Chris Green <cl@isbd.net> wrote:
Theo <theom+news@chiark.greenend.org.uk> wrote:
Chris Green <cl@isbd.net> wrote:But a keepalive is only a character (or two), even if it sends a TCP
OK, my current WiFi set up is (as a mobile connection would be) behind >> > a NAT router and I set up reverse ssh tunnels to allow me to connect
'on demand' to the Pi (BBB). So I can do exactly the same using the
mobile data connection.
Will the mobile provider object to the connection being up all the
time but with virtually no data going through it?
Mobile networks are often quite aggressive at killing idle connections
through their CG-NAT - 30 seconds idle is common, for example. To avoid >> that you have to send keepalives, which will gradually consume your data >> allowance.
packet as a result that's 1500 bytes. Say 600 keepalives per Mb,
that's only a few Mb per day which shouldn't cost too much.
This depends on the provider. I've been using mobile broadband for
my home internet for years, from various providers. At least one
rounded up the data used over certain connection periods for
charging purposes. Maybe you'll avoid that if the connection never
does go dead, but on the other hand it might trigger regular
round-ups to 1MB just because an open connection gets rounded up
to 1MB every so often by their system.
This is a "try it and see" sort of thing, terms of service
documents can be long and detailed, but often don't actually match
the reality of how their system works. Some providers round up by
KB instead of MB, by the way.
This is based on experience with mobile broadband providers in
Australia only.
The Natural Philosopher <tnp@invalid.invalid> wrote:
On 27/12/2020 14:12, David Higton wrote:
If you have no idea of its IP address, then it gets somewhat harder.
By definition on a mobile network its behind a HUGE NAT proxy. Unless
you are supremely lucky and you het an IPV6 address
Yes that's the case for any "normal" account. In Australia there
is/was at least one reseller offering mobile broadband accounts
with a fixed IPv4 address, on either the Telstra or Optus networks.
You paid for it of course, but it wasn't big $$$.
Odds are that the OP isn't in Australia, so I won't bother trying to
dig up the link. But I'm guessing that there would be similar
options in their country if they looked hard enough. Mobile
broadband is now used quite a bit in industry for this sort of
thing.
Joe <joe@jretrading.com> wrote:
On Sun, 27 Dec 2020 20:28:52 +0000
Chris Green <cl@isbd.net> wrote:
Tauno Voipio <tauno.voipio@notused.fi.invalid> wrote:
You have also a need to provide routing from the internalAy? I'm not at all sure what you mean by this.
network to the OpenVPN daemon for the subnet (or host) to
tunnel via the VPN.
I think what he means is that using a VPN from a single computerHmm!! I don't see how that makes sense. 'Using VPN from a single
doesn't need any routing changes, but if you want one computer to
handle VPN for other local computers, and the VPN machine is not the network's default gateway, then you need to tell the other computers
that the VPN computer is the gateway to the distant network. The
simplest way is with a DCHP configuration. I recall using a Win2000 workstation as a VPN server for a remote office and needing to do
this.
computer' when the 'single computer' is on a LAN - but then it all
goes to pot doesn't it? Either the computer is on one's LAN or it's
in a VPN with the remote but it can't really do both can it?
Tauno Voipio <tauno.voipio@notused.fi.invalid> wrote:
On 27.12.20 20.04, Chris Green wrote:Ay? I'm not at all sure what you mean by this.
If your OpenVPN machine is not the same as the incoming firewall/router,
you do need port forward from the outside to the OpenVPN machine. The
usual port is UDP/1194.
You have also a need to provide routing from the internal network
to the OpenVPN daemon for the subnet (or host) to tunnel via the VPN.
The first and last are 'site-to-site' VPNs, handling multiple clients.
Best done by scenario 1), but can be done by 3) if the gateway cannot
be a client of the VPN type required. Most modern routers can be client
or server to some VPN types e.g. IPSec and PPTP, but not usually
OpenVPN.
OP here - I'm in the UK but the system this is for will be in France.
So digging out specialist providers and such is one level more
difficult than doing it 'at home'.
On 28/12/2020 11:07, Joe wrote:
The first and last are 'site-to-site' VPNs, handling multiple clients.
