Local storage access using VPN.

[Mavrrick]

I am just looking for clarity on what is needed from a network perspective for local sotage access across a vpn. This is suggestrd by the app to use instead of using port forwarding to enable external access for better security. I have a unraid server with OpenVPN installed. I can connect to multiple internal network objects. Whenever i try to connect to the local storage though i tap on the hub select in the library and nothing happens.

Initially I thought it might be related to the ip of my device remotely. I updated my VPN config to have me on the same class C network as the hub and still nothing.

[JamesC]

Mavrrick,

I've opened a ticket regarding your questions on local storage and VPN access. A support agent will reach out to you via email to collect more information.

Thanks,

JamesC

[Mavrrick]

Thank you JamesC.

I suspect this is something to do with how my device is being identifies as being local. All of your documentation talks about setting it up in the VPN on a router. In my case i am using my Unraid server, but this can also easily be done with a RaspberryPI. That server then basically then does some routing and proxing of traffic from my device to thr local network. That may mean the network gateways are different and may be the cause of why it isn't being seen as local. It will be interesting to see what support says.

[Mavrrick]

Something to add for anyone else trying to work on this.

I have found a few occasions where i can get it to work over my VPN, but i would have to be in the app first and have already established a connection to the base station. I think this continues to point to it being a problem with the software understanding where the is. I think once the app identifies the ip/hostname it is good to continue to with access until the app is restarted. 

Just to be clear so far with local access and setting up port forwarding does seem to work pretty well so far.

[gadgetfan]

When port forwarding for Direct Storage Access on the Smart Basestation when away from the LAN, do I forward TCP, UDP or both? 

I see where the app names which port to forward.

Thanks!

[Mavrrick]

I have just TCP protocal opened up through my router.

[harlequinman]

Ok so I tried the port forwarding option and that works when outside of my home wifi i.e. I can access the videos recorded onto my microSIM in my Ultra hub however with all the security warnings and my lack of knowledge in this area I'm not comfortable with using this method of accessing my local storage when away from home. The guidance implied on the Arlo app is to use VPN. I understand what a VPN is and why it's there but not got a clue what all the various acronyms are or what they mean. I have a VPN set up already on my iPhone but that is provided by my employer to access their own intranet. So reason for my comment here is where do I start? Presumably I need to download a VPN app from the Apple App Store and configure it somehow to privately tunnel through to the local storage on my Ultra Hub? Are these VPNs free? Can anyone recommend a VPN I can download and use and provide a step by step idiots E2E VPN setup up guide? I had a look at OpenVPN on the App Store but there's no real guidance that comes with it. Thanks in advance.

[Mavrrick]

So VPN is simply referring to a technology to connect a device to a another network across a Virtual Private Network. There are also VPN Services out there like NordVPN, or EasyVPN and don't be confused by them a they are not the same thing.

I suspect for the context of this connectivity you need to look at your router to see if it has a option to setup VPN's using a built in VPN Server. Some routers have a OpenVPN server and you can download the software for you mobile device and setup the connection. If your router doesn't have a VPN Server built in you may have to use Port Forwarding. This is actually why I started this thread. My Google Wifi doesn't have a built in VPN Server. I use a vpn software on my unraid server. I have now tried two different ones and neither appears to have worked. I suspect for the reasons I have posted above. Support has reached out to me and hopefully i will hear back shortly as to what needs to be done.

The reason port forwarding isn't as secure is because you are basically putting your base station on the web. Once that is done anything that hits the port on your router will be directed to the hub, and then if the hub has any vulnerabilities it can be hacked. Arlo doesn't use a standard port and it is randomized so it can't be predicted by an attacker. This means i can just do a port scan and find every user with a Arlo Smarthub open with port forwarding.  I have also tried a few times to access the port and it seems that they atleast did a decent job blocking it from responding to generic stuff.

With that said port forwarding is probably pretty safe. Is it as safe as a VPN no, but i doubt it is something to really worry about to much.

[Mavrrick]

Ok so I was contacted by support. They found a bug where the IP of the Hub wasn't being identified properly and passed to the Arlo Mobile client. It is something to do with how the hub starts up. Unfortunately I recently returned my Pro3 kit and just ordered the hub by itself for the this functionality so i can't test it just yet. With the explanation I got from support this means that i was right and wrong about the problem. It is related to identifying the IP of the hub, but it may not be a problem for VPN's that are not on the router. I will check that in 5-7 days when my new hub comes in. 

The way you can check for this yourself would be to go to the port forwarding section of the app and see if your hubs local ip is missing from the display. If it is, the suggestion I got was to restart the hub from the mobile app. It is simply a timing issue at the startup time of the hub. This is a known issue at this point as they referenced another customer that was having similar issues.

