NETGEAR is aware of a growing number of phone and online scams. To learn how to stay safe click here.
Forum Discussion
Solved
Remote VPN access with access control
I've just installed a two-station Orbi 770 in an environment that is remote from my office requires using MAC-number based access control to allow only authorized users without constantly changin...
schumaku has provided the key to this issue. Connect to the VPN using "tap" mode (UDP port 12974) (sorry it took me so long to set up the experiment)
Using a Windows computer (because most other operating systems do not support tap) and the OpenVPN client that supports tap (I just installed OpenVPN 2.7.6, because OpenVPN-Connect does not support tap). Connected the Windows laptop to my smartphone Hot Spot and connected the laptop to my Orbi RBR50:
Notice that because the connection is "tap", the laptop was assigned an IP address on the Orbi LAN and has provided the hardware MAC address to the Orbi. The Windows laptop is now on the Orbi LAN and can access the Orbi web interface (192.168.1.1 on my Orbi).
At this instant, Access Control is not enabled (because I decided long ago that it provides no value in my environment). The experiment will need to be repeated with Access Control enabled.
Using VPN in tap mode should allow you to administer the Orbi system remotely and maintain the LAN Setup table to allow only specified WiFi devices on the network.
p.s. Setting up OpenVPN is not trivial, but c'est la vie.
p.p.s. If OpenVPN somehow fails on your model of Orbi, there is another solution. Install a Brume VPN gateway on the network.
https://www.gl-inet.com/products/gl-mt2500/
This will allow you to VPN into the local network using either OpenVPN or Wireguard (more efficient, but probably not significant for this type of use)
schumaku has provided the key to this issue. Connect to the VPN using "tap" mode (UDP port 12974) (sorry it took me so long to set up the experiment)
Using a Windows computer (because most other operating systems do not support tap) and the OpenVPN client that supports tap (I just installed OpenVPN 2.7.6, because OpenVPN-Connect does not support tap). Connected the Windows laptop to my smartphone Hot Spot and connected the laptop to my Orbi RBR50:
Notice that because the connection is "tap", the laptop was assigned an IP address on the Orbi LAN and has provided the hardware MAC address to the Orbi. The Windows laptop is now on the Orbi LAN and can access the Orbi web interface (192.168.1.1 on my Orbi).
At this instant, Access Control is not enabled (because I decided long ago that it provides no value in my environment). The experiment will need to be repeated with Access Control enabled.
Using VPN in tap mode should allow you to administer the Orbi system remotely and maintain the LAN Setup table to allow only specified WiFi devices on the network.
p.s. Setting up OpenVPN is not trivial, but c'est la vie.
p.p.s. If OpenVPN somehow fails on your model of Orbi, there is another solution. Install a Brume VPN gateway on the network.
https://www.gl-inet.com/products/gl-mt2500/
This will allow you to VPN into the local network using either OpenVPN or Wireguard (more efficient, but probably not significant for this type of use)
Thank you! These are very promising suggestions, and I will explore them.
There is yet another potential solution: install a VPN Host on a local computer (on the Orbi LAN).
For example, I have a Raspberry Pi that I use for various things, such as running a Pi-Hole server. On a lark, I installed Wireguard on the Pi. If I deliberately forward Wireguard port 51820 through the Orbi router to the Pi, I can VPN into the LAN.
Thus, if the computer being used to manage the Orbi supports Windows, using a tap connection with the OpenVPN software that supports tap is the obvious choice. (no additional equipment. less complexity, less cost)
If the computer does not support Windows, it may be necessary to use a VPN connection to a device on the network that is not the Orbi router.
This is a great suggestion, thank you. Right now, I'm struggling to get OpenVPN 2.X running on my Windows 11 box. If I can get that to connect, that would be the best. Otherwise, it would be an excuse to play with a Pi!
OpenVPN can be a bit of a struggle. One thing I do is set the log debugging level higher. In the client.ovpn file, I change
verb 0
to
verb 5
("verb" might stand for "verbosity"? )
I also neglected to change the name of the TAP-VPN file to NETGEAR-VPN. (turns out reading the instructions is important)
And, somehow it could not find the certificate files, so I have to change the file names to the complete Windows file path (and use two "\" instead of one.
This probably will not affect you, but when I first set up VPN, I chose No-IP for the DDNS (and have NO memory of why I picked it), and found out later that if I didn't use it every 30 days, it would disappear unless I paid for a subscription. So, I'm out $35/year