NETGEAR is aware of a growing number of phone and online scams. To learn how to stay safe click here.
Forum Discussion
Solved
Remote VPN access with access control
I've just installed a two-station Orbi 770 in an environment that is
- remote from my office
- requires using MAC-number based access control to allow only authorized users without constantly changing passwords.
On the Web interface, the access control section appears to give me what I need, and the VPN capability promises to give me access to the web admin interface remotely. Indeed, it does--as long as access control is turned off. But then, of course, I'm not limiting access to the MAC numbers in my list. But if I turn it access control on, my VPN session is blocked. This is not surprising, because VPN doesn't pass on the MAC number of my home machine, so even if I authorize access for that MAC number, it doesn't recognize me.
Is there some way to tell the system to grant access to a VPN channel, even while access control is on?
schumaku has provided the key to this issue. Connect to the VPN using "tap" mode (UDP port 12974) (sorry it took me so long to set up the experiment)
Using a Windows computer (because most other operating systems do not support tap) and the OpenVPN client that supports tap (I just installed OpenVPN 2.7.6, because OpenVPN-Connect does not support tap). Connected the Windows laptop to my smartphone Hot Spot and connected the laptop to my Orbi RBR50:
Notice that because the connection is "tap", the laptop was assigned an IP address on the Orbi LAN and has provided the hardware MAC address to the Orbi. The Windows laptop is now on the Orbi LAN and can access the Orbi web interface (192.168.1.1 on my Orbi).
At this instant, Access Control is not enabled (because I decided long ago that it provides no value in my environment). The experiment will need to be repeated with Access Control enabled.
Using VPN in tap mode should allow you to administer the Orbi system remotely and maintain the LAN Setup table to allow only specified WiFi devices on the network.
p.s. Setting up OpenVPN is not trivial, but c'est la vie.
p.p.s. If OpenVPN somehow fails on your model of Orbi, there is another solution. Install a Brume VPN gateway on the network.
https://www.gl-inet.com/products/gl-mt2500/
This will allow you to VPN into the local network using either OpenVPN or Wireguard (more efficient, but probably not significant for this type of use)
17 Replies
On my old Orbi RBR50, Access Control indeed does block VPN connections:
However, it is not clear (to me) what the goal is.
- To access computer resources at work while connected to the home network?
- To access computer resources connected to the home network while...?? (somewhere else?)
OpenVPN, the unknown entity...
On my old Orbi RBR50, Access Control indeed does block VPN connections:
Well, if you want to operate an OpenVPN TUN connection (that's what your Access Control shows!) for the device coming in with the IP address 192.168.2.2 you obviously have to ALLOW this connnection.
requires using MAC-number based access control to allow only authorized users...
We talk of OpenVPN here - there is no MAC based pre-auth or auth.
OpenVPN TAP (layer 2 ethernet bridging) connections use the same core authentication mechanisms as TUN (layer 3 routing) modes. Authentication happens over a secured TLS channel using pre-shared certificates, credentials, or multi-factor tokens before the bridge interface activates.
In Netgear's simplified OpenVPN implementation (without reinventing the wheel), the cerdentials login is based on the username and password - undoubted the Orbi admin and the admin password.
Nothing else is supported by Netgear.
If you really intend to enable Access Control - check what the Orbi system is blocking, and allow to keep your VPN connection workable.
OpenVPN in TAP mode encapsulates and passes full Layer 2 Ethernet frames, meaning source and destination MAC addresses are included inside the tunnel payload. However, it does not transparently pass your physical computer’s native network card MAC address across the internet link.
There you might see Access Control blocking your effective VPN traffic on the router - as you want to enable Access Control, you might have to deal with it.
...without constantly changing passwords.
VPN MAC-based authentication uses a device's unique physical hardware address (MAC address) to control network access.
While some network gateways check MAC addresses during a connection attempt, standard VPN protocols do not use MAC addresses for secure identity verification because they are easily spoofed.
Instead, systems use username/password, certificates, or 2FA. This reduces your choice on the Orbi OpenVPN server to the credentials login, as explained above.Where is this idea coming from that you constantly need changing passwords?
In a student environment, with a constantly changing population of high-tech transients hungry for connectivity, the standard solution with PW-based access control is frequently changing the system pw. But this is burdensome for the legitimate tenants, who often have multiple devices connected.
When the Orbi's access control is turned off, its OpenVPN does indeed authenticate with admin + pw. The problem is that if access control is turned on, the router first checks the MAC number before even asking for credentials. I'm hoping (but probably in vain) that there's a way to tell Orbi to ignore access control for someone with admin credentials.
The MAC-address limitation makes sense because a VPN connection doesn't necessarily present the remote device's original MAC address to the router. It would be useful to know whether the Orbi 770 offers a separate VPN-specific allow rule or another authentication method that can coexist with Access Control enabled.
The Orbi provides wifi access for student tenants at a small apartment building I manage. Access control lets me limit access to my tenants, rather than the tons of other students in the neighborhood, without the inconvenience (to my tenants) of a regularly changing password. But it would be very convenient for me to be able to manage the network remotely, including adding new devices for my tenants when they request it.
The Orbi provides wifi access for student tenants at a small apartment building I manage. Access control lets me limit access to my tenants, ...
...so no way around on MANAGING access control if you really want to enable it.
