Below is how to configured an ATV on a network without a Plex Server or PlexConnect to remotely connect to a Plex/PlexConnect Server.
Here is my setup:
Location #1
- Netgear R7000 running Tomato 1.28.0000 -124 K26ARM USB AIO-64K (10.0.100.1)
- unRAID Server running PMS and PlexConnect Dockers (10.0.100.50)
Location #2
- Linksys WRT310N v1(no USB) running Tomato 1.28.0005 124 ND VPN (192.168.1.1)
- ATV3 (192.168.1.12)
Basic step outline:
- setup location #1 router as OpenVPN server
- setup location #2 router as OpenVPN client
- only use the VPN for the ATV
- configure location #1 router to handle the redirection of trailers.apple.com so no changes are needed on the ATV
- configure PlexConnect to use non standard (80/443) ports
- allow Plex artwork to show on the remote ATV
1.) Setup Location #1 to use a Dynamic DNS. This will keep the ATV connected even after your ISP changes your public IP. Directions can be found in the link from step #2
2.) To configure Location #1's router to act as the OpenVPN server, we first must create the proper keys. I found this link to be quite helpful in acquiring the necessary keys:
http://www.howtogeek.com/60774/connect-to-your-home-network-from-anywhere-with-openvpn-and-tomato/
This should provide you with ca.crt, dh1024.pem, SERVERNAME.crt, SERVERNAME.key, CLIENT.crt, and CLIENT.key
3.) Setup OpenVPN server on Location #1 router.
VPN Tunneling -> OpenVPN: Server -> Basic
Start with WAN - checked
Interface Type - TUN
Protocol - UDP
Port - 1194
Firewall - Automatic
Authorization Mode - TLS
Extra HMAC - Disabled
VPN subnet/netmask - 10.8.0.0 255.255.255.0
VPN Tunneling -> OpenVPN: Server -> Advanced
Poll Interval - 0
Push LAN to clients - checked
Direct clients to redirect internet traffic - unchecked
Respond to DNS - checked
Advertise DNS to clients - checked
Encryption cipher - AES-128-CBC
Compression - Adaptive
TLS renegotiation time - -1
Manage Client Specific options - unchecked
Allow user/pass auth - unchecked
VPN Tunneling -> OpenVPN: Server -> Keys
enter each key as appropriate in the following format:
-----BEGIN PRIVATE KEY-----
VPN Tunneling -> OpenVPN: Client -> Basic
Protocol - UDP
Server Address/Port - your.ddns.address 1194
Firewall - Automatic
Authorization Mode - TLS
Extra HMAC - Disabled
Create NAT on tunnel - unchecked
VPN Tunneling -> OpenVPN: Client -> Advanced
Poll Interval - 0
redirect internet traffic - unchecked
accept DNS configuration - Strict
Encryption cipher - AES-128-CBC
Compression - Adaptive
TLS renegotiation time - -1
verify server certificate - unchecked
custom configuration - route-nopull
VPN Tunneling -> OpenVPN: Client -> Keys
Certificate Authority -> ca.key
Save your settings
5) Configure Location #2 router to have all devices bypass the VPN except for the ATV
Administration -> Scripts -> WAN Up (192.168.1.12 is the local IP of the ATV)
sleep 60
ip route flush table 200
ip route flush cache
ip rule add from 10.0.14.12 lookup 200
VPN_GW=`ifconfig tun11 | awk '/inet addr/ {split ($2,A,":"); print A[2]}'`
ip route add table 200 default via $VPN_GW dev tun11
6) Configure Location #2 router to route trailers.apple.com to the ATV without assigning a static DNS server on the ATV itself. In other words, absolutely no configuration is necessary on the ATV.
Administration -> Scripts -> Firewall (IP's correspond to the designations at the top of this post)
REMOTE_PLEXCONNECT=10.0.14.50 REMOTE_PLEXCONNECT_PORT=8081 REMOTE_PLEXCONNECT_SSL_PORT=8082 APPLETV=192.168.1.12 REMOTE_ROUTER=10.0.100.1plexconnect_addr=(expr "(nslookup 2>/dev/null REMOTE_PLEXCONNECT|grep '^Address')" : 'Address.* \([0-9][0-9]*\.[0-9][0-9]*\.[0-9][0-9]*\.[0-9][0-9]*\)') appletv_addr=(expr "$(nslookup 2>/dev/null APPLETV|grep '^Address')" : 'Address.* \([0-9][0-9]*\.[0-9][0-9]*\.[0-9][0-9]*\.[0-9][0-9]*\)') router_addr=(expr “$(nslookup 2>/dev/null $REMOTE_ROUTER|grep ‘^Address’)” : ‘Address.* ([0-9][0-9].[0-9][0-9].[0-9][0-9].[0-9][0-9])’)
iptables -I FORWARD -i br0 -o tun11 -j ACCEPT
iptables -I FORWARD -i tun11 -o br0 -j ACCEPT
iptables -I INPUT -i tun11 -j REJECT
iptables -t nat -A POSTROUTING -o tun11 -j MASQUERADEiptables -t nat -A PREROUTING -p tcp -s $appletv_addr -d $router_addr --dport 80 -j DNAT --to-destination $plexconnect_addr:$REMOTE_PLEXCONNECT_PORT
iptables -t nat -A PREROUTING -p tcp -s $appletv_addr -d $router_addr --dport 443 -j DNAT --to-destination $plexconnect_addr:$REMOTE_PLEXCONNECT_SSL_PORT
Advanced -> DHCP/DNS -> Dnsmasq
address=/trailers.apple.com/10.0.100.1 address=/atv.plexconnect/10.0.100.1
7.) The PlexConnect Settings.cfg file that corresponds with the above routing rules:
[PlexConnect] enable_plexgdm = True ip_pms = 10.0.14.50 port_pms = 32400 enable_dnsserver = True port_dnsserver = 53 ip_dnsmaster = 8.8.8.8 prevent_atv_update = True enable_plexconnect_autodetect = True ip_plexconnect = 10.0.14.50 hosttointercept = trailers.apple.com port_webserver = 8081 enable_webserver_ssl = True port_ssl = 8082 certfile = ./assets/certificates/trailers.pem loglevel = Normal logpath = .
8.) If you were to start the PlexConnect at this point, it would not give your remote location coverart as it is currently not authorized to do so without credentials. To solve this, open up your PMS to
Settings -> Network and Show Advanced
Change List of networks that are allowed without auth to your two networks. For me the following worked:
192.168.1.0/255.0.0.0,10.0.100.0/255.0.0.0
9.) Reboot both routers and the ATV. The WAN Up script at Location #2 has a 60 delay so you may have to wait a few minutes for your ATV to join the VPN.
10.) Install the certificate on your ATV as described here:
https://github.com/iBaa/PlexConnect/wiki/Install-Guide-Certificate-via-Ethernet
11.) On your ATV, open the trailers app and you should be in business.
