# Creating a VPN to stream ALL my TiVo Roamio channels away from home



## jeffrypennock (May 18, 2006)

I have TWC in NYC which ABSURDLY sets the copyright setting on all the non-OTA channels such that I can stream at home but can't stream outside the house. Comcast and other providers don't do it. On a different thread here, someone suggested that you could set up a VPN to replicate your in-home streaming iOS experience when you're out-of-home (OOH). I want to do this! I started researching if I could/how to go about this and realized...I have no clue how and know less about this topic than I thought I did. 

Here's what I have:
TWC (television and premium internet)
Arris DG860A wifi modem router from TWC
TiVo Roamio Plus (connected via ethernet to the Arris)
iPad & iPhone running latest iOS and latest TiVo app

Is this something I can do with the equipment that I have? Does my router support a VPN (is that even a relevant question? I logged in to the configuration interface for my modem and I didn't see an obvious "VPN" tab where I could configure this but maybe I missed it)? There are so many high-lever users and experts on here, I am hopeful someone will please tell me how to do this or refer me to instructional articles that would teach me how. (Because the resources I was finding online were all either irrelevant or made sense/got me no closer to my goal.)

I think this is a much more appealing offer than getting a Sling (I've burned through too many of those flawed devices over the years) if this is something I can make work for me.


----------



## telemark (Nov 12, 2013)

What's your Internet Bandwidth (Up/Down)?
Do you still have the SlingBox?


----------



## jeffrypennock (May 18, 2006)

I don't have a sling box here in NYC, no.
My download is 31Mbps and my upload is 6Mbps.


----------



## telemark (Nov 12, 2013)

Upstream is usable, but I figure most people would prefer a Slingbox because it avoids a VPN.

This thread has some technical details.
http://www.tivocommunity.com/tivo-vb/showthread.php?t=492571

After starting to write out directions, I don't feel this is for the faint of heart, because it could break anytime Tivo updates the app, and then you'd have to know some networking to figure out what's wrong.

Three methods to VPN from IOS when you're out and about. 
1) Built in support, like so: http://support.apple.com/kb/ht1288
2) 3rd party software that require jailbreaking
3) External wifi hardware (hotspots, laptops, smart phones in connection sharing mode)


----------



## jeffrypennock (May 18, 2006)

You're right, this really isn't for the faint of heart. I've used a VPN as an end user for years. I had no idea the creation/administration of one would be so hard. How is there not a VPN out of the box from Apple or some other clever retailer?


----------



## HDRyder9 (Aug 2, 2007)

I support a lot of customers where VPN is a necessity. For ease of use and economy, I use Cisco RV042 routers with built in VPN support. If you can use PPTP protocol it's as easy as adding a PPTP user with a password and a remote Windows device or iOS device will log in.

For full time VPN connections, I like to use a RV042 router on each end. Essentially, you are on the same subnet and Tivo won't even notice it's not a local connection.


----------



## DavidDeLano (Dec 8, 2014)

I know this is a really old post, but it seems on the track of what I'm attempting to do. I have two Cisco RV130s VPN connected but I can't get the ends to be the same subnet. Any help?


----------



## HarperVision (May 14, 2007)

DavidDeLano said:


> I know this is a really old post, but it seems on the track of what I'm attempting to do. I have two Cisco RV130s VPN connected but I can't get the ends to be the same subnet. Any help?


FWIW, I use Asus routers on each end and they have OpenVPN built into them so I just set the one where the host TiVo is as the server and then use the other one that's distant and away from "home base" setup to be the client. This way they see each other easily.

My speed isn't fast enough for it to stream from the separate tivos, but they do see each other as if they're on the same local LAN and I can transfer shows between them.

Go to smallnetbuilder.com for a bunch of different scenarios.


----------



## HDRyder9 (Aug 2, 2007)

DavidDeLano said:


> I know this is a really old post, but it seems on the track of what I'm attempting to do. I have two Cisco RV130s VPN connected but I can't get the ends to be the same subnet. Any help?


What and where is your DHCP server?


----------



## DavidDeLano (Dec 8, 2014)

Thanks to both of you for responding. I've been out in the weeds trying to get this to work and hitting way too many dead ends, even though some people say they have it working. I keyed in on this thread, since it mentions Cisco routers for the VPN, though a different model than I have (though looking at the specs, mine just appear to be newer versions).

The Cisco router on each end provides DHCP for it's own subnet. Currently I have 192.168.0.0 on one end and 192.168.1.0 on the other end. I can see all the devices across the VPN, but broadcast messages are of course not crossing the subnets.

