Home Network Question

GadgetBoy

Active Member
Here is my scenario:

I have two PC's on my network that I want to access from outside. One is my Homeseer box and the other is my Media Center box. Obviously, access to HS is for automation things and access to my Media Center box is to use the application Remote Potato.

Currently, my HS box is exposed (i.e. if I go to my IP address, I get the HS page). I want to also be able to access the Media center box without having to use port forwarding (i.e. http://123.1.1.1:8080), since my company blocks web sites that have ports specified after them.

I hope I am asking the question correctly.

Any suggestions?

Thanks in advance,
GB
 
It would help if you provided the name and model of your Internet router(ie. cable modem, wireless router). Also, nowing your ISP could help.
 
Signal 15 is correct. In my opinion you should not expose anything directly to the internet without some sort of security and firewalls.

I happen to use Microsoft Home server for that type of access but that was only a side benefit. I actually wanted the backup capability for my 3 computers.

The suggestion of OpenVPN is a good idea. Also, some of the higher end small business routers provided VPN capability in the past but they were not cheap.
 
It would help if you provided the name and model of your Internet router(ie. cable modem, wireless router). Also, nowing your ISP could help.

FiOS.

The router is the one that comes with the installation - I'm not sure exactly which one. I will check when I get home tonight and post it.

Thanks.
 
When you enter the external IP address (from your ISP) now, from a remote location, you said that you are directed to your HS computer... correct? As is, does it require login information to connect to it? If not, can you add it?

As far as accessing the second computer, assuming you can get onto the HS machine, can't you just remote desktop from the HS machine to the other one?

The difference I see with doing a VPN is that it essentially just adds your remote computer to the same network. Basically like adding a 3rd computer to your home network. I am not sure what your HS setup or other computer have running as far as accessing them, but you would still need to enter local IP address info (if they are running server software such as Apache or other) to or remote desktop to those machines.

Someone please correct me if I am wrong... I am definitely not a network engineer, but I think I am correct... No??
 
If the devices being accessed have login pages does that suffice for security? I have ports exposed (and not SSL connection either) and have always wondered about that.

So if that is ok I have a few ideas:

1. Windows remote desktop, or some other brand. I like this because it's free.

2. Change the port to 80 on device being accessed, I assume you can't do this because HS is on 80 now though.

3. Use a proxy browser. Not sure if this would work, but it sure would be easy. There are a ton of these services. I have none to reccomend, maybe someone else could help with that. If your IT dept is that strict, they might have these sites blocked though.
 
I use LogMeIn for everything.
Use the free version it works awesome.
You don't have to mess with forwarding or setting up a dmz or dyndns.

Here is my scenario:

I have two PC's on my network that I want to access from outside. One is my Homeseer box and the other is my Media Center box. Obviously, access to HS is for automation things and access to my Media Center box is to use the application Remote Potato.

Currently, my HS box is exposed (i.e. if I go to my IP address, I get the HS page). I want to also be able to access the Media center box without having to use port forwarding (i.e. http://123.1.1.1:8080), since my company blocks web sites that have ports specified after them.

I hope I am asking the question correctly.

Any suggestions?

Thanks in advance,
GB
 
I have a similar setup with wanting my HA box remotely accessible, and I am using a secure shell (copSSH) and TightVNC for what I thought (being no network expert) was as good and secure a setup as a VPN. Am I wrong? I had to forward one port but have a private key logon that is needed for access.
 
Depending on where the OP works, there's a good chance that if they block specified ports, they probably also block things like VPN and LogMeIn.

Gadgetboy - silly question but I'll ask anyways... when you've tested this at work, have you specified HTTP://xxx.xxx.xxx.xxx:8080 ? If you don't put the HTTP in front, many browsers don't know which protocol you're after and won't connect.

It depends on the type of place you work - fortune 100, strict IT, smaller shop? They have different standards.

Worse yet, many ISP's now block port 80 to your house, as well as some other commonly used ports for web-hosting, because your TOS don't allow running a web-site at your house (but as long as you have port flexibility, there's usually ways around this).

