Need help getting remotely located R6700AX router added to my phone Nighthawk app "products"

[DSperber]

This is like a comedy of errors.

(1) ISP uses CGNAT, so port forwarding on the router does not work. I am in California and remotely connect to the computer in Florida using RealVNC which requires port forwarding in the router. I can fall back to using Team Viewer to remotely connect, but I prefer RealVNC. So I wanted to solve this port forwarding problem.

(2) I got ISP to assign "static IP" and that fixed things. Now port forwarding on the router works perfectly. And so now I can use RealVNC to remotely connect from my client computer in California to the host computer in Florida.

(3) Before discovering that CGNAT was involved, I had simply built my standard connection mechanism. This runs No-IP DUC client (dynamic DNS) on the Florida host computer, which "phones home" every hour to provide the current numeric IP address of the computer which is then used to resolve the symbolic host name as facilitated by No-IP. I remotely connect from California to the symbolic host name, which gets resolved to a numeric IPD through No-IP, and now RealVNC can connect to its client running on the Florida machine. But it depends on port forwarding working on the router, and the "phone home" message getting out from the Florida host machine to No-IP in the cloud.

(4) Well, technically, now that I've got a static IP at the Florida location, I really don't need No-IP and dynamic DNS at all. But I have not yet uninstalled the No-IP DUC client, so it is still running every hour, "phoning home" with its numeric IP address. Unfortunately, the Armor security software running on the R6700AX is blocking this message from going out:

"NETGEAR Armor has detected that HPOmen [which is the laptop on the LAN which has No-IP DUC installed on it] is sending unencrypted authentication information and blocked that page."

This happens once per hour, which also results in an hourly notification on my cell phone in California where the Nighthawk app is installed, since the new R6700AX is a new registered product on my Netgear account. It's not present on my Nighthawk app as "My Products" (because I was never in Florida to get it added through being local to the WiFi network so I could add it), but it is on my Netgear products.  So I get notified every hour of this blockage.

(5) Theoretically I can "whitelist" the URL for No-IP, so that the blockage will no longer occur. However you cannot use the router itself to do the "whitelisting". And you cannot get to Armor on the router. You can only do the whitelisting using Nighthawk app on the phone. But I cannot manually add the new R6700AX router to my NIghthawk app without physically being local to the router so I can connect via WiFi to it.

(6) So there is no way to add the new router to "My Products" to the Nighthawk app on my phone, because I am not in Florida. There is no way to use the router itself to do the whitelisting for Armor. There is no way to get into Armor on the router, except through the Nighthawk app. I appear to be screwed... and obviously must uninstall the No-IP DUC client in order to prevent this all from happening.

(7) Netgear says  they can't help, and pass me off to Bitdefender (in Romania, who is apparently the vendor responsible for Armor). Bitdefender says they can't help. Netgear can't help. Great!

(8) If I get someone in Florida to add the Nighthawk app to their phone, and sign in with my Netgear account credentials (thus representing a second phone with the Nighthawk app on it for my account), will they be able to add the new R6700AX in Florida to my Nighthawk account? Should I be able to then see it on the Nighthawk app  running on my own cell phone in California which is logged in to the same Netgear account? If so, since "Anywhere Access" is enabled on my Nighthawk app I technicall would then be able to whitelist the URL, right?

Anybody have any other advice?

[DSperber · Accepted solution]

Ok. I have emerged victorious.

As I described previously, I bought a second R6700AX and had it shipped directly to me in LA so that I could pre-configure it properly using both the Nighthawk app on my phone for "wizard" features available to the app, as well through the web browser UI for the more complex configuration required (i.e. static IP, as well as MAC address reservation for a fixed LAN IP address, as well as port forwarding to that fixed LAN IP address for RealVNC), for its eventual home in Florida running under Hotwire Communications.

The pre-configuration also includes declining any subscription or trial period for Armor, as well as checking "do not bother me ever again" to get rid of it permanently.

And I also set up a refund for the first R6700AX so that when the second one arrives and is swapped in, the net cost will only be for the one final router.

So just yesterday the pre-configured second router finally arrived in Florida and was swapped in. WORKED PERFECTLY! And today the first router was dropped at a nearby UPS store and I've already received the refund.

