Remote connections - secure? #41
Replies: 7 comments 18 replies
-
|
I would be very cautious opening WAN ports while using older, not actively developed software. |
Beta Was this translation helpful? Give feedback.
-
|
What is the worst that could happen? |
Beta Was this translation helpful? Give feedback.
-
|
A bad actor finds an un-patched attack vector via the open port/software; gains access/control to your network; installs and activates keyloggers and other 'malware' network wide; gains important authentication credentials for important infrastructure. ;-) but in all seriousness probably not much.. |
Beta Was this translation helpful? Give feedback.
-
|
You should really set up a self-hosted VPN connection that you can use to access your network while remote. When using this type of connection, your remote devices appear on the network as local devices, so it works great with things like SageTV. You won't use any of the SageTV remote connection capabilities or open any SageTV specific ports on your router/firewall. |
Beta Was this translation helpful? Give feedback.
-
|
The only problem with this approach is when the local network that you are using is on the same subnet as your VPN. For example, my home network is 192.168.1.X. When I am at a hotel that also uses 192.168.1.X and I try to use a VPN it won't work. This has caught me a couple of times. |
Beta Was this translation helpful? Give feedback.
-
|
Could you point me in the right direction for how to set up a self-hosted VPN? I was using a commercial solution with a flashed router for a year or so, but because of the extra hop(s) through the VPN, the speed and ping response was compromised. |
Beta Was this translation helpful? Give feedback.
-
|
What router/firewall device are you running? Most residential grade routers support OpenVPN. If this is true with your device, you can set up the OpenVPN server right on the router. There are lots of how-to on the web, but search for "VPN [your router model]" and you'll likely find one specific to your device. Once the VPN server is set up on the router, then you will need to download the corresponding VPN client software on any device you want to connect to the network remotely. Luckily this software is available on most OS (even AndroidTV, etc), so connecting a device to view SageTV remotely isn't hard. I have a ShieldTV that has the VPN set up on it so I can carry that with me when I am traveling and have direct connection to my SageTV system from any TV I may come across (as long as I have internet available). I just plug my Shield into the TV, connect it to the internet, and start (turn on) the VPN connection before starting the SageTV MiniClient app. You could do the same thing with a computer running the SageTV Client software or a mobile phone, tablet, etc. |
Beta Was this translation helpful? Give feedback.
-
|
I use Open VPN and SageTV does not work very well with it ... It Asks for user ID etc ... It does not connect locally without having to setup a place shifter user, Connecting remotely is a pain in the butt. Channels DVR Emby Plex etc... connect as if the Client is local not SageTV. |
Beta Was this translation helpful? Give feedback.
-
|
Take a look at Twingate. They have a free plan that may suit your needs. It works well for me. Tailscale is another option. |
Beta Was this translation helpful? Give feedback.
-
|
My post above is meant for those posting an option you should explain how it works. I know for a fact OPENVPN does not work to use SageTV as local. Also Tail scale does not work either unless you know how to set it up ? |
Beta Was this translation helpful? Give feedback.
-
|
When using the SageTV Miniclient software you are prompted to enter a username and password even when on your local network. This is not related to using a VPN software at all. You should be able to set up the system to automatically connect so you don't have to enter that information each time. The user experience when using the SageTV Miniclient software is going to be identical whether you are on a local network, or connecting to the local network while remote over a VPN. I can say with 100% certainly that using OpnVPN does work exactly as it should when it is set up correctly. I have a full time VPN connection set up between my parents house and my house as well as a separate "on-demand" VPN connection set up for remote access to my home network. I can use either to connect to my SageTV network. Both use OpnVPN for both connections. My son even took the Shield TV to college this year and had no problems connecting to the home SageTV system anytime he wanted to (which admittedly wasn't that often, but it never failed to work properly). |
Beta Was this translation helpful? Give feedback.
-
|
Just to be clearer, I'm looking to connect a remote HD300 to my server without transcoding. Server side upload is about 40 mbps and I believe that all tuners/sources are currently right around 10 mbps or less. |
Beta Was this translation helpful? Give feedback.
-
|
If you find a way to connect the Android Client using a VPN Please post instructions. |
Beta Was this translation helpful? Give feedback.
-
|
The only way to make an HD300 appear local is for it to be on the same subnet which requires an L2 VPN. This would require having dedicated routers at both the home and remote site for an HD300. However, for an android client you can use an OpenVPN app to make the connection prior to opening the Sage app. While OpenVpn can be setup as a layer 2, it is very CPU heavy so your transfer rates may be impacted by the router or client processing power. The other option is to use a more modern VPN like Wireguard (and Wireguard android app) which is much more cpu efficient however that may not be available on commercial routers and it is only a L3 so you would still appear to connect remotely. I use homebuilt routers running OpnSense and Wireguard to connect specific ip(s) at a remote site to my home network. I modified the sage properties so that remote connections pass the bitrate tests for no transcoding. So, for example, if you have an nvidia shield setup as a media player at a remote location, all traffic can be routed though the home router to allow secure sage traffic and to eliminate any remote IP blocking by streaming services (Netflix). OpnSense has great how-to guides for Wireguard setup (road warrior and selective routing). |
Beta Was this translation helpful? Give feedback.
