[RadioDan]

I have been trying to setup WOL, so I can boot into my PC from elseware via the internet. I have successfully managed to wake up the system from another computer within the small wired network here, but no joy when trying to do this from "outside"

The router I am using is a Linksys WAG54GX2. I have hunted around online for any articles/tutorials etc and I am told that the router needs to support "Subnet Directed Broadcasts", which i'm not sure the WAG54GX2 does? Another article mentioned forwarding a UDP port to the (static) IP address of the computer in question, however, how can a computer have an IP address when off??

I am using DynDns to keep the outside IP updated and as said before, have no trouble in waking up the computer from any machine (via the DynDns domain) within the network.

Any help will be much appreciated!

[mickevh]

Errr, I'm not sure this is doable.

You'd need to create a port forwarding rule in your router to let traffic in from the Internet (which would allow anyone to wake your PC up) and you'd need a way to persuade your router to "broadcast" the "magic packet" that wakes the target PC up to the whole of your private/internal network, and I'm not sure the router will help you with that. It's more likely to see it as an "attack" and prevent it.

[gary99129]

Originally Posted by mickevh

I don't hold out much hope, but you could try the following:

Turn off DHCP (client) on the host you want to WOL then set it's private IP address etc. manually. Check you can still get to the internet.

Register your router with DynDNS so that you can always find the public IP address of your router.

Create a "port forwarding" rule in your router so that any traffic it receives from the Internet to it's public IP address is "forwarded" to the private IP address of the host you want to WOL.

Normally the firewall in home routers doesn't let in any unsolicited traffic from the Intenet. The "port forwarding" rule opens up a hole in this regime (which you'd want to do if - for example - you had a web server at home.) I'd pick a "UDP" port with an "usual" or unpopular port number.

Then test. However, you MUST test from a physically different network to your home network, or you're not testing the traffic through your router and
it's port forwarding rule. If you test from the home network, your source PC and/or router will figure this out and not send traffic "out and back in again" it will send it direct on the LAN and so not prove anything.

Then you've got to figure how to create the correct "magic packet" on the source PC to WOL the target PC and get it into the IP packet you want to send through the Internet.

And in this scenario, anyone on the Internet will be able to WOL your target PC - so would you really want to?

This also may fail if you're router regards your target PC as being "off" when it's in it's quiesced state (ie the router ARP table has aged out.)

Like I said, I don't hold out much hope for this.

Maybe someone else has an easier solution, 'cos this all sounds hard to me.

Sorry guys, that won't work (explanation below - it's probably not 100% correct but near enough). The only way to do it from the Internet would be to use a VPN or a web server on the same 'network' as the PC you are trying to wake. Effectively you connect to the web server, and it in turns sends the WOL data to wake up the PC, one of my colleagues has had this working.

WARNING, this is for IT Techies only, I promise you this will be like a foreign language if you aren't a techie. The reason WOL cannot be done directly from the Internet is that to wake a PC requires broadcasting the MAC address on the Data-Link Layer of the OSI 7 layer model. IP addressing works at layer 3, MAC addresses are at layer 2. Routers will not accept communications on layer 2, so will ignore the WOL data and more importantly routers do not pass broadcasts just like a DHCP request cannot be passed through a router (well there is an easy way around that on decent routers).

[mickevh]

Originally Posted by gary99129

...The reason WOL cannot be done directly from the Internet is that to wake a PC requires broadcasting the MAC address on the Data-Link Layer...

Yeah - that's what I figured out when I thought about it a bit more.

[RadioDan]

Well, there must be some way of doing it! All the research I've so far indicate that it is possible to do with a router?

Dan

[extremelydodgy]

Not really. You'll need a VPN for this to work. Netgear has a really cheap SSL VPN concentrator (not a recommendation but it seems to be reasonably reviewed) if IPSec seems like too much trouble.

[RadioDan]

ok, this Netgear SSL312 looks exiting. I assume with this I can WOL and remote access any computer on my network - easily using a web brower?

