Remote Access to rPi.

[Phil23]

Hi All,

Looking for some assistance in configuring remote access to a Pi I'm setting up with CMX for a relative.

To date I've done a lot of searching, but seem to be going in circles.
I have a rPi-3 that I've installed the image on, no great problems there.

I can access it inside my LAN with both Putty & WinSCP.

Problem is that once it's installed it will be sitting on a Wireless NBN service that is behind CGNAT.
So Port forwarding on the clients router won't be available.
I think a VPN will be to difficult given the ISP's "Free Wifi Modem" & also the presence of CGNAT.

Teamviewer is often suggested, but have tried that over a GUI build, but the whole lot becomes too memory hungry for the Pi3 & it all grinds to a halt.

All my searching to date suggests that a reverse SSH connection or tunnel is the solution, but examples I see vary greatly & I'm finding it hard to work out what to implement.

I read also of local proxies or agents as a mid hop.

Has Anyone out implemented a solution to solve this.

Thanks

Phil.

PS; My own internet connection here is a full public static IP so I assume whatever goes on the Pi creates a persistent connection to that IP or a relay agent behind it.

[jlmr731]

if the pi has a GUI you can try something like realVNC its free for up to 5 computers no need for any port forwarding. works good on my linux systems ( use it as a backup way in if my openvpn goes down) there are others programs like it but have great luck with realvnc and pretty light on resorces for the server, and the client will still work with low bandwidth.

[rogerthn]

I do have a OpenVPN server on a Raspberry PI to enable access to my local LAN from Internet.
You need a, known public IP and port forward of one UDP port.

[freddie]

How about a service like ngrok?

[Phil23]

if the pi has a GUI you can try something like realVNC.

I've been using the internal VNC client for Lan Access, but was not aware of it's Cloud functionality.
Gave that I try yesterday & it may well be a good solution. Just needing the Gui.

I do have a OpenVPN server on a Raspberry PI to enable access to my local LAN from Internet.
You need a, known public IP and port forward of one UDP port.

Port Forwarding is the problem here with CGNAT.
You have the Internet facing Shared Public IP --> Different WAN IP --> Local Subnet IP.
No Control over the ports between Public IP & WAN.

That said, my router supports OpenVPN, so if I configured it as the server, I may be able to have the pi dial in regardless of the CGNAT.

How about a service like ngrok?

Stumbled on that one too.
But didn't spend enough time digesting the information.

Thanks All.

[jlmr731]

Good to hear it may work for you, it was the one thing I thought of if you can open any ports, plus pretty light on system. There are several desktops that are good to use for a pi like xfce, mate i know there may be others best to look for light weight desktop environments.

[HansR]

I tried to install openVPN yesterday and it failed.
Asked support about it they said Debian was not supported, only Ubuntu. Replied back why do they supply the installation? Anyway: can't install on Debian.

The answer:

Access Server can be installed on Debian OS on a none ARM based architecture only.
Access Server supports installation only to Ubuntu20 installed on ARM64 base architecture.

So in your case, since your running Debian on RPI, its not supported. You need to run Ubuntu20 then install Access Server.

[rogerthn]

That said, my router supports OpenVPN, so if I configured it as the server, I may be able to have the pi dial in regardless of the CGNAT.

I do have VPN access to my sons LAN via an ASUS RT-AC87U

I tried to install openVPN yesterday and it failed.
Asked support about it they said Debian was not supported, only Ubuntu. Replied back why do they supply the installation? Anyway: can't install on Debian.

The answer:

Access Server can be installed on Debian OS on a none ARM based architecture only.
Access Server supports installation only to Ubuntu20 installed on ARM64 base architecture.

So in your case, since your running Debian on RPI, its not supported. You need to run Ubuntu20 then install Access Server.

Sorry but I've lost my detailed installation notes
Some details from my Raspberry Pi 3 Model B Plus Rev 1.3

Code: Select all

systemctl status openvpn.service
● openvpn.service - OpenVPN service
   Loaded: loaded (/lib/systemd/system/openvpn.service; enabled; vendor preset: enabled)
   Active: active (exited) since Sun 2021-04-25 15:31:08 CEST; 1 months 28 days ago

Code: Select all

cat /etc/os-release
PRETTY_NAME="Raspbian GNU/Linux 10 (buster)"
NAME="Raspbian GNU/Linux"
VERSION_ID="10"
VERSION="10 (buster)"
VERSION_CODENAME=buster
ID=raspbian
ID_LIKE=debian

Code: Select all

apt show openvpn
Package: openvpn
Version: 2.4.7-1
Priority: optional
Section: net
Maintainer: Bernhard Schmidt <berni@debian.org>
Installed-Size: 1,019 kB
Depends: debconf (>= 0.5) | debconf-2.0, libc6 (>= 2.28), liblz4-1 (>= 0.0~r130), liblzo2-2, libpam0g (>= 0.99.7.1), libpkcs11-helper1 (>= 1.11), libssl1.1 (>= 1.1.1), libsystemd0, iproute2, lsb-base (>= 3.0-6)
Recommends: easy-rsa
Suggests: openssl, resolvconf, openvpn-systemd-resolved
Homepage: https://openvpn.net/
Download-Size: 426 kB
APT-Manual-Installed: yes
APT-Sources: http://raspbian.raspberrypi.org/raspbian buster/main armhf Packages
Description: virtual private network daemon
 OpenVPN is an application to securely tunnel IP networks over a
 single UDP or TCP port. It can be used to access remote sites, make
 secure point-to-point connections, enhance wireless security, etc.
 .
 OpenVPN uses all of the encryption, authentication, and certification
 features provided by the OpenSSL library (any cipher, key size, or
 HMAC digest).
 .
 OpenVPN may use static, pre-shared keys or TLS-based dynamic key exchange. It
 also supports VPNs with dynamic endpoints (DHCP or dial-up clients), tunnels
 over NAT or connection-oriented stateful firewalls (such as Linux's iptables).

[HansR]

@rogerthn: Thanks. Must be the difference between Access Server and OpenVPN Connect.
Anyway, I'm going to try ngrok first now.

[HansR]

Btw: I tried ngrok an that is the easiest way I think. If you really want it on a daily basis with the same URL/Port it costs ($5/month).

[ConligWX]

I just use: https://github.com/angristan/openvpn-install

then register a domain with google domains, and use google DDNS (same protocol as DynDNS and its only £10 a year)

edit the ovpn file to add your domain name. and thats it.

[sutne]

I use realVNC. https://www.realvnc.com/en/raspberrypi/
It can be used locally or via a cloud service. It is included in Raspbian, only needs to be enabled.

And it is free for private users.

I am very satisfied with this solution.

[HansR]

I use realVNC. https://www.realvnc.com/en/raspberrypi/
It can be used locally or via a cloud service. It is included in Raspbian, only needs to be enabled.

And it is free for private users.

I am very satisfied with this solution.

It wasn't installed on my RPi so I installed it. I don't have the gui so can't get into it. And then it's getting complex. Or am I missing something? How do I use it in commandline mode?

[sutne]

There is something here about running Virtual desktop or SSH:
https://help.realvnc.com/hc/en-us/artic ... d-line-0-6

[liddelljs]

Hi all,
Bit late wading into this one and doubt it will solve @Phil23's original problem but I have used PiVPN for a few years now (https://www.pivpn.io/) for remote access to my RPI's and love it. Specifically written for RPi and has a nice installer to guide installation for those of us with limited knowledge. The latest version offers wireguard as an alternative to OpenVPN (https://www.wireguard.com/). User beware - wireguard doesn't offer password access (OpenVPN does).

Cheers
Steve