Verizon updated my router and broke my long-running system for remote control of my home control/security system! Is there a non-browser program (Win 11) which can function through a tunnel (VPN) to access/control Hubitat? (My previous system using a browser worked great. Grrr.) Thank you!
Never tried it, but subsystem for android will run play store apps on windows 11.
Can you share more about how you previously accessed the hub remotely and what Verizon changed about your internet connection recently?
I’m not 100% clear on the problem you’re trying to work around.
There’s no way to reach the hub via SSH or other dedicated protocol for remotely accessing a server, if that’s what you mean.
If your previous system worked great using a browser, what is preventing you from accessing the hub the same way?
Is the problem because your new "updated router" no longer has a public IP on the WAN port, and the ISP has given you a CGNAT address?
Seems like the easiest option at this point would to just purchase Remote Admin. It isn't that pricy, especially if if you bundle it with another subscription like Hub Protect.
Have you thought about using BlueStacks to run the Android Hubitat app on Windows? That might be an option, though I have never tried it.
Some more detail: My home setup: A remote laptop with WireGuard connects to a DDNS site which forwards the tunnel to my home router, then through a port to my WG server, then to my home LAN. It DID work great for several years! Now it only opens the sign-in page of my router (!) and won't go further. I have checked router settings (e.g. port-fwd'ing), the DDNS site settings, etc. No luck. (Also: Part of my system - a non-browser program on my laptop for remotely handling a security DVR - STILL WORKS thru the tunnel, etc, just fine! So my system seems to work IF I'm not using a browser to go through the tunnel, etc, to my server and Hubitat.) (Also, I noticed the sign-in page on the router has changed which leads me to believe the router was updated. It's a Verizon Fios router. ) Thanks for responding!!
No need to reply more than once, everyone can see each one of your replies.
What you’re describing seems strange though, since it sounds like your wireguard tunnel is still functional?
It just doesn’t make much sense if “browser-based” connections to LAN devices are failing but “non browser-based” connections are unaffected.
I’m guessing something’s up with either your DDNS or the wireguard configuration?
You can bypass the DDNS completely if you try to temporarily establish a wireguard tunnel using your router’s WAN IP instead of DDNS hostname. If that works, DDNS was the problem.
If that doesn’t help, then perhaps sharing more details of your wireguard client configuration could provide some clues.
(Sorry for the multiple replies.) Since my NON-browser program works thru the WG tunnel to/thru the DDNS site, then to/thru my router to my server and on to the DVR successfully, I "assumed" the problem getting to the Hubitat is using the browser to do that. Could be wrong? (The browser makes it thru the tunnel to the DDNS then to the router; it's there that it stops (and opens the sign-in page). The non-browser software goes straight thru like they both used to do. I tried several browsers with the same result.) I'm not a comm guru (obviously), so I don't know what the router could be doing to the connection - if that is the problem - or what to do about it. Getting hold of Verizon help is always "challenging" though I could try after this long weekend. Thanks again for your response!!
ALSO, WireGuard is used for both browser and non-browser. Also, neither will work if the WG tunnel is not turned on!
VPN clients can operate as "Split Tunnels", which means some apps will always use the tunnel, while other apps will use the local access.
To confirm that your browser is routing through your VPN, open https://whatsmyip.com/ on the browser and confirm if the address shown is your "home" address, or your "current" remote location.
Are you sure the DHCP setup was preserved? Your hub has the same local LAN ip as before?
I’m not an expert but this doesn’t seem like a plausible explanation to me.
What exactly are you entering in your web browser to try to get to the hub once your laptop is connected through the wireguard tunnel?
Ok so i was trying to conceptualize how this is suppose to work. I have a few things.
First lets define a few things.
- Dynamic DNS doesn't do anything with tunneling perse, unless the service is more then DDNS all it does is tell your client devices what the external IPV4 address is for your ISP provided router.
- The term VPN is heavily overused now a days. It sounds like what you are trying to do is create a site to site VPN vs simply a client talking to a remote remote network over a VPN. A Site to Site VPN effectively takes your VPN device and turns it into a router. Are you trying to do all this stuff from the Laptop with Wireguard, or are you trying to use it as a way to access the home network?
- I suspect what you mean by browser is simply traffic over port 80 or port 443. You can use CURL and connect on those ports and that is not with a typical browser. Allot of apps out there are HTML 5 based now and just encapseluate them selves to look look like a traditional app. Even the Hubitat app is effectlively functioning from a HTML browser.
So the first question is why are you getting the Login to your router when you try to connect? What i suspect is happening is that you are using the DDNS name which points to the router and then simply on port 80. This is the only thing that makese sense. So when you try to connect what is the hostname/IP you are using? What happens if instead of using DDNS you just put the IP of the Hub in the browser window? DDNS shouldn't have anything to do with this outside of allowing the WG connection to find the external ip of the ISP router.