I had them both on 192.168.0.0 for a while, making sure the IP addresses didn't overlap, but I could not see any devices on the other end when I did that.

Behind each router is a Netgear router in AP mode to provide WiFi access. Adding that detail in case a router function on the Netgear happens to be a useful solution.

Are you suggesting I just use one end for DHCP and routing?? What happens when VPN goes down? I have tenants in the vacation home that would be upset if the network goes down.

I have 50M on one end and 100M on the other, though the upload speeds on both ends are around 20M. I don't think bandwidth would be an issue, and downloading instead of streaming is an option. If I get this to work, one end will need a new TiVo or a Stream for the other end to see it.


----------



## DavidDeLano (Dec 8, 2014)

Thanks for the smallnetbuilder reference. I haven't found anything to solve my problem yet, but there is info here that I hadn't encountered in all my google searches.

It appears I need a bridge and that my current configuration is only allowing a tunnel, and I don't know how to get from one to the other......

David


----------



## DavidDeLano (Dec 8, 2014)

Another thought.....with the VPN in place, is it possible to manually configure a device on one end, the TiVo in this case, to be on the other network??


----------



## kdmorse (Jan 29, 2001)

DavidDeLano said:


> Another thought.....with the VPN in place, is it possible to manually configure a device on one end, the TiVo in this case, to be on the other network??


Yes.

You can also automatically configure it with a dhcp reservation (assuming you run a DHCP server that allows you to lie. linux dhcpd is fine. I never could get windows to assign an out of scope dhcp address).

You can also put a bridge filter on the vpn so that only the Tivo's traffic is bridged. And if you do it right, you can get it to just get it's IP address via DHCP off the remote network.

In both cases, the downside is that all the oddly configured tivo's internet traffic will flow over the VPN and out the other site to the internet. Not an issue for daily calls. But can be problematic for Netflix.

There are ways around this of course, depending on how creative you want to get.

(And to answer your earlier question, a VPN that can run in Bridge mode is pretty much a requirement. It can be router to router. It can be a passive bridge between a device on each network. And while OpenVPN is not the only possibility, it is generally the weapon of choice.)


----------



## HarperVision (May 14, 2007)

kdmorse said:


> Yes. You can also automatically configure it with a dhcp reservation (assuming you run a DHCP server that allows you to lie. linux dhcpd is fine. I never could get windows to assign an out of scope dhcp address). You can also put a bridge filter on the vpn so that only the Tivo's traffic is bridged. And if you do it right, you can get it to just get it's IP address via DHCP off the remote network. In both cases, the downside is that all the oddly configured tivo's internet traffic will flow over the VPN and out the other site to the internet. Not an issue for daily calls. But can be problematic for Netflix. There are ways around this of course, depending on how creative you want to get. (And to answer your earlier question, a VPN that can run in Bridge mode is pretty much a requirement. It can be router to router. It can be a passive bridge between a device on each network. And while OpenVPN is not the only possibility, it is generally the weapon of choice.)


Thanks for jumping in here and saving me! It was starting to get over my head. I actually forgot most of what I learned since setting my Asus point to point OpenVPN up months ago, haha!


----------



## DavidDeLano (Dec 8, 2014)

Now I'm getting more questions than answers!

How do I create a bridge instead of a tunnel?? And, I'm trying to do this with my Cisco RV130's. I don't have OpenVPN running. If I need to run another device, I can, but I'm trying to avoid that - I have enough running already!

I don't think the DHCP will allow me to lie and allocate an IP that would be on the other side. What I meant was, can I configure the TiVo itself to have an IP that is on the other side? I think I've tried that, but failed to connect, but I've tried so many different things I can no longer remember.

And what does this mean: "There are ways around this of course, depending on how creative you want to get." I can get creative, but I have to know how/what to do.

David


----------



## DavidDeLano (Dec 8, 2014)

Confirmed...the DHCP on this end only allows me to allocate within this subnet. What happens if I put the MAC in at the other end? But then, how do I get the TiVo to use the other DHCP server?


----------



## HarperVision (May 14, 2007)

Just get a couple cheaper Asus routers that have OpenVPN built in or flash update it with Merlin for more options and then be done with it, I say!


----------



## DavidDeLano (Dec 8, 2014)

I have no qualms about adding standalone boxes to fix the problem. I just don't want to have to have a dedicated computer running 24/7 on each end. What ASUS models should I be looking at? And would I still configure the VPN with the Cisco boxes, or would they just step back and become routers only?

