Need advice on VPN routers

[pschmehl]

Total newbie here. Just registered. I'm a retired computer security guy (edu), and I never setup any kind of network like a lot of my peers did. No server racks in my house. No switches. No Cat5E in the walls. Nothing. I have the TWC router (an Arris DG1670A) and a 2.4 and 5 GHz wireless network.

Recently I've been researching getting one IP camera to watch my driveway. That has led me down numerous paths which finally led me here.

I think I want to hardwire my TV and Roku. I have a 200Mbps connection from TWC which tests out to that or slightly more on my Windows 10 PC (which is plugged in to the router) but my wireless connection is half of that for the 5GHz network (on my Mac laptop) and half again for the 2.4GHz network (TV, Roku, some other stuff).

Both my Roku and my TV are on the 2.4 GHZ network, so hardwiring them would provide an instant speed upgrade. (Streaming works fine now, but hardwiring it would be much better.) I can pull the wire and make up the switchplates, so that's not a problem. I have two open ports on my router, so I *could* use one for the TV and Roku (with a splitter) and one for the camera.

But, if I get the camera, I want remote access, so that means setting up VPN. I could do that on my Windows 10 box, but I'm a retired computer security guy, so no.

Since I'm retired, I don't want to dump a ton of money buying all sorts of equipment and building out a huge network that I'll seldom ever use. IF I get the camera, I'll use a PoE injector for that rather than buying a switch.

I'm old and lazy and have a ton of other interests to keep me occupied, so I don't want to buy and build out unix boxes to do all this stuff and then have to maintain them. I already manage five different internet FreeBSD servers (websites and mail servers), so I have no interest in doing more. I'd prefer something that was set and forget as much as possible.

All I really need is VPN and perhaps a few more ports in case I come up with another crazy idea. Right now my Windows box and printer are plugged in to the Arris, so I only have two ports left.

There are some relatively inexpensive gig routers with VPN on Amazon. Here's some I've put on my wish list (I use it like a bookmark - I delete them once I've eliminated ones I don't want.)

TP-Link TL-R600VPN Gigabit Broadband VPN Router
Netgear ProSafe FVS318G 8-Port Gigabit VPN Firewall
Cisco RVL200 4-Port SSL/IPsec VPN Router
Linksys LRT214 Gigabit VPN Router
Cisco Systems 5-Port Gigabit VPN Router (RV130K9NA)
D-Link 8-Port Gigabit VPN Router

My question for you old pros at this is, which of them seems to be the most reliable? Would you recommend something else entirely?

 

[sfx2000]

But, if I get the camera, I want remote access, so that means setting up VPN. I could do that on my Windows 10 box, but I'm a retired computer security guy, so no.

Might not need a VPN - just find a camera vendor that has a reasonably secure implementation (Panasonic is good for this), and port forward it... Secure IP based cams do exist, just do a bit of research - the cheap ones generally are not.

Security is best when it is kept simple...

 

[pschmehl]

True that. I'll keep looking.

 

[System Error Message]

VPN is still useful but "VPN" routers are actually archaic platforms that do not support the most recent features or have the most outdated hardware. All the routers you listed are terrible.

Here is a checklist you have to go through before getting one.
Your WAN speeds with their setup (such as using PPPOE, vlan).
VPN speeds and type you want.
Features you want.

For example asus routers support more vpn types than what these vpn routers offer. mikrotik CCRs and x86 have WAN and VPN speeds better than any "VPN router" without needing to rely on hardware acceleration, only hardware encryption and support more vpn types and configs. Each CCR core does 300Mb/s of PPTP, each x86 core does way more depending on the CPU.

 

[pschmehl]

I don't really need another wireless router, but OTOH, I wouldn't object to getting one if it's not too high priced. Do the new 802.11ac routers still have the 2.4GHz band? I have to have that for some of my older devices.

 

[sfx2000]

Do the new 802.11ac routers still have the 2.4GHz band?

Most consumer grade, and many SME oriented products do offer 2.4GHz - the main site has a wealth of more focused info and reviews there on various product...

 

[pschmehl]

This is a bit of overkill, but the price is right and it has the bonus of a PoE port. Mikrotik RB2011iLS-IN 10 Ehternet Ports RouterBoard

I'd have to familiarize myself with OpenVPN, but I don't think that would be a problem.

Thanks for the tip.

 

[System Error Message]

This is a bit of overkill, but the price is right and it has the bonus of a PoE port. Mikrotik RB2011iLS-IN 10 Ehternet Ports RouterBoard

I'd have to familiarize myself with OpenVPN, but I don't think that would be a problem.

Thanks for the tip.

bad cpu for VPN. MIPS perform poorly with it. If you do want POE consider the RB3011 instead as it has a decent dual core ARM with a single POE in and POE out port.

go to routerboard.com, look at the CPU details of it. The architecture, clock and core count are important. There are also datasheets.

If you want to use vpn than look at the RB1100AHx2, RB3011 and CCR series for mikrotik. Many consumer routers also do use dual core ARMs but the qualcomm based ARM is better than broadcom.

 

[pschmehl]

Those are getting kind of rich for my blood. Remember, I only need one VPN tunnel. Nobody but me will ever use it.

 

[System Error Message]

Those are getting kind of rich for my blood. Remember, I only need one VPN tunnel. Nobody but me will ever use it.

The speed at which the router will do the tunnel is important. MIPS will only do a few Mb/s of openVPN.

 

[pschmehl]

After tons of reading and research, I've decided to setup the built in PPTP VPN in my Windows 10 box IF I get the camera, and limit access to the camera's IP address. Thanks to @sfx2000 for reminding me to KISS. I changed the password to my 5GHz wireless network, which is running at 100 Mbps, and got both my TV and Roku working on that network, so I no longer feel motivated to hardwire those. 100 Mbps should be more than enough to stream videos.

