Arlo Ultra Smart Hub and Eero Mesh

[LBD]

Trying to set up my Arlo Ultra Smart Hub. All directions recommend a VPN to be able to access the library securely from outside the home base. What can an outsider see if I do not get a VPN? Am I putting everything on my phone at risk? I was under the impression that purchasing the smart hub and inserting a micro SD card would be all I would need to connect the three cameras and view the videos without paying a monthly fee for the Arlo cloud. I don't want to see the videos when I am home, want to see them when I am NOT home. If there is an intruder or delivery caught on camera, I would like to be able to view it when I am not home. If I am home, I do not need to see the video. Direct Storage is enabled, and I guess I also need to enable Port Forwarding. But this is where it says to get a VPN.

[jguerdat]

Use of a VPN is definitely a better idea than port forwarding since you have to have the VPN credentials to be able to log into the router while port forwarding is open to anyone who can guess what random port is being used.

The VPN that's needed is one that's supported by the router. I suspect many/most current routers have this support but you need to check the manual to be sure. There's no need to subscribe to a VPN provider.

[StephenB]

---

@LBD wrote:

Trying to set up my Arlo Ultra Smart Hub. All directions recommend a VPN to be able to access the library securely from outside the home base. What can an outsider see if I do not get a VPN? Am I putting everything on my phone at risk?

To be clear, the VPN being talked about here is one that is built into your router.  It's not a VPN to give you privacy when browsing, instead it's a VPN specifically set up for remote access to your home network.  "Getting the VPN" either means enabling the feature in your existing router, or purchasing a new router that has the feature.  Most high-end routers do have it, including Netgear Nighthawk and Orbi models.  I use an Orbi myself.

Also, the phone isn't at risk - it's more about securing your home network (including the smarthub).

Most people (including me) consider a VPN to be more secure, but port forwarding can also be secure.

With a VPN, all the data flowing from the smarthub to your phone is doubly-encrypted - once by the smarthub, and once again by the VPN.  The security downside of a VPN is that if someone is able to hack into it, then they have full access to your home network - including any PCs.  The hacker still wouldn't be able to access your Arlo equipment, unless they also find a way to hack into the smarthub and defeat its encryption.

With Port Forwardng, the security is only what is built into the smarthub itself.  So you are trusting Arlo to maintain that security. @jguerdat is correct in saying that any internet traffic to that port will be forwarded to the smarhub without needing credentials.  But the smarthub securiry is designed to reject requests that aren't authenticated by your Arlo account. I haven't seen any reports anywhere of someone managing to hack into a smarthub.  That's not to say it's impossible, but I would expect to see such reports if it happened with any frequency. 

If you do decide on port forwarding, then see if you can reserve the smarthub's local IP address in your router.  Most routers have that feature - but there are a couple of different names for it.  IP address reservation, Mac address reservation,  ARP reservation, ... When you reserve the address, the port you forward will always to to the base station, even if you reboot your home network.  Otherwise it might go to a different device (perhaps a PC) - which does create some security risks.