And, in fact I am now able to connect directly to the router in Florida through my phone in LA using the Nighthawk app:

And furthermore, the No-IP DUC client once again works perfectly, not that Armor is not blocking the No-IP URL:

Case truly closed!!

[DSperber]

What happened? I just posted a reply and it's now disappeared!

I actually got an email from the forum congratulating me on posting my very first reply. And now that reply has disappeared!!

Must I actually recompose it and repost it?

Not happy

[DSperber]

Thank you for your response. But no, I didn't consciously buy that lesser expensive version with the 1-year free trial to "security". I bought the slightly more expensive regular R6700AX. Never knew or expected that Armor would be available, or self-activate.

I've contacted No-IP and they have no other complaints from any other of their users about  Netgear router/Armor blocking the "phone home" messages send hourly by the No-IP DUC client program that runs on the computer I remotely connect to using RealVNC (and which requires port forwarding in the router). But that's my current goal, to "whitelist" the dynupdate.No-IP.com URL in Armor. But to do that I must use the "Security" (Armor) tile on the Nighthawk dashboard on my phone. But that tile isn't even present, because the only product I currently access through Nighthawk is my R7800 in Los Angeles (at my home) which does not have Armor on it.

I really would like to know from somebody if I can just get someone in Florida (while local to the R6700AX and its wifi network) to install Nighthawk on their phone, and log into my account using my credentials. Then presumably THEY could add the R6700AX to my account. And since I have "Anywhere Access" enabled on my phone I should then be able to see the "Security" tile, and get into it, and whitelist that URL by myself. Yes?

Note that I do not want to "setup a new Nighthawk router/network". That's already been done. I only want to add that R6700AX router the the devices available from Nighthawk app on the phone. Can I do that? Or do I have to destroy all the router setup and configuration I've already done, simply to get that new router added to my Nighthawk account so that I can see it on my phone in LA?

This is really crazy. I just want Armor to be deleted from the router, or disabled for my Netgear account (if it is not free I certainly will not pay for it in a year). How can I get rid of it? Can Netgear support do that for me, or not?

[DSperber]

Ok. After three days of trying I finally got to speak to someone from the responsible department within Netgear that deals with Armor. And yes, my idea about having a friend in Florida install the Nighthawk app on his phone and then connecting to the router to add it to the "my products" which can be managed by that phone... it would work. And then HE could disable Armor on that router, but only using his phone. I would sitll not see the router using the Nighthawk app on my phone, even though his phone was logged in using my account credentials! Only the  phone that makes the connection to the router can communicate with that router, having nothing to do with the account on which this is all taking place!!!

Nevertheless, while working with the support agent on the phone, I happened to log into the armor.netgear.com site, which is actually where any Armor subscription information for my Netgear account is kept. And, amazingly, I discovered that somehow I had begun a 30-day trial!!!  I don't remember doing that but apparently I must have clicked on something in haste and that began a 30-day trial period:

Ideally I should be able to cancel my own trial subscription. But in actuality they do not provide any way for me to terminate it early. Yes, it will expire automatically in 28 days if I don't opt-in to pay for it. But they provide no way for me to terminate this trial myself, on my own account!

After much screaming and hollering, it turns out that he admitted he was able to contact the "customer care advocate" responsible for Armor subscriptions, and ask that my 30-day trial be immediately canceled. So they can do it, but I can't.

I requested that, and within 10 minutes it was done.

So now I theoretically had Armor disappeared from my R6700AX (which I forced a reboot on, per the support agent's recommendation).

I then tried to initiate one of the DUC outgoing "phone home" messages, just to be sure it went out and that it was no longer blocked and that I would no longer get a notification from Nighthawk on my own cell phone. Well, I couldn't initiate the outgoing message. In fact I couldn't even communicate with No-IP to get the host list for my account (in order to update it with the latest numeric IP address for the client machine). Very strange.

After much unsuccessful playing around I decided to uninstall/reinstall the DUC program. Perhaps that would clear things up.

But no. This "no hosts" error persists. I wonder if the cancellation of my Armor trial will take some time to actually disappear, even though it sure looks like it's no longer on my account. I will wait until tomorrow before re-contacting Netgear.

Really losing patience with this device.

[schumaku]

Yes, you need someone "local" to your Florida router to access it (WiFi is sufficient) to enable it to your Netgear account (probably with 2FA active?) for Anywhere access. Then disabling Armor in the security tile is certainly workable.

