(Help!) Access outside local network

[nintendowii111]

I would like to make this work over the web. How does one use the recommended PiVPN to do this?

Sorry I’m new to this ;)

[nebhead]

Since this is a web based application, a local VPN is currently needed so that you can access your instance of the garage door opener at it's IP address. With that said, there are number of ways to setup a VPN at home so that you can access your home network when you are away. The easiest way is to use PiVPN on another raspberry Pi in your house (https://www.pivpn.io/). It's very straight forward to setup on a freshly installed Raspberry Pi. I'd highly recommend using WireGuard as it's very easy to setup on your phone, PC or tablet with the right app using a QR code. Once you establish your VPN, you should be able to go to the IP address of your garage door in your browser, just like you do normally and get access.

I've considered other ways to make the door accessible outside of the home network, but security is a huge concern. And it may require a third party server to service an API or something. If anyone out there knows how to do this properly, please do let me know. :)

[nintendowii111]

Since this is a web based application, a local VPN is currently needed so that you can access your instance of the garage door opener at it's IP address. With that said, there are number of ways to setup a VPN at home so that you can access your home network when you are away. The easiest way is to use PiVPN on another raspberry Pi in your house (https://www.pivpn.io/). It's very straight forward to setup on a freshly installed Raspberry Pi. I'd highly recommend using WireGuard as it's very easy to setup on your phone, PC or tablet with the right app using a QR code. Once you establish your VPN, you should be able to go to the IP address of your garage door in your browser, just like you do normally and get access.

I've considered other ways to make the door accessible outside of the home network, but security is a huge concern. And it may require a third party server to service an API or something. If anyone out there knows how to do this properly, please do let me know. :)

I understand security is a concern, but I'd like to at least see it function outside the network without security. I don't have another raspberry pi (and don't want another one lol); could you tell me how could I go about using my router to allow the server on the pi to be broadcasted in the public?

[nebhead]

So, if security is completely not a concern, then you would simply need to open a port on your router to forward to your raspberry pi. Depending on your router manufacturer, you'll need to log into their interface, and assign a port forward. Maybe select a random port like 8086 and then forward that to your Pi IP with port 80. When you access your external IP from outside your house, the requests will be forwarded to the Pi inside your network.

If your internet provider changes your IP on you, you'll want to setup a dynamic DNS service as well. This might not be supported by your router, but many bigger manufacturers have something similar like No-IP, to allow you to assign a human readable domain name to your IP.

Anyway, with all of this said, anyone on the internet would have access to the webUI and possibly be able to hack into your Pi, and then use that as a basis for a hack on the rest of your computers in your network. Anything is possible. Ransomware, bitcoin mining, etc. So do this at your own peril.

[nintendowii111]

So, if security is completely not a concern, then you would simply need to open a port on your router to forward to your raspberry pi. Depending on your router manufacturer, you'll need to log into their interface, and assign a port forward. Maybe select a random port like 8086 and then forward that to your Pi IP with port 80. When you access your external IP from outside your house, the requests will be forwarded to the Pi inside your network.

If your internet provider changes your IP on you, you'll want to setup a dynamic DNS service as well. This might not be supported by your router, but many bigger manufacturers have something similar like No-IP, to allow you to assign a human readable domain name to your IP.

Anyway, with all of this said, anyone on the internet would have access to the webUI and possibly be able to hack into your Pi, and then use that as a basis for a hack on the rest of your computers in your network. Anything is possible. Ransomware, bitcoin mining, etc. So do this at your own peril.

I was afraid that opening ports for the pi would expose everything else on the network, if it only would leave the pi wide open I would be ok with it, but I don't want to affect any other devices on the network.

Although, I've been looking into getting this project to work online and found Ngrok.
Have you tried looking into this service as a means for outside access?

Thanks again!

[nebhead]

I mean, technically speaking if you forward to port 80 on the Pi itself, that is the only device that the outside world will see. So, if you do your diligence, and correctly secure the port 80 interface on the Pi, then you should be fine. There are lots of applications that work this way and are designed with security in mind. I'm just not confident that this garage door opener is secure and has all potential attack vectors handled. :) And if someone were to find some crack in the security of the Pi (nginx, flask, etc.) then they could launch attacks on the rest of the network. Anyway - let me take a look at Ngrok and see if it can be applied in this instance. Having some kind of secure tunnel is always good for overall security. I probably should build in some kind of secure API to allow for opening / closing the door from other applications (i.e. home assistant), which would probably address the problem in this case.