Best done by scenario 1), but can be done by 3) if the gateway cannot
be a client of the VPN type required. Most modern routers can be client
or server to some VPN types e.g. IPSec and PPTP, but not usually
OpenVPN.
Asus router support OpenVPN client and server out of the box. Any router supported by OpenWrt is also OK.
druck <news@druck.org.uk> wrote:
Asus router support OpenVPN client and server out of the box. Any
router supported by OpenWrt is also OK.
If a router 'supports VPN' what does that actually mean?
Presumably it doesn't mean that the router runs as a VPN server, or
does it?
If my router supports VPN (which it does, a Draytek 2860N) and I
enable it what else needs to happen to make it useful? ... and what
The Natural Philosopher wrote to Joe <=-
It's a common requirement, and the magic codeword is 'M2M' (machine to machine). You'll probably need to go to a specialist SIM provider, the average high-street phone shop salesman won't have a clue what you're talking about.
That I did NOT know. That simplifies everything
Martin Gregorie wrote to Chris Green <=-
IOW it does about the same job as the wifi link on a Pi 3, 4 or Zero W except that it preferentially connects to a 3G or 4G base station
rather than to the nearest wifi router.
OP here - I'm in the UK but the system this is for will be in France.
So digging out specialist providers and such is one level more
difficult than doing it 'at home'.
Getting the carrier to provision them properly may be tough. I have a
Thinkpad laptop with a SIM slot for a Gobi card, but if I slot in a
working GSM sim, it doesn't work. Don't know if they're locked to a
specific carrier or need to be provisioned differently to work.
We have a handful of T-Mobile 4G hotspots, and that service is
$5/month, if memory serves.
druck <news@druck.org.uk> wrote:
On 28/12/2020 11:07, Joe wrote:
The first and last are 'site-to-site' VPNs, handling multiple
clients. Best done by scenario 1), but can be done by 3) if the
gateway cannot be a client of the VPN type required. Most modern
routers can be client or server to some VPN types e.g. IPSec and
PPTP, but not usually OpenVPN.
Asus router support OpenVPN client and server out of the box. Any
router supported by OpenWrt is also OK.
If a router 'supports VPN' what does that actually mean?
Presumably it doesn't mean that the router runs as a VPN server, or
does it?
If my router supports VPN (which it does, a Draytek 2860N) and I
enable it what else needs to happen to make it useful?
... and what
does my LAN behind the router look like, is it *all* on the VPN by
default or what? ... and how do I connect a remote system to the VPN?
... and how do I connect a remote system to the VPN?
If a router 'supports VPN' what does that actually mean?
Presumably it doesn't mean that the router runs as a VPN server, or
does it?
If my router supports VPN (which it does, a Draytek 2860N) and I
enable it what else needs to happen to make it useful? ... and what
does my LAN behind the router look like, is it *all* on the VPN by
default or what? ... and how do I connect a remote system to the VPN?
If my router supports VPN (which it does, a Draytek 2860N) and I
enable it what else needs to happen to make it useful?
It depends on the type of VPN. Some like OpenVPN are normally secured
by certificates, some just by password. They will often need a key at
both ends for use in the symmetrical encryption. Asymmetrical encryption
can be provided by the certificate, but that is generally too slow to
have a decent performance.
... and what
does my LAN behind the router look like, is it *all* on the VPN by
default or what? ... and how do I connect a remote system to the VPN?
If the router is the endpoint, then all the LAN is potentially
available to the client. If the router has a decent firewall user
interface, then access can be tailored so that only certain LAN
computers are visible. Ideally the router should connect to the LAN via
a separate firewall computer running iptables or nftables, which allow
very fine-grained control in forwarding. Of course, the LAN computer firewalls can also permit packets on only certain ports when arriving
from the router.
... and how do I connect a remote system to the VPN?
Give the VPN client the public IP address or hostname, and tell it to connect. Network Manager works fairly well these days, and has plugins
for some VPNs.
Obviously arrange for the client to have any keys or certificates it requires. It is wise to have human intervention required
e.g. to have a private key encrypted with a good passphrase which is not entrusted to the VPN client, so if the key becomes compromised it can
be cancelled and replaced without much risk of intrusion. I keep
OpenVPN, ssh and other keys on a USB stick in my wallet, so even if I
lose a laptop, my home network is still safe, and if I lose the wallet,
the encryption passphrase isn't stored on the stick.
