Bacnet Discovery across VPN tunnel help!

[optecmuza]

So I'm trying an idea I had with bacpypes and trying to make bacnet scan work across a VPN tunnel

I have device A, sitting in 192.168.1.0/24 locally in an ubuntu machine at my office. This device is running tailscale VPN.

I have device B, sitting in EC2 AWS, sitting in 172.31.18.51/XX also in the tailscale mesh VPN. (ubuntu as well)

Both devices have their iface tailscale0 and unicast works, I'm able to ping and the UDPConsole.py example works for me when doing unicast.

What I want to achieve is the following:

I want to send a BACnet who-is from device B that propagates acordingly throught the VPN tunnel and device A responds with an I-Am back to Device B.

What do I have to run on Device A to make this work? Is the BBMD.py example applicable or is the IP2IPRouter.py example applicable?

Let me know!

[JoelBender]

I'm not familiar with tailscale, so this is a bit of a poke in the dark and see what squeals...

...the UDPConsole.py example works for me when doing unicast.

Do you have control over both device A and B, like they are both BACpypes applications, or just one end? Setting up a device from a vendor to initiate a specific kind of request with different destination address options can be a challenge.

When you run the console application are you providing the CIDR address, or just the tailscale provided address? The difference is being able to bind to the broadcast address of the tailscale network that is given to you. If both ends can bind both their unicast address (like 172.31.18.51) and the broadcast address (like 172.31.18.255 assuming network 172.31.18.0/24) then there's nothing special you need to do. Both unicast and broadcast Who-Is requests will be received on both ends and it won't matter if the response is unicast or broadcast.

The stumbling block will be if you don't have control over how the response to the Who-Is request will be sent. Modern stacks will respond with a unicast I-Am, but older ones will respond with a broadcast which might not make it through the tunnel.

For next steps, try running the console application at both ends and try broadcast messages like * snork and see what it looks like on the other end. Both the BBMD and IPv4-to-IPv4 applications could be something you want, but there's not quite enough foundation to build on more layers. After that I'm going to recommend you switch to BACpypes3 and run this for more testing:

$ python3 -m bacpypes3 --address 172.31.18.51/24 --instance 10101

And start sending unicast and broadcast Who-Is and I-Am messages.

[optecmuza]

Tailscale is similar to tosibox or other VPN services where it opens a tunnel between machines running the tailscale service.
Let me explain what I'm hoping to achieve:

Imagine a chiller plant with bacnet devices on subnet 192.168.0.X/24. We would have a computer running Ubuntu with two available ethernet interfaces. One interface is on 192.168.0.X/24 for the bacnet network. Another interface is on an unknown subnet that its there just for outbound internet connection. We would install tailscale VPN on this machine to add it to the VPN network that tailscale allows you to belong. My computer in the office and our servers in EC2 AWS are also running tailscale so basically its a big VPN network where all these machines are accessible.

Now this on-site machine has 3 ifaces, eth0 for bacnet, eth1 for internet/wifi/whatever and tailscale0 for the vpn tunnel.

On EC2 AWS we have a machine that runs Skyspark which is a software that has a full stack of BACnet. This machine is also running tailscale, which allows me to reach the on-site machine through the tailscale tunnel. I want to be able to send bacnet scans from the ec2 machine. Because they are in different subnets, bacnet scans won't work, however unicast will work if I do static mapping of bacnet devices. I'm not a super expert in bacnet but I think this scenario, the ec2 instance is a foreign device right? Can bacpypes help me in running a BBMD or Router service on the on-site machine to allow for this?

[bbartling]

Can you just setup an "edge" application for BACnet scrapes reads/writes or whatever and then use some other protocol on tailscale to transfer the data? Like a message bus service like MQTT, ZMQ, or Rabbit MQ (ranging from easiest to hardest in setup from only dabbling...) for getting data from edge to AWS... Or even rest API payload. Some mega makeover I would absolutely jump to asyncio bacpypes3. There is Py asyncio MQTT packages out there... I do have a side project that is a "rest like" web app for BACnet. It would be interesting running this on the edge device and then on your AWS instance just hit it thru the tailscale VPN with typical REST API web app requests. https://github.com/bbartling/bacpypes3RcpServer Let me know what you think.

