Surveillance Networks (This topic began as an inquiry regarding interest. Enough desire was shown to proceed. Main content is later in this thread) Main content begins at Ubiquity EdgeRouter X - Configuring to Isolate Surveillance Networks...

ipcamtalk.com

EdgeRouter - OpenVPN Server - Step By Step setup

EdgeRouter - OpenVPN Server - Step By Step setup I just found this for those that have an Edge Router (in my case an ER-4). It has a Step by Step setup ---with pictures too. o_O...

ipcamtalk.com

I had found the second one earlier, just wasn't sure if there were other, non-CLI options.

 

[Ri22o]

I tried this last night and need to reset the router and start over. This is painful.

 

[Michael James]

Nope.

Is it correct to assume that when you use a VPN at the router level, that any device in the house doesn't need to run the OpenVPN client side software (64 bit MSI installer). So if I have a laptop running on the LAN inside the house, I don't need it. But if I use the laptop at the airport, for example, I need to run it?

 

[wittaj]

Is it correct to assume that when you use a VPN at the router level, that any device in the house doesn't need to run the OpenVPN client side software (64 bit MSI installer). So if I have a laptop running on the LAN inside the house, I don't need it. But if I use the laptop at the airport, for example, I need to run it?

Yep not needed within LAN - Outside of LAN same way as your phone. Download openvpn app and copy your certificate in

 

[Ollie]

Dynamic DNS is independent of OpenVPN. Dynamic DNS is simply mapping your WAN IP to a FQDN. When you bring up an OpenVPN connection, the client will connect to the OpenVPN Server on the port you configured (which is also your router's WAN IP). Dynamic DNS makes it easy to be able to VPN back into your network when your WAN IP can change often.

How risky it is for the network system (using ddns)? I believe that your ip is now easier to be exposed - but what is its consequences?

 

[Michael James]

So Im having an issue.... every 2 days or so, my Android phone, my laptop, wont connect to the OpenVPN any longer. Not sure what is going on.
My Host Services | My Dyn Account

This is the messages I am getting from my laptop:

Sun Apr 14 10:25:10 2024 WARNING: Compression for receiving enabled. Compression has been used in the past to break encryption. Sent packets are not compressed unless "allow-compression yes" is also set.
Sun Apr 14 10:25:10 2024 OpenVPN 2.6.9 [git:v2.6.9/6640a10bf6d84eee] Windows [SSL (OpenSSL)] [LZO] [LZ4] [PKCS11] [AEAD] [DCO] built on Feb 12 2024
Sun Apr 14 10:25:10 2024 Windows version 10.0 (Windows 10 or greater), amd64 executable
Sun Apr 14 10:25:10 2024 library versions: OpenSSL 3.2.0 23 Nov 2023, LZO 2.10
Sun Apr 14 10:25:10 2024 DCO version: 1.0.0
Sun Apr 14 10:25:13 2024 TCP/UDP: Preserving recently used remote address: [AF_INET]97.149.146.106:1100
Sun Apr 14 10:25:13 2024 UDPv4 link local: (not bound)
Sun Apr 14 10:25:13 2024 UDPv4 link remote: [AF_INET]97.149.146.106:1100
Sun Apr 14 10:25:23 2024 SIGHUP[hard,] received, process restarting

Sun Apr 14 10:25:54 2024 [UNDEF] Inactivity timeout (--ping-restart), restarting
Sun Apr 14 10:25:54 2024 SIGUSR1[soft,ping-restart] received, process restarting
Sun Apr 14 10:25:55 2024 TCP/UDP: Preserving recently used remote address: [AF_INET]97.149.146.106:1100
Sun Apr 14 10:25:55 2024 UDPv4 link local: (not bound)
Sun Apr 14 10:25:55 2024 UDPv4 link remote: [AF_INET]97.149.146.106:1100

Attaching what its showing on my Samsung 23 Android phone.*

Looks like my issue is around DynUpdater not updating the WAN address correctly. I had to manually tell it to us the existing WAN address

 

[txedgeman]

Looks like my issue is around DynUpdater not updating the WAN address correctly. I had to manually tell it to us the existing WAN address

I would delete the screenshots showing your userid for security reasons. (Since you have solved the problem, might delete them all in this case).

 

[Michael James]

I would delete the screenshots showing your userid for security reasons. (Since you have solved the problem, might delete them all in this case).

Done..thx

 

[The Automation Guy]

How risky it is for the network system (using ddns)? I believe that your ip is now easier to be exposed - but what is its consequences?

Using a DDNS service is not a security risk. This is because there is no "security through obscurity" when it comes to the internet. The idea that you can somehow "hide" your public IP address and gain some level of security this way is a lie. When "bad guys" are trying to exploit a residential network, they aren't looking for a specific network. They are doing scans of the entire internet looking for particular open ports or devices that have a known exploit they want to use. In other words, the bad guys" aren't going to find your network because of DDNS service, they are going to find it through their port scans. However even if they did find it somehow through DDNS, your security is based 100% on the way your router/firewall is set up. Think of it this way.... it doesn't matter how the "bad guys" got to your front door (ie your network on the internet), your security is 100% dependent on how strong your front door is.

