Geeky post - onboard internet routers ... and more

[Hurricane]

Following a thread from about a year ago, I thought I would write an update.

This was that thread:-
Remote Monitoring - Again.........
This thread not about a replacement for the RUT950 it is about securely connecting the boat's LAN to the home LAN,

In the above thread I found jake009's comments really interesting and challenging.
That thread discusses the Teltonica RUT950 4G router.
Initially, I was very disappointed in the RUT950's internal hardware.
In fact, I still am but I did give it a second go - rewound the firmware to the older version (v6 IIRC ) and it has been working well as a 4G router since.

But, that isn't the point of this discussion.
During that thread/conversation, jake009 commented on my downstream system.
I was using DDWRT routers to connect a secure data tunnel between the boat's LAN and my home LAN
I think jake009's comment at the time was "Thats a Blast from the Past" (referring to my DDWRT routers).
Anyway, that got me thinking - I said so in that thread.
The old system had been running for over 10 years and I decided it needed an upgrade.

I started by experimenting with some Raspberry Pis and OpenWRT.
OpenWRT has loads of support and is still actively being developed.
I also investigated using pfSense and OPNsense but the hardware those projects support is limited and doesn't run on the Raspberry Pi.
All this stuff is Open Source so freely available.
The other attraction for me to OpenWRT is that it is based round Linux (in fact, it IS Linux)
And I'm a great fan of Linux - all my computer systems are Linux or Linux based.
Here is a photo of the Raspberry Pi 4 configured as a router.



After a few weeks playing with the Raspberry Pi 4 and some extra interfaces, Jeff Gerling posted a Youtube video on a couple of other options.
Jeff Gerling is my "go to man" about anything to do with the Raspberry Pi.
He has an excellent Youtube channel - full of information.
BTW, he also manages a second Youtube channel with his farther on industrial radio installations etc - very interesting
Anyway, this is his video on alternatives to my Raspberry Pi 4 as a router:-

So, after digesting that video, I bought a couple of the DFRobot Ethernet router boards and after a lot of searching I managed to aquire a couple of Raspberry Pi CM4s to plug into them.
This is a Raspberry Pi CM4 - they are like "rocking horse poo" to find.



This project ran "on and off" all the way through last year but I finally came back to it as a winter project.
I'm very slow at getting my head round stuff like this - it always takes me a long time to do these kinds of things.
In the meantime, my old DDWRT system was still working so there was no pressing need to upgrade - why mend something that isn't broken?
Well, the converse to that is "don't wait until it breaks".

Finally late in November, I got it all working using OpenWRT and (for me) a new security model using Wireguard.
The old DDWRT system uses OpenVPN for its secure tunnel.
OpenVPN uses complicated electronic Certificates and Keys similar to those used when accessing your bank account.
In my case, I created my own Certification Authority making me completely independent.
But setting up these Certificates and Keys up takes ages.
Wireguard is the "new kid on the block" and MUCH easier to set up.
It uses a much simpler system of Public and Private Keys - a set for each end of a connection.
OpenVPN uses a Client - Server concept whereas Wireguard is considered peer to peer although you can consider one of the peers as a server.
I SAID AT THE BEGINNING THIS WAS GOING TO BE GEEKY - YOU WERE WARNED

Anyway, to summarise
The design is a secondary router which is placed downstream in each LAN (one at home and one on the boat).
Any devices connected to these extra routers can communicate with each other securely as though they were on the same network.

Moving on
Just before Christmas, SWMBO and I visited our daughter and son in law who is equally geeky and he showed me some hardware that he had been playing with.
Essentially, he showed me a router made from a conventional "barebones" x86 computer - more powerful than most desktop PCs.
Lots of these have emerged recently since Intel released the base electronics.
Super little boxes so I bought a couple of these:-



The ones that I bought come from China but you can order them on Amazon.
https://www.amazon.co.uk/dp/B0B28RNZPM?psc=1&ref=ppx_yo2ov_dt_b_product_details
I chose the ones with smallest RAM and smallest SSD - way bigger/more powerful than OpenWRT needs.
They say the delivery is about a month but I got them in about 10 days.

It was then an easy job to translate everything that I had learned on the Raspberry Pi onto the powerful little routers.
Here is a graphical drawing that I put together to show the concept - I've removed sensitive information (IP addresses etc) from the drawing:-



During January I disconnected the old home DDWRT router and inserted my lovely new OpenWRT box.
I then headed out to the boat to connect the other end up.