…

On Sat, Jul 20, 2024, 10:05 AM optecmuza ***@***.***> wrote: Tailscale is similar to tosibox or other VPN services where it opens a tunnel between machines running the tailscale service. Let me explain what I'm hoping to achieve: Imagine a chiller plant with bacnet devices on subnet 192.168.0.X/24. We would have a computer running Ubuntu with two available ethernet interfaces. One interface is on 192.168.0.X/24 for the bacnet network. Another interface is on an unknown subnet that its there just for outbound internet connection. We would install tailscale VPN on this machine to add it to the VPN network that tailscale allows you to belong. My computer in the office and our servers in EC2 AWS are also running tailscale so basically its a big VPN network where all these machines are accessible. Now this on-site machine has 3 ifaces, eth0 for bacnet, eth1 for internet/wifi/whatever and tailscale0 for the vpn tunnel. On EC2 AWS we have a machine that runs Skyspark which is a software that has a full stack of BACnet. This machine is also running tailscale, which allows me to reach the on-site machine through the tailscale tunnel. I want to be able to send bacnet scans from the ec2 machine. Because they are in different subnets, bacnet scans won't work, however unicast will work if I do static mapping of bacnet devices. I'm not a super expert in bacnet but I think this scenario, the ec2 instance is a foreign device right? Can bacpypes help me in running a BBMD or Router service on the on-site machine to allow for this? — Reply to this email directly, view it on GitHub <#531 (reply in thread)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AHC4BHOVTYFJ5XVK562LXUTZNJ4DXAVCNFSM6AAAAABLEZET7OVHI2DSMVQWIX3LMV43URDJONRXK43TNFXW4Q3PNVWWK3TUHMYTAMJQGI4DIOA> . You are receiving this because you are subscribed to this thread.Message ID: ***@***.*** com>

[bbartling]

@optecmuza I am actually experimenting with this... this is sort of an interesting use case.

So I am familiar with Tailscale we use it quite a bit where I run remote bacpypes3 applications inside a couple buildings to conduct demand response research projects for the company I work for.

In my remote Linux device "bacpypes3RcpServer" is running and I can dial into the web interface via the browser all through Tailscale... where then I can discover my BACnet devices, discover a points in a device/devices, and test out the BACnet network all through the browser (like HVAC controls contracting) via the app's "Swagger UI" which is something built into the web app frame work called FastAPI ... its really neat for testing out API's visually on a browser and especially cool for a remote BACnet network and I think it works great especially when the building is really far away.

Feel free to ping me am more than happy to give a demo. I made this client HTTP request script just now to tested it out and it works great. Am running the client request script from Starbucks WiFi on my Windows laptop and hitting the Linux application running the BACpypes3/RPC server inside some remote building ... where pretty quick I was able to use ChatGPT to assist in making that client Rest API BACnet read multiple requests to run inside Starbucks and scrape the BACnet network through Tailscale inside the remote building on 10 VAV box on a handful of useful points (most points at least HVAC devices are worthless data used only in the initial setup of the device... hopefully people don't scrape everything in IoT on short intervals) and it works great. Half an hour or less with Chat GPT on this client request script and ...

Device Instance: 20, Object Identifier: analog-input,1019, Property Identifier: present-value, Value: 61.990440368652344, Description: Discharge Air Temperature (DA-T)
Device Instance: 20, Object Identifier: analog-input,1106, Property Identifier: present-value, Value: 70.9557876586914, Description: Zone Temperature (ZN-T)
Device Instance: 20, Object Identifier: analog-output,2014, Property Identifier: present-value, Value: 0.0, Description: Heating Valve Output (HTG-O)
Device Instance: 20, Object Identifier: analog-output,2131, Property Identifier: present-value, Value: 52.85157012939453, Description: Air Damper Output (DPR-O)
Device Instance: 20, Object Identifier: analog-value,1103, Property Identifier: present-value, Value: 70.0, Description: Zone Temperature Setpoint (ZN-SP)
Device Instance: 20, Object Identifier: analog-value,3384, Property Identifier: present-value, Value: 392.4878845214844, Description: Supply Air Flow Setpoint (SAFLOW-SP)
Device Instance: 20, Object Identifier: analog-value,3515, Property Identifier: present-value, Value: 394.3880310058594, Description: Supply Air Flow (SA-F)
Device Instance: 20, Object Identifier: multi-state-value,3290, Property Identifier: present-value, Value: 1, Description: Effective Occupancy (EFF-OCC)

Some sort of Brick model ontology would be really neat too to build on top of...

