2
I want to access the devices on my local network, I'm interested specially in the CCTV camera and the raspberry Pi, that acts as a CCTV server.
Unfortunately, I use a 4G modem at home, so no public IP, and no chance, as I already asked.
My Current network:
How I'm planning to do it:
Is this feasible? and if so, would it work just setting OpenVPN up and configuring port forwarding?
why no vpn client on the external computer? you'll need it to connect the external computer or mobile phone, to the vpn server. – barlop – 2015-12-23T11:14:48.347
Because I want to be able to check the port 80 of the camera from anywhere, even with phones with no VPN client. – Aleix – 2015-12-23T11:30:19.400
Then you will obviously need a web server and that web server must have an interface not on the VPN. Where is that in your picture? – barlop – 2015-12-23T11:38:16.637
It might be running on the VPN interface if he configures interface forwarding, but obviously that needs a bunch of security measures. – nKn – 2015-12-23T11:41:56.753
@barlop the webserver would be run either on the CCTV camera itself (port 8080), or theres also one in the raspberry pi (port 80). All I want is be able to access those from an external device outside the VPN (by forwarding ports). – Aleix – 2015-12-23T12:16:54.920
@nKn any input on what security mesures should I setup? – Aleix – 2015-12-23T12:17:38.380
@Aleix Basically what I specified in my answer below. You should make sure that you grant access to the webserver to only the ones you want to authorize. A combination of
iptables
and a security tool likeknockd
is probably a good start. – nKn – 2015-12-23T12:22:47.397you could restrict things so that only certain IP addresses can connect to the web server, alternatively, you may have some security options if you are willing to carry an ssh client on usb. – barlop – 2015-12-23T12:44:08.683
@barlop what if I just forward the ports I need (such as 80) to the devices I need and that's it? – Aleix – 2015-12-23T13:10:57.950
@Aleix well, do you want everybody on earth to be able to see your cctv? – barlop – 2015-12-23T13:22:42.217
@barlop the CCTV is password protected, so yeah, that would be the idea... – Aleix – 2015-12-23T13:55:15.600
To Aleix , security may be ok, not sure off hand, what @nKn has in mind re security given that your web server is to be open to all(but with password protection which you have covered), been a while since I used a vpn.. Hopefully he can elaborate – barlop – 2015-12-23T14:54:56.890
I'd not rely uniquely on the password authentication, that's why I suggested a tool like
knockd
which expects 3 TCP packets at 3 different ports consecutively (a safe-like emulation), and only if that happens, the daemon opens up the port for the IP that made the request. Otherwise it will be kept closed. I know it's a nuisance, but even every security is not enough when exposing services to the internet. – nKn – 2015-12-23T16:08:38.273