NETGEAR is aware of a growing number of phone and online scams. To learn how to stay safe click here.
Forum Discussion
Solved
Remote VPN access with access control
I've just installed a two-station Orbi 770 in an environment that is remote from my office requires using MAC-number based access control to allow only authorized users without constantly changin...
schumaku has provided the key to this issue. Connect to the VPN using "tap" mode (UDP port 12974) (sorry it took me so long to set up the experiment)
Using a Windows computer (because most other operating systems do not support tap) and the OpenVPN client that supports tap (I just installed OpenVPN 2.7.6, because OpenVPN-Connect does not support tap). Connected the Windows laptop to my smartphone Hot Spot and connected the laptop to my Orbi RBR50:
Notice that because the connection is "tap", the laptop was assigned an IP address on the Orbi LAN and has provided the hardware MAC address to the Orbi. The Windows laptop is now on the Orbi LAN and can access the Orbi web interface (192.168.1.1 on my Orbi).
At this instant, Access Control is not enabled (because I decided long ago that it provides no value in my environment). The experiment will need to be repeated with Access Control enabled.
Using VPN in tap mode should allow you to administer the Orbi system remotely and maintain the LAN Setup table to allow only specified WiFi devices on the network.
p.s. Setting up OpenVPN is not trivial, but c'est la vie.
p.p.s. If OpenVPN somehow fails on your model of Orbi, there is another solution. Install a Brume VPN gateway on the network.
https://www.gl-inet.com/products/gl-mt2500/
This will allow you to VPN into the local network using either OpenVPN or Wireguard (more efficient, but probably not significant for this type of use)
OpenVPN, the unknown entity...
On my old Orbi RBR50, Access Control indeed does block VPN connections:
Well, if you want to operate an OpenVPN TUN connection (that's what your Access Control shows!) for the device coming in with the IP address 192.168.2.2 you obviously have to ALLOW this connnection.
requires using MAC-number based access control to allow only authorized users...
We talk of OpenVPN here - there is no MAC based pre-auth or auth.
OpenVPN TAP (layer 2 ethernet bridging) connections use the same core authentication mechanisms as TUN (layer 3 routing) modes. Authentication happens over a secured TLS channel using pre-shared certificates, credentials, or multi-factor tokens before the bridge interface activates.
In Netgear's simplified OpenVPN implementation (without reinventing the wheel), the cerdentials login is based on the username and password - undoubted the Orbi admin and the admin password.
Nothing else is supported by Netgear.
If you really intend to enable Access Control - check what the Orbi system is blocking, and allow to keep your VPN connection workable.
OpenVPN in TAP mode encapsulates and passes full Layer 2 Ethernet frames, meaning source and destination MAC addresses are included inside the tunnel payload. However, it does not transparently pass your physical computer’s native network card MAC address across the internet link.
There you might see Access Control blocking your effective VPN traffic on the router - as you want to enable Access Control, you might have to deal with it.
...without constantly changing passwords.
VPN MAC-based authentication uses a device's unique physical hardware address (MAC address) to control network access.
While some network gateways check MAC addresses during a connection attempt, standard VPN protocols do not use MAC addresses for secure identity verification because they are easily spoofed.
Instead, systems use username/password, certificates, or 2FA. This reduces your choice on the Orbi OpenVPN server to the credentials login, as explained above.
Where is this idea coming from that you constantly need changing passwords?
In a student environment, with a constantly changing population of high-tech transients hungry for connectivity, the standard solution with PW-based access control is frequently changing the system pw. But this is burdensome for the legitimate tenants, who often have multiple devices connected.
When the Orbi's access control is turned off, its OpenVPN does indeed authenticate with admin + pw. The problem is that if access control is turned on, the router first checks the MAC number before even asking for credentials. I'm hoping (but probably in vain) that there's a way to tell Orbi to ignore access control for someone with admin credentials.