[nintendowii111]

I mean, technically speaking if you forward to port 80 on the Pi itself, that is the only device that the outside world will see. So, if you do your diligence, and correctly secure the port 80 interface on the Pi, then you should be fine. There are lots of applications that work this way and are designed with security in mind. I'm just not confident that this garage door opener is secure and has all potential attack vectors handled. :) And if someone were to find some crack in the security of the Pi (nginx, flask, etc.) then they could launch attacks on the rest of the network. Anyway - let me take a look at Ngrok and see if it can be applied in this instance. Having some kind of secure tunnel is always good for overall security. I probably should build in some kind of secure API to allow for opening / closing the door from other applications (i.e. home assistant), which would probably address the problem in this case.

Hey again, I'm curious if you wouldn't mind making a few new changes to Garagezero. I have it setup and working and definitely enjoy it. What I wouldn't mind having, however, is 12-hour time instead of 24, also, making the event log be from up-down, most recent, to least recent. i.e. most recent button press log at top of history. Thirdly, option to remove door-status for those who do not use reed switches to know status of the door. and lastly, change the big green door button to have visual feedback when pressed? i.e., make it to where it turns yellow when pressed, and doesnt allow to be pressed again for a few seconds and then turns back to green. This sequence would indicate that the button press was received by the server and would stop a double press if accidentally it was double pressed by the user.

Thanks again for the help!

[nebhead]

Yeah I'm definitely up for making improvements and adding features. I'm away from my workshop for the next week and a half but I will take a look at these when I return. I'm actually thinking I will implement a password feature as you asked about before because I think it might be useful in your case and in case of having a secondary keypad.

…

On Thu, Jul 1, 2021, 11:15 AM nintendowii111 ***@***.***> wrote: I mean, technically speaking if you forward to port 80 on the Pi itself, that is the only device that the outside world will see. So, if you do your diligence, and correctly secure the port 80 interface on the Pi, then you should be fine. There are lots of applications that work this way and are designed with security in mind. I'm just not confident that this garage door opener is secure and has all potential attack vectors handled. :) And if someone were to find some crack in the security of the Pi (nginx, flask, etc.) then they could launch attacks on the rest of the network. Anyway - let me take a look at Ngrok and see if it can be applied in this instance. Having some kind of secure tunnel is always good for overall security. I probably should build in some kind of secure API to allow for opening / closing the door from other applications (i.e. home assistant), which would probably address the problem in this case. Hey again, I'm curious if you wouldn't mind making a few new changes to Garagezero. I have it setup and working and definitely enjoy it. What I wouldn't mind having, however, is 12-hour time instead of 24, also, making the event log be from up-down, most recent, to least recent. i.e. most recent button press log at top of history. Thirdly, option to remove door-status for those who do not use reed switches to know status of the door. and lastly, change the big green door button to have visual feedback when pressed? i.e., make it to where it turns yellow when pressed, and doesnt allow to be pressed again for a few seconds and then turns back to green. This sequence would indicate that the button press was received by the server and would stop a double press if accidentally it was double pressed by the user. Thanks again for the help! — You are receiving this because you commented. Reply to this email directly, view it on GitHub <#25 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AEXUYFTKTDLNHY3WNGSI3UTTVSWE5ANCNFSM47FHILLA> .

[nebhead]

FYI: Just added sort capability in the development branch with the last commit.

73ee534

[nintendowii111]

FYI: Just added sort capability in the development branch with the last commit.

73ee534

Thanks!

[nebhead]

FYI: Just added 12H/24H select button so that events will be displayed in the UI as selected.

3fea0cf

[nintendowii111]

FYI: Just added 12H/24H select button so that events will be displayed in the UI as selected.

3fea0cf

Hey, how does one install the update? Will redoing the install process overwrite the files and stuff?

[nebhead]

You'll need to first update your git repo by doing a pull, then switch to the development branch and reboot.

Use SSH to log into your pi, then:

pi@garage-zero:~ $ cd garage-zero/
pi@garage-zero:~ $ sudo git pull

This should get the latest from GitHub, including the development branch. If you see errors, it's possible that you may have modified the original files which means GitHub can't resolve the conflicts. You can reset back to the original by running sudo git reset --hard, but keep in mind that your changes will be lost.

pi@garage-zero:~ $ sudo git checkout development

This should switch you to the development branch.

Then reboot the system.

pi@garage-zero:~ $ sudo reboot

Hopefully, this will work. :) Let me know how it goes.

[nebhead]

Oops, found a bug. Also implemented another minor feature. Updates are here: 7adb188