Are you giving them OpenVPN (bridged!) access to your network?
Usign OpenVPN in TAP or TUN mode?
without the inconvenience (to my tenants) of a regularly changing password
Seriously, are you sharing the (one and only!) Orbi admin password to users having access to your managed network by VPN?
But it would be very convenient for me to be able to manage the network remotely, including adding new devices for my tenants when they request it.
New devices (== new tenants) with new MAC address each?
And you seriously share the VPN access, which is clearly done for a single user, based on a shared admin password? ROFL, sorry.
Last but not least? The tables on this consumer class models are limited, the number of IP adddresses, and MAC addresses you can add to the Access Control is limited.
Wrong product, for the wrong purpose. Its clearly a single user, consumer class device. Good luck!
No worries--I'm not sharing admin credentials, or VPN access. But using passwords to control user access to the SSID is problematic in this environment, because PWs get passed around. For years, I used MAC access control on an open SSID (no PW at all) on Linksys, and their cloud interface let me add and remove MAC numbers remotely. But they discontinued the cloud interface last March.
schumaku has provided the key to this issue. Connect to the VPN using "tap" mode (UDP port 12974) (sorry it took me so long to set up the experiment)
Using a Windows computer (because most other operating systems do not support tap) and the OpenVPN client that supports tap (I just installed OpenVPN 2.7.6, because OpenVPN-Connect does not support tap). Connected the Windows laptop to my smartphone Hot Spot and connected the laptop to my Orbi RBR50:
Notice that because the connection is "tap", the laptop was assigned an IP address on the Orbi LAN and has provided the hardware MAC address to the Orbi. The Windows laptop is now on the Orbi LAN and can access the Orbi web interface (192.168.1.1 on my Orbi).
At this instant, Access Control is not enabled (because I decided long ago that it provides no value in my environment). The experiment will need to be repeated with Access Control enabled.
Using VPN in tap mode should allow you to administer the Orbi system remotely and maintain the LAN Setup table to allow only specified WiFi devices on the network.
p.s. Setting up OpenVPN is not trivial, but c'est la vie.
p.p.s. If OpenVPN somehow fails on your model of Orbi, there is another solution. Install a Brume VPN gateway on the network.
https://www.gl-inet.com/products/gl-mt2500/
This will allow you to VPN into the local network using either OpenVPN or Wireguard (more efficient, but probably not significant for this type of use)
Thank you! These are very promising suggestions, and I will explore them.
There is yet another potential solution: install a VPN Host on a local computer (on the Orbi LAN).
For example, I have a Raspberry Pi that I use for various things, such as running a Pi-Hole server. On a lark, I installed Wireguard on the Pi. If I deliberately forward Wireguard port 51820 through the Orbi router to the Pi, I can VPN into the LAN.
Thus, if the computer being used to manage the Orbi supports Windows, using a tap connection with the OpenVPN software that supports tap is the obvious choice. (no additional equipment. less complexity, less cost)
If the computer does not support Windows, it may be necessary to use a VPN connection to a device on the network that is not the Orbi router.
Success! After installing OpenVPN 2.x on Windows 11 and asking Google to explain the error messages I was getting, I successfully reached the Orbi, made sure my Windows MAC was authorized, switched access control on, disconnected, and successfully reconnected! Thank you very much for the suggestions.
I thought it might be helpful to leave a few notes in summary of the discussion for others who have this problem, with thanks in particular to schumaku for pointing out the importance of TAP and HappyCat for some promising experiments and lots of very helpful comments.
The OBJECTIVE was to obtain remote access to the web interface of the Orbi 770, with MAC access control implemented on the Orbi.
The APPROACH was to use the Orbi's built-in OpenVPN server for access.
My initial, unsuccessful approach was to use tunnelblick on a Mac, with the config files from the Orbi. The PROBLEM was that the Orbi didn't recognize my VPN connection as coming from a machine in the MAC access table, so whenever I turned access control on, I lost my connection. Several on the conversation thought that the problem was that the Orbi was using TUN, which doesn't present the client's MAC address to the server. schumaku proposed using TAP, which HappyCat verified experimentally, accessing from a Windows machine. It's necessary to use OpenVPN 2.x; OpenVPN Connect does not support TAP.
In studying the .opvn/.conf file generated by the Orbi, I discovered that it already was expecting a TAP connection, since it includes the line "dev TAP".
I'm a novice in configuring VPNs, so I had to learn that TAP is supported on a client as a virtual device, with its own MAC number, different from the machine's WiFi or Ethernet numbers. My windows machine had one (probably generated by the OpenVPN installer, accessible via cmd at ipconfig /all), and when I authorized that machine with the TAP MAC number, everything worked.
Back on the MAC with Tunnelblick, I started look for the TAP MAC number (ifconfig -a), and didn't find one. Then I learned that the ovpn configuration language includes an option lladdr, which takes a user-supplied MAC number in the usual form (e.g., lladdr 00:11:22:33:44:55). I made one up, added that line to the Tunnelblick .conf file generated by the Orbi, authorized that number to my Mac on the Orbi web interface, turned on access control, and the Mac connected right up.
It's interesting that when I called Netgear tech support about the problem, they told me there was no way to use the VPN to access the web interface if the Orbi had access control turned on, and urged me not to use access control. Happily, this community knew better. Thank you again, all!
