Easiest Way to Secure Camera System

SouthernYankee · Sep 16, 2018

Depend on how you disabled the bi computer.
How did you disabled the bi computer on the router.

scquestions · Sep 16, 2018

SouthernYankee said:
Depend on how you disabled the bi computer.
How did you disabled the bi computer on the router.

Just went in the Asus router interface and disabled internet access to the computer.

SouthernYankee · Sep 16, 2018

Scquestions
In the Asus router, I disabled internet access for the complete home subnet. No internet access for the all computer, tablets, tv...
But from my tablet I am able to access the UI3 blue Iris web site. 192.168.1.234:8081 .... This is my local bi server IP address, with a web portal

Asus RT-AC66U router, clicked network map. Clicked the globe in the network status, internet status, click internet connection off.

scquestions · Sep 16, 2018

SouthernYankee said:
Scquestions
In the Asus router, I disabled internet access for the complete home subnet. No internet access for the all computer, tablets, tv...
But from my tablet I am able to access the UI3 blue Iris web site. 192.168.1.234:8081 .... This is my local bi server IP address, with a web portal

Asus RT-AC66U router, clicked network map. Clicked the globe in the network status, internet status, click internet connection off.

I can't access via my phone via the browser, nor the Blue Iris app, nor my laptop. Just the Blue Iris computer itself.

scquestions · Sep 16, 2018

SouthernYankee said:
Scquestions
provide a screen shot of the IP range in your router. On an ASUS router this is LAN->DHCP server
Log in to your camera with IE web browser. Take a screen shot of the network TCP/IP setting. On a dahau camera Network->TCP/IP the TCP/IP tab

The range on the Asus router was 192.168.50.2 to 192.168.254 but I changed it to 192.168.240 in order to assign IP addresses above 240 for the cameras.

I'll try to log in to the cameras if I'm able.

scquestions · Sep 16, 2018

SouthernYankee said:
Scquestions
provide a screen shot of the IP range in your router. On an ASUS router this is LAN->DHCP server
Log in to your camera with IE web browser. Take a screen shot of the network TCP/IP setting. On a dahau camera Network->TCP/IP the TCP/IP tab

I've found the camera settings.. I've found the page you mentioned but would rather not post a screenshot. It looks like I'm able to change the IP address from this interface. Maybe I'll try that?

And the camera is in DHCP mode, not static.. Maybe that is the problem.

scquestions · Sep 16, 2018

SouthernYankee said:
Scquestions
provide a screen shot of the IP range in your router. On an ASUS router this is LAN->DHCP server
Log in to your camera with IE web browser. Take a screen shot of the network TCP/IP setting. On a dahau camera Network->TCP/IP the TCP/IP tab

Well, I've been able to get all of the camera's IP addresses to switch to static and be outside the DHCP range. Your post helped me to figure it out. I had to set everything up in the router's interface (assigning the camera to an IP address) and then went into the camera's interface and changed it to static and entered that same IP address.

So, I'm set up there. Next I'm assuming it's necessary to change the Blue Iris PC's IP address to static also?

Tiny Cam Monitor Pro is working with the new IP addresses but I'm not sure why the Blue Iris app isn't working. Also, I'm still not able to access Blue Iris from another PC on the same network.

TonyR · Sep 17, 2018

scquestions said:
.......and then went into the camera's interface and changed it to static and entered that same IP address.

Yes, that cured the issue you faced last. Looking back, you were advised to assign static IP's to cams but I think it was assumed you would log into the cam and config it to be static. Even yours truly failed to make that clear...sorry.

scquestions said:
Next I'm assuming it's necessary to change the Blue Iris PC's IP address to static also?

Yes, by all means.

scquestions said:
Also, I'm still not able to access Blue Iris from another PC on the same network.

Insure in BI, 'Options' that the webserver is 'enabled'; when you attempt to run UI3 from another PC on your LAN open your browser (preferably Chrome) with this URL :

Code:

http://Your-BI-server-IP:BI-port/ui3.htm

Unless you have user 'anonymous' checked, you'll be asked for user/pass.
If you do have user 'anonymous' enabled, insure that it is set for 'LAN access only' for that user.

scquestions · Sep 17, 2018

TonyR said:
Yes, that cured the issue you faced last. Looking back, you were advised to assign static IP's to cams but I think it was assumed you would log into the cam and config it to be static. Even yours truly failed to make that clear...sorry.

Yes, by all means.

Insure in BI, 'Options' that the webserver is 'enabled'; when you attempt to run UI3 from another PC on your LAN open your browser (preferably Chrome) with this URL :

Code:

http://Your-BI-server-IP:BI-port/ui3.htm

Unless you have user 'anonymous' checked, you'll be asked for user/pass.
If you do have user 'anonymous' enabled, insure that it is set for 'LAN access only' for that user.

Thanks for all of your help.

UI3 is still just working from the computer itself, not from any other device. Maybe there's a setting within the router that should be changed?

It's just saying the connection timed out on Chrome.

