VPN tunnel between 2 homes over the internet, what kind of equipments?

[PandaBear]

So, now that I have moved to a new internet with no data cap, this opens up some possibilities like having a security camera tunneling data to an off site security NVR, or a file server streaming from one to another. I have used dyndns before but that's only for non encrypted stuff in a pinch, instead of a dedicated ipsec etc between non PC equipments. I want to ask the experts here on how can this be done and what sorts of equipments I would need on both sides:




Home 1: Sonic Fiber with their provided PACE 5268AC modem + router, Generic security camera and NVR from China (it's cheap and good enough, don't complain about the quality, it works). Download / Upload about 600/600mbps, no data cap.

Security NVR's viewing side sit behind the ISP modem router, but need to VPN tunnel an offsite IP Camera into the camera network side of the NVR.

I currently expose the viewing port of the security NVR to the router and have one of the windows PC on this network setup with duckdns. I used to have the NVR entered the dyndns info and let it update its name regularly, but the ddns is no longer free unless you manually log in once a month or so. This becomes a problem as I do not want manual work to keep it updated. Duckdns does that automatically now from this same public ip address and now my only problem is the VPN tunnel or ipsec. I don't think the router support that so I have to find a way to tunnel the "cameras" side of the NVR to the router, and VPN the traffic without someone spamming with another public camera into my network (although I might get lucky it may never happen, our ISP says they don't filter anything so it will eventually happen). I think the NVR is a DHCP server on the camera network so I would have to find a way to turn off the router's DHCP if I want to loop that side in, to avoid 2 competing DHCP server.




Home 2: Xfinity internet with their provided Arris XB3 modem router, then behind it a TP-Link Archer C8, will likely buy an IP camera from the same brand as the security NVR above. Download / Upload about 130/21mbps, no data cap.

Offsite IP Camera here, need to go through the TP Link Archer C8 to the NVR network, to the NVR's camera side network using either IPsec or a dedicated VPN equipment.

I want to install a 4MP or 5MP H.265 camera, then send the traffic to Home 1 and the forwarded port to the security NVR's ethernet port. I think without a VPN tunnel, that would require my router to have a special case for the DHCP for this camera, and without IPSEC or any other VPN in between, nothing is going to be encrypted.




Seems like the easiest way to solve this problem is to buy a matching pair of VPN tunnel supporting equipment on both sides, are there any cheaper and simpler way to this without special equipment or monthly fee?

 

[rijndael]

I would start by figuring out what port filters your ISPs have headed towards each house. If they block inbound IPSEC or https, you will be narrowing down your choices.

 

[PandaBear]

I would start by figuring out what port filters your ISPs have headed towards each house. If they block inbound IPSEC or https, you will be narrowing down your choices.

My understanding is other than email they don't block anything on the NVR side of the network. They are not big ISP that does things like that they explicitly mention that only email is blocked due to spam, and people can run server on their network.

 

[Rand]

2 different consumer routers, generic china nvr and cams and a remote IP cam on another site.. .. what could go right

not recommended.. Good luck though.

Edit: for clarity

Why the requirement to vpn it into a remote NVR? Just grab a local ip camera with microsd and have it backup somewhere.. IMO.
that is easy and relatively foolproof.

 

[PandaBear]

2 generic bottom barrel consumer routers, with generic cams and NVR... and 2 sites.. what could go right

not recommended.. Good luck though.

I've done worse, 2 generic bottom barrel routers WDS each other relaying free internet from a few houses away.

Honestly the only problem right now is the "and 2 sites". The generic cams and NVR work quite well and caught a few bad neighbors and thefts behaviors, money well spent to be honest.

I guess in the worst case I can accept 2 scrap old routers from ewaste bin and install open source router firmware and run them with ipsec as dedicated VPN tunnel? I know WRT-160N can handle 6mbps upload before dropping packets, anything newer than that should be reliable enough for 1 camera.

 

[Rand]

I've done worse, 2 generic bottom barrel routers WDS each other relaying free internet from a few houses away.

I edited.

 

[redhat]

Ubiquiti just released version 3.x of firmware for a lot of their EdgeRouter devices. One big add is that it now natively has WireGuard VPN built in. You could do a Site-to-site with them.

The EdgeRouter ER-X is a $50-$60 device that’ll do up to gigabit speeds with hardware NAT offloading enabled. They are older, circa 2015 but by the recent firmware release still supported and still sold by Ubiquiti.

I run them all over, easy to manage and dead-nuts reliable. They only have a 800 MHz processor and 256 MB of RAM but perform flawlessly. Also use very little power.

I use one with 500/20 Mbps Spectrum and bury the needle. For the price, performance and power I’m hard pressed to find better. But I will say they’re old by today’s standards.

Configuration… you’ll have to do some setup and know some networking to get them up. They are NOT click, point, and run.

 

[redhat]

Another thought with this is you can also setup dynamic DNS updates in the EdgeRouters with your DYN-DNS provider of choice, whether it be a bought custom domain or the free @no-ip.org/@dyndns.org domains.

Would make it easy for a “set-it-and-forget-it” setup with the potential for new WAN DHCP leases every so often.

 

[PandaBear]

The ER-X is a good recommendation. I was thinking about a pair of Raspberry Pi running WireGuard VPN as a starting point.

Reason for having an NVR offsite? 1) I already have one running 4 cameras and enough storage for 21 days of continuous traffic. Can I do SD card instead? Sure. I am more concerned about whether SD card can store enough if we find out something is stolen after a trip. Let's say it store 24 hours only, and we go on a 10 day trip, will we have footage to cover that? Maybe I'm overthinking, maybe someone seeing a blinking camera pointing at them will be enough to chase them away. I don't know, maybe criminals are smart enough but we have seen enough idiots, stealing 3 year old used shoes in front of my house, that I don't trust idiots being smart to behave in front of a camera.

