Accessing BACnet device over VPN

[JimitD]

Hi Joel,

I was have created a BACnet device with local IP address. Which is in range 192.168.X.XX

This device has OpenVPN running on it with IP address of 172.30.XX.XX.

So, by VPN connection, remotely I would like to Read Properties of BACnet device.

Please suggest.

[JoelBender]

This will be simpler if you have the ability to run BACpypes applications on each side of the tunnel. The basic idea is to send very simple UDP packets between the two devices based on their IP addresses and see how the source address is presented when it is received. Assuming that you have your A device locally and your B device is on the destination network with other BACnet devices.

Install BACpypes on both machines and run the samples/UDPConsole.py application. In both cases you give the application the IP address and port number, so on the A device you would give it 172.30.XX.XX/16 because this is a 16-bit network in CIDR notation, and use the default port 47808. On the B device give it 172.30.YY.YY/16, assuming that makes sense, and it might not!

With both applications running, enter 172.30.YY.YY spam in the A device and see what the source address is when it arrives on the destination. This is a unicast message.

Try again by entering * eggs on the A device and see if the VPN tunnel will (1) recognize that the packet is being sent to a broadcast address, and (2) will forward the packet to the VPN server at the other end that will (3) re-broadcast the packet with the same source address. If this works you are golden, the rest of the BACnet work is easy. If this doesn't work, there's more work that needs to be done.

Let me know what you find out.

[JimitD]

Hi Joel,

Thank you so much for detail explanation.

I am able to establish two side communication with samples/UDPConsole.py application. Both remote located machines running on VPN service. IP of A is 172.30.0.113/16 & B is 172.30.255.10/32. The results are as below,

1.  172.30.255.10 spam
    172.30.255.10 hello there
   

Response received at destination machines is 

received 'spam' from ('172.30.0.113', 47808)
received 'hello there' from ('172.30.0.113', 47808)

2.

• eggs
  received broadcast 'eggs' from self
• Hello
  received broadcast 'Hello' from self

This two works perfectly. 

But in BACpypes.ini file I would like to give **address** to local IP which is in range 192.168.XX.XX. See below, 

objectName: BACnet Home Device
address: 192.168.20.100/24
objectIdentifier: 444
location: Mumbai
maxApduLengthAccepted: 1024
segmentationSupported: segmentedBoth
vendorName: XXXX
vendorIdentifier: XXXX
foreignBBMD: XXXX
foreignTTL: XXXX

Here, how can I make device **A** communicate with device **B** over VPN?

[JoelBender]

So you have successful unicast (point-to-point) messages, you will be able to send confirmed services like Read and Write Property. In the address field for the A device, put 172.30.0.113/16 exactly as you have in the test application. By seeing that the B device is receiving the correct address, a BACnet device will be able to respond with a Simple or Complex ACK.

Now put 172.30.255.10/32 in the INI file for the B device and run the Sample4_RandomAnalogValueObject.py sample application. This will present itself as a BACnet device on its network. On the A device run the ReadProperty.py, then at the prompt put in a read request:

read 172.30.255.10 analogValue:1 presentValue

If you get a number back, you are off to the races, welcome to BACnet!

[JimitD]

Here is the point Joel,

I want to put device A address to 192.168.20.100/24 because it would be accessed by other BMS system locally. To have local access I need to have local IP range but for VPN the IP & Subnet are changing.

Now, If I put device A address to 172.30.0.113/16 then it will be available for remote access but will not be available locally

So, can we use BBMD here?

Please suggest.

[JoelBender]

Every BACnet device has one and only one BACnet address, and because you have two distinct IPv4 networks you also have two different BACnet networks. To join them together you need a BACnet Router which can listen on both networks for requests and forward them on to the other network.

There is an IP2IPRouter.py sample application which can forward traffic from one network to another, but it does not have an application layer, it is strictly a network layer application. (Note that there is a proposal that would make such applications fail conformance tests because they are harder to manage.)

Maybe what you need is an application that merges together the router and ReadWriteProperty.py application so it can be a router and generate and respond to requests for both IP networks. When this router is working, other devices on your local IP network will be able to tunnel requests to devices on the other side of the VPN network.

A BBMD is used for forwarding broadcasts, and you might need one of those at some point, but it won't help you in this case.

If you have netifaces installed, you can use the interface name rather than the IP address in the INI file (like what is shown in the output of the ip addr command), assuming that the VPN client doesn't dynamically change the name for every connection.

[JoelBender]

Just to see how this goes, I'm going to convert this issue to a discussion.

[ChristianTremblay]

If you connect directly to the device and you already know everything about it (aka you don't need broadcast) the BBMD is not required.

One thing I do a lot is registering as a foreign device to a router on the other subnet. Pretty common.