Functionality of the BT Business Hub 5

This presumes the availability of FTTC broadband instalable at our office some time later in the year, or next....

I have been unable to find the manual for the BT Business Hub 5 online (incompetent Googling?), and so would be grateful if a knowledgeable person could tell me whether it can do 'conditional forwarding' to another router on the same LAN. Or is a better VDSL modem/router (like Draytek Vigor 2860) needed?

I am also unclear what to do it I wish to use Microsoft's Remote Desktop Protocol (RDP) from a home PC to a work server - usually one sets up a software VPN on the home PC, but I don't know whether this requires any form of (hardware) VPN on the router. If this is necessary, will the Business Hub 5 do this?

Thanks!

I just did a quick google search and found the following (Quick Start Guide):

https://btbusiness.custhelp.com/euf/assets/Broadband...

And I also found this (Tech Specs):

http://btbusiness.custhelp.com/app/answers/detail/a_...

Not too sure if that's what you wanted.

Paul

Thank you - I had found those two too, but I was hoping for a manual of a couple of hundred pages, rather than a two-page PDF and a two-screen web page! Not much chance of finding "conditional forwarding" in either!

I've just been using a BT Business Hub 5 this evening and can confirm that the functionality is pretty basic. It doesn't have a remote management capability, nor can it terminate a VPN. I'll have a look again tomorrow to see what other functions it doesn't have.

I'm a bit puzzled by 'conditional forwarding'. Do you mean that you have multiple static IP addresses and you want those static IP addresses to be forwarded to a second router or do you mean DNS conditional forwarding where different DNS servers are used based on the domain query?

Perhaps you mean port forwarding where incoming traffic to a specific port is forwarded to a particular address on the internal network?

One thing I would recommend if you are setting up a Windows work server to be accessed remotely using RDP is Duo Two Factor Authentication. This means that unauthorized users can't just keep trying username and password combinations until they get in. The most basic option is free. See https://duo.com

Edited by caffn8me (Fri 08-Jul-16 01:29:29)

Thanks, Sarah!

Single LAN/subnet; two routers, two ADSL lines.
Line 1/Router 1 is to be used for all traffic for www.specialservice.org.uk
Line 2/Router 2 is for all other internet traffic, runs DHCP, and is the Default Gateway

Router 2 needs conditional forwarder to send all requests for www.specialservice.org.uk over to Router 1 and hence Line 1

This is used in conjunction with static routes which route www.xxx.0.0 MASK 255.255.0.0 relating to the SpecialService to the IP address of Router 1

There's a bit more to it, and I don't pretend to understand much of this, but it works at one site with a Draytek Vigor 2760 (requires bodges because that doesn't do conditional forwarding, but the 2860 does).

Well, it's not good news. You can't even set static routes.

Your best bet would seem to be using a Draytek 2860.

I do have another suggestion but I'll have to post that when I get home later tonight as I'm in the way here

Right, I'm home.

If I understand you correctly (which I probably haven't - see below), the web server, www.specialservice.org.uk, uses a private IP address on the LAN side of Router 1 and this LAN is part of the same subnet as the LAN side of Router 2. The webserver has a DNS entry in the real world that is an IP address on the WAN side of Router 1 and internet requests for www.specialservice.org.uk are port forwarded to it.

You want LAN side clients to access the webserver by its LAN address and not go all the way out to t'internet and back in again.

A cheap but proper fix would be to set up a DNS server on your LAN to answer all DNS queries for LAN clients.

For this I would use a Raspberry Pi set up as a recursive DNS server for LAN clients with it authoritative for the specialservice.org.uk zone.

Set your DHCP server to give out the IP address of this as your only DNS server and set all static IP clients to use this server.

The whole setup can be done very easily with the Raspbian Jessie Lite or Arch Linux distributions (I use both).

You could used Webmin if you wanted a GUI to administer the DNS server.

Total cost of hardware is about £52 from Amazon for a Raspberry Pi 3, official Pi 3 power supply, case and 32GB class 10 micro SDHC memory card. The software to do this all is free. It just takes a little bit of setting up. If you have an experienced Raspberry Geek this would take about 40 minutes from scratch including installing the operating system, software, applying updates and configuring the DNS zone for specialservice.org.uk.