Usually, when I do this kind of stuff something doesn't work but in this case it all went according to plan.
One small problem - my VoIP telephone connection to home (uses a Raspberry Pi PABX) didn't work.
After a bit of head scratching I found and fixed the problem.

OK - this is a geeky thread so I will explain that problem.
This is for those who know about networks
My old OpenVPN configuration used a TAP connection rather than a TUN connection.
TAP connections operate within a single subnet whereas TUN connections route different subnets.
i.e. with TUN the local LAN is a different address range from the remote LAN.
Wireguard (that I switched to) only works with different subnets (like OpenVPN's TUN)
My VoIP problem was that my VoIP server (the Raspberry Pi PABX) needed to be changed to accept both of the subnets.

Another design problem that I have had to resolve is WOL.
WOL is "Wake On LAN)" - the ability to remotely start/boot a computer.
WOL works using Ethernet Layer 2 (MAC addresses etc).
OpenVPN (TAP) works on Layer 2 so on my old DDWRT system, I could easily send WOL packets to start my devices remotely.
Wireguard is designed to only works on Layer 3 so WOL commands can't transfer through my new tunnel.
The solution is to get the routers themselves to send the WOL packets.
I do this using SSH to run a command on the remote router.
That process isn't very interactive so I wrote some GUI applications to send the WOL commands over SSH.
One GUI application runs on my desktop devices - the other is an Android app.

One additional benefit of a secure tunnel like this is that you can also connect to the system from elsewhere.
For example a PC at another location can also connect into the system.
And all my Android devices can connect wherever/whenever they have an internet connection.

Anyway, I told you this was going to be a geeky thread.
I hope some of you will find this report interesting.

 

[Hurricane]

Oh yes
One thing I forgot to mention.
The new Wireguard system is about 4 times quicker than my old DDWRT system.
Very evident on the boat when I want to browse directories etc remotely.

 

[jakew009]

Oh yes
One thing I forgot to mention.
The new Wireguard system is about 4 times quicker than my old DDWRT system.
Very evident on the boat when I want to browse directories etc remotely.

Good stuff this is the best way to learn networking fundamentals.

Now here’s another interesting thing to do that will actually have a useful purpose (if you don’t already have a roadwarrior VPN setup)

Tailscale is a sort of hosted VPN service, so you might not like it because it’s technically not fully in your control. But it’s got so many benefits that makes the trade off worth it imo. It uses Wireguard underneath but their management UI layer on top is brilliant.

Sign up for a Tailscale account.

Install the tailscale app on your phone and say a laptop.

Now setup a Tailscale subnet router on your existing network. You can either put one just at home (which will hairpin all your road warrior traffic through the home connection even if destined for the boat), or setup a subnet router on both the home and boat networks.

Now, you can leave your phone connected to the VPN all the time and have access to all your normal services.

Tailscale let’s you dynamically chose what they call your ‘exit node’ so you can for instance seamlessly route all your internet traffic out via your UK IP address even when you are in Spain and not connected to your boat network.

I think you mentioned you use NordVPN before - Tailscale will be a replacement for it.

 

[Hurricane]

Good stuff this is the best way to learn networking fundamentals.

Now here’s another interesting thing to do that will actually have a useful purpose (if you don’t already have a roadwarrior VPN setup)

Tailscale is a sort of hosted VPN service, so you might not like it because it’s technically not fully in your control. But it’s got so many benefits that makes the trade off worth it imo. It uses Wireguard underneath but their management UI layer on top is brilliant.

Sign up for a Tailscale account.

Install the tailscale app on your phone and say a laptop.

Now setup a Tailscale subnet router on your existing network. You can either put one just at home (which will hairpin all your road warrior traffic through the home connection even if destined for the boat), or setup a subnet router on both the home and boat networks.

Now, you can leave your phone connected to the VPN all the time and have access to all your normal services.

Tailscale let’s you dynamically chose what they call your ‘exit node’ so you can for instance seamlessly route all your internet traffic out via your UK IP address even when you are in Spain and not connected to your boat network.

I think you mentioned you use NordVPN before - Tailscale will be a replacement for it.

Thanks for commenting again.
You are responsible for me loosing many hours learning this stuff.
But I don't regret any of it - I really enjoyed the process.