On the other hand, at $60 each for the ER-X maybe I should just buy a local NVR and slap an old HDD inside to just call it a day.

 

[Rand]

Do you have a camera already or need a nvr and camera?


I have an EZVIZ 4- 4k IP camera system
8 Channel NVR w/ (2TB WD Purple)
THIS ONE:
https://www.bhphotovideo.com/c/product/1443691-REG/ezviz_un_1884a2_8_channel_nvr_with.html

Sitting here surplus never installed although I powered it on one time to see if it worked.
I think I used one of the included 75ft ethernet cables though.

 

[redhat]

Another thought, I am not sure if your NVR does this at all -- I run Reolink cameras and their NVR. All on a separate VLAN, with the Reolink NVR/cameras only able to hit the outside internet. The Reolink NVR uses their P2P service and I can access my NVR from anywhere. Works very well.

Maybe that is an option, not necessarily a RL but anyone who does that? But it doesn't help if you want to keep the footage local or in one location due to environmental or physical damage.

 

[redhat]

I keep thinking of things. Got an old computer lying around? Maybe Blue Iris is an idea?

https://blueirissoftware.com

They have remote access and affordable pricing. $79 for the full version and a lite version for 1-camera $39. They also have a 15-day trial.

 

[PandaBear]

Another thought, I am not sure if your NVR does this at all -- I run Reolink cameras and their NVR. All on a separate VLAN, with the Reolink NVR/cameras only able to hit the outside internet. The Reolink NVR uses their P2P service and I can access my NVR from anywhere. Works very well.

Maybe that is an option, not necessarily a RL but anyone who does that? But it doesn't help if you want to keep the footage local or in one location due to environmental or physical damage.

Yeah, mine is not Reolink but something probably serve similar function. GWSecurity GW5500 NVR. I'm sure it is just a generic HKVision setup like everyone else these days with a different label. It now has 9TB of storage and 4 cameras (I forgot but think it is 4 or 5MP h.265), powered by poe through cables I crimped. It monitor the apartment complex my parents live in and the NVR is hosted in their owner occupied unit. Works well, and they can view them from their smart phone on the road. Currently it stores about 15-18 days of footage of those 4 cameras. It also has its own VLAN but if I were to record an offsite camera I probably would run it through 2 IPsec VPN to tunnel it into the VLAN side, at least that's my "plan".

Or maybe simpler to just store the footage locally either with some open source method or the blue iris you suggested.

 

[PandaBear]

Do you have a camera already or need a nvr and camera?


I have an EZVIZ 4- 4k IP camera system
8 Channel NVR w/ (2TB WD Purple)
THIS ONE:
https://www.bhphotovideo.com/c/product/1443691-REG/ezviz_un_1884a2_8_channel_nvr_with.html

Sitting here surplus never installed although I powered it on one time to see if it worked.
I think I used one of the included 75ft ethernet cables though.
View attachment 296071

Nice setup, I think mine is similar. Why aren't you using it?

 

[Rand]

Nice setup, I think mine is similar. Why aren't you using it?

Was too hard to run Ethernet to where I wanted the cameras from one location. Never got around to paying someone.

I have unifi Cameras now. I can run them off decentralized poe switches.

 

[alarmguy]

This thread is over my head. Though I tend to keep things simple. Im happy with the new WiFi EUFY cameras. First time my life using solar powered, though they can be transformer wired and they also have dedicated transformer only. I chose the solar because we dont have crime here but I like gadgets and once in a while I find them useful, if even to see what wildlife crawls around in the night.
Without the home base they record on motion only. Thing is the human activated motion works amazingly well, same with general motion and vehicle motion. Amazing depending on how you set it up, it will record clips of anything you want.

With the HomeBase addtion ( I dont use it) you can record 24/7 by adding up to a 16TB drive
Thing is you really dont need to do 24/7 as the selection of human, motion and vehicle motion works so well you can be alerted right away or simply keep that silent and it will just store the motion clips under "events" in the phone app.
I still have it silent alert me on my iPhone but on the phone app all the alerts and clips are on the calendar and you can select to review them by day or filter out even by hour.

Only reason I am mentioning all this is its simplicity and everything is encrypted. Of course portable on your smart phone to view hassle free by clicking on the app. If you choose to send it to someone, you then download it and it will decrypt it to be sent or even stored in your photos/video.

I used to install mostly Honeywell NVRs in commercial buildings, sometimes homes. (sometimes big buildings, a well known industry custom laptop factory and offices (Diesel laptops, google it, amazing company you never heard of) too, also uniform companies (CINTAS). Pretty much the software is set up, just plug in the information. Also of course somewhat more of a tech always available if we ran into a glitch.

For something simple that always works and never goes down the above mentioned Eufy is one heck of a package for a homeowner.

I have two E30's my son just bought 4-s340s for his new home. Jsut closed on it so will be an awhile before he hooks them up maybe.
Only reason I have them is for fun-wildlife- check to see if it's raining at the house when I see thunderstorms and I am not home.
We dont have crime here but these cameras are pretty good for what they are. Key would be not to mount them too high up unless you get the zoom model.

Last house I had 4 EZ-Viz cameras, wired power, Wifi video. They were ok but motion detection wasnt anywhere near as accurate as teh EUFY (no I dont work for them) PS no subscription needed.
https://www.eufy.com/collections/outdoor-security-cameras?ref=navimenu_1_1_1_3_viewMore

 

[uc50ic4more]

Tailscale is what you're after, @PandaBear . There are similar competitors; and of course you can set up your own WireGuard-based VPN if you felt like it; but Tailscale is purpose-built for your use-case and offers a generous free tier of use.