Hope this helps others if they are experiencing the same issue. I will check back once I get the new hub in.

[mauijer]

Sorry to dumb down this conversation but just to clarify, but how do I find out if my netgear router can have a VPN? After I do that I have do download a netgear vpn app to my iphone?

I see in my iphone general settings section there is a VPN option where I can add VPN configuration... is this where I need to go?

Thanks, I would really love for Arlo to be less cryptic in this whole ordeal.

[Mavrrick]

You would need to look at the documentation for your router.  Review the manual for how to setup a VPN.

[StephenB]

---

@mauijer wrote:

 how do I find out if my netgear router can have a VPN?

What Netgear router do you have?  Nighthawk and Orbi routers have openVPN built in.

[Mavrrick]

I wanted to also let everyone know in my case the VPN option is still not working. I have tested it with both OpenVPN and Wireguard through my Unraid server. Everytime i try to use that  when disconnected from my home wifi it fails to connect. 

I will be trying to reach back out to support for further help.

[mauijer]

I have a Netgear N600 wifi cable modem router with dual band gigabit

Under Advanced home setup I see:

Internet setup

Wireless setup

WAN setup

LAN setup

Guest Network

No VPN option.

If I go to "Advanced setup" below that I have the following options:

Wireless Settings

Portforwarding/Port Triggering

Dynamic DNS\

Remote Management

UPnP

USB Setting

IPv6

Under Portforwarding/Port Triggering i can select either option and then add a Service name and an IP Address....?

Is that where I am suppose to go? What do I do next? I am trying to access from an my arlo remotely from an Iphone when not at home.

Thank you

[Mavrrick]

Select port forwarding. Fill in the port with the port provided in the arlo app when enabeling access using port forearding. If you have a option to do a range of ports put in the one from the app twice. Then put in the ip address of the arlo base station provided in the app as well. As far as service name that is just to tell you later what it is so anything descriptive should be good like Arlo local storage access. The save it

[Mavrrick]

You may also want to go into setup and set a staicip/dhcp reservation for your arlo base station if you haven't already as well.

[rajattandon1]

team i am trying to see my local storage video in my mobile iphone 7 outside wifi network please can share the step by step process for port forwarding to work.

[Mavrrick]

Have you consulted your router manual? What router do you have?

[rajattandon1]

apple router nothing in manual to help
airport extreme

[Mavrrick]

Try these directions https://m.youtube.com/watch?v=GeH5UxmQKWo

[vnorred]

For Maverick in particular:  Just to let you know I am running PiVPN (OpenVPN) on a raspberry pi 4 for my server.  Gateway router is a Netgear R7000.  VPN works beautifully from my Android phone from outside the network on accessing all local machines EXCEPT my VMB5000 smart hub.  Same problem you had.  In fact when in the ARLO App and I access the library and then click on the Cloud the smart hub shows up grayed.  So that appears that the Arlo App does not see the hub at all.  I can ping the smarthub and traceroute to the smarthub from th3e phone.  I will check some other forums for this issue.

[vnorred]

Maverick, did you ever get access through your VPN?  I can not find that anyone in the universe has been successful with this using a local VPN server separate from the router.  Although there is no reason it should not work when I can get access to any other device on my LAN through my VPN.

[vnorred]

I tried a different approach.  I setup a VPN server on my Netgear R7000 router (my gateway).  It rund OpenVPN as a server.  I added this server as a profile  on my Android phone and the connection was solid from outside to my LAN and any device on my LAN EXCEPT the VMB5000 hub.  As before, I can ping the VMB500-0 from my phone and traceroute from my phone to the VMB5000.  But cannot get the Arlo App to recognize the hub.  So having the VPN server on a separate hardware platform from the gateway router did not matter.  I did read that the smart hub talks to the Arlo app over ports 443 and 80.  If that is the case, the gateway router should have those ports open since the Arlo app would have to query the hub first with an inbound packet group.  At least it seems that way.  I can find no information from Arlo to verify that, so it would seem that no one has successfully gotten this to work.

[lrnjjj]

i have the arlo ultra and to access my library remotely, i have to open a portal which is I've heard dangerous, and now i here through vpn, i can access that? where would i access a vpn at? i think I've got time to consider about the camera. i really think we should easily be able to access the library with a breeze. this should be a slide in the park, in this day of high tech.

[vnorred]

You must install a VPN Server on one of your local devices, preferably your router if it is capable of running a VPN Server.  Then install the VPN client on your smart phone and it should work when you are outside of your local LAN.  You can google each of those processes to see numerous tutorials on the subject.  Stay with OpenVPN.