Not to much money either. Anybody used/setup one of these? I gather it will just plug into my wired network and from any computer on the internet, I can do things as if I was on the internal network?

Dan

[extremelydodgy]

The reviews all basically say 'It works' so it seems to be worth a punt. I use a Juniper SA700 at home and a bigger one at work, and for my uses SSL VPN works pretty well for me.


The one variable in your case is a domestic dynamic IP link, but if you self-sign I don't see this having a major issue.


The concentrator will sit behind your primary firewall/router, and you direct port 443 to it. I use external authentication for home and work, but the Netgear box definitely should be able to do its own authentication. I don't know how the Netgear handles certificates, but I'm assuming you'll be able to self-sign certificates.


Basically, what you need to get SSL VPN going is:
- Port 443 going to your concentrator
- A valid certificate, be it self-signed or recognised trusted CA issued (the latter probably won't work with DynDNS)
- Client(s) with the above certificate installed if self-signed (if CA, no need)
- User ID and password registered on the concentrator device


It's fairly straightforward, and I doubt Netgear will make it hard.

[fox uk]

I have actually got this to work, but it is kinda cheating ..... depending on the model of your router, you may be able to upgrade/change the firmware to a hybrid version which allows you to instruct the router to send the WOL magic-packets to the local LAN. Around a year ago I had a Netgear DG834GT which i upgraded the f/ware to the 'uber-firmware' which you can find online (just google it). This adds a number of extra menu-items in the web-gui for the router - one of which is 'wake on lan' and allows you to specify a local host and a MAC address... the router will then send a magic-packet to your local host. Works fine!

Again, this relies on you enabling the option to manage the router via the web (which can have security implications!). But it does mean you can log onto the router from the internet and instruct it to wake a local host.

Unless you have a serious bit of kit (like a hi-end commercial Cisco router for example), your average SOHO router won't accepted directed broadcasts from the internet. It will just discard them.

Hope that helps. Dave

[mattclarkie]

There are websites that allow you to send magic-packets over the net, but by default most routers from Netgear, Linksys, Belkin .etc. block internet traffic on the broadcast address as it is a security threat.


The only way around it is to either use a router that allows it, get a custom firmware, or use a VPN or SSH as others have suggested.

It is probably best leaving the computer on if you really need to access it remotely.


I do use WoL on my home network to wake the NAS when I need it, which works fine because the routers don't block the broadcast address over LAN, just WAN.

[RadioDan]

Having a closer look through my Linksys router, it appears you can setup a VPN on it, there being quite a number of detailed settings. If I can get help to set this up, I gather I will be able to achieve what I want to be able to do? What software would I need to be running on the remote computer?

Many thanks, Dan

[extremelydodgy]

Not too much info I've been able to dig up on a cursory look, but it does appear to support VPN access. So I guess you should give it a try. However, the reason I mentioned SSL is that many people find an IPSEC VPN very hard to configure, since they don't know any of the terminology involved. Most of the setup involved in an SSL VPN is procedural, not technical.

[Rab2]

I had this working fine a while back without VPN or SSL.
At the time I was using a Be router (Thomson speedtouch I think) Unfortunately I'm not using this router anymore so can't verify the config for it.
I'm pretty sure it was only a matter of forwarding traffic on port 7 and/or 9 to the ip of the onboard network card on the pc.

Took me a while to get set up at the time. One thing I found was a lot of the so-called magic packet utilities didn't actually work.. The most reliable site I found was Wake On Lan Used to use this from work all the time and vnc in.

[t72bogie]

Originally Posted by RadioDan

ok, this Netgear SSL312 looks exiting. I assume with this I can WOL and remote access any computer on my network - easily using a web brower?

Not to much money either. Anybody used/setup one of these? I gather it will just plug into my wired network and from any computer on the internet, I can do things as if I was on the internal network?

