NETGEAR is aware of a growing number of phone and online scams. To learn how to stay safe click here.
Forum Discussion
Solved
Remote VPN access with access control
I've just installed a two-station Orbi 770 in an environment that is remote from my office requires using MAC-number based access control to allow only authorized users without constantly changin...
schumaku has provided the key to this issue. Connect to the VPN using "tap" mode (UDP port 12974) (sorry it took me so long to set up the experiment)
Using a Windows computer (because most other operating systems do not support tap) and the OpenVPN client that supports tap (I just installed OpenVPN 2.7.6, because OpenVPN-Connect does not support tap). Connected the Windows laptop to my smartphone Hot Spot and connected the laptop to my Orbi RBR50:
Notice that because the connection is "tap", the laptop was assigned an IP address on the Orbi LAN and has provided the hardware MAC address to the Orbi. The Windows laptop is now on the Orbi LAN and can access the Orbi web interface (192.168.1.1 on my Orbi).
At this instant, Access Control is not enabled (because I decided long ago that it provides no value in my environment). The experiment will need to be repeated with Access Control enabled.
Using VPN in tap mode should allow you to administer the Orbi system remotely and maintain the LAN Setup table to allow only specified WiFi devices on the network.
p.s. Setting up OpenVPN is not trivial, but c'est la vie.
p.p.s. If OpenVPN somehow fails on your model of Orbi, there is another solution. Install a Brume VPN gateway on the network.
https://www.gl-inet.com/products/gl-mt2500/
This will allow you to VPN into the local network using either OpenVPN or Wireguard (more efficient, but probably not significant for this type of use)
I thought it might be helpful to leave a few notes in summary of the discussion for others who have this problem, with thanks in particular to schumaku for pointing out the importance of TAP and HappyCat for some promising experiments and lots of very helpful comments.
The OBJECTIVE was to obtain remote access to the web interface of the Orbi 770, with MAC access control implemented on the Orbi.
The APPROACH was to use the Orbi's built-in OpenVPN server for access.
My initial, unsuccessful approach was to use tunnelblick on a Mac, with the config files from the Orbi. The PROBLEM was that the Orbi didn't recognize my VPN connection as coming from a machine in the MAC access table, so whenever I turned access control on, I lost my connection. Several on the conversation thought that the problem was that the Orbi was using TUN, which doesn't present the client's MAC address to the server. schumaku proposed using TAP, which HappyCat verified experimentally, accessing from a Windows machine. It's necessary to use OpenVPN 2.x; OpenVPN Connect does not support TAP.
In studying the .opvn/.conf file generated by the Orbi, I discovered that it already was expecting a TAP connection, since it includes the line "dev TAP".
I'm a novice in configuring VPNs, so I had to learn that TAP is supported on a client as a virtual device, with its own MAC number, different from the machine's WiFi or Ethernet numbers. My windows machine had one (probably generated by the OpenVPN installer, accessible via cmd at ipconfig /all), and when I authorized that machine with the TAP MAC number, everything worked.
Back on the MAC with Tunnelblick, I started look for the TAP MAC number (ifconfig -a), and didn't find one. Then I learned that the ovpn configuration language includes an option lladdr, which takes a user-supplied MAC number in the usual form (e.g., lladdr 00:11:22:33:44:55). I made one up, added that line to the Tunnelblick .conf file generated by the Orbi, authorized that number to my Mac on the Orbi web interface, turned on access control, and the Mac connected right up.
It's interesting that when I called Netgear tech support about the problem, they told me there was no way to use the VPN to access the web interface if the Orbi had access control turned on, and urged me not to use access control. Happily, this community knew better. Thank you again, all!