There were two like Tailscale, that I looked at.
I think Tailscale was one of them.
I also had a go with Cloudflare but all these systems are very dependent on other external services.
And Cloudflare was far to complicated.
I wanted to be independent from any other external service.
At the moment, I have a static IP address at home thus making me completely independent.
My home Wireguard router is always available so as soon as another peer connects, the "keep alive" option keeps the VPN active.
However, I have set this system up using DDNS in case my next ISP won't be able to give me a static address in the future.
So, I'm not completely independent - but, at least I'm in control.

The point is that I am not dependent on other internet services.

Also, having switched to x86 hardware, I could have used pfSense or OPNsense after all.
But at that stage, I was too far down the line with OpenWRT and didn't want to relearn another system.

This is the video tutorial that finally got it working for me.
As I say, I'm a very slow learner and it is videos like this that help a lot:-

EDIT
BTW - for those who don't know, Luci is the name of the GUI/Web interface within OpenWRT
Most examples of setting up OpenWRT use a command line but I managed to stick to using the Luci (GUI/Web interface) for everything.
I'm comfortable using the command line but, in this case, I wanted to set it all up using the web interface only.
That said, it was useful to SSH into the appropriate router every now and then.
Its Linux after all, so works just like all my other systems.

 

[colhel]

My only contribution to this thread is to say the thread title's very accurate

 

[RobbieW]

This may be a bit late for you, I'll mention it anyway. There is a branch of OpenWrt called ROOter, ROOter by Of Modems and Men, that is explicitly written for modem support. If you have aspirations for 5G or Class 20 modems it would be worth a look. Its actively developed and supported, runs on a variety of platforms including the Pi and x86 and has stuff like Wireguard or OpenVPN built in using LuCI interfaces. I've been using it for over 5 years, initially on the boat and now at home, currently with a Pi4.

 

[Hurricane]

This may be a bit late for you, I'll mention it anyway. There is a branch of OpenWrt called ROOter, ROOter by Of Modems and Men, that is explicitly written for modem support. If you have aspirations for 5G or Class 20 modems it would be worth a look. Its actively developed and supported, runs on a variety of platforms including the Pi and x86 and has stuff like Wireguard or OpenVPN built in using LuCI interfaces. I've been using it for over 5 years, initially on the boat and now at home, currently with a Pi4.

Interesting, Robbie.
I will have a good look at that project.
As I say, I am disappointed in the hardware of the RUT950.
At the moment, I use it only as a connection to the internet.
It works well (now) but I have visions of replacing it in the future.
So, it might be fun to build the replacement and OpenWRT would be top of the list.
I know the RUT950 uses its own build of OpenWRT but the hardware is very primitive.

Actually, whilst on the subject of the upstream routers.
Thats the 4G router on the boat and the ISP's broadband router at home.
To recap, the site to site routers are downstream of the 4G/Broadband routers.
By design, these additional routers build an extra level of security.
By this, I mean an extra LAN at each location.
At each end, one LAN is created by the 4G/Broadband routers and and another LAN created by the site to site routers.
Both LANs use NAT and separate firewalls.
I think the term used is "Double NATing", but there is a very useful additional benefit.

I BELIEVE THE FOLLOWING TO BE VERY IMPORTANT - TO EVERYONE
I consider my upstream LAN (the one connected to the 4G on the boat or the Broadband at home) to be my "insecure" LAN,
And the downstream "site to site" LAN to be "secure".
I then install all those dodgy IoT devices on the upstream LAN.
I'm sure that lots of people don't realise that they are "potentially" creating a security risk when using IoT devices.
Amongst others, IoT devices can be considered to be IP Cameras, Door Bells, Heating System Controls and Smart Switches etc.
Even Alexa and Google Assistants use this concept.
Most, if not all, these devices connect to external servers creating a "tunnel" through your home routers.
That "tunnel" is then used by you to connect to your home IoT devices when you are away from home.
You have, effectively created a security risk - if YOU can tunnel through into your OWN network, I'm sure someone else could as well.
This issue is compounded by cheap Chinese devices - how do you feel about your cheap Chinese camera connecting to a Chinese server???

My solution to this problem is to put all my dodgy IoT devices on my insecure LANs and keep my "secure" LAN for my more sensitive computers.
Even Alexa is connected to the insecure LAN

I wonder how many people don't realise the risk.