Should I setup a VPN server to access my IP Camera outside of the home network?

[FlexiPack]

I have a feeling this will be a resounding 'yes!' But, I wanted to check before I pursue this further as setting up a VPN server is new territory for me. If the answer to my question is yes, then my 2nd question is what's the best way for me to achieve it with a small budget and little know-how?

Relevant info:

My IP camera is a Floureon (cheap Chinese generic make). Currently I have it accessible outside of the home network via port forwarding on my BT homehub router. I chose a random 4 digit port, it's password protected. I'm aware that this still isn't secure but I'm not aware of what exactly the pitfalls are. I mean, if the worst that can happen is that someone can hijack my CCTV camera then all they'll see is a back garden but if they can use this to access other devices on the network then that's something I'd need to address.

Are there ways to make my current setup more secure or is it just papering over cracks? From my brief research into home vpn servers, I think the following options are viable for me (please correct me if I'm wrong):

Router with OpenVPN server built-in
NAS with OpenVPN Server Built-in
Raspberry Pi with PiVPN

With the router option, it would be used simply for the VPN server as I can't afford the fancier DSL ones. I was looking at something like the RT-N66U. So my IP cam would connect to the Asus via wifi, the Asus router would be connected to my BT homehub via ethernet. Not ideal, but I can't think of a better way to do it with a 2nd router.

Ideally, I would like go with the easiest setup and also the option that needs the least maintenance (this is my parents house and I live in a different area).

Thanks.

 

[Xentrk]

I have a feeling this will be a resounding 'yes!' But, I wanted to check before I pursue this further as setting up a VPN server is new territory for me. If the answer to my question is yes, then my 2nd question is what's the best way for me to achieve it with a small budget and little know-how?

Relevant info:

My IP camera is a Floureon (cheap Chinese generic make). Currently I have it accessible outside of the home network via port forwarding on my BT homehub router. I chose a random 4 digit port, it's password protected. I'm aware that this still isn't secure but I'm not aware of what exactly the pitfalls are. I mean, if the worst that can happen is that someone can hijack my CCTV camera then all they'll see is a back garden but if they can use this to access other devices on the network then that's something I'd need to address.

Are there ways to make my current setup more secure or is it just papering over cracks? From my brief research into home vpn servers, I think the following options are viable for me (please correct me if I'm wrong):

Router with OpenVPN server built-in
NAS with OpenVPN Server Built-in
Raspberry Pi with PiVPN

With the router option, it would be used simply for the VPN server as I can't afford the fancier DSL ones. I was looking at something like the RT-N66U. So my IP cam would connect to the Asus via wifi, the Asus router would be connected to my BT homehub via ethernet. Not ideal, but I can't think of a better way to do it with a 2nd router.

Ideally, I would like go with the easiest setup and also the option that needs the least maintenance (this is my parents house and I live in a different area).

Thanks.

You can see the steps involved in the OpenVPN server setup here:

https://x3mtek.com/openvpn-server-setup-instructions-for-asuswrt-merlin/

I recommend the VPN option. Once connected to the network via VPN, I just type the static IP address of the camera in a browser to access the logon menu to view videos.

 

[Fingers]

I would isolate it on a VLAN and block LAN access. When you include both words together "cheap chinese", you cant be sure who has access to the servers.

 

[FlexiPack]

I would isolate it on a VLAN and block LAN access. When you include both words together "cheap chinese", you cant be sure who has access to the servers.

I've just had a quick look as I didn't know what a VLAN was (still not 100% sure lol). If I am understanding it correctly, is it basically what I was thinking of doing with going with a 2nd router option? As in, having a separate address block for the 2nd router?

You can see the steps involved in the OpenVPN server setup here:

https://x3mtek.com/openvpn-server-setup-instructions-for-asuswrt-merlin/

I recommend the VPN option. Once connected to the network via VPN, I just type the static IP address of the camera in a browser to access the logon menu to view videos.

Thanks, that will come in handy if I go for an Asus.

 

[Fingers]

yeah sort of, you can just split into different subnets and isolate them so they cant talk to anything other than the servers for software updates ect.

 

[FlexiPack]

yeah sort of, you can just split into different subnets and isolate them so they cant talk to anything other than the servers for software updates ect.

If my IP cam was on a different subnet, would that make it inaccessible to other devices on the home network? in other words, would no one on the home network be able to view the camera?

I'm thinking of going for the 2nd router option. I just need to decide whether keep my BT Homehub as a router and have two wireless networks going (concerned about an extra network on an already crowded wifi spectrum around here) or just use the BT Homehub as a VDSL modem (if that's possible) and use this new router as my only router.