On the flip side, using a DDND service makes legitimate access much easier because in those cases you need to connect to a specific network. So there is a lot to be gained by using a DDND service, and really nothing to loose.

 

[FletcherHubbards]

On the BI server machine, when I go to ping.eu, it shows: Your IP is 97.149.xxx.xxx (it whos the real numbers, I just masked them so I don't give it out here)

jiofi.local.html tplinklogin​

 

[Michael James]

Yep not needed within LAN - Outside of LAN same way as your phone. Download openvpn app and copy your certificate in

UPDATED 4/20/24 at 10:19am EST

Well, I thought I had this resolved. but now I don't know what the issue is....

Setup:
Using Asus Router GT-AX6000
Using the OpenVPN that's part of the router firmware. I'm on the latest version of the Firmware for the router.
I am using a Verizon Home Internet box that is set to pass thru. Every 3-4 days Verizon changes its WAN IP address.
Because of the changing WANIP address, I am using a DDNS from DynDNS. (mjamesXXXXX.dyndns.info). DynDNS uses DynUpdater which is a client application installed on the computer where BlueIris is installed and on the same network as the Asus router.
I have nothing changed under the Advanced setting in OpenVPN menu on the router.
On my laptop, I run Online Ping, Traceroute, DNS lookup, WHOIS, Port check, Reverse lookup, Proxy checker, Bandwidth meter, Network calculator, Network mask calculator, Country by IP, Unit converter and I get this: 75.192.10x.xxx

The attached "OpenVPN Android S24" shows the log for the OpenVPN client on the S24 Android phone.
If I go to the Asus router and hit the "Export OpenVPN Configuration file" and install that file on my OpenVPS client software on the phone, it starts working again..

What am I doing wrong here?

 

[f1restarter]

UPDATED 4/20/24 at 10:19am EST

Well, I thought I had this resolved. but now I don't know what the issue is....

Setup:
Using Asus Router GT-AX6000
Using the OpenVPN that's part of the router firmware. I'm on the latest version of the Firmware for the router.
I am using a Verizon Home Internet box that is set to pass thru. Every 3-4 days Verizon changes its WAN IP address.
Because of the changing WANIP address, I am using a DDNS from DynDNS. (mjamesXXXXX.dyndns.info). DynDNS uses DynUpdater which is a client application installed on the computer where BlueIris is installed and on the same network as the Asus router.
I have nothing changed under the Advanced setting in OpenVPN menu on the router.
On my laptop, I run Online Ping, Traceroute, DNS lookup, WHOIS, Port check, Reverse lookup, Proxy checker, Bandwidth meter, Network calculator, Network mask calculator, Country by IP, Unit converter and I get this: 75.192.10x.xxx

The attached "OpenVPN Android S24" shows the log for the OpenVPN client on the S24 Android phone.
If I go to the Asus router and hit the "Export OpenVPN Configuration file" and install that file on my OpenVPS client software on the phone, it starts working again..

What am I doing wrong here?

Have you tried using the "OpenVPN for android" client from google play instead of "OpenVPN connect" ?

After the latest OpenVPN Connect update (version 3.4.1) it startet acting up for me as well, but the other app works fine. With no easy way of downgrading the OpenVPN connect version that is a simple thing to try.

 

[jmhmcse]

Have you created a cron entry on the Asus router that verifies and updates your DynDNS record as the public IP changes? It’s your responsibility to keep the definition correct.

 

[Michael James]

Have you tried using the "OpenVPN for android" client from google play instead of "OpenVPN connect" ?

After the latest OpenVPN Connect update (version 3.4.1) it startet acting up for me as well, but the other app works fine. With no easy way of downgrading the OpenVPN connect version that is a simple thing to try.

OpenVPN craps out on the laptop as well using OpenVPN as well. So its not just the Android device

 

[Michael James]

Have you created a cron entry on the Asus router that verifies and updates your DynDNS record as the public IP changes? It’s your responsibility to keep the definition correct.

I have no idea how to do this. I'm very new to this

 

[jmhmcse]

I have no idea how to do this. I'm very new to this

Web searches are your friend... you can find a lot of instructional information and documentation.

Asus Router GT-AX6000 Firmware v3.0.0.4.388_23012 or later is documented as having direct support for DynDNS.

 

[Michael James]

Web searches are your friend... you can find a lot of instructional information and documentation.

Asus Router GT-AX6000 Firmware v3.0.0.4.388_23012 or later is documented as having direct support for DynDNS.

1) Im not sure what you may be referring to..... I already have DynDNS setup natively on the Asus Router side (see attached)

2) cron entry on the Asus router that verifies and updates your DynDNS record as the public IP changes. I googled this. Unfortunately, I am on the latest stock version of the Firmware. I'm not using Ausus WRT Merlin firmware.

I may have found the issue but testing:

Dyndns has a "host updater key" (that I don't ever remember generating) and that needs to be used instead of the password associated with my account. Replacing the password with the key on the router DDNS settings should hopefully result in a successful update. Will know in a few days

 

[Michael James]

OK, so this is confirmed!

Dyndns has a "host updater key" (that I don't ever remember generating) and that needs to be used instead of the password associated with my account. Replacing the password with the key on the router DDNS settings should hopefully result in a successful update.