I understand that some may think this is stupid or inadequate, but it's probably sufficient for what I need and saves me money. The only reason I would ever use VPN is when I was away from home and only to look at the camera. The camera has built in security (not very good) and PPTP is adequate, so with IP restrictions, my risk is limited to someone breaking in to the VPN, guessing the password for the camera and then viewing hours and hours of footage of my empty driveway and cars passing by in the alley. Not exactly a situation that requires world class security.

If I ever decide to get a better setup, I'll probably get something off of eBay. They've got enterprise firewall/vpn appliances for as little as $10. Yeah, not the latest and greatest, but more than sufficient for what I would need.

Thanks for all your input and help. You helped me to clarify my needs and diminish my lust for getting something new and bright and shiny.

 

[Samir]

VPN is still useful but "VPN" routers are actually archaic platforms that do not support the most recent features or have the most outdated hardware. All the routers you listed are terrible.

I think 'terrible' is a bit of an extreme opinion. Many of the units listed will work perfectly fine for the OP and the relatively simple task of watching the camera.

The main problem with VPN routers is how to 'dial in'? Some platforms have incompatibilities that may be an issue depending on what you're using to access the vpn. So that being said, what is the vpn client going to be? Phone? tablet? computer? And accessed from where? public networks? hotspots?

 

[Samir]

Here's a unit that's perfectly capable and even is multi-wan to boot in CDWs outlet:
https://www.cdw.com/shop/products/CISCO-RV042G-DUAL-GIGABIT-WAN-VPN-B/4287170.aspx?pfm=srh

 

[pschmehl]

I think 'terrible' is a bit of an extreme opinion. Many of the units listed will work perfectly fine for the OP and the relatively simple task of watching the camera.

The main problem with VPN routers is how to 'dial in'? Some platforms have incompatibilities that may be an issue depending on what you're using to access the vpn. So that being said, what is the vpn client going to be? Phone? tablet? computer? And accessed from where? public networks? hotspots?

Thanks.

iPhone 6 and/or Mac Powerbook (El Capitan), both of which can do PPTP, L2TP, IPSec and IKE. So there should not be a problem connecting to any reasonably standards compliant VPN device.

 

[Samir]

After tons of reading and research, I've decided to setup the built in PPTP VPN in my Windows 10 box IF I get the camera, and limit access to the camera's IP address. Thanks to @sfx2000 for reminding me to KISS. I changed the password to my 5GHz wireless network, which is running at 100 Mbps, and got both my TV and Roku working on that network, so I no longer feel motivated to hardwire those. 100 Mbps should be more than enough to stream videos.

I understand that some may think this is stupid or inadequate, but it's probably sufficient for what I need and saves me money. The only reason I would ever use VPN is when I was away from home and only to look at the camera. The camera has built in security (not very good) and PPTP is adequate, so with IP restrictions, my risk is limited to someone breaking in to the VPN, guessing the password for the camera and then viewing hours and hours of footage of my empty driveway and cars passing by in the alley. Not exactly a situation that requires world class security.

If I ever decide to get a better setup, I'll probably get something off of eBay. They've got enterprise firewall/vpn appliances for as little as $10. Yeah, not the latest and greatest, but more than sufficient for what I would need.

Thanks for all your input and help. You helped me to clarify my needs and diminish my lust for getting something new and bright and shiny.

I missed this post. Glad you found a cheap and easy way to do what you wanted. And with all the layers involved, that's a lot of guessing someone would have to do to get to see some mundane footage.

 

[Samir]

Thanks.

iPhone 6 and/or Mac Powerbook (El Capitan), both of which can do PPTP, L2TP, IPSec and IKE. So there should not be a problem connecting to any reasonably standards compliant VPN device.

'Should' is the appropriate word. A lot of times the theoretical doesn't work in practice, for whatever reason. I think you've found the best solution with using what you already got.

 

[RMerlin]

If you are going to keep a machine running to host the VPN server, I would recommend looking at something else than PPTP, since PPTP is considered to be crypto-cracked for a few years now.

I assume your VPN needs involves mostly accessing your cameras remotely. You don't need 200 Mbps of routing performance for this, look for an ARM-based home router that has either built-in OpenVPN or which can run Tomato/DD-WRT. A Netgear R7000 or an Asus RT-AC68U should give you around 50 Mbps of OpenVPN throughput - plenty sufficient for camera monitoring (which would be capped by your upstream performance anyway, not your downstream).

I would also recommend separating the switch from the router. Go with the basic 4 ports router, and rely on a switch for additional ports. They tend to be more reliable, easier to start with an 8-port if you intend to expand, and you can get a managed one at a very reasonable price these days, if you ever intended to play with VLANs.

 

[RMerlin]

Thanks.

iPhone 6 and/or Mac Powerbook (El Capitan), both of which can do PPTP, L2TP, IPSec and IKE. So there should not be a problem connecting to any reasonably standards compliant VPN device.

Apple is removing PPTP support with iOS 10 (and with the next MacOS iteration as well I believe).

 

[sfx2000]

Apple is removing PPTP support with iOS 10 (and with the next MacOS iteration as well I believe).

Confirmed on both - Apple is going away from PPTP...

(which is a good thing, honestly, both the auth and encryption vectors there are so very broken these days on all platforms)

 

[pschmehl]

I found an open source vpn server that runs on Windows and does IPSec and L2TP. https://www.softether.org/

That should work fine for my needs. If I add more cameras in the future, I'll consider buying a purpose built device.