Network Advice Wireless Camera System

[Brenneke]

I have a new Arlo Pro 3 camera system that stores video on a USB drive connected to it's hub. I would like to access this drive remotely - the Arlo Android app does allow for this with recommended port forwarding.
Please give me your advice on whether this can be safe and how to best set up.
I have:
1) ISP router
2) Asus RT-N68U ethernet connected to ISP router
3) OVPN set up on Asus
4) Latest Merlin FW
5) YazFi

Thank you.

 

[L&LD]

Safely? Remove the Arlo app from your device.

Use OpenVPN to access your home network and the USB drive itself.

 

[Brenneke]

Safely? Remove the Arlo app from your device.

Use OpenVPN to access your home network and the USB drive itself.

Lol, OK! Please explain.

Can you please give me a quick overview of how I would set this up to accomplish? Would it be possible to do this with a phone?

 

[L&LD]

There are many threads that guide new users through OpenVPN. Please use the search for further details.

A simple overview;

• Create an OpenVPN Server on the router with defaults except for the following.
• Download the OpenVPN client configuration file.
• Import the above file into a VPN client.

At this point, you should be able to connect to your network and access the resources you need.

Depending on what your ISP connection is, your specific phone and firmware and your expectations of performance, this should be possible to one degree or another with almost anything that you may have.

Edit: Removed settings recommendations that were proved wrong by @ColinTaylor (see posts below).

 

[netware5]

Just an addition to the above @L&LD's post: Before moving to OpenVPN implementation check how you could access the video from within your LAN, but without using the Arlo app.. For example, does the USB drive accessible via some standard protocol like SMB, FTP, etc. I am not familiar with Arlo and don't know how they organised access to the video. I will be not surprised if they managed to force you to do this only via their app Some vendors have such bad habbit So if everything is OK and you are able to access video using some standard protocol from within you LAN, you may step forward with OpenVPN in order to do the same but from outside. The OpenVPN will just provide you with opportunity to act from outside the same way as when you are inside.

 

[Brenneke]

There are many threads that guide new users through OpenVPN. Please use the search for further details.

A simple overview;

• Create an OpenVPN Server on the router with defaults except for the following.
• Select Manage Client Specific Options to 'Yes'.
• Select Allow Client to Client to 'Yes'.
• Download the OpenVPN client configuration file.
• Import the above file into a VPN client.

At this point, you should be able to connect to your network and access the resources you need.

Depending on what your ISP connection is, your specific phone and firmware and your expectations of performance, this should be possible to one degree or another with almost anything that you may have.

L&LD, what security risk is the Arlo app?

As stated in OP, I am already set up with OpenVPN on router. Thank you for the additional OpenVPN configuration details but I do not have the knowledge to understand what you mean by "you should be able to connect to your network and access the resources you need".
How exactly would I connect and what would I use?
Would this be possible to do with a phone?
Please keep in mind that the USB drive I would like to connect to is on the Arlo hub, not sure it is readily accessible without their app. ?
Thank you.

 

[Brenneke]

Interesting that you both mention VPN, I would like to learn more about how that helps with connecting remotely to a drive on a network.
I posted a screenshot from the Arlo app - their wording makes it sound to me that port forwarding is not necessary if a VPN is used. Again, I do not have the knowledge to understand what they (and maybe you) mean but would really like to see it explained in simple terms.
Thank you.

 

[netware5]

Interesting that you both mention VPN, I would like to learn more about how that helps with connecting remotely to a drive on a network.
I posted a screenshot from the Arlo app - their wording makes it sound to me that port forwarding is not necessary if a VPN is used. Again, I do not have the knowledge to understand what they (and maybe you) mean but would really like to see it explained in simple terms.
Thank you.

VPN allows secure access to any LAN resources from outside like you are inside. Think about VPN as a hypotetical cable with one end plugged in LAN side of your router and other end plugged in you client device somewhere around the Globe. Many people here in this forum will tell you that they trust only to OpenVPN, i.e. they believe that the only port opened to the external world (Internet) shall be the port on which the OpenVPN server listens. Any other services opened to the external world are considered as insecure - HTTPS web interface, SSH, FTP, etc. So that mean port forwarding of the Arlo app shall be considered as severe security risk.