What are your port forwar rules. If you have port 80 forwarded to the Hubitat, that is a bad idea. This opens it up to the internet and your VPN isn't protecting it. Also some routers will not allow you to forward port 80. It could be as simple as that is the problem if that was what you were trying to do.
You may also have some routing issues as well since Wireguard would need to be the intermediary between your ISP Router and the remote network.
- Can you epxlain what port forwards you have setup?
- What are the IP Subnets on each part of the wireguard setup?
- What the URL is that you are using to connect to the hub?
- What happens if you use the Hub's local ip vs the DDNS name?
Everyone has given me a lot to ponder and checkout! Thanks! It will take a bit to do this, so patience is requested. Soon!
((I'll send the following along before addressing the questions raised. Later...))
First, my hardware setup: A Verizon/FiOS router has an eth. connection to an RPi (the "server"). On the backend of the RPi I have a LAN (no connection to the router!). The LAN has two devices attached: one, eth. to the C7 Hubitat (the Hubitat's only connection other than to its sensors), and two, an RPi wifi connection to my sec. DVR (its only connection). (The intent was to isolate that LAN from anything other than the backend of the RPi.) (By "backend" I mean the decrypted "output" of WireGuard from the RPi end of the tunnel. Also the input to the RPi/tunnel for the return data from the devices. I.e. "comms".)
My Win 11 desktop has an eth. connection to the router (no wifi). It is configured as a "remote" device for WG and has a WG "interface" file for encrypted connection. If I don't turn on WG, it behaves as a general internet PC (and cannot connect to the RPi, etc.). It can, however, connect to the router via 192.168.1.1 e.g. for setting port-forwarding.
I have a Win 11 laptop and an Android phone which are also remote WG devices.
Second, my software: Starting from the outside, the three remote devices have WG installed with individual "interface" files for setting up the encrypted connection.
The "Endpoint" of the connections (in the interface files) is xxx.yyy.org:zzzz, my DDNS website/url followed by the port-number(zzzz) that is port-forwarded in my router to the RPi. (Thus the tunnel is set up between the remote and the RPi via the DDNS site.) The DDNS site does nothing but forward my connection to the up-to-date address Verizon has assigned.
((I'm sure my description of this setup lacks sophistication, but I hope it makes sense!))
Now, more on software: My sec. DVR company provides a P2P Win program to comm with the DVR. I gave the DVR a fixed IP and port-number within the RPi LAN. IF WG is activated on a remote, this P2P program can comm via the tunnel to the RPi and on to the DVR. (This always works!) IF WG is inactive, the program will NOT connect to the DVR because it can't get to/thru the RPi. Other than this, I don't know how the program comms with the DVR.
To comm with the Hubitat from my remotes, I need to use a browser. What previously worked was my entering xxx.yyy.org (as above) with WG turned on. It just always worked! Not now.
(A note: I temporarily connected the Hubitat directly to the router, entered its assigned IP into a browser, and opened up the Hubitat. It worked fine and thus confirmed the problem is NOT with the Hubitat itself.)
More later!
I believe that when you enter that URL (with no port number) you are attempting to connect to port 80 of your Verizon router (the router console interface).
Verify that your browser is actually connecting to your home's VPN by opening https://whatsmyip.com/ in the browser. The address that is shown should be the public IP of your home, and not the IP of your current remote location.
If this test is successful, then enter the LAN address of your hub into the browser, for example 192.168.1.99. In other words, try to connect the same way you would as if you were on your local LAN.
Thanks. The WG “interface file” for the tunnel has an “endpoint” with :port# on the end of it. I assume that’s how my P2P DVR program connects successfully. I’ll look at whatsmyip…
I should have noted: my Hubitat is NOT connected to my ISP router, only to the output of the RPi (server). Thus I can’t connect directly to it via the ISP router. (I hope I understand what you are suggesting! Maybe not…)
Yes, the port number in the WG config file, instructs WG to connect to the Verizon router on port wxyz. You would have set up a port forwarding rule on the Verizon router to direct port wxyz requests to your Pi.
When you try to connect via your DDNS address (no port number) , you are only making the request to the Verizon.
After confirming that your browser is actually connected to your home network (using whatsmyip) please try to connect using the LAN IP of the hub, not the DDNS name.
I fear I may have caused confusion by not distinguishing between the LAN of the ISP router and the LAN from my RPi server! Let’s call the latter one (RPi) the PLAN (Personal LAN). Sorry.
Prompted by your comments, I just ran an experiment: On my desktop (with WG activated) I entered the PLAN IP for my DVR into my browser – and it opened the sign-in page on the DVR!! I am surprised and not sure how it did that! That did NOT work for the hub IP, however; it wouldn’t connect. Baffling again.
I’m heading offsite shortly and will try some of this from my remote laptop. Thanks again!