Using a port other than 9999?

[JordanDave]

I'm wondering how hard it would be to add a port number argument. I don't think it's available now ... but I might have missed it.

Anyway, I'm trying to control switches remotely and I'd like to be able to port-forward to several different switches. At this time, I can only do the one port-forward for 9999.

Thanks.

[kirichkov]

I don't think what you want to achieve is a good idea. Actually it's a very bad idea. This means anyone on the big bad internet will have access to your home appliances/lights.

[JordanDave]

Yes, anyone persistent already has the ability to turn my one switch (passed through on 9999) on and off. Actually, being able to use a port number other than 9999 might be slightly more secure as an attacker who knew about 9999 might not try Kasa protocols on other ports.

In any case, my use case isn't critically impacted by the switch being changed and anyone who would be critically impacted probably wouldn't do a pass through in any case.

[kirichkov]

Can't you solve the issue installing a VPN? I can recommend WireGuard because if its outstanding on-demand functionality, and being lightweight both on devices' CPU and bandwidth.

[JordanDave]

Perhaps. But I know next to nothing about VPNs and I need to be careful not to impact a fairly wide variety of inbound and outbound connections to my local network.

To clarify a bit of what I'm doing...

I have a number of Raspberry Pi's providing a variety of services - environmental monitoring, physical security, hvac and irrigation control, and even a web server tracking covid data. All of these work very well almost all of the time - they've all be running for years. But every now and then one or more just seem to go away. Power cycling generally restores the ailing system.

All of that is fine when I'm in the area. But the systems run unattended for months at a time. If a system goes away, I can generally get someone to come and power cycle the system. But that's a bit of a pain.

So I've put all of them onto Kasa switches so I can power cycle them remotely. I can do this to all of them with a single 9999 port number by power cycling one of the Pi's and then using Putty or VNC to power cycle the others from within the LAN.

So, that works unless there's more of an issue with the one I can get to. But it's a bit kludgy and I'd really rather be able to power cycle each of them independently and remotely.

Thanks for your thoughts!

[kirichkov]

Given that your Pis provide physical security, exposing the one port to turn off your physical security to the internet is a really bad idea - you'd be practically handing off the physical security key to the internet. You should really consider VPN for this use case. The other thing that you can use is Raspberry Pi watchdog - it's meant to reboot the system if something isn't right - high load, lack of connectivity, etc.

[JordanDave]

Yes, of course the physical security Pi on/off switch is not, and would not, be available directly - I won't be port forwarding it in any case.

But I'm intrigued by the use of a VPN. As I said, I'm not very familiar with VPNs, but I don't see how that would allow me to access multiple Kasa switches? Also, would a VPN require additional hardware? I think my ASUS router can support a VPN, though they don't mention Wineguard.

In any case, my original request remains the problem I'm attempting to solve...

[kirichkov]

Yes, of course the physical security Pi on/off switch is not, and would not, be available directly - I won't be port forwarding it in any case.

But I'm intrigued by the use of a VPN. As I said, I'm not very familiar with VPNs, but I don't see how that would allow me to access multiple Kasa switches?

A VPN makes your device that is not physically part of the network to be part of the network. If you can access multiple Kasa switches locally, you would be remotely too.

Also, would a VPN require additional hardware? I think my ASUS router can support a VPN, though they don't mention Wineguard.

It can run on Raspberry Pi with port forwarding.

[NameUnrequired]

python-kasa is shockingly overcomplicated and an absolute mess to work with, but it would be trivial to add it to pyHS100 which python-kasa is an asynced fork of. you'd just have to alter the init of smartbulb and smartdevice to take and store your port, then a slight alteration to the query method in the main class of protocol.py so that uses your port

if async is a requirement, you can just run pyHS inside async functions anyway. I genuinely have no idea why anyone bothers with python-kasa. it's such a buggy, messy waste of time. but then it comes top when you google python for tp-link/kasa, so not a huge surprise

[JordanDave]

Thanks for reminding me of pyHS100!

It's much easier to deal with. I added the following snippit to the query definition in protocol.py:

    # If port is at default value, check for port in host name
    if (port == TPLinkSmartHomeProtocol.DEFAULT_PORT):
        hSplit = host.split(":")
        if (len (hSplit) == 2):         # If exactly one semicolon
            host = hSplit[0]
            port = hSplit[1]

This allows host names of the form "Host:Port" for example "192.168.0.93:9998". It seems to be the only change required and seems to work just fine with port forwarding on my Asus router.

[karpach]

I have a similar need, so I created PR in python-kasa: #471

[rytilahti]

This is now possible using the DeviceConfig introduced in #569. There is no (direct) homeassistant support in the UI, but I have personally debugged a remote device using a config entry using this feature which is the preferred way as it is a rather exotic use-case :-)