From the screenshot you posted I understood that Arlo provides you with two options when connecting from outside - to connect via VPN (more secure) or to connect directly (less secure) by forwarding the port on which Arlo service is listening, e.g. you open the door from your router's WAN side to the hubdevice where your USB disk is connected. If you install OpenVPN server you will be able to use your phone with Arlo app in the same way as if you are at home and connected to the internal LAN.

But many people here had bad security experince with such Android apps (the ASUS Android app designed to manage Asus routers is a good example). So real paranoid guys don't trust to such Android apps in general. So it would be better if you don't use the Arlo app at all. I don't know íf it is possible, because I don't know if even Arlo provides some standard file access service like SMB, FTP, etc. to the attached USB disk. If such service exists you may just delete Arlo app from yout phone and access the video files by relevant client. If such service does not exist you should keep your Arlo app and use it, but only if you are inside, or if outside - via VPN only. I any case the majority of people here will prefer not to use Arlo app at all, or in exceptional cases use it, but only from within the LAN.

 

[ColinTaylor]

• Create an OpenVPN Server on the router with defaults except for the following.
• Select Manage Client Specific Options to 'Yes'.
• Select Allow Client to Client to 'Yes'.

Why are you changing this setting? I can't see how this is relevant for accessing the cameras, or is this just a general-purpose recommendation?

 

[L&LD]

@ColinTaylor is there no need to change those settings if you want to connect to devices on the LAN?

 

[ColinTaylor]

@ColinTaylor is there no need to change those settings if you want to connect to devices on the LAN?

No, that option only effects whether or not two or more VPN clients connected to the same VPN server can talk to each other directly (without having to be routed to the router and back again). So "client" in this case is referring to a VPN client, not a client on the LAN.

 

[L&LD]

@ColinTaylor thank you. I've misunderstood that setting all this time.

 

[Maverickcdn]

@ColinTaylor thank you. I've misunderstood that setting all this time.

Makes two of us, I had my suspicions, although I cant say I ever did any testing to prove to myself it was the way we were thinking

 

[Brenneke]

OK - using OpenVPN is going to be more secure and most secure if I can find a way without their app.
Using the Arlo app is least secure if port forwarding but better if using VPN and no port forwarding, (?)
So, until I can determine if there is a way without the app, I will attempt to use it in the most secure way I can.
Can this be true that by using a VPN port forwarding is not required? And what should be on VPN...the router, mobile device that has the app or both? Am still having trouble with the idea that port forwarding is necessary, but if on VPN then forget about it!
This (I guess) is how the physical connection of components should be:
USB drive > Arlo hub > Asus router > ISP router
Will the ISP router present any problems?

Appreciate your time and patience, thank you.

 

[Samir]

So the reason port forwarding isn't needed with a vpn is because the vpn server is the router itself, so your device is connecting to the router itself. And once it does that, the device is literally like it is at home, so however you can see the camera at home is how you can see it even when you are away--no port forwarding or any other changes in settings.

 

[Brenneke]

So the reason port forwarding isn't needed with a vpn is because the vpn server is the router itself, so your device is connecting to the router itself. And once it does that, the device is literally like it is at home, so however you can see the camera at home is how you can see it even when you are away--no port forwarding or any other changes in settings.

I see, that is the part I missed.....SERVER. It is not enough just to be running VPN on router. That is what whooshed over my head in L&LD's first reply to me!
I will read and research how to set up and connect to my own VPN server - did I get it now?

Thank you.

 

[L&LD]

@Brenneke you're on the right track.

With this stuff, you need to roll your sleeves up, get your hands dirty and even fail a few times, but then it will become clear.

Set up an OpenVPN Server, import the file you download to the device you want to use it on (you may need to install another 'app' first) and then see if you are connected to your router. The next steps will come easier.

 

[Samir]

I see, that is the part I missed.....SERVER. It is not enough just to be running VPN on router. That is what whooshed over my head in L&LD's first reply to me!
I will read and research how to set up and connect to my own VPN server - did I get it now?

Thank you.

So that's actually not what I intended to mean, but it worked to get you on the right track, lol.

There's some routers that have the openvpn server built-in, so no other server needed--you connect to your router and then your local network is accessible via what ever you normally would if you were local.

 

[Brenneke]

Can you please let me know if it is going to be possible to run both OpenVPN server and client on same router?
Please point me in the right direction on how to make it so if yes.
Thank you.

 

[L&LD]

Yes, both can be used concurrently. Just make sure they are on different subnets and different ports.

What are your expectations for both running? Will you access your router to use the VPN, for example?