Sure, you can add multiple Netgear routers with Anywhere Access. As of writing, if these are the same models they can be identified based on the serial number only.

A little bit confused why Bitdefender does not like the No-IP DUC client. I would assume the current version is fully https enabled. Remains the point that they might have the No-IP DDNS updater hostname in their block list why ever. You are not using some kind of old/outdated or third-party DDNS updater?

[michaelkenward]

---

@DSperber wrote:

---

Forgive me for diving on here without going through all the long and painful saga. (You have my sympathy.) Is the idea that you want to add your new router to your existing account so that it shows up the screen Nighthawk App screen above?

Have you tried adding it? Out if the box Anywhere Access is enabled. If you add the new router to your account it should be available in the same app screen as your R7800.

For example, I see this in the screen that you show.

Have you added the new device to the same MyNetgear account as your R7800? If you do that Security (Armor) will show up in devices that support it.

As you know, that doesn't include the R7800.

For more help on Armor, have you tried the section given over to that?

NETGEAR Armor - NETGEAR Communities

Your issue isn't really related to the router so much as a generic one with Armor.

[schumaku]

@michaelkenward out of the box Anywhere Access might be available and enabled, but not linked to a Netgear account in the Apps. This "trust" need to be established manually.

@DSperber Guess you talk about this "no host". I'm not convinced the Armor will be immediately disabled on the router with the license revoked.

Yes, I would expect No-IP will make your configured host(s) available here.

Disarming Armor on the App still might be required. 

Unluckily - Netgear might argue it to be a "security" item - they don't give us any access to the App config from the Web UI via the Netgear Account Web portal. It's implemented like a different scope. 8-/

[DSperber]

(1) Really won't do me much good to have a friend in Florida put Nighthawk on his phone and then connect to the router there, even if Anywhere Access is enabled on his phone and his Nighthawk app. Does me zero good in California if I wanted to work on the router using my phone. And that's because Nighthawk on a given phone controls the routers added on that specific phone... no matter what account credentials are used to log into the associated Netgear account.

My objective is not just disabling Armor on that router (even though theoretically it is no longer operational in trial mode) because it still does seem to be active and operating. I also want to be able to get to it through Anywhere Access on my own phone, which is impossible given what the situation is.

(2) Yes, I know I can add multiple routers to my own phone's Nighthawk app... if  only I were local to the additional routers. But I'm not. And there's no manual way to accomplish this, even with remote connection to the web browser UI of the router. You have to do it all through Nighthawk on the phone, which is impossible given what the situation is.

(3) I am pretty convinced that Armor is actually still active and operating on the router. I have no real way of knowing that, of course, since the web browser UI into the router provides zero access to Armor. And of course I don't have a "Security" tile on my own phone's Nighthawk app because my R7800 (the only product defined for my phone) doesn't support Armor. So there's no real way of knowing whether or not Armor has actually been truly neutered on the R6700AX other than by external symptoms... like the No-IP DUC client program failing to get hosts.

According to the No-IP support group who I contacted regarding this program failure:

"That error means that DUC is unable to reach out to us.

There must be something at the network location that's blocking the DUC's communication.

There isn't any way for us to know specifically what's causing it but I'll send you some possibilities.

-This is typically a firewall issue. Outbound must be allowed on ports 80, 443, 8245 and 8253.

-Another possibility is if your network is run by someone else they may have something at the network that blocks those kind of attempts.

-Lastly it can be some sort of security software on a device at the network. It can be on the computer itself or on the router of the network.

If you can't get it working we recommend you try configuring DDNS on the router instead:

https://www.noip.com/support/knowledgebase/how-to-configure-ddns-in-router/   "

Their guess is as good as mine. It's obviously not working, and my guess is that Armor is blocking the retrieval of the host name list for my account at program launch (or pushing the "edit hosts" button), same as it was blocking the hourly "phone home" outgoing messages from the client.

[DSperber]

(1) I know I can add additional routers to my own phone's Nighthawk app. But I must be local to that router to do it, and I'm in California while this router is in Florida. There's no other way to get it added to my phone. The routers managed by the Nighthawk app on a given phone must have been configured while the phone is local to that router's wifi network and I was not when the router was installed (by a friend in Florida).