Dan

yeah- exactly that, very easy to set-up and an ideal solution for small business who want secure remote access, it was the first SME class SSL concentrator on the market - good review here

SmallNetBuilder - Small Network Help - Netgear's Breakthrough SSL312 VPN Gateway

[mattclarkie]

I had to build my on WoL client, because all the ones I downloaded didn't work, or expected things that aren't even needed.


There is a French one that claims to be the best, it kept asking for an address of something(no idea what) to send the packet, all it should need is the MAC of the computer, and maybe the broadcast address for the network, but it insisted on something that I don't even think exists, so I said screw that and built one in about 3 minutes. Of course only LAN not WAN.

[markpaq]

This one works for me. I'm using a Cisco router so I've been able to modify the ACL's to allow a specific UDP port.

[Bristolbulldog]

Wake On LAN FAQ - dslreports.com

[mickevh]

WOL fans - you may be interested in a utility I found called MC-WOL for generating and transmitting magic packets. This won't address the "doing WOL from the Internet" issues which are the central theme of this thread, but if (like me) you have a PC buried in a cupboard that you want to WOL from a laptop on the sofa, this may be of interest...

The AMD Magic_Pkt utility is all fine and good, but what I really wanted was a way to simply embed a shortcut in the start menu of one PC that would wake another. MC-WOL is a good old fashioned cmd line tool which accepts a parameter which is the MAC address of the PC you want to wake (plus IP subnet broadcast address if on another IP subnet, but that's unlikely to be necessary in most SOHO LANs.)

So, I create a shortcut in my start menu "MC-WOL xx:xx:xx:xx:xx:xx" fiddle the properties so it runs minimised, give it a suitable name ("Wake up XXXX") and change the icon for something I find cute. To use, simply cick the shortcut and my other PC springs into life. Being a shortcut, obviously you could stick it anywhere else you like (desktop for example.)

Usual caveat about "this is someone else's program, you use it at you own risk, etc. etc."

Enjoy. Mick

[trueg]

mickevh, in another thread you mention that using WOL over WAN is dangerous/unsecure.

Could you elaborate on that for me? If you have port 666 (as an example) forwarded to your PC and it is in hibernation mode (essentially turned off), the only way to turn it on would be if someone knew your MAC address and happened to send a WOL packet using that MAC on the random port you have chosen. All other traffic would be ignored since it is off. Once in Windows, port 666 should be blocked by the firewall, so it is only ever used when the PC is off and only works if the correct MAC is used. Even if someone was able to figure out your MAC address and turn your computer on, is there anything they can do if nothing responds to that port once the O/S is running?

On a different note, many of the web sites that allow you to send WOL packets use ports 7 and/or 9 by default. In my case my Belkin router blocks incoming UDP traffic on ports 7 & 9 whether the ports are forwarded or not.

This site allows you to specify a different port...
Depicus

I initially tested it with port 80 and that worked, so now I am using a random 5 digit port that is forwarded through my router to my PC. I also found a Pocket PC version on that same site that allows me to wake my PC from my phone. This way my HTPC can shut down after 60 minutes of inactivity and if I want to use Remote Desktop from my Pocket PC Phone or Laptop I just need to wake it up, wait 30 seconds and then Remote Desktop in. =)

[mickevh]

Did I? Blimey that sounds a bit alarminst.

The risk is that you've opened up an inbound port to you network which all the worlds lovely port scanners might try to exploit. As you say, there's a few hoops to jump through to make any use of it, so the risk is low, but there is a risk. As ever with these things, it's about balancing the risks against the benefits.

My ideal solution would be to SSH into the router (needs a loginid & P/W) then have the router send the WOL packet for me so that there's no need to forward any WOL's from the Intenet, but obviously that required a router that can do so.

Cheers, M.

[trueg]

Yes indeed, I too would like a router that would allow me to do that. I've recently discovered that although my router will pass WOL packets, 5 minutes after hibernating it flushes the ARP table and forgets where my PC is. I can wake it within the first few minutes after shutting down, but when I try at the 10 minute mark it no longer works.

