Setting up a vpn

[#1]

Hi folks,

I've recently started working a lot from home and decided that I ought to invest in a NAS drive for storage. It would be absolutely fantastic to be able to access this NAS remotely (via Windows explorer not a Web client/3rd party client due to software needing to find files). This has led me to the idea that I could set up a home vpn. I also don't wish to subscribe to a vpn service as I'm not trying to hide my Internet usage, etc. I just want to access the home network from elsewhere, directly.

I have the plusnet hub one router and my understanding is that this doesn't support VPN/isn't a vpn server.

Would I be able to set up a vpn if I purchased something like the tplink safestream r600 and plugged that into the router?

I'm reasonably amateur at networking but am willing to learn.

Many thanks in advance,
Chris.

[#2]

Hi Chris,

What you are asking is totally possible but there are multiple layers to get your head around doing this.

• Firstly, a NAS drive is ideal for home network storage. Do it, it's a worthwhile investment.
• If you wanted to browse your NAS from remote, you can do this WITHOUT a VPN by port forwarding however it is considered not secure to expose SMB to the public web so certainly don't do that.
• You can create a VPN server on a device within your network (Raspberry Pi for example or even replace the router if it supports it). This would then give full access to your home network HOWEVER you will struggle to get network discovery working as you'd be in 2 different broadcast domains.
• You can easily browse to your NAS if you set up a DNS record or memorise the IP address and you would get the kind of access you want.

A working example would be similar to my own setup, I use an L2TP/IPSEC connection back to my router, once connected to my VPN I get an IP address 10.254.254.X and I can browse to my file server on 10.10.10.X.

Whether this would suffice is another matter though as SMB share performance depends on both your internet connection speed AND is intolerant to higher and variable latency. It is enough to be able to access files and yes you could pull music files off but I wouldn't expect to be "quickly" be able to pull and push movies about.

[#3]

Thanks for the reply Steve, very insightful. I wouldn't mind replacing the router - but do plusnet allow it? I have heard some ISP's require their own brand router to access the internet.

Not being familiar with the raspberry pi/coding, I'd rather not go down the "custom build" route if at all possible. Ideally I'd just like to purchase a "box" that I can plug in, set up and forget.

Is this possible?

Many thanks,

Chris

[#4]

Hi @macker202,

You are welcome to connect a 3rd party router and you can find all the connection details that you'll need here. Although you can use your own router, we are unable to provide support for it but you will usually be able to find any information you need on the manufactures website or in the forums.

Along side the above, always make sure the router you purchase is compatible with your broadband product. If the connection is ADSL, I would recommend an ADSL2+ router and if the service is fibre, a VDSL2 router.

Thank you.

[#5 · Accepted solution]

Hi @macker202 ,

If you would prefer to stay "hands off" then I'd suggest a router made my Draytek. It'll out perform the standard offering in many ways and also has VPN server functionality built in to most. As PN staff have already confirmed using a 3rd party router is fine but they have diminished diagnostics, you can always keep the PN hub in a cupboard to connect up should a fault occur (although I've not needed to do that in the year or so I've been with them).

[#6]

That's fantastic advice both. Thank you very much.

Chris

[#7]

@macker202 A couple of follow ups.

1) I use a Draytek 2860 with Plusnet. It provides the VPN functionality you want very well.

2) Some of the NAS suppliers have a service to allow remote access without a VPN. This generally works by them hosting a server and providing a client that accesses their server. Your NAS also connects to their server and the connection goes via 3 hops. This is simple but personally I didn't like remote access to my stuff from their server.

3) Having tried Buffalo and WD NAS products I recommend the Synology range.

Synology have their remote access service https://www.synology.com/en-uk/knowledgebase/DSM/tutorial/Network/How_to_make_Synology_NAS_accessibl... 

4) There are other cheaper NAS solutions but I like the Synology as the hardware has sufficient power to be reasonably responsive even with their cheapest hardware. If you think you might want redundant disks then buy a two drive box but you can start with a single disk.

[#8]

Hi,

We are trying to do the same at our heritage railway.  I have a new PC (EPOS server)  and many other PC that I would like 
to offer remote connects via VPN.  We have  a Draytek 2860 ADSL router & a non-static IP address from Plusnet

Is there a way of advertising the  VPN with a service name such that when Plusnet changes the IP address we will still connect?  Is this VPN  service be registered on the Plusnet DNS server.

A static IP would be ideal and if this is not possible  then we will have to have one.

This is the first time I have setup a VPN so as much help as possible is needed.

JohnP

[#9]

@JohnP2,

I can't offer you any advice on setting up a VPN (I'll leave that to the helpful community), but I can confirm you are able to have a static IP on your account. 

Business customers receive single, and blocks, of IPs for free as part of their packages. Residential accounts can add single static IPs on in the member centre, click on the broadband tab and then configure static IP. Residential customers get charged a one off fee of £5 to add a static IP and it will be assigned immediately - make sure to reboot your router once adding to make sure the IP gets assigned correctly. 

[#10]

@JohnP2 

The one off £5 charge for a static IP address with Plusnet is one of the best things about the service.

Alternatively, see this on the Draytek website:

https://www.draytek.co.uk/information/our-technology/draytek-ddns-service

If anything financial is involved be EXTREMELY careful with allowing VPN access. You need to be certain who is connecting.

https://www.draytek.co.uk/information/our-technology/vpn-overview

for an overview of VPNs.

You may also want to segregate your network.

If I correctly understand what you are trying to do, in my view you are in the realms of needing professional IT support to secure and configure the system.

[#11]

Mark,

Thank you for your comments and advice.
I looks like a accessing the  VPN via rDNS is going to be complicated.   I will go for a static IP address.

The VPN  is for selected volunteers who support the  EPOS systems old and new also not forgetting my self support
all our PCs and systems.  I will be using long service certificates for more security.

JohnP

[#12]

@JohnP2 

At the very least you can keep an eye on the VPN graph.

If you create an account for each person and log everything you can see what is happening.

The logs can also be emailed.

With some care it is possible to create fairly secure systems with the Draytek.