Re: Re: Simplest 3G/4G connection for Pi, must work headless and stand-alo
By: Chris Green to druck on Mon Dec 28 2020 12:46 pm
If a router 'supports VPN' what does that actually mean?
Presumably it doesn't mean that the router runs as a VPN server, or
does it?
If my router supports VPN (which it does, a Draytek 2860N) and I
enable it what else needs to happen to make it useful? ... and what
does my LAN behind the router look like, is it *all* on the VPN by
default or what? ... and how do I connect a remote system to the VPN?
VPN capable routers are used mainly for enterprise /small businesses.
The idea is that you have an office in Berlin with LAN A, and an office in Washington with LAN B. You configure your routers to establish a virtual private network between them so both LANS are merged (sort of).
ie:
LAN A has subnet 192.168.10.0/
LAN B has 192.168.20.0/
The router generated VPN makes it so a computer in LAN A can use a network printer with ip 192.168.20.5 in LAN B, access a file server which is not allowed traffic to the open internet at 192.168.20.11 (LAN B) etc as if both networks where directl??y connected, instead of separated by the whole Internet. In fact the connection between the two networks is encrypted and thus
deemed private.
This is the most common scenario that you find documented for VPN enabled routers, followed by the road-warrior setup (you use VPN in order to allow a laptop using an insecure LAN connect to your office in Berlin and access resources in LAN A as if the laptop was in Berlin's office).
Neither do I need security, the remote system has no personal
information on it at all, the only data to be stolen is temperatures, voltages and other measurements on my boat.
Chris Green <cl@isbd.net> wrote:
Neither do I need security, the remote system has no personal
information on it at all, the only data to be stolen is temperatures, voltages and other measurements on my boat.
You do need security, to prevent it from being taken over by a
botnet/hacker and getting you banned from the network.
Also if you have a
vpn connection, it's effectively on your home lan.
The idea is that you have an office in Berlin with LAN A, and an office in Washington with LAN B. You configure your routers to establish a virtual private network between them so both LANS are merged (sort of).
ie:
LAN A has subnet 192.168.10.0/
LAN B has 192.168.20.0/
Chris Green <cl@isbd.net> wrote:
OP here - I'm in the UK but the system this is for will be in France.
So digging out specialist providers and such is one level more
difficult than doing it 'at home'.
Just a thought, but have you considered using SMS to ask the remote end to initiate the connection?
I don't know the best framework for handling the SMS side, but
at the least something polling it with AT commands would do.
I guess that's part of my issue with all this. I don't need speed,
all I need is something fast enough to handle interactive terminal
usage. Neither do I need security, the remote system has no personal >information on it at all, the only data to be stolen is temperatures, >voltages and other measurements on my boat.
All I need is a reliable piece of wet string between me and the SBC on
the boat. :-)
... apparently 192.168.178.0 is a popular choice ...
The Natural Philosopher wrote to Joe <=-
> It's a common requirement, and the magic codeword is 'M2M' (machine to
> machine). You'll probably need to go to a specialist SIM provider, the
> average high-street phone shop salesman won't have a clue what you're
> talking about.
TNP> That I did NOT know. That simplifies everything
We have a handful of T-Mobile 4G hotspots, and that service is
$5/month, if memory serves. It's a great deal for what possibilities
it opens up.
A. Dumas <alexandre@dumas.fr.invalid> wrote:
Chris Green <cl@isbd.net> wrote:
Neither do I need security, the remote system has no personal
information on it at all, the only data to be stolen is temperatures,
voltages and other measurements on my boat.
You do need security, to prevent it from being taken over by a
botnet/hacker and getting you banned from the network.
To prevent what "from being taken over by a botnet/hacker"? If they
break into my boat and have access to the computer there then there's absolutely nothing that using a VPN will prevent.
Richard Falken wrote:
followed by the road-warrior setup
There is a third common useage, the one I use frequently:
I VPN to the universtity library and go to a publisher's website. The publisher sees my university IP-address and recognizes me as authorized
to access his content.
