Subscriber Discussion

Choosing A VPN Router

JH
Jay Hobdy
•Feb 25, 2017
IPVMU Certified

Our typical install consists of Dahua DVR/NVRs. We usually use a simpleLinksys router and use DYNDNS. But we are looking for a secure solution. In all fairness, this is how I was taught, and how my former company did it. Now I know better

I read the article here https://ipvm.com/reports/vpns

I plan on having an IT company that has a much better understanding of this, help us with this. My goal is to find a device that can handle the uploading of 16 to 25 cameras. In reality I do not think it will be more than 4 cameras as they are all using their mobile device. I can not remember the last time I helped someone configure SmartPSS that was not on the local network.

What are the steps here?

Calculate upload bandwidth of one NVR?

Would this device work? IPsec VPN throughput: 110 Mbps

http://www.linksys.com/us/p/P-LRT214/

I have a client running SmartPSS with 4 monitors and they have roughly 60 cameras up at any time. When I go to system performance, it shows an average of 30-35 Mbps. Is that an accurate representation of what they are downloading? Can I use that number to conclude that the Linksys with a VPN throughput of 110 Mbps would work?

I am asking the IT company to handle finding a client for the mobile devices.

(1)
JH
Jay Hobdy
•Feb 27, 2017
IPVMU Certified

Shameless bump

 

Surely with all the talk of VPN, someone has an opinion

Avatar
Ethan Ace
•Feb 27, 2017

The integrators I know typically use SonicWall's TZ series or Cisco. The Ubiquiti USG is starting to become more popular, as well, but I don't know many using it yet.

I'm not on top of models enough to comment on the Linksys you linked, but let me see if I can get an opinion from someone else.

UI
Undisclosed Integrator #1
•Feb 27, 2017

Don't use a Linksys... I'm with a legitimate tech company and for the love of god, don't use Linksys, Dlink, or Netgear... ever. 

I would look at a Sonicwall SOHO or something down those lines. We have had good luck with the sonicwalls, despite configurations being a bit of a PITA, they have been reliable and have passed our vulnerability tests for multiple clients.

As for throughput, when you look at it, base it on your internet connection, the best performance you are going to get is based on your ISP upload. 

 

JH
Jay Hobdy
•Feb 27, 2017
IPVMU Certified

 

 

Is there a licensing issue here when using mobile devices? I thought I read that on another site.

 

Are these Dell branded, built devices or just resold by Dell?

 

 

What do these different speeds mean?

 

I am assuming I am looking at the VPN throughput at 100 Mbps?

 

Most of our clients are limited to 10-15 Mbps upload speed so it seems like this router will easily outpace the upload speed.

 

Am I looking at this wrong?

UI
Undisclosed Integrator #1
•Feb 27, 2017
In reply to Jay Hobdy

Dell Purchased Sonicwall several years ago, so under the dell sonicwall flag. 

Since this is an actual firewall, it will proactively monitor packets and traffic looking for bad things, so that is what a lot of those numbers mean. Basically you should be fine, and it should do 100Mbps throughput on a VPN. 

These things are capable of doing L2TP, and their documentation is a bit vague about how many but I believe it was like 5-10 L2TP connections at once, so depending on how many people you have connecting in you will need to factor that in. 

(1)
Avatar
Ethan Ace
•Feb 27, 2017
In reply to Undisclosed Integrator #1

Dell actually spun them back out in 2016. They're owned by some equity group now. Dell still offers them for sale, but they're not owned anymore. 

U
Undisclosed
•Feb 27, 2017

Concur.  Don't buy consumer grade swill from vendors who reliably ship exploitable kit (like D-Link.)  Use at least a mainstream SOHO-class device like the Dell/Sonicwall boxes.

P.s. don't use dynamic dns, don't connect to the public internet without secure gear, and please change the passwords so we don't have to read about you in Forbes (after we all stop snickering at the Bay Alarm article.)

 

 

JH
Jay Hobdy
•Feb 27, 2017
IPVMU Certified

 

I pray you read about me in Forbes, just on a good note !!

 

http://www.firewalls.com/products/firewalls/sonicwall/sonicwall-tz/soho

 

On that site, they say 1 client VPN license. Does that mean only 1 client can connect at a time?

 

I really do not see more than 1-2 people needing connection, and doubtful if at the same time.

 

If I have a site that does not have static IP's, what alternative to Dynamic DNS do I have?

UI
Undisclosed Integrator #2
•Feb 28, 2017

Mikrotik for larger installations and ASUS routers for the embedded DVR/NVR installs.

JH
Jay Hobdy
•Feb 28, 2017
IPVMU Certified

I was talking to my IT guy today and he brought up a good point. From our office we will have multiple clients that we would want to VPN into at one time. Especially if we are doing status checks on equipment, we do not want to keep logging in to different sites.  Is this common to have a dashboard or a system that allows an integrator to connect to multiple clients at the same time? He is going to look into the Sonicwall and see if it allows that

UI
Undisclosed Integrator #3
•Mar 01, 2017
In reply to Jay Hobdy

Are you saying that you want the vms servers at your customers sites connect to a network on your office? I guess it will be doable. You can set some of these things up so that the different clients (the vms servers) can't talk to each other. This would be important, so that one customer can't get access to another customers vms server.

If you, however,  want to have a vpn server on the customer side, making the whole remote network available to your local office, I see a problem. Many of the sites will probably use the same private ip network subnets. lobbing them together in a site-to-many_sites fashion would make your local workstations confused, I think. If 4 sites have the vms at 192.168.0.10, the vpn server at your end would not know which customer network to route the traffic to. It would probably just pick the last network to update the routing table on the vpn server in your office. It would probably be possible with NAT, but then you are dealing with a way bigger configuration job than just connecting to them one by one.

But what do I know. The IT guys probably have some technique for this, that I am not aware of.

Avatar
Jon Dillabaugh
•Mar 01, 2017
Pro Focus LLC

Are you trying to do site-to-site VPN, or server-client VPN? It's hard to decipher. 

Site-to-site would link two routers and entire networks, which could be a lot of traffic. 

Server-client style would have one VPN router (or a server) host the VPN and individual clients would connect independently. The clients could be using any VPN enabled device. 

JH
Jay Hobdy
•Mar 01, 2017
IPVMU Certified

Our initial desire was a vpn solution that allowed us to secure the camera system and allow remote access from mobile devices.

 

Then the IT guy asked me if we wanted access from our office. We typically look at our client's system weekly to check cameras, etc. so we would want access from our office as well.

So we want both.   if possible. or at least the capability to set it up later without replacing customer hardware 

New discussion

Ask questions and get answers to your physical security questions from IPVM team members and fellow subscribers.

Newest discussions