(2) Similarly since my own R7800 is currently the only router on my phone's Nighthawk's product list, there is no Security tile since Armor isn't supported by the R7800. Anywhere Access is enabled, but it only works for the routers in the product list for the given phone... which currently is only my R7800.

(3) I actually didn't know there was a separate Armor forum. Sure, I could investigate over there for additional support. But I've already decided what I'm going to do (see my next post).

[DSperber]

So I give up, with Netgear and Bitdefender and Armor. It looks like Armor is still functioning, and is interfering with No-IP DUC client trying to communicate with the No-IP web site, both at program launch to retrieve the host name list for my account, and also hourly when sending out the "phone home" numeric IP update message.

Yes, I do realize that with the "static IP" that I now have from Hotwire Communications because their use  of CGNAT is incompatible with port forwarding on any router, I actually don't even really need to be running the No-IP DUC client at all! It's a static IP address, and there's no need to use a dynamic DNS service which needs an hourly "phone home" update to provide the current IP address.

But it's the concept. I really want the No-IP DUC client to be able to work as it always has, even if the IP address sent never changes. It is Armor that is causing the failure, and it never failed until I installed the R6700AX router last week and accidentally activated the 30-day trial period for Armor.

And also, I really do want Anywhere Access to the router in Florida, which will never happen as things stand because I am in California.

So here's my new plan to solve all of these objectives:

(1) I am going to buy a new R6700AX and have it shipped to me in California. I will set it up on my own Spectrum internet service, temporarily swapping out my R7800 for the R6700AX. This will allow me to add this second R6700AX to the Nighthawk app on my own cell phone so that I can forever more get to it through Anywhere Access. I will set it up temporarily for DHCP (which is how my own Spectrum internet service works), and everything else as if it were going to truly replace my R7800. I will absolutely not activate any trial period for Armor, choosing to "don't display this message again" if offered. I don't know if the Security tile on the Nighthawk app will appear even if Armor is not activated on the router, but I will find out when my hands are on the router in California.

(2) Then I'm going to disconnect the second R6700AX, box it up, and ship it to Florida.

(3) I am also going to initiate a return of the first R6700AX currently installed in Florida (with its unknown Armor status) to Amazon. The physical dropoff of this first router at a UPS store for Amazon refund will not happen until the second router (which I've mostly pre-configured in California and then shipped it to Florida) actually arrives in Florida.

(4) Once the second router gets to Florida, my friend will swap it with the current first router. And I will walk him through a repeat of the local web browser UI configuration for "static IP" and port forwarding to the local IP address of the laptop computer on which RealVNC client and No-IP DUC client both run. I of course will have verified that No-IP DUC client works on my Spectrum DHCP world and with no Armor running on the second R6700AX. I feel confident that it will continue to work in Florida even after "static IP" is configured on that router. As long as Armor is not active I'm sure everything else should be fine and No-IP DUC client should have three green checks even though I realize I don't need to run this program as I have "static IP" implemented.

I believe this is the only way to accomplish all objectives, including most importantly being able to get to the Florida router through Anywhere Access on my own phone and Nighthawk app.

And there will not be any Armor to contend with. All should be well... hopefully.

[DSperber]

So the new R6700AX router arrived yesterday (at my home in California). Today I unboxed it and temporarily replaced my R7800 with the R6700AX on my Spectrum DHCP internet connection, so that I could use the Nighthawk app on my phone (which previously had just my existing R7800 showing in my "products") to then set up everything for its eventual actual "production environment static IP" configuration with Hotwire Communications in Florida.

And now that I knew what to look for, it absolutely was true that Armor is simply available and ACTIVE out-of-the-carton for a 30-day free trial period. I didn't make a mistake and accidentally enable the trial period on the original first R6700AX that was shipped directly to Florida. That's simply how Netgear packages it, so that it's ON by default and you have to OPT-OUT (by DISABLE'ing it during the first 30-days) or declining the expected sign-up/renew option (at the monthly or annual subscription price) when the 30-day trial period finally expires.

I am also convinced that even though Netgear manually terminated my 30-day trial period for Armor on the first router, it must still actually be functioning and is not truly DISABLE'd. That clearly is why the No-IP DUC client continues to fail, even though my 30-day trial period is truly terminated early. Armor is obviously still actually running ENABLE'd on the router. It can only be DISABLE'd using Nighthawk on a phone.