It is this that allows me to work from home.
followed by the road-warrior setup
Richard Falken wrote:
followed by the road-warrior setup
There is a third common useage, the one I use frequently:
I VPN to the universtity library and go to a publisher's website. The publisher sees my university IP-address and recognizes me as authorized
to access his content.
On 29-12-2020 13:37, Axel Berger wrote:
Richard Falken wrote:
followed by the road-warrior setup
There is a third common useage, the one I use frequently:
I VPN to the universtity library and go to a publisher's website. The
publisher sees my university IP-address and recognizes me as authorized
to access his content.
It is this that allows me to work from home.
This is ~exactly how the general public now knows "vpn": to pretend to
be from a different country and circumvent geoblocks on content. Unfortunately, but perhaps inherently, these are often dodgy services.
I do not know what was mentioned regarding OpenVPN setup, but it took me a while to understand how it works. I choose certificate based
authentication. So I had to create and deploy certificates for and to the clients I use. This way the client can connect without providing password.
I do that by using a simple proxy setup, one-liner ssh command,
configure Firefox to use the proxy and it's done.
If a router 'supports VPN' what does that actually mean?
Presumably it doesn't mean that the router runs as a VPN server, or
does it?
If my router supports VPN (which it does, a Draytek 2860N) and I
enable it what else needs to happen to make it useful? ... and what
does my LAN behind the router look like, is it *all* on the VPN by
default or what? ... and how do I connect a remote system to the VPN?
Richard Falken <nospam.Richard.Falken@f1.n770.z6212.fidonet.org>
wrote:
The idea is that you have an office in Berlin with LAN A, and an
office in Washington with LAN B. You configure your routers to
establish a virtual private network between them so both LANS are
merged (sort of).
ie:
LAN A has subnet 192.168.10.0/
LAN B has 192.168.20.0/
Yes, and this is a nice gotcha if you want to connect two networks
behind the same type of modem/from one isp; they are bound to use the
same subnet, just their default settings; so the vpn connection won't
work. I had this once on different modems/isp's; apparently
192.168.178.0 is a popular choice. Solution is to give one of them a different subnet.
Kees Nuyt wrote to Deloptes <=-
Nowadays it's easy to set up a VPN server with
PiVPN <https://pivpn.io/>
Axel Berger wrote to Chris Green <=-
Chris Green wrote:
I do that by using a simple proxy setup, one-liner ssh command,
configure Firefox to use the proxy and it's done.
It's me, there's a lot I don't know about networks, but I do not understand that sentence at all, not one little bit.
Kees Nuyt wrote to Deloptes <=-
Nowadays it's easy to set up a VPN server with
PiVPN <https://pivpn.io/>
Many appliance routers can run DD-WRT or OpenWRT, and it can act as a
OpenVPN client or server. I'm about to order a Pi, though, and PiVPN
looks like a nice tool to use instead - and to get familiar with the
Pi.
The one thing I've been trying to figure out is how to use OpenVPN to
route selected traffic through a local node but route the rest over
the internet. Netflix doesn't like VPNs, and I want to be able to get
local TV stations outside of my area with an app that limits
available channels to your local area. I'm hoping it's easier to set
up than with DD-WRT.
Axel Berger wrote to Chris Green <=-
Chris Green wrote:
I do that by using a simple proxy setup, one-liner ssh command,
configure Firefox to use the proxy and it's done.
It's me, there's a lot I don't know about networks, but I do not understand that sentence at all, not one little bit.
The SSH protocol allows for port forwarding, which allows network
traffic to be routed over it. Connect via SSH to one of the machines
in your university, configure SSH port forwarding, and with a little
work all web traffic will go over the ssh tunnel to your university
and appear to come from your university instead of your home.
It's a little deep to try and explain off the top of my head, there
are a lot of tutorials on the web that'll explain it better than I
can.
Connect via SSH to one of the machines
in your university, configure SSH port forwarding, and with a little
work all web traffic will go over the ssh tunnel to your university
and appear to come from your university instead of your home.
| Sysop: | Rempala |
|---|---|
| Location: | Richlands, NC |
| Users: | 106 |
| Nodes: | 10 (0 / 10) |
| Uptime: | 40:28:56 |
| Calls: | 205 |
| Files: | 6 |
| Messages: | 111,121 |