A few years (!) ago, I wrote about using accessing your files from anywhere using a custom DDNS setup. In the 2 years I've been in Chicago so far, my entire apartment building has shared one IP address. That meant my custom DDNS solution couldn't work anymore, and so I looked into other ways I could access my files from anywhere. I couldn't find any.

There are things like ngrok that can expose local servers through tunnels, but that wouldn't work for my on-demand use case where I'd remotely turn on my computer to access files through SMB.

I looked into getting a NAS such as QNAP or Synology but decided the hassle and cost of setting up these storage devices wasn't worth it (versus the amount of times I'd actually need access to all my files).

I settled for the obvious solution of just copying all important files to my phone whenever I traveled for extended periods of time. That actually wasn't so bad. However, my building recently got switched to Comcast. I had mixed feelings about the change: there are lots of negative reviews about Comcast, and I never really did have any issues with Access Media 3 (despite the horrible reviews it has).

The first thing I realized with the new Comcast service was that I had my own IP address again. That opened up many doors, including finally being able to again have on-demand access to all my files from anywhere. The first thing I did, however, was purchase a 3 year VPN service from NordVPN. Having a real IP address again (as convenient as it is) sounds a bit scary.

The next thing I did was use my CpanelDdns library to dynamically set the A record of a domain to point to my IP address. I used my old Android phone (that I use as a clock) and MacroDroid to setup the recurring HTTP request.

Next, I wanted at least remote access to my computer. Being able to turn it on was a nice first step. I set up a port forward to my computer and used Wake on LAN to send the magic packet.

With the computer turned on, I wanted VNC access. I set up a port forward to my computer and connected via 4G on my phone. When my screen appeared, I suddenly felt like something was fishy. I don't think VNC has any smart way of rate-limiting. I found "Expert" settings that could set a blacklist threshold.

VNC blacklist expert options

What that does is prevent the connecting client from re-authenticating if the password is wrong. I changed that to 1, and set the timeout to 600 seconds. That means anyone attempting to brute-force my password would only get one try, and they'd have to wait 10 minutes between each guess. I then found out that VNC blacklists just the IP when there is authentication failure. It seems like there's so many ways to just get around whatever VNC decides to blacklist. What I wanted was something like using a certificate to authenticate rather than using a password. Something like SSH. Turns out there is a way to VNC over SSH. But that wouldn't work for my use case of connecting with my phone.

At this point, I realized what I really needed was a VPN server. A simple search for "openvpn server windows" doesn't really show too many useful resources. The first step is to just check out the guide on Reddit and the "official" Easy Windows Guide. They're both somewhat similar, so either one will do. The trickiest part for me was finding out what settings I should keep and what I should change.

In order to route client traffic through the server, this setting must be enabled:

push "redirect-gateway def1 bypass-dhcp"

The simple warning "(The OpenVPN server machine may need to NAT or bridge the TUN/TAP interface to the internet in order for this to work properly)" is not one to be taken lightly, as I later found out.

Because the server is set to take 10.8.0.1 for itself, it ended up being on a different subnet than other things on my network. I tried changing this to 192.168.1.0 but that had many issues so I gave up on that. I ended up using push "route 192.168.1.0 255.255.255.0" to allow clients to reach this subnet as well. I'm not sure if this does what I expect, but everything works now, so I'm keeping it.

There's nothing too special about the client.ovpn file that needs to be changed.

You must configure the Windows Firewall to allow incoming traffic through UDP to the port your VPN server is listening on.

Configure Windows Firewall to allow incoming requests through UDP

If you set it all up and nothing is working and you have no idea where to start debugging (e.g. is it the port forward that broke, is it even running, etc), it's helpful to know that you can start the server without going through services.msc, with the help of:

$ openvpn ..\config\server.ovpn

When nothing was working at first, I checked the output of this command to find out I had authentication errors.

After figuring all that out, I had successfully connected my phone to my Windows OpenVPN server at this point. However, I couldn't access local SMB file shares. I found out that the OpenVPN TAP network was set to Public, where file sharing was turned off (as it should).

Public network doesn't allow file sharing

There are many ways to resolve this issue, but I ended up going with this simple solution of setting the default gateway to the DHCP server address of the TAP network.

Surprisingly, I still had no access to the SMB share after doing this. I wondered if there were ACLs that only allowed access to file shares in the local subnet. There were.

SMB restricted to local subnet by default

In the Windows Firewall, find File and Printer Sharing (SMB-In). In the Scope tab, add the subnet set for VPN clients.

Add the subnet to allow access

And there you have it. A HUGE caveat of this is I have no idea how to get actual Internet traffic working through this VPN. It seems like I can only access local resources, but that's no problem for me since I only want access to VNC and SMB. Maybe someday I'll figure out how this all works...

January 19, 2019 | 4 comments

Comments

Nice work, Michael!

DD | January 20, 2019

Thanks DD!! :)

Michael | January 20, 2019

Hi Michael, ツツ

MM | February 11, 2019

Hi MM :)

Michael | February 15, 2019
© 2019 Michael Cheng
made in Taiwan