Orbi and VPN help

[jfirestorm44]

Hello all. I have spent the last month working on setting up a NAS and am at the point where I am trying to get a VPN tunnel for external access. I have found a couple older post about Netgear and their lack of support for anything but OpenVPN. I have spent the last few days trying to get Wireguard working and I now believe it's just not possible with this router. My questions are:

1) What makes the router deny the signal even when the ports are forwarded?

2) Has this been resolved by Netgear and maybe I just have another issue preventing me from using Wireguard?

3) Does anyone use CFW for this purpose and which one?

4) Is there any orther way to get another VPN working aside from OpenVPN?

 I wish I had done some more research now before buying something that is so limited. This is frustrating but hopefully there's a good answer and way to get it working.

[CrimpOn]

I can verify that Orbi's OpenVPN Host does work.  I have VPN set up on two Orbi systems and can VPN into both.  All devices on the LAN are accessible, including the Orbi router itself, which is mainly what I use VPN for.

Where do you intend to host a Wireguard VPN? Since the stock Orbi will not host Wireguard, there has to be a computer on the LAN somewhere doing so.

If you are willing to consider alternate firmware, Voxel has a version of Orbi firmware for the RBR50 which includes Wireguard, both as Host and Client.  If you download the most current version, there is a QuickStart file that describes how to set it up.  I have run some of his versions (prior to the current one.  I switch back and forth between stock and Voxel.  I have not set up Wireguard, but have verified that his OpenVPN works the same as stock firmware.

http://www.voxel-firmware.com/Downloads/Voxel/html/orbi.html 

[jfirestorm44]

Thanks for the response. I have it running in a container on a Raspberry Pi. I for the life of me can't figure out why it's not allowing me to access my lan though. If I enable it on my phone through the Wireguard app then my phone just loses internet access all together. I have tried while on wifi and while on LTE with no luck.

I did set up the OpenVPN on the router also and it works fine. I just wanted to try Wireguard due to it having great reviews. Plus I am already using DuckDNS for DDNS and because I used the native OVPN on the Orbi I had to sign up for another DNS service (No-IP).

So does that mean that the Orbi does not block other VPN services? I should be able to use any other VPN and access my network just fine?

[CrimpOn]

Oh, my.  You are far more sophisticated than I am.  I know that testing my OpenVPN is a chore because I have to switch my phone to LTE, then create a hot spot so that my laptop can connect through the phone rather than my  Orbi WiFi, then start the VPN.

You could put the Pi in the DMZ.

Did you check that the Wireguard ports are "open" using one of the web testers, such as "ShieldsUp!"

[jfirestorm44]

---

@CrimpOn wrote:

Did you check that the Wireguard ports are "open" using one of the web testers, such as "ShieldsUp!"

---

I'm so glad you brought that up. I did use sevral sites and they all say it's BLOCKED. I deifnatly have it set in the port forwarding section. I selected port 51820 and pointed it at my Raspberry Pi (192.168.1.29). Does it show blocked becuase it's not pointing at something external to the network?

[CrimpOn]

The Orbi does not seem to open a port until something is "listening".  How about probing the Pi port 51820 internally?  Pi has a firewall that is "on" by default.

[CrimpOn]

It's a little frustrating that wireguard is not in the Raspbian distribution yet.  Did you use this "how to" guide when installing:

https://engineerworkshop.com/2020/02/20/how-to-set-up-wireguard-on-a-raspberry-pi/ 

[jfirestorm44]

Maybe I'm just an idiot (probably) in the docker-compose script I used I left SERVERURL as wireguard.domain.com because...well no body on any forum ever said anything about changing it when I posted my file. After a ping test to that domain I realized there was no response. I then changed that variable to my duckdns domain and Voila! I can connect to the internet now.

I do have a couple of questions though:

1. When using Traceroute against 'mydomain.duckdns.org' I get a direct hop. However when I use subsub.mydomain.duckdns.org it's 3 hops and shows my home ip address. How can I have a direct tunnel to my sub-subdomains also?

2. All of the what's my ip websites show my home address from my phone. How can I completely hide myself from being tracked? Is there a way to go through other servers and not see my ip?

I am very new to networking and how a packet gets form one place to another. This is alos my first time using a VPN so this may seem trivial. Thanks again.

[CrimpOn]

Once again, you are far ahead of me.  I have been installing Wireguard on my Pi4 and now it's dead.  What I get for attempting to follow directions on a web site when I have no idea what I'm doing.

Off now to flash Raspbian on the SD card and start over.

Good Luck with Wireguard.

[jfirestorm44]

Ha! Good luck and have fun.