David


----------



## HarperVision (May 14, 2007)

DavidDeLano said:


> I have no qualms about adding standalone boxes to fix the problem. I just don't want to have to have a dedicated computer running 24/7 on each end. What ASUS models should I be looking at? And would I still configure the VPN with the Cisco boxes, or would they just step back and become routers only? David


I have an RT-AC56U at each end and they work fine, but you can get any at this level or above to do the job. I hear the best to look for are the ones with the dual core processors. I use mine separate from my main router, an AC66U. No need to use the Cisco one anymore.

You can also see if your existing Cisco ones support being flashed by something called the Tomato firmware, which you should be able to run OpenVPN on as well.


----------



## DavidDeLano (Dec 8, 2014)

I could actually replace the Netgear routers that I'm using as WiFi APs if I found ASUS WiFi routers with OpenVPN built in. Or....any chance that a Netgear can be updated with OpenVPN. I've not tried flashing a router, but that could be an option.

David


----------



## HarperVision (May 14, 2007)

DavidDeLano said:


> I could actually replace the Netgear routers that I'm using as WiFi APs if I found ASUS WiFi routers with OpenVPN built in. Or....any chance that a Netgear can be updated with OpenVPN. I've not tried flashing a router, but that could be an option. David


See if it can via Tomato. Google search your model with tomato.


----------



## DavidDeLano (Dec 8, 2014)

Did you have to update your RT-AC56U? I don't see that it supports OpenVPN. I'm hesitant to mess with anything that is in place as I can't afford to have the network down should I fail. I think I'd still leave the Cisco's in place for routing.

With TAP, how is DHCP and NAT handled??


----------



## HarperVision (May 14, 2007)

DavidDeLano said:


> Did you have to update your RT-AC56U? I don't see that it supports OpenVPN. I'm hesitant to mess with anything that is in place as I can't afford to have the network down should I fail. I think I'd still leave the Cisco's in place for routing. With TAP, how is DHCP and NAT handled??


I updated mine with Merlin FW, but the regular FW from Asus offers OpenVPN too, just a few less options.

I use TUN so not sure about TAP.

I really have forgotten a lot since setting up, sorry. (Lyme Disease sux!) Best thing to do is read, read, read!


----------



## DavidDeLano (Dec 8, 2014)

Well, I have TUN set up with the Cisco routers, and that isn't working. So, what did you do to make it work?? TAP seems to be the answer.

I've been read, read, reading for months trying to get this figured out......


----------



## HarperVision (May 14, 2007)

DavidDeLano said:


> Well, I have TUN set up with the Cisco routers, and that isn't working. So, what did you do to make it work?? TAP seems to be the answer. I've been read, read, reading for months trying to get this figured out......


It was really just a matter of connecting the two together, one as server the other as client and downloading the server's auto generated certs for the client to connect. It may have been TAP I used, I'll have to check it all when I get home from work tonight.

If you go to Merlin's website you can download the FW files and read about all the settings also for Asus routers with his FW.

www.Asuswrt.lostrealm.ca


----------



## DavidDeLano (Dec 8, 2014)

I'd also still like to hear how HDRyder9 has two Cisco routers connected, since that is what gave me hope that I could get what I have working.....

I'll read up on Merlin in the mean time.


----------



## DavidDeLano (Dec 8, 2014)

My Netgear R6700 routers appear to have OpenVPN support built in, but I can only see how to put them in server mode, and not client mode. I ran into this originally when I was attempting to set up the site-to-site VPN with these routers, but couldn't come up with any way to do it. That is when I bought the Cisco routers, which set the VPN up fine, but I have two subnets.


----------



## DavidDeLano (Dec 8, 2014)

HDRyder9 - The VPN settings for the RV042 look the same as those for the RV130, so it must be some other settings you have to make it work. The instructions say that the two ends must be on separate subnets, which makes the TiVo discovery not work. The only setting I see that might change this would be to set one end to be a router instead of a gateway and then set it to use DHCP Relay to the router on the other end. I could try this, but I'd rather be at the end I'm changing, in case something goes wrong and I can't access the router remotely.


----------



## DavidDeLano (Dec 8, 2014)

I reconfigured the VPN to use 192.168.0.0 on both ends. It let me do that without complaint. The far end, which is 192.168.1.0 didn't have an issue. The near end, which is 192.168.0.0 puts the router in a state where it is no longer communicating via the web interface. It is still alive and routing but apparently the VPN is keeping it so busy that it doesn't have time to service the web service. This happens even if the VPN is not connected, but enabled. To get out of this state I have to unplug the WAN cable, wait a bit, web interface comes back, disable the VPN. So, I'm still not sure how you are getting both ends on the same subnet.