SouthernYankee · Sep 17, 2018

Scquestion.
From other PCs on your network can you ping the BI server.
Also what anri virus, firewall are you using on the BI server.
Disable your anti virus, firewall on the BI server, test from another PC if you can connect via ui3

scquestions · Sep 17, 2018

SouthernYankee said:
Scquestion.
From other PCs on your network can you ping the BI server.
Also what anri virus, firewall are you using on the BI server.
Disable your anti virus, firewall on the BI server, test from another PC if you can connect via ui3

Just tried to ping using command prompt and it timed out.

Everything is default Windows 10. I didn't install antivirus. The computer is disabled access to the Internet via the Asus router.

looney2ns · Sep 17, 2018

scquestions said:
Just tried to ping using command prompt and it timed out.

Everything is default Windows 10. I didn't install antivirus. The computer is disabled access to the Internet via the Asus router.

Windows 10 includes antivirus and firewall, you will have configure it properly, with opening ports and such.
The BI help file discuss's this.

scquestions · Sep 17, 2018

looney2ns said:
Windows 10 includes antivirus and firewall, you will have configure it properly, with opening ports and such.
The BI help file discuss's this.

That was the problem! Thank you!

I opened up the help file, searched for firewall, and got the instructions. Now, on Windows Firewall there are three options, allow, allow if secure, and block. I chose "allow". Hopefully that's alright.

And this also fixed the issue with the Blue Iris app. It's working on my phone now.

scquestions · Oct 30, 2018

I'm still struggling to connect to Blue Iris via UI3 via a cellular connection using Open VPN. I've tried both on my cell phone and on a laptop using the phone's mobile hotspot. It'll connect to the Asus interface, it'll show my cable IP address, but it won't connect to UI3 or the cameras.. Once connecting to the home WiFi network both worked again. I'm not sure if there's a problem but as far as I know the OpenVPN settings are all default. I've chosen to disable Internet access to the Blue Iris computer and each camera, so maybe that's the reason it's not letting me connect, but because it works on the home network I'd think it would work via the VPN too.

catcamstar · Oct 31, 2018

scquestions said:
I'm still struggling to connect to Blue Iris via UI3 via a cellular connection using Open VPN. I've tried both on my cell phone and on a laptop using the phone's mobile hotspot. It'll connect to the Asus interface, it'll show my cable IP address, but it won't connect to UI3 or the cameras.. Once connecting to the home WiFi network both worked again. I'm not sure if there's a problem but as far as I know the OpenVPN settings are all default. I've chosen to disable Internet access to the Blue Iris computer and each camera, so maybe that's the reason it's not letting me connect, but because it works on the home network I'd think it would work via the VPN too.

The only odd thing I see in your setup, is the "block internet access" for the BI system. Just to make sure that this isn't the showstopper: can you enable it for just 1 minute, open VPN connection and try to load the UI3 webpage again. If that ain't not working either, you might have to look into a firewall rule on your BI system: if you connect locally, you are coming from a 192.168.x.x address, however coming from VPN, you enter through a 10 address.

Hope this helps!
CC

cuz · Nov 4, 2018

Wow, lots of good info here, thanks a lot. One question I didn't see answered is...

Does anyone make an affordable 8 or 16 channel NVR that can require login over HTTPS?
So far the only one I can find is from Axis, but it's expensive considering the limited features when you compare it to Hikvision's offerings.

Thanks,
-Cuz

catcamstar · Nov 4, 2018

cuz said:
Wow, lots of good info here, thanks a lot. One question I didn't see answered is...

Does anyone make an affordable 8 or 16 channel NVR that can require login over HTTPS?

I'm not behind my NVR wheel right now, but I do know that Dahua IPC's carry the HTTPS feature (eg IPCamera/Setup HTTPS - Dahua Wiki). Not sure about the NVR though.

Edit: yes, it does: Troubleshoot/NVR/Expired Cert - Dahua Wiki

cuz · Nov 4, 2018

catcamstar said:
I'm not behind my NVR wheel right now, but I do know that Dahua IPC's carry the HTTPS feature (eg IPCamera/Setup HTTPS - Dahua Wiki). Not sure about the NVR though.

Edit: yes, it does: Troubleshoot/NVR/Expired Cert - Dahua Wiki

Thanks, but the link you provided shows that the Dahua NVR supports login over HTTPS, but it doesn't say anything about requiring it. I want to disable the NVR's ability to accept an HTTP login attempt. The setup screen shown in the Wiki looks like you can pick any port you want for HTTP login, but not disable it. When we run vulnerability scans on our internal network, having an open HTTP port flags an alert. I am looking to replace my current old DVR with a newer IP based NVR system but it must have the ability to disable HTTP access.

catcamstar · Nov 4, 2018

cuz said:
Thanks, but the link you provided shows that the Dahua NVR supports login over HTTPS, but it doesn't say anything about requiring it. I want to disable the NVR's ability to accept an HTTP login attempt. The setup screen shown in the Wiki looks like you can pick any port you want for HTTP login, but not disable it. When we run vulnerability scans on our internal network, having an open HTTP port flags an alert. I am looking to replace my current old DVR with a newer IP based NVR system but it must have the ability to disable HTTP access.

From the manual (http://www.dahuasecurity.com.ph/download/dhi-nvr5208_5216_5232-8p-4ks2_user_manual_20160822.pdf) on page 228, I deduct that you could throw HTTP port to 37337 for example, not sure whether (or not) someone