Can IPTVs use a VPN

[Andrew911tt]

I have a developer in Japan who I have sent a US based TV. When He tries to access any on the Applications it says that he has to be in the US for the applications to work.

Our idea is to set up a VPN. We would get 2 Cisco RVL200 or RV042 or something similar and set them up as client and server. We would then send one to Japan.

I want to make sure that this will work with out a computer being the client device.

Any ideas would be appreciated

Andrew

 

[sk1939]

If it's just for the applications, it might work, but the TV might still see that it is in Japan through OTA signals (unsure) or via whatever the ISP tells it. I have no experience at all with these TV's, but from a technical perspective, a VPN could work, but you would have to channel all traffic through it, and it would probably be slow with high latency.

 

[thiggins]

VPNs are used all the time for this. Main issue is how much throughput you need. See these reviews:
AccessMyLan Reviewed
VyprVPN Reviewed
Private WiFi Reviewed
HotSpotVPN Reviewed

 

[Andrew911tt]

If it's just for the applications, it might work, but the TV might still see that it is in Japan through OTA signals (unsure) or via whatever the ISP tells it. I have no experience at all with these TV's, but from a technical perspective, a VPN could work, but you would have to channel all traffic through it, and it would probably be slow with high latency.

The TVs internal tuner will not be connected to anything so that is not a problem.

I brought up this question because in the review of the RVL200 it is stated that

allow the installation of the Virtual Passage ActiveX applet, and I was connected!

so with this being a TV and not a computer I just want to make sure that this will not cause a problem

Andrew

 

[sk1939]

I see no technical issues with it, so I would give it a shot. Like I said though, make sure you have enough throughput to handle the traffic, a 5 down 2 up connection won't cut it.

 

[Andrew911tt]

Is there a recommendation for which router you would use?

 

[sk1939]

For a TRUE router, I would recommend a Cisco 1941 or 29XX, or a Juniper J2320; but that is way beyond what you are looking for both in cost, configuration difficulty, and features. What you are call a router is really called a residential gateway or home router, rather than a true router.

Back on topic:

If it were me I would get a Juniper SSG5 or better (or Cisco ASA 5505 [if you know IOS] or better) if you can afford it. The RV-082 would be perfect for your remote user, but I would not use it for your office. The RV-042 might also work, but it is limited (21 mbps at best) for VPN throughput.

The best situation would be to deploy a SSG5 for your office, this way you have the capability to support not only your overseas user, but also anyone who could currently benefit now, or in the future, from VPN access. The RV-042/82 would be perfect for end user's but I don't trust their reliability in an office environment at all. The SSG5 would be very important if it's your primary firewall/router for an office of more than 10 people, because if they're net-intensive then the RV's would probably not be able to handle the traffic.

Note that the SSG5 has a much better reliability for a business than the RV's would, especially given that they have in my experience, tended to be quite unstable for VPN connections, especially site-to-site 24/7 like your doing. Also, AVOID the CISCO SA520/540 for Site-to-Site VPN!

Also as a side note, the firewall in the SSG also provides built in Anti-Virus if you buy the license, and is quite decent. It also supports IPv6 which may become quite important in Japan, as they are very likely to transition over within the next year or two.

The consultant in me would say get something like a Juniper SSG20 for the main office, and Juniper SSG5 for your remote user as it would be the most stable (multi-vendor solutions for VPN tend to be quite a hassle as all the syntax/features are different). However, if you don't have $1600 to spend on VPN/Firewall/Routing equipment, then I would say at the very least get the SSG5 for your main office, and an RV-082 or Netgear's FVS336G-200NAS, or UTM5EW-100NAS. The Netgear's are both gigabit, do Site-To-Site, and the later has built in Anti-Virus/Intrusion protection for the LAN side of the network for a year.


Now to the prices:

Juniper SSG5 - $630
Juniper SSG20 - $950
Cisco ASA 5505 Security Plus (ONLY IF YOU HAVE A CCNA or HIGHER) - $530
Cisco Linksys RV-082 ( Get the latest version!) - $370
Netgear FVS336G-200NAS - $235
Netgear UTM5EW-100NAS - $369

 

[Andrew911tt]

I was just told that I have to have a router that does "split tunneling" to do what I want is this correct?

Does the RV042 do this?

 

[sk1939]

Split tunneling allows a remote VPN user to access a public network, most commonly the Internet, at the same time that the user is allowed to access resources on the VPN. This method of network access enables the user to access remote devices, such as a networked printer, at the same time as accessing the public network. If network security is a concern, I would not recommend using split tunneling.

You might be able to achieve the same effect by just creating a VPN link that point directly to the public network or a proxy server if you don't care about said user accessing the private network.


Couple things to note with split tunneling. Realize that split tunneling renders the VPN vulnerable to attack as it is accessible through the public, non-secure network. When split tunneling is enabled, users bypass gateway level security such as web or content filtering.
Separately, ISPs that implement DNS hijacking break name resolution of private addresses if you use a DNS server with split tunnels.

You might be able to use the RV 042, but it would be complicated to setup requiring static routes and such, and I'm not sure if it does it well. The RV082 for sure can do it. As I suggested though, if it's just for one user, then the RV082 or either of the Netgears would work. I would actually suggest the Netgear for your remote user, as if your remote user has over a 100 mbps connection, the RV082 will bottleneck it.

Also note that you CANNOT double NAT these devices, meaning you cannot put either end behind another router. Both of these devices would have to be at the edge (ie attached directly to the modem) for VPN and split tunneling to work correctly.