I am not sure if I am adding this question to the right part of the forum so bear with me.
I have 3 veralite devices running in different houses (all UI5 at 1.5.662). One is in stalled locally, one at my parents house, and one at my vacation home. Locally I recently had an issue where the Vera was interfering with my Verizon setup boxes. Not a big issue, as I was able to get everything settled with MCV help and some forum searching. Through the searching I learned how to SSH into my vera and a couple of other nifty tricks to configure the firewall etc.
My question involves accessing my vacation home Vera without being there. I do realize any initial setup would require me to work locally with it. I could easily punch holes in the router with port forwarding, but I would prefer not to do this. I have a family friend that wants me to help them with one of these as well and I want to have the peace of mind of being able to remotely change small things; that which can be done through the SSH access. Is there a way to have the Vera contact me through a secure SSH tunnel at the same time it creates one to MCV when the tech support button is engaged? I would still like to keep the MCV access enabled because they are far more advanced than I, however I see no need to call them for four devices if the situation arises.
I have searched the forum for a couple of days and I am sure something of the sort exists, however I am unable to locate it. Any help would be great.
Yes, but.
The MCV tunnel forwards to local port 80, so the access that you are giving MCV is equivalent to them viewing your Vera’s web interface. That’s not the same as your Vera listening on port 22 for a SSH terminal (command line) session. I imagine it’s the latter that you want, since you’ve already got the former through cp.mios.com.
The trick is to work around network address translation (NAT), which your vacation Vera is probably behind, making it unreachable as the destination of a network connection. There are two approaches that work. One is to set up a VPN (virtual private network) server on your vacation network, which lets you put your home PC temporarily behind your vacation home’s NAT, on the inside next to your Vera. The other is to have your home PC and your vacation Vera each make outgoing connections to a static IP address on the global Internet, and that IP address connects the two sessions into one. (This is essentially how Skype works.)
The VPN option is probably easier to do with off-the-shelf components. If your vacation modem hasn’t got a VPN server option then you could probably set up a small computer (such as a Raspberry Pi) to act as a proxy. The exact specifics will depend greatly on what equipment you have on hand and what you are comfortable messing around with. You could probably google a howto. Just filter out all the pages talking about using VPNs to get around geographic restrictions on online media: those are also VPNs but backwards to what you want.
You may be tempted to just forward port 22 to your vacation Vera from your vacation modem. I would caution against doing that unless you want bots on the Internet to attempt to crack your Vera root password by brute force.
You are right that forwarding port 22 is not an option I would like to pursue. Sadly I had hoped to avoid using vpn in the case of installing one in my parents friends house.
Am I missing some type of access that MCV has through the cp.mios.com portal? I have been able to work on blocking comms to my verizon set top boxes through ipaddress/cgi-bin/webif/info.sh and was curious if that was accessible remotely; to include the file structure I can reach through ssh? I was hoping to play around with making my own UI and had hoped to implement it directly into the Vera. I know no way of loading these files without root access to the vera. Maybe I am wrong and cp.mios.com gives me some remote access that I have yet to discover. Any ideas?
Bear with me as I am fairly new with the Vera. Thank you for your response.
I don’t think that cp.mios.com gives you access to the OpenWrt config pages. If I recall, only URLs that start with /cmh are accessible through cp.mios.com, for the simple reason that they prepend it onto the URL for any remote request you make. In short, MCV made a conscious decision to keep the other pages out of the tunnel and don’t give you a way to override it.
If you wanted to go the Skype route and replicate cp.mios.com for yourself, but make a version that operates from / instead of /cmh/ then you would need a host somewhere on the Internet with a fixed global IP address. Then you would need some way of securing that host so that only you could access it. HTTPS and passwords would probably form part of the picture. To my mind this is more effort than a VPN.
If you knew exactly what command to run from the shell you could always run os.execute(“…”) in the Test Lua box. But without any way of knowing what the output of the command is. Personally I’d do this only in emergencies; the risk of breaking the plank you are standing on is too great.
Roger.
Thank you for the insight and support. I you might be right and that VPN might be the way to go even if it involves working with the router. I’ll let you know if I come up with something.