I contacted Belkin, but I doubt they allow command line access. I believe I only need access to the ARP command in order to issue a magic packet.

[fearghost]

Originally Posted by trueg

Yes indeed, I too would like a router that would allow me to do that. I've recently discovered that although my router will pass WOL packets, 5 minutes after hibernating it flushes the ARP table and forgets where my PC is. I can wake it within the first few minutes after shutting down, but when I try at the 10 minute mark it no longer works.

I contacted Belkin, but I doubt they allow command line access. I believe I only need access to the ARP command in order to issue a magic packet.

Hi trueg,

Basically, what you need to get WOL working from the internet is a router that supports ip directed broadcasts or static ARP tables.

Your ARP table is timing out after your pc is switched off. Your router will 'bind' the mac address with the ip address of your pc while it is switched on, but once the router can no longer see the ip address of your pc it will drop this 'binding'. This is usually set to just a few minutes time out.

Some 'high end' routers will allow you to manually bind an ip address and mac address permanently (such as the Draytek 2820). That way, the router doesnt forget the ip / mac address association and will forward the wol packet correctly. As was stated earlier in this thread, WOL packets work at layer 2 (mac address), not layer 3 (ip address).

An alternative to this is to forward the WOL packet to the broadcast address of your local subnet (nnn.nnn.nnn.255) but most wont allow this for security reasons. If you broadcast then the packet is sent to every device on the LAN and the one with the matching mac address will pick it up.

Im not sure why but I have always found ADSL routers to rarely support either of these features and you would normally need to use a 'hacked' firmware to get it to work propely.

Hope this helps.

[SeanT]

Most networks have too much traffic for the passive form of WOL to work properly (this is where you allow any traffic to wake the computer, as opposed to just magic packets)
The solution to this is to put the computer on it's own subnet, and let the router, erm, route packets to the machine - meaning that nothing on the network can wake it up apart from a device that knows it's IP address and sends packets to that. This is how my home server works - it has a secondary network card for traffic on a different subnet.

If you then have a router that will route packets from the internet to this different subnet (which my blasted netgear one won't!! - grrr) you're done.

If not, you're back to square one (although I get around the issue with a tiny thin client type PC that I leave on all the time, which then wakes the server up when I VNC to it!)

[jameson_uk]

Originally Posted by fearghost

Basically, what you need to get WOL working from the internet is a router that supports ip directed broadcasts or static ARP tables.

If your router is the only thing left on then this is true. If you have a server or NAS box you can connect to this via the internet and send the WOL command like that.

IIRC there are various PERL scripts that will do the actual WOL bit.

[trueg]

Yup, the router is dropping the IP/MAC association after a few minutes and it doesn't allow forwarding to a broadcast address.

Having my computer wake on Pattern Match allows it to wake whenever it receives data, but even when all of the other PCs are turned off, something is still waking my PC every hour or two. Setting it to wake on "Magic Packet only" allows it to remain asleep until I specifically wake it.

Luckily, I was able to pick up a used Linksys WRT54G v3.0 for $15 yesterday. I loaded up DD-WRT, which has a Wake-on-LAN feature so I should be good to go. =)

[fearghost]

DD-WRT is an excellent choice It should support all your needs.

By the way, NETBIOS may be the culprit waking your pc before... It generates a lot of network 'chatter'....

[trueg]

Thanks for the tip about NetBIOS.


I have my WRT54G w/DD-WRT up and running and I love it. I'm very familiar with BusyBox Linux, so once I had my ports forwarded and I assigned a static DHCP address to my HTPC, I used telnet to gain CLI access and created a static ARP association. Now I can wake my PC from anywhere in the world right from my Pocket PC. Once it is up I can log in to Remote Desktop mobile and have my way with my PC.

Every router should be running Linux.

[fearghost]

Nice one trueg, glad you got it all working ok