NETGEAR is aware of a growing number of phone and online scams. To learn how to stay safe click here.
Forum Discussion
Remote VPN access with access control
I've just installed a two-station Orbi 770 in an environment that is remote from my office requires using MAC-number based access control to allow only authorized users without constantly changin...
On my old Orbi RBR50, Access Control indeed does block VPN connections:
However, it is not clear (to me) what the goal is.
- To access computer resources at work while connected to the home network?
- To access computer resources connected to the home network while...?? (somewhere else?)
OpenVPN, the unknown entity...
On my old Orbi RBR50, Access Control indeed does block VPN connections:
Well, if you want to operate an OpenVPN TUN connection (that's what your Access Control shows!) for the device coming in with the IP address 192.168.2.2 you obviously have to ALLOW this connnection.
requires using MAC-number based access control to allow only authorized users...
We talk of OpenVPN here - there is no MAC based pre-auth or auth.
OpenVPN TAP (layer 2 ethernet bridging) connections use the same core authentication mechanisms as TUN (layer 3 routing) modes. Authentication happens over a secured TLS channel using pre-shared certificates, credentials, or multi-factor tokens before the bridge interface activates.
In Netgear's simplified OpenVPN implementation (without reinventing the wheel), the cerdentials login is based on the username and password - undoubted the Orbi admin and the admin password.
Nothing else is supported by Netgear.
If you really intend to enable Access Control - check what the Orbi system is blocking, and allow to keep your VPN connection workable.
OpenVPN in TAP mode encapsulates and passes full Layer 2 Ethernet frames, meaning source and destination MAC addresses are included inside the tunnel payload. However, it does not transparently pass your physical computer’s native network card MAC address across the internet link.
There you might see Access Control blocking your effective VPN traffic on the router - as you want to enable Access Control, you might have to deal with it.
...without constantly changing passwords.
VPN MAC-based authentication uses a device's unique physical hardware address (MAC address) to control network access.
While some network gateways check MAC addresses during a connection attempt, standard VPN protocols do not use MAC addresses for secure identity verification because they are easily spoofed.
Instead, systems use username/password, certificates, or 2FA. This reduces your choice on the Orbi OpenVPN server to the credentials login, as explained above.
Where is this idea coming from that you constantly need changing passwords?
In a student environment, with a constantly changing population of high-tech transients hungry for connectivity, the standard solution with PW-based access control is frequently changing the system pw. But this is burdensome for the legitimate tenants, who often have multiple devices connected.
When the Orbi's access control is turned off, its OpenVPN does indeed authenticate with admin + pw. The problem is that if access control is turned on, the router first checks the MAC number before even asking for credentials. I'm hoping (but probably in vain) that there's a way to tell Orbi to ignore access control for someone with admin credentials.