So it really wouldn't have mattered even if I could have have "whitelisted" the problematic No-IP URL for the Armor-blocked outgoing message from the No-IP DUC client. That would have at least temporarily removed the blockage. But I still would not have wanted to pay any money ongoing for Armor under any circumstances.

So that's what I was now able to do since I had the new second R6700AX available for configuration via Nighthawk on my California phone. So the 30-day trial period is still "active", and theoretically I can re-ENABLE Armor if I want to play with it during the trial period (which I don't). It is now DISABLED and non-functioning.

And sure enough, with Armor DISABLED there is now ZERO PROBLEM for the No-IP DUC client to work correctly, both at program launch (when it successfully retrieves the host list for my account) as well as hourly sending "phone home" messages out to No-IP. No problems whatsoever, and three green check marks in the GUI.

I will now box it back up and ship it to Florida. I've already pre-configured the "address reservation" for the Florida laptop and its MAC address, as well as the proper "port forwarding" rule to that laptop so that I can remotely connect through RealVNC... while living inside the "static IP" setup of Hotwire (in order to overcome their default CGNAT configuration which inhibits port forwarding).

Everything is set to go, with nothing for them to do in Florida except literally just disconnect the three wires going to the current physical R6700AX, swap out the old R6700AX and swap in the new R6700AX, reconnect the three wires to the new R6700AX, power things up and start Windows.

And we should emerge victorious. I will have the ability to manage the Florida router via Anywhere Access from Nighthawk on my California phone for functions that can be done that way. And I will also have available a remote RealVNC connection to the laptop to use the standard local web browser UI into the R6700AX for that class of functions.

[Retired_Member]

Armor is simply available and ACTIVE out-of-the-carton for a 30-day free trial period.  I didn't make a mistake and accidentally enable the trial

did you use the Setup Wizard to initially setup the router?

or register it with Netgear during setup?

[DSperber]

Yes, I decided to just use the total wizard offered by the Nighthawk app on my phone, through the "set up a new network" process. I let it guide me.

And I never had to manually register the new router or do anything except push NEXT and occasionally make a choice or answer questions. The already present (for my own R7800) Nighthawk app already knew my Netgear account credentials. so the serial number of the new router was automatically discovered and used to register this new router on "my products" of my Netgear account.

So now I have both R7800 and R6700AX on my phone's Nighthawk "products". And my online Netgear account shows the second R6700AX from today as well as the first R6700 AX from last week.

And I did NOT "opt-in" to accept Armor for 30 day free trial. Messages trying to tell me how good it was just appeared, and the "Security" tile on my Nighthawk dashboard was just present, showing a green message "Network protected 29 days remaining".

Then, from dashboard hamburger menu button -> Settings on Nighthawk (with the R6700AX as the currently selected product) I was shown an item named "Security", with the slide button already green showing Armor ENABLED. I then tapped on the button to DISABLE Armor.

Since the 30-day trial period is still technically still active I can also re-ENABLE Armor if I wanted to (which I don't). And the dashboard Security tile now has a red message "Protect with Armor now".

Note that with the R7800 selected for "product" there is no Security tile shown on the dashboard.

[DSperber · Accepted solution]

Ok. I have emerged victorious.

As I described previously, I bought a second R6700AX and had it shipped directly to me in LA so that I could pre-configure it properly using both the Nighthawk app on my phone for "wizard" features available to the app, as well through the web browser UI for the more complex configuration required (i.e. static IP, as well as MAC address reservation for a fixed LAN IP address, as well as port forwarding to that fixed LAN IP address for RealVNC), for its eventual home in Florida running under Hotwire Communications.

The pre-configuration also includes declining any subscription or trial period for Armor, as well as checking "do not bother me ever again" to get rid of it permanently.

And I also set up a refund for the first R6700AX so that when the second one arrives and is swapped in, the net cost will only be for the one final router.

So just yesterday the pre-configured second router finally arrived in Florida and was swapped in. WORKED PERFECTLY! And today the first router was dropped at a nearby UPS store and I've already received the refund.

And, in fact I am now able to connect directly to the router in Florida through my phone in LA using the Nighthawk app:

And furthermore, the No-IP DUC client once again works perfectly, not that Armor is not blocking the No-IP URL:

Case truly closed!!