Setting up VPN server (router?) for offsite access

[gdgross]

Hi all, found this forum, seems helpful to newbs like me - I'm a semi tech-y fellow here but not much in the way of IT things, although I'm learning.

I'd like to set up a way to access and log into my mac-mini, which is at home, from anywhere on the internet. Currently I can do this via the splashtop app, but for various reasons, I would like to set up my own system. I understand that this will require creating a VPN server for my LAN, and maybe some additional hardware purchases. (specifically a dedicated VPN router, which i understand is a specific piece of hardware, that may or may not house a vpn server?)

I'd like to be able to log in from a windows machine on a different wired network miles away from the mac mini and its LAN, using sonic wall or the windows built in VPN client, and control the mac mini via microsoft remote desktop, or similar software. I'd also like to be able to log in from my macbook pro laptop, using the same or similar tools from any old wireless network at starbucks or wherever.

My current home network looks like this (not counting a few additional wifi nodes that aren't shown for clarity)

As I understand it, hardware wise, I will need to do something like this:

First, is my understanding of the hardware correct?

Second, I will need to set up a VPN server, yes? Is this something that lives on the VPN router? Or can it be installed on either NAS (QNAP-TS453) or the mac mini itself?

Third, what steps will I need to go through to set this up properly? I assume the VPN router will have some software that i'll need to configure once I connect it all, or maybe it's just a webpage I can connect to and configure. I believe I'll also need an ip or domain or something for the VPN, and a name for the mac mini itself to connect remotely?

Thanks for your help all - I'm slowly becoming IT fluent lol.

Geoff

 

[degrub]

Which device is providing IP addresses for your local LAN and Wifi clients ?

Search QNAP for a VPN server as a start

See what the issues are for connecting to that VPN server through the WAN (from outside) with a Macbook and a Windows device.

 

[gdgross]

Which device is providing IP addresses for your local LAN and Wifi clients ?

Search QNAP for a VPN server as a start

See what the issues are for connecting to that VPN server through the WAN (from outside) with a Macbook and a Windows device.

TBH, I'm not sure who's providing the IP addresses for my local LAN? maybe the are all DHCP? How would i find this out?

I'll do some searching for using the QNAP - not opposed to additional HW if it makes it easier for me though.

 

[ColinTaylor]

TBH, I'm not sure who's providing the IP addresses for my local LAN? maybe the are all DHCP? How would i find this out?

I'm assuming that your "Velop Wifi Node" is also a router and is providing DHCP for your entire LAN.

I'll do some searching for using the QNAP - not opposed to additional HW if it makes it easier for me though.

You don't necessarily need to have a VPN router. It may be convenient to replace your current router with another on the has a built-in VPN server. You'd typically do this if you don't have any other reliable always-on server on your LAN that could run a VPN server. The QNAP NAS is the most obvious candidate for running a VPN server. You generally don't want to add another (VPN) router in front of an existing router because it creates a double-NAT situation which brings it's own problems.

 

[gdgross]

I'm assuming that your "Velop Wifi Node" is also a router and is providing DHCP for your entire LAN.


You don't necessarily need to have a VPN router. It may be convenient to replace your current router with another on the has a built-in VPN server. You'd typically do this if you don't have any other reliable always-on server on your LAN that could run a VPN server. The QNAP NAS is the most obvious candidate for running a VPN server. You generally don't want to add another (VPN) router in front of an existing router because it creates a double-NAT situation which brings it's own problems.

Ok, thanks Colin - yeah the Velop is a wifi router, and since it's first in the chain, does that mean it's the one that's distributing out the internal IPs?

Thanks for that explanation too. I don't have a dedicated router device currently, (at least in hardware), so I assume something on my network must be doing that job without my knowing it, then? (the velop since it's the most "upstream device?)

TBH, I want the easiest way to do this; I don't particularly mind if it's on the QNAP, if it's on an additional piece of hardware, and the qnap just lives on the network without being a VPN server itself. (unless the additional HW is $$$$, then maybe it's worth the effort to figure out how to set up the VPN server on the QNAP.) Although if I did install it on the QNAP, I'm assuming I'd want to reconfigure the physical networkto make the QNAP the most upstream device, so everything behind it is on the VPN?)

I do have an expressvpn service running on a couple machines individually, but not the network, so I could use that account whichever route I go.

Sorry if these questions are basic!

THanks

 

[sfx2000]

Sounds like a great thing for Tailscale or ZeroTier...

 

[ColinTaylor]

Although if I did install it on the QNAP, I'm assuming I'd want to reconfigure the physical network to make the QNAP the most upstream device, so everything behind it is on the VPN?)

No, that's not how it works. Usually you'd just need to forward the VPN port from the Velop to the QNAP's VPN server. Check the QNAP documentation to see if it supports a VPN server as that is likely going to be the easiest solution.

What about the Mac mini, is that always-on? If so you could use that to host your VPN server instead of the QNAP.

I do have an expressvpn service running on a couple machines individually, but not the network, so I could use that account whichever route I go.

This is not the same thing. ExpressVPN is a commercial VPN service whereby your clients connect to their VPN server in an attempt to obfuscate your internet activity. What you are asking for is to run your own VPN server on your LAN so that you can connect to your home network remotely. Totally different.

 

[Piotrek]

to obfuscate your internet activity

Not so much to obfuscate as to transfer internet activity from ISP to VPN company

 

[gdgross]

What about the Mac mini, is that always-on? If so you could use that to host your VPN server instead of the QNAP.

Yeah, I'd be happy to set up on the mini, I just didn't realize that was a possibility. It's always on, yes. Any guides out there on how to do this?

This is not the same thing. ExpressVPN is a commercial VPN service whereby your clients connect to their VPN server in an attempt to obfuscate your internet activity. What you are asking for is to run your own VPN server on your LAN so that you can connect to your home network remotely. Totally different.

Gotcha on the diff, thx for clearing that up.

 

[Piotrek]

Any guides out there on how to do this?

How to set up a VPN server on QNAP NAS behind the router?

Applicable Products QVPN Procedure Follow these steps to set up a VPN server on a QNAP NAS behind a router. Install QVPN service ...

www.qnap.com

 

[gdgross]

How to set up a VPN server on QNAP NAS behind the router?

Applicable Products QVPN Procedure Follow these steps to set up a VPN server on a QNAP NAS behind a router. Install QVPN service ...

www.qnap.com

well thanks for doing my research for me

I'll take a look through that guide

 

[gdgross]

well thanks for doing my research for me

I'll take a look through that guide

The article is helpful, but it doesn't address a couple of questions that come up when setting up the VPN server in QVPN app on the NAS OS.
I'm trying to set up a wireguard VPN server, and there are a few things I don't know. (wireguard is the protocol of how it works I assume?)

1. Servername: can this be anything I like?
2. DNS server? It's blank by default and doesn't seem to require an entry.

Thanks

 

[Piotrek]

1. Servername: can this be anything I like?

Yes. Valid characters: A–Z, a–z, 0–9, Valid special characters: Hyphen (-)

2. DNS server? It's blank by default and doesn't seem to require an entry.

DNS for VPN client eg. 1.1.1.2 or 9.9.9.9 or other.

How to Configure WireGuard VPN Server and Client Settings in QVPN Service 3

How to Configure WireGuard VPN Server and Client Settings in QVPN Service 3 WireGuard Enabling a WireGua ...

www.qnap.com

Quick Start - WireGuard

www.wireguard.com

 

[gdgross]

Thanks Peter. I'll wade through those and see if I can get it set up. The video seems particualrly helpful.