So I am only Hobbit level networking and network programming level... am real curious to ask @JoelBender Wizard level or others, what's your thoughts on this approach? ... instead of BACnet across the internet or VPN just using TCP HTTP requests with JSON payload of the data ... where then the BACnet application is just running on the LAN or intranet inside the building...

[optecmuza]

@bbartling Men that looks cool!. Let me give that a try and report back. I really want to keep the BACnet functionaility on Spyspark at the cloud level though. If I could have a service running on the on-site machine that acts as a BBMD or Router so whenever the cloud machine Skyspark BACnet stack sends any BACnet operation through the interface, it broadcasts accordingly as it were in the same subnet, however, I dont shy away from cool stuff so I'm giving your project a look!.

@JoelBender If you thing BACpypes3 can help me with that, let me know!!

[JoelBender]

@bbartling

... instead of BACnet across the internet or VPN just using TCP HTTP requests with JSON payload of the data.

I proposed Streaming BACnet for connection oriented virtual link layer before the IT-WG settled on web sockets for BACnet/SC. Apparently it was too simple ;-). Encoding requests and responses as JSON is pretty simple too, BACpypes3 has sequence_to_json() and json_to_sequence() functions for that. BACnet Web Services (B/WS) also has JSON based REST services, but I've never implemented it (or the archaic SOAP web services) because I have no need for it.

[JoelBender]

I wrote:

For next steps, try running the console application at both ends and try broadcast messages like * snork and see what it looks like on the other end. Both the BBMD and IPv4-to-IPv4 applications could be something you want, but there's not quite enough foundation to build on more layers.

Now for why...

There are options for devices X, Y and Z depending on what you have control over and what you do not. If there is no way to send and receive broadcasts over the VPN (which means each device has to be able to bind to 1.2.3.255 for a /24 network) then the only option is to treat it as a unicast network. This topology assumes that all of the blue diamonds are one BACnet network (call it network 1), all of the purple diamonds are on another (call it network 2). I would think the you would want the other EC2 instances to all be normal devices, the green diamonds are all on network 3, so Z is a B/IPv4-to-IPv4 router between network 3 and network 2.

---

Scenario 1 - Broadcast on the VPN Network

X is B/IPv4-to-IPv4 routers between network 3 and 1, Z is a B/IPv4-to-IPv4 router between network 3 and 2. Y is a "normal" device on network 3. A Who-Is global broadcast from Y will be received by X and re-broadcast on 1, it will also be received by Z and re-broadcast on network 2.

A global broadcast I-Am from Chiller 1 will be received by X and re-broadcast on network 3. This will be received by Y and processed normally, it will also be received by Z and re-broadcast on network 2.

---

Scenario 2 - No broadcast on the VPN network

X is a BBMD-to-IPv4 router, it's a BBMD on network 3 and a normal B/IPv4 device on network 1. Y is a foreign device and registers with the BBMD on the network3 side of X. Z is a Foreign-Device-to-IPv4 router, it registers with X just like Y and is a normal B/IPv4 device on network 3. A Who-Is global broadcast from Y will be (1) sent as a unicast message to X which will (2) re-broadcast it on network 1 and (3) forward an additional copy to Z. Z will then (4) re-broadcast the request on network 2.

A global broadcast I-Am from Chiller 1 will be received by X and sent as a unicast message to Y and processed as usual. An additional copy will be unicast to Z and re-broadcast on network 2.

---

Both scenarios have their own issues with respect to maintaining the associations on network 3, sending out I-Am-Router-To-Network messages at the appropriate times, and registering as a foreign device on connect and reconnect make things harder.

All of these can be handled by BACpype3, and if the VPN IPv4 address are persistent/consistent then the configurations are just JSON config files, otherwise it'll need some help resolving interface names to IPv4 networks (address and mask). BACpypes3 uses ifaddr for this kind of work.

[JoelBender]

Arguably the best option would be for you to create Z, a BACnet/SC hub in the cloud as an EC2 instance with a public IPv4 address and a secondary interface that lives on network 2. Then X is a B/SC node/router to network 1 and Y is a B/SC node. You would issue certificates for all three using a service like Let's Encrypt. The nodes would be making TLS connections to the hub and there would be no use for tailscale (except to connect to SkySpark, but that's not BACnet traffic).

BACpypes3 does not support B/SC yet. Some pieces are in there, but it's incomplete.