So what would be best practice for my specific situation: VPN into home network and DDNS

[vmachiel]

Hi,

So I’m just looking for what the best option is here. I’ve managed to setup a raspberry pi with pihole (proud of that). I bought a Synology Nas for backup and Plex (got that working as well). I use a Asus RT-AX86U router with the latest version of merlin.

So I’m looking for the best wat to get on my network when I’m on the go. This way my Pihole can help me and I can access my NAS/view plex. But I find so many options and I just don’t know what to do. What is the best practice? Lowest possibility to mess something up security wise? (Really scared to forget something and open up my whole home network.

So what should I do: -VPN on the raspberry Pi, or Nas OR on the router? - What kind of VPN to use? OpenVPN is possible on the router, I also read about wireguard and tailscale.. - DNS: how to handle DNS to my current dynamic IP? Use a DDNS provider (which one) or use something built into the router (That opens something with a certificate which is scary). I also have a domain parked at hover, can I use that somehow.

I’m not asking for step by step guides, just what options you all recommend. I’ll look up tutorials for those. If more details are needed please tell me, I’m really not that advanced..

Thanks!

 

[L&LD]

Welcome to the forums @vmachiel.

VPN on the router. Minimize your security weak points. OpenVPN will give you up to greater than 200Mbps on your router, provided the ISP you're currently connected to and your own ISP has those speeds or greater (download for your current location, upload from your ISP).

 

[RMerlin]

It depends. If you have a Synology with an Intel CPU, then use OpenVPN on the Synology, combined with Synology's own DDNS. Better performance than running OpenVPN on the router, very easy to setup, and it will make management fairly simple by having everything combined.

 

[drinkingbird]

It depends. If you have a Synology with an Intel CPU, then use OpenVPN on the Synology, combined with Synology's own DDNS. Better performance than running OpenVPN on the router, very easy to setup, and it will make management fairly simple by having everything combined.

Would running an IPSEC VPN server on the router take advantage of the hardware IPSEC? I guess even if it did, probably still not as good as an intel CPU.

 

[vmachiel]

Thanks for the replies!

It depends. If you have a Synology with an Intel CPU, then use OpenVPN on the Synology, combined with Synology's own DDNS. Better performance than running OpenVPN on the router, very easy to setup, and it will make management fairly simple by having everything combined.

No it has a R1600 from AMD. So does this change the equation towards to router in your opinion or no?

 

[Clark Griswald]

Without issues, I use OVPN/WG on my router, and have WG as a "backup" running on a RPi 4. Have been using NO-IP on router with comcrap, without any updating issues. I haven't considered using the 918+ for vpn/ddns, since everything has been working well.
Edit: I am running the current Plex beta.

 

[RMerlin]

No it has a R1600 from AMD.

Close enough. What I really meant is it needs to be an x86 CPU rather than an ARM CPU. I would use that instead of the router's weaker ARM CPU.

 

[RMerlin]

Would running an IPSEC VPN server on the router take advantage of the hardware IPSEC? I guess even if it did, probably still not as good as an intel CPU.

If the router has bcmspu support, yes. But it would probably still be slower than on an x86 CPU most likely, tho I have never compared them myself.

 

[vmachiel]

Without issues, I use OVPN/WG on my router, and have WG as a "backup" running on a RPi 4. Have been using NO-IP on router with comcrap, without any updating issues. I haven't considered using the 918+ for vpn/ddns, since everything has been working well.
Edit: I am running the current Plex beta.

So OpenVPN or Wireguard: which one should I go with and why?

 

[Clark Griswald]

OPVN v WG search is a better read compared to what I could state.
I use both. I used PiVPN WG prior to putting any vpn on router, so I Family was using wg initially. OVPN for Asus routers is Griswald easy to install, so what started as a vpn test, ended with both being used on the router, with PiVPN running as a "backup".
TESTING:
Installed both on Family's devices, and they had no preference and experienced zero issues, so we've kept both.

 

[Crimliar]

I would and do, have WireGuard set up on the router. My mobile uses CG-NAT and WireGuard punches through better than any other solution I've tried. OpenVPN and even InsantGuard usually work for me, just not always.

 

[vmachiel]

Thanks for the replies, I’ll look for guides on wireguard on the router.