I should add....I'm using 255.255.255.0 as the mask, if that would make any difference.

I didn't get far enough to try setting the far end DHCP to point to the near end.


----------



## brewman (Jun 29, 2003)

Is slingbox out of the question? It's a very simple, not too expensive solution that is plug-n-play. Unless you're just dead set on getting VPN working Slingbox just works.


----------



## NYHeel (Oct 7, 2003)

brewman said:


> Is slingbox out of the question? It's a very simple, not too expensive solution that is plug-n-play. Unless you're just dead set on getting VPN working Slingbox just works.


For many people Slingbox doesn't work because they can't hijack their TV all the time. If you have a second TV with a Mini attached to it that might be easier to do. But for me, we have one main TV and I can't simply watch stuff via Slingbox as other people may be using it at the same time.


----------



## DavidDeLano (Dec 8, 2014)

I don't have a Slingbox, but know people who do, and there are limitations that won't make it work for me. And, my wife is used to using the TiVo, and adding in another device is out of the question.

I didn't see NYHeel's response before posting this. He hit the nail on the head. There are permanent residents at both locations.


----------



## brewman (Jun 29, 2003)

NYHeel said:


> For many people Slingbox doesn't work because they can't hijack their TV all the time. If you have a second TV with a Mini attached to it that might be easier to do. But for me, we have one main TV and I can't simply watch stuff via Slingbox as other people may be using it at the same time.


Understood. I went the mini + slingbox route for that very reason.


----------



## ggieseke (May 30, 2008)

Try manually entering the IP address of the other TiVo at each end. That option is at the bottom of Showcases on older models, but now it's Add an App at the bottom of Apps & Games.

Both TiVos should be on static addresses so that they never change. This used to work over a VPN because the TiVo Beacon protocol supports a "directed" mode that uses specific TCP addresses instead of UDP broadcasts. I don't know if it still works.

From what I know about Cisco router-router VPNs, it isn't possible to have both ends on the same subnet. Recent Cisco IOS versions have some options to support mDNS (Bonjour), but it's a real ***** to get it working. I spent nearly a week reprogramming our Catalyst switches and the wireless controller at work just to get a ChromeCast dongle to work across multiple VLANs.


----------



## DavidDeLano (Dec 8, 2014)

brewman - I like your mini/slingbox suggestion, but I need this to be bidirectional, so would need to get two slingboxes and two minis. Then I'd have to train the users on how to access the slingboxes, which from my understanding takes a phone/tablet/PC to do it, with no direct access from a TV. My wife doesn't even get how to find the DVD player. I'm pretty much resigned to designing a solution that is accessible from the TiVo itself.

ggieseke - My frustration is that I see posts where people say they have it working, but with no details. I feel like I'm just missing some setting that will get it all to work. I did find the Add An App setting on the TV here (a Premier). But, now I have to get the VPN working again to try it out (the far end isn't communicating). I had looked for that setting before, but hadn't found it (or I've tried it and it didn't work). I have static addresses set up on my end, but I'd been changing the addresses around so much on the other end that I had not yet locked them down. If this work, I'll do that.


----------



## brewman (Jun 29, 2003)

DavidDeLano,

Good Luck (you're going to need it). Not only are you trying to tackle technology issues, but you're also fighting user ability issues which can be even more frustrating. I don't envy you.


----------



## DavidDeLano (Dec 8, 2014)

Some interesting developments. I have the VPN back up and functional, but with separate subnets as before.

I went to the TiVo itself and tried to add an app.....I can't add an IP from the other subnet. I edited the Network setting, though, to have a subnet of 255.255.254.0. I can now add an IP from the other subnet, but when I try to access it, it gives me an error message that the application is not currently available and to try again later.

In checking the network settings, it's interesting to note that the Broadcast IP is now 192.168.1.255, not 192.168.0.255. I still can't see the other TiVo as a device.

I set the subnet to 255.255.0.0, and now the Broadcast IP is 192.168.255.255, which I think means it should broadcast on both subnets.

Now, in the apps, ALL the TiVo device IPs show up (I didn't have to add them), the TiVo Roamio, two Minis, and the MoCa. I get the same error that the application is currently not available if I select any of the IPs. Nothing new has shown up in the Devices listing, but I also know that the Broadcasts aren't sent out all the time, so will check back on it in the morning.

Any thoughts from here? Is there something I need to do to enable the apps on the far end? Is the Broadcast IP of 192.168.255.255 going to help out at all?

David


----------

