130 replies to this topic

[betacentauri]

Then try to setup VPN. This also works with an iPhone, iPad.
Some router make it quite easy to setup VPN. I e.g. have a fritzbox and iPhone. Fritzbox setup is only some mouse clicks. iPhone setup was not so easy, but you can find instructions in the Internet.
I would prefer to use a router with good firmware support to create VPN tunnel. Another option is to install OpenVPN on the receiver...

[kermith]

Thanks. The Fritzbox looks pretty cool maybe something for the future since I got a new router with my fiberline a couple of months ago, but it doesn't have VPN built in.
VPN is really interesting. @betacentauri, when you mean setting up a OpenVPN on the receiver, do you mean VU+ box as being the receiver?

Edited by kermith, 29 November 2016 - 18:43.

[Dimmie]

It's very simple. Don't do WAN sharing and make sure the firewall in your router blocks all incoming parts.

 

Even with VPN enabled on WAN sharing, it is still possible to enter the box. 

 

So the one and only solution: quit wan sharing

[kermith]

Very simple indeed. The safest thing to do would also have all of the computers off line, and then just connect the network cable when needed. I'm not ironic, it is the safest thing. My question is more of a "if" I need WAN share what would be the best alternative being aware of the consequences. 

[betacentauri]

With receiver I mean E2 box.

[Dimmie]

1. WAN sharing = illegal, so not supported. So there should be no "if".

2. When you do WAN sharing (with or without VPN) , you forward a port in your router to expose your share on the internet. So you expose your hardware to the internet which means it can be hacked.

 

Normal internet traffic by a pc is a totally different thing. Then you don't have to open/forward a port. 

[Dimmie]

Asking for "if" is the same like walking into a police station and then asking: "Hey I know robbing a bank is illegal but if I should do it what is the most secure way not to be caught".

[WanWizard]

Setup a site-to-site VPN between your home and your country house. Then both internal networks can talk to each other, without exposing them to the internet.

 

I do the same here, both my routers support IPSec.

[littlesat]

low a very quick and easy setup for VPN (Site-2-Site and Road Warriors).

->

But the last time I saw it the standard OpenFritz software has light VPN... that is not that secure.... 

[WanWizard]

The Fritz (the standard OS) does IPSec as well. With a couple of limitations, and not the easiest of configs. But it can be done, we have two of them connected to our office router.

[littlesat]

But didn;t you need special software installed on the Fritzbox....

 

I'm still considering to post a how-to, how to install and configure OpenVPN on your box and how to create (as example) good keys a.....  and how te create a .opvn file for your iPad/iPhone... but as the preferable safety is to use the VPN of your server I did not post it yet...

[WanWizard]

No, you don't. And afaik both boxes are 7490's.

[SpaceRat]

Fritz!Box does IPSec.
I've connected my Linksys running StrongSwan on LEDE to two Fritz!Boxes.

Gesendet von meinem Siemens C25 mit Tapatalk

[Robinson]

I'm still considering to post a how-to, how to install and configure OpenVPN on your box and how to create (as example) good keys a.....  and how te create a .opvn file for your iPad/iPhone... but as the preferable safety is to use the VPN of your server I did not post it yet...

 

The how-to would indeed be very useful.

[kermith]

 

I'm still considering to post a how-to, how to install and configure OpenVPN on your box and how to create (as example) good keys a.....  and how te create a .opvn file for your iPad/iPhone... but as the preferable safety is to use the VPN of your server I did not post it yet...

 

The how-to would indeed be very useful.

 

 

1. WAN sharing = illegal, so not supported. So there should be no "if".
2. When you do WAN sharing (with or without VPN) , you forward a port in your router to expose your share on the internet. So you expose your hardware to the internet which means it can be hacked.
 
Normal internet traffic by a pc is a totally different thing. Then you don't have to open/forward a port.

I think your answer has a point but if I'd count on how many times most people cross that line everyday it would take a whole different discussion and I wont even go there.
 

With receiver I mean E2 box.

Oh, OK, thanks.
 

 

I'm still considering to post a how-to, how to install and configure OpenVPN on your box and how to create (as example) good keys a.....  and how te create a .opvn file for your iPad/iPhone... but as the preferable safety is to use the VPN of your server I did not post it yet...

 
The how-to would indeed be very useful.

 

Yeah, that would be appreciated.

But also how about just allow devices with specific mac address to be able to logon to the router or the box?
Would that work?

[SpaceRat]

No.

MACs can be spoofed.

And also only the traffic inside the LAN cares about MACs, it's IP based through the outside world.

[kermith]

OK. Thanks. Then the OpenVPN setup is mostly versatile and interesting. 

Also the SSH setup from post #11 is not a bad idea.

@littlesat if you could please post a "how to" setup guide

Edited by kermith, 30 November 2016 - 15:49.

[SpaceRat]

ssh is easy to set up:

Execute the following commands to generate and install a key pair on your E2 box:

dropbearkey -t rsa -f ~/.ssh/id_rsa
dropbearkey -y -f ~/.ssh/id_rsa | grep "^ssh-rsa " >> ~/.ssh/authorized_keys
chmod 600 ~/.ssh/*
chmod 700 ~/.ssh
chmod 700 ~

You should now be able to login to your box using the private key file id_rsa located in /home/root/.ssh of your box (See the instructions of your ssh client on how to use key auth).

If this succeeds, make the content of /etc/default/dropbear read

DROPBEAR_EXTRA_ARGS="-s"

This will disallow password logins for ssh entirely (let alone logins with empty passwords, which is the default for all oe-a images) (The only way to recover from ssh login problems would then be telnet).

You can transfer the file /home/root/authorized_keys to other boxes too, to use the same key file for multiple boxes, but make sure to adjust the file rights after copy:

chmod 600 ~/.ssh/*
chmod 700 ~/.ssh
chmod 700 ~

With ssh, you have everything you need:

• ssh gives you shell access, just like telnet but secure (when using key auth)
• ssh gives you file access, either using scp (secure copy) or sftp (FileZilla supports sftp, you can access your box' files just like you could using ftp).
• ssh allows to tunnel ports from the remote machine (= your E2 box) to your local machine.
  You can for example tunnel port 80 of your E2 box to port 80 of your smartphone and port 8001 of your E2 box to port 8001 of your smartphone.
  As long as the tunnel is established, you can login to your E2 webif using address "http://localhost" on your smartphone and use streaming, just as if your smartphone would be your E2 box.

The free app "ConnectBot" (https://play.google....=org.connectbot) has the necessary capabilities of using key auth and port tunneling on Android.

[kermith]

WOW, thanks for the explanation. Would it work on iPad as well? Someone mentioned I'd have trouble using it...

[littlesat]

Nope... on ssh the iPad with iOS >= 7 will "blow-up" the tunnel after the app that did open the tunel is not on the foreground for approx 5 min... The only option for iPad I found is openVPN...