I'd test the remote access options first, like LogMeIn or TeamViewer or GoToMyPC - or any of those to see if you can find one that's not blocked - that's your simplest solution; if not, it might be helpful to see if there's any sort of hosted proxy service that'll handle the translation for you - but I'm not aware of any offhand (would require some fancy googling).
 
If he can already get to and access the HS machine, why the need to setup and use other services such as LogMeIn? What do they provide other than a login/pw? Not to mention the fact that they are storing your IP (and possibly login) information on their servers... no thanks for me.

Personally, Im not sure how this is any better than having login information of your own. At least that way, you are the only one that has the information.

In any case, the OP did mention that he wants to be able to log into more than 1 machine. Is that easy to setup with said services, if more than 1 machine needs to be addressed on the same internal network?

I guess the other thing for me personally, is the idea that if this was only to setup access to my HA machine(s), I really wouldn't feel all that vulnerable if someone hacked into it. Not to mention the fact that someone hacking into your machine, would practically have to target you specifically. How is said person going to get your IP information? Login and password? What is so great about you and your life that a hacker wants to target you? Otherwise, if it's a random attack, are they going to know/understand how to use Homeseer, CQC, or other automation software that is on said HA machine? If so, the worse thing I see happening is them changing my lighting scenes, or irrigation schedule, etc. It's not as if I would have files stored on this machine that were of extreme importance, other than the configuration files (which I would also have backed up elsewhere).

Maybe it's just me that is naive (and someone please advise if you have had an experience of your own), but I am more worried about my own online shopping and someone stealing my debit/CC information and incurring charges from someone else. And in all reality, it doesn't even have to be online shopping. There was a local fishing tackle supply store, who had their CC information stolen a few months ago. There were probably a couple of hundred local people who had to report fraudulent charges. I guess I just don't see the big risk in having my HA machine hacked, vs. other things to worry about. I have also had similar discussions about WiFi security. I'm not going to have my connection wide open for anyone to access, but why the need for hidden SSID, encryption, MAC filtering, AND firewalls, etc. If a hacker is targeting you, he is going to get in, you only added MAYBE a couple of hours to his work, it's still not impossible to get into. So other than a targeted attack, which you aren't ever going to stop, why would your neighbor or other go through all the work of getting in to check his email? It's a lot easier for someone who is just trying to gain internet access to stop into the local coffee shop, hotel parking lot, or the hundreds of other places that now have free WiFi. That said, my SSID is hidden and I currently have no encryption or other setup. So if any of you wants to sit in my driveway and guess around for a while as to what my SSID is, you would be free to use my internet connection if you figured it out :)
 
I have a similar setup with wanting my HA box remotely accessible, and I am using a secure shell (copSSH) and TightVNC for what I thought (being no network expert) was as good and secure a setup as a VPN. Am I wrong? I had to forward one port but have a private key logon that is needed for access.
That is very good security and I'm doing pretty much the same thing.
I have DD-WRT on my router and use SSH RSA-2 private key security along with a password hitting a non-standard port to authenticate to. Once I do I can port redirect anything I need, such as my Elk M1 interface, CCTV DVR, VNC, and even map drives. I also set my router up with DDNS for easy IP management.

It is as secure as a high-end VPN which is much more secure than PPTP (the most common and easiest VPN setup.) If you can wrap your head around redirecting ports then it is a viable solution with excellent security.
 
Exposing your home automation webserver isn't just a security issue. What if there is a worm outbreak, which scans machines really aggressively, and crashes your home automation server because the internal webserver can't handle that kind of behavior (something similar has happened in the past). Now your home automation is offline, which could become a real problem if you rely on it for critical things (or if you don't want to make the significant other mad ;)).

As for hiding your SSID, it's useless, your network can still be found. But since you aren't using any encryption, you make it pretty easy for others to get on your network, and snoop your credit card transactions ;) Then you also have to worry about someone using your wifi network to download illegal materials (has happened/been documented), so you really need to be more careful with your wireless.

I would definitely try LogMeIn as well. If the MCE app is HTTP based, then you could set up a reverse proxy, but this is where things get complicated. You could also run an SSH server on that port, and then use SSH port forwarding on the client side to get into any machine you want. Lots of options!
 
Back
Top