Jump to content

Trying to set up a VPN server on my NAS

Aleph256
 Share
Posted

Figured it would be the best place to post.

I deployed a Drivestor 4 Pro last year.

(I know now it's not the best value hardware, but there was an enticing sale and my needs were "I want a backup that isn't a bunch of external HDDs").

 

Over time I started using it for more than just storage, and now it's running a qBittorrent server.

To be able to manage it remotely, I did some basic port forwarding on my router (and the same for a FTP server a bit down the line).

As I didn't want my data to transit through the Asustor servers, I did not set up a MyAsustor account to use their DDNS service, and log in directly from my router's public IP.

And it's been working pretty mint so far.

 

It's been brought to my attention that raw forwarding like that is not the safest option, and that I should set up a local VPN instead and remote to it.

As such, following this thread and this video, I tried setting up a L2TP one.

I downloaded VPN Server on the NAS and set it up like so...

image.thumb.png.758d197efd9803723194ae4c0b07f32e.pngimage.png.856c59088086f807bd8ff1baaeb2f6d0.png

 

... Then I forwarded the relevant ports on the router...

image.png.a4d04c2c230e658e42f45cec22e652df.png

 

... And finally tried to set it up on my phone, once again using the router's public IP.

image.png.cb691185bf44e470b8995b150070f237.png

 

However, it fails to connect.

I tried both the raw IP and by specifying the ports.

 

So... What's the (probably obvious) thing I seem to have missed?

Do I actually need a domain name and can't just connect from an IP?

Did I miss a parameter somewhere?

Should I give up, buy a Pi and try again there?

Link to comment
Share on other sites
Link to post
Share on other sites
Posted
1 hour ago, Aleph256 said:

So... What's the (probably obvious) thing I seem to have missed?

Make sure your port forwards are both UDP and TCP.

 

1 hour ago, Aleph256 said:

Do I actually need a domain name and can't just connect from an IP?

I don't believe you need a domain, but I think is somewhat integral to having a "true" crypto cert (which isn't really necessary for personal use).

 

1 hour ago, Aleph256 said:

Should I give up, buy a Pi and try again there?

To the credit of the PiVPN devs, it really does just work (much to my surprise, since the last time I tried to set up a VPN, it broke TrueNAS's VM IP configurations horribly).

Main System (Byarlant): Ryzen 7 5800X | Asus B550-Creator ProArt | EK 240mm Basic AIO | 16GB G.Skill DDR4 3200MT/s CAS-14 | XFX Speedster SWFT 210 RX 6600 | Samsung 990 PRO 2TB / Samsung 960 PRO 512GB / 4× Crucial MX500 2TB (RAID-0) | Corsair RM750X | Mellanox ConnectX-3 10G NIC | Inateck USB 3.0 Card | Hyte Y60 Case | Dell U3415W Monitor | Keychron K4 Brown (white backlight)

 

Laptop (Narrative): Lenovo Flex 5 81X20005US | Ryzen 5 4500U | 16GB RAM (soldered) | Vega 6 Graphics | SKHynix P31 1TB NVMe SSD | Intel AX200 Wifi (all-around awesome machine)

 

Proxmox Server (Veda): Ryzen 7 3800XT | AsRock Rack X470D4U | Corsair H80i v2 | 64GB Micron DDR4 ECC 3200MT/s | 4x 10TB WD Whites / 4x 14TB Seagate Exos / 2× Samsung PM963a 960GB SSD | Seasonic Prime Fanless 500W | Intel X540-T2 10G NIC | LSI 9207-8i HBA | Fractal Design Node 804 Case (side panels swapped to show off drives) | VMs: TrueNAS Scale; Ubuntu Server (PiHole/PiVPN/NGINX?); Windows 10 Pro; Ubuntu Server (Apache/MySQL)


Media Center/Video Capture (Jesta Cannon): Ryzen 5 1600X | ASRock B450M Pro4 R2.0 | Noctua NH-L12S | 16GB Crucial DDR4 3200MT/s CAS-22 | EVGA GTX750Ti SC | UMIS NVMe SSD 256GB / Seagate 1.5TB HDD | Corsair CX450M | Viewcast Osprey 260e Video Capture | Mellanox ConnectX-2 10G NIC | LG UH12NS30 BD-ROM | Silverstone Sugo SG-11 Case | Sony XR65A80K

 

Camera: Sony ɑ7II w/ Meike Grip | Sony SEL24240 | Samyang 35mm ƒ/2.8 | Sony SEL50F18F | Sony SEL2870 (kit lens) | PNY Elite Perfomance 512GB SDXC card

 

Network:

Spoiler 
                           ┌─────────────── Office/Rack ────────────────────────────────────────────────────────────────────────────┐
Google Fiber Webpass ────── UniFi Security Gateway ─── UniFi Switch 8-60W ─┬─ UniFi Switch Flex XG ═╦═ Veda (Proxmox Virtual Switch)
(500Mbps↑/500Mbps↓)                             UniFi CloudKey Gen2 (PoE) ─┴─ Veda (IPMI)           ╠═ Veda-NAS (HW Passthrough NIC)
╔═══════════════════════════════════════════════════════════════════════════════════════════════════╩═ Narrative (Asus USB 2.5G NIC)
║ ┌────── Closet ──────┐   ┌─────────────── Bedroom ──────────────────────────────────────────────────────┐
╚═ UniFi Switch Flex XG ═╤═ UniFi Switch Flex XG ═╦═ Byarlant
   (PoE)                 │                        ╠═ Narrative (Cable Matters USB-PD 2.5G Ethernet Dongle)
                         │                        ╚═ Jesta Cannon*
                         │ ┌─────────────── Media Center ──────────────────────────────────┐
Notes:                   └─ UniFi Switch 8 ─────────┬─ UniFi Access Point nanoHD (PoE)
═══ is Multi-Gigabit                                ├─ Sony Playstation 4 
─── is Gigabit                                      ├─ Pioneer VSX-S520
* = cable passed to Bedroom from Media Center       ├─ Sony XR65A80K (Google TV)
** = cable passed from Media Center to Bedroom      └─ Work Laptop** (Startech USB-PD Dock)

 

Retired/Other:

Spoiler

Laptop (Rozen-Zulu): Sony VAIO VPCF13WFX | Core i7-740QM | 8GB Patriot DDR3 | GT 425M | Samsung 850EVO 250GB SSD | Blu-ray Drive | Intel 7260 Wifi (lived a good life, retired with honor)

Testbed/Old Desktop (Kshatriya): Xeon X5470 @ 4.0GHz | ZALMAN CNPS9500 | Gigabyte EP45-UD3L | 8GB Nanya DDR2 400MHz | XFX HD6870 DD | OCZ Vertex 3 Max-IOPS 120GB | Corsair CX430M | HooToo USB 3.0 PCIe Card | Osprey 230 Video Capture | NZXT H230 Case

TrueNAS Server (La Vie en Rose): Xeon E3-1241v3 | Supermicro X10SLL-F | Corsair H60 | 32GB Micron DDR3L ECC 1600MHz | 1x Kingston 16GB SSD / Crucial MX500 500GB

Link to comment
Share on other sites
Link to post
Share on other sites
Posted
  • Author
10 minutes ago, AbydosOne said:

Make sure your port forwards are both UDP and TCP.

Like this ?

image.png.ded75edebc95265021101653ce6dac9e.png

 

Changed and applied.
Still doesn't seem to work 🤔

 

Might it have to do with my local net being on the "default" 192.168.x.x range instead of 10.10.x.x? I'm a nocive when it comes to network stuff.

Tried changing the dynamic range to that in NAS app but no results.

Link to comment
Share on other sites
Link to post
Share on other sites
Posted
6 hours ago, Aleph256 said:

Like this ?

image.png.ded75edebc95265021101653ce6dac9e.png

 

Changed and applied.
Still doesn't seem to work 🤔

 

Might it have to do with my local net being on the "default" 192.168.x.x range instead of 10.10.x.x? I'm a nocive when it comes to network stuff.

Tried changing the dynamic range to that in NAS app but no results.

I would try using this site to scan those ports to make sure they are actually open. 

It is possible that they are blocked by something else or your isp.

https://www.grc.com/x/ne.dll?bh0bkyd2

Link to comment
Share on other sites
Link to post
Share on other sites
Posted
  • Author
8 hours ago, m9x3mos said:

It is possible that they are blocked by something else or your isp.

Well that was the start of a solution - appears all three ports are closed.

Tried setting them up open as a custom rule in my router's firewall... Buuuuuut seems like going for a custom filtering rules borks my Internet traffic. Thanks, ISP. I'll be doing some more digging around on that subject.

 

10 hours ago, Electronics Wizardy said:

I'd try using OpenVPN here and see if that works.

Eeeeeeeh I've considered it but I've read it's more of a hassle to set up on the accessing device?

Link to comment
Share on other sites
Link to post
Share on other sites
Posted
6 hours ago, Aleph256 said:

Well that was the start of a solution - appears all three ports are closed.

Tried setting them up open as a custom rule in my router's firewall... Buuuuuut seems like going for a custom filtering rules borks my Internet traffic. Thanks, ISP. I'll be doing some more digging around on that subject.

 

Eeeeeeeh I've considered it but I've read it's more of a hassle to set up on the accessing device?

Shouldn't be more of a hassle. Depends on the config, but commonly there is a config file you load and then your good.

 

Does your router support hosting a VPN server?

Link to comment
Share on other sites
Link to post
Share on other sites
Posted
  • Author
5 hours ago, Electronics Wizardy said:

Does your router support hosting a VPN server?

Would probable be much less of a hassle if it could, but alas no - the downsides of an ISP-provided router.

 

I have a coworker who's good at all this networking stuff, I'll pick his brain tomorrow.

Link to comment
Share on other sites
Link to post
Share on other sites
  • 2 weeks later...
Posted
  • Author

So... Back to the grinder.

Turned out the aforementionned coworker is away for a few weeks, and I've been busy these last days.
 

Tried again by setting up an OpenVPN server this time.
The flip side is: it works - I do get notifications of the user logging in on the ASUSTOR side of things.

The down side:

  • I can't seem to access my NAS as I would expect to do
    • Now that I'm connected, I should be able to just use the local IP and port, right?
  • Being connected to the VPN locks me out of the Internet (throws a NAME_NOT_RESOLVED error, which makes me think of a DNS issue)
    • I did check to enable the base 8.8.8.8 Google DNS

 

What's the (probably obvious) step I am missing?

Link to comment
Share on other sites
Link to post
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
 Share
Go to topic listing Servers, NAS, and Home Lab

×