I run a number of Raspberry Pis as internet and LAN facing nameservers and they're rock steady and use very little electricity. Clone the SD card of a working setup and you have instant disaster recovery for about £7.

What's not to like?

Edited by caffn8me (Sat 09-Jul-16 01:44:27)

Reading your description again, I may have completely misunderestimated the problem. I'm not certain if I have or haven't.

It could be that www.specialservice.org.uk is an external server but you want all traffic to reach this outbound via Line 1. That would typically be described as policy based routing rather than conditional forwarding (a Microsnot^TM term for using different DNS servers based on the domain being queried).

Apologies if that's the case.

I believe it would still be possible to use a Raspberry Pi for this using a Squid proxy in accelerator (reverse proxy) mode. To do this you'd again set up the Raspberry Pi as the primary DNS server for specialservice.org.uk and you would give its LAN IP address as www.specialservice.org.uk. It would sit on Router 1 with that as its default gateway. The proxy would forward all LAN requests for www.specialservice.org.uk to the real world www.specialservice.org.uk.

This is perfectly doable but would take a little more work. I do use a Raspberry Pi in reverse proxy mode to add HTTPS and two factor authentication from the Internet to a LAN based server. Using it as described above would be simpler.

PS: The BT Business Hub 5 definitely doesn't do policy based routing.

Edited by caffn8me (Sat 09-Jul-16 01:19:26)

Thanks, Sarah, for your very full answers.

You are indeed correct that www.specialservice.org.uk is an external server (leading to a whole bunch more on a 10.xxx.0.0 subnet). Router 2 supplies DNS server IP addresses (for the SpecialService network) via DHCP.

I used the term "conditional forwarding" because that's what the SpecialService organisation uses, and I believe the menu entry in the Draytek 2860 also uses this term, but I agree that policy-based routing is probably more accurate.

Thanks for the tip about Duo, which I will look into.

I think you said you were going to suggest a router as an alternative to the 2860. Certainly it seems from what you say that a BT Business Hub 5 won't do what we want, either for policy-based routing or VPN termination...

The suggestion I was going to make was for a solution that didn't require a new router. Suggestion 2 (using a Squid proxy) would work without a new router but it wouldn't terminate a VPN - although with a bit further tweaking, the Raspberry Pi could be used for this as well.

'Route Policy' or 'Policy based routing' are the terms used by Draytek - see here rather than 'conditional forwarding'. That's why my little Womble brain got a bit confused. I've just logged into a 2860 and the relevant menu item is "Load-Balance/Route Policy". I've taken a screen shot here. This is IP address based routing as opposed to domain name. This means that if the IP address of the special service changes, you'll need to update the route policy.

If you're going to use a router as the solution, the Draytek 2860 would be the one to go for. It's approved by Openreach for use on FTTC should you upgrade in the future and it can be used for VPN. I use a number of 2860s and they're generally very reliable. The only caveat is I have found that some functions can stop working after long periods of uptime (I seem to recall that VPN was one). As a result I've scheduled an automatic weekly reboot and everything now works fine.

If you are looking to connect inbound to a Draytek from home for RDP access, you don't need a VPN router at home. You can set up a VPN connection directly from the end computer to the remote router using the Remote Dial-in User VPN functionality. Don't use PPTP, it's insecure. Remote Dial-in User VPNs can also be set up to use two factor authentication if a they use a RADIUS server that has this functionailty. Again this can all be done with a Raspberry Pi (I do this).

If you're looking at LAN to LAN VPN, the Draytek is very good for this too. The only concern I have is with BT multiple static IP addresses. In this case, BT still assign a DHCP address to the WAN interface and the static addresses are a secondary routed network. This makes setting up VPNs difficult as you would normally want the WAN to have a fixed IP address to terminate the VPN. If it keeps changing (which it does on a BT connection) it's not very helpful. There may be a workaround with the Draytek (I know the Watchguard T10-D has one) but I haven't looked as I actively avoid BT connections due to this problem. It's not an issue if you only have a single static IP address.

Good luck!

Edited by caffn8me (Sat 09-Jul-16 16:50:13)