-
Unfortunately, the extenders don't have the capacity to run any additional software (like a VPN client) on them. Therefore the only way you will be able to do this is to set up a local network that you can run a VPN client on to connect to your home network via a VPN system. Once you get this network connecting to the home network properly, then you can simply add the HD extender to this network and the data should pass through the VPN connection to the home network and the extender will appear as a local device on the home network. The good news is that if you want to do this while traveling to random locations (ie not a second home you own), you could simply set up a wireless router to run the VPN client (set up to connect to your home network) and then plug that router into whatever network you can find at the remote location. It will create a new network piggybacking off the existing network, but shouldn't interfere with the existing local network if the network address scheme is different than the existing network. Therefore I would set up the router to use something like 172.39.83.1/24 which is odd enough that it likely won't be used by another existing local network. You can either plug the extender into the router for a hardwired connection, or connect to it via the wireless network created by the router. You can carry this special wireless router with you when you travel and simply plug it into an existing network. This way you don't have to try and set up a VPN connection from scratch at each remote location you find yourself at. Of course it is even easier if you stop using the extender and move to a Android device (like a Firestick or Shield TV) because those devices can run both the VPN client and the SageTV software (along with all the other streaming services you may subscribe to). You can simply connect that device to whatever local network you have access to, start the VPN software/connection on the device, and then watch SageTV via your home server without having to carry around a wireless router as well. If you are trying to do this at a second home you own, then you can simply set up a VPN connection that connects the two home networks together full time. You can even specify what traffic gets sent out over the VPN, so you can have only the SageTV traffic hit the VPN, while all the other traffic just goes out to your local internet provider like normal. |
Beta Was this translation helpful? Give feedback.
-
|
So, back to the original question (assuming there is no VPN involved), if I just have the SageTV ports open on that machine and forwarded from my router, and I connect the HD300 directly to the server's public IP address while remote, is the username and password transmitted securely or in the open? |
Beta Was this translation helpful? Give feedback.
-
|
Keeping Ports open is always bad news ... Emby got hacked a few weeks ago and that is kept up to date. I would be leery of opening port for SageTV. |
Beta Was this translation helpful? Give feedback.
-
|
I replied on original forum about this topic. Easiest to buy a travel router and run WireGuard. I prefer Glinet routers as it already as WireGaurd installed. Then use the android MiniPlayer app you can use install the WireGuard client. The other option is buy second travel router and have it connect. Then anything connected to it can use the VPN connect. |
Beta Was this translation helpful? Give feedback.
-
|
Are there VPN hardware devices, one SageTV server side, and one remote all hard wired that are pre-configured where I can just plug them in at each end and it requires very little setup and maintenance? Would one of these units at both ends work to create a VPN tunnel between my home networks? |
Beta Was this translation helpful? Give feedback.
-
|
Something like this ... |
Beta Was this translation helpful? Give feedback.
-
|
That looks like the same thing, but more expensive with the wifi. I'll be hard wired at both ends, so I was hoping the GL.iNet MT2500 (Brume 2) would be powerful enough to use at each end, for a good fast connection. The first one is 30% off, so only $63. This video seems to explain it, to some degree. |
Beta Was this translation helpful? Give feedback.
-
|
... and it looks like each unit, even the server end (port-forwarded), can be behind another router. I suppose the client end doesn't require port-forwarding, just the initial setup to connect back to server end. |
Beta Was this translation helpful? Give feedback.
-
|
Or maybe the MT2500 Brume 2 as the server and this cheap device on the client end, if it was powerful enough: |
Beta Was this translation helpful? Give feedback.
-
|
I use mango on server side. They where $20 pre pandemic. They are only 2g but on sever side it is hardwired. My travel router is the older Certa that is 2g/5g. But I mostly use a FireStick directly with WireGuard client. I only use the Travel router for my work PC as they restrict VPNs. You connect the travel router and no one is a wiser that the connection is VPNed. |
Beta Was this translation helpful? Give feedback.
Uh oh!
There was an error while loading. Please reload this page.
-
When connecting remotely to the SageTV server in my home, is the username and password transmitted securely? If not, are they easily compromised?
Does the answer to this question change if I'm connecting with an Android Client, or an HD300?
Only the necessary ports on my router are forwarded.
Beta Was this translation helpful? Give feedback.
All reactions