managing access points with an access controller from another city

Hello All,

I am trying to set up a demo project and having a problem in one of the basic steps.

Here is my set-up
:
Attachment 16924
To achieve the desired function in the shown topology, what options do I have?
1. I think a VPN connection between the two DSL modems can resolve the situation. If this is true, what modem should I use to establish a site to site vpn? (cannot afford router devices, it is why I want to use ADSL modem to achieve this)

2. I feel I need to use some type of Point to Point connection between the two system but how is that possible? Since there is no leased line, hdlc or framerealay here (only internet) what can I do?

3. IF I put the AP and AC as DMZ devices in each modem, can they communicate between each other with the real ip numbers? (I am unsure about it)

I am really in need of some comments here.

Thanks in advance.

Is the intention to eventually have multiple APs accessed by the Controller from multiple locations? If thats not the case then why not just have the controller on the same local network as the AP and then vpn into the controller externally?

Regarding VPN, you could setup something like OpenVPN or configure windows.

Actually, the main intention is managing multiple APs from several different locations.
However, any company which can need this solution will probably have an hdlc, ppp etc. connection between the branches. However, for test topology I only have 2 adsl lines and can use 2 modems to simulate the situation.

About VPN, I am not sure about OpenVPN but how can I run that software on an ADSL modem? I don't have any server machines in the system. Only 2 adsl modem/routers. I feel I need to establish some kind of point to point communication between the public sides of the modems and they can route the packets to internal networks. Can static routing feature fix this issue?

OpenVPN is open source software you can install onto a computer to setup vpn but I dont think you can install it on the ADSL modem. I made the assumption that you already have ADSL modems and they dont have VPN support? If thats the case, its beyond me how you're going to tunel the traffic, unless you can assign a public ip to both AP and Controller (doesnt sound like a good idea or would even work)?

Quote:

---

Originally Posted by apeo

OpenVPN is open source software you can install onto a computer to setup vpn but I dont think you can install it on the ADSL modem. I made the assumption that you already have ADSL modems and they dont have VPN support? If thats the case, its beyond me how you're going to tunel the traffic, unless you can assign a public ip to both AP and Controller (doesnt sound like a good idea or would even work)?

---

Your assumption is great, because my modems don't support VPN so I was planning to replace them. If I can do it with any other way I think it is also OK. This way, the open VPN computer should be the default gateway for the network I guess?

Perhaps look at Meraki? Does essentially want you want to do with the Configuration stored in the cloud.

Have a look at this:

Site-to-Site Layer 2 Bridging Using OpenVPN Access Server and a Linux Gateway Client | Documentation

Quote:

---

Originally Posted by apeo

Have a look at this:

Site-to-Site Layer 2 Bridging Using OpenVPN Access Server and a Linux Gateway Client | Documentation

---

thank you very much. This is exactly what I was looking for if I can deploy OpenVPN.

I am running a pfsense box that is running Unifi controller software. I have also setup a IPsec VPN for management but there is no reason that other traffic does not travel on it. Unifi do document how to set up a cloud controller for their system so it is possible to do.

What vendor are you using? Some of them now encrypt controller-AP control traffic and as such you shouldn't need a VPN, if there's NAT in front of the controller then put the relevant port forwarding rules in place. You can tell the AP(s) how to find the controller via DHCP, DNS or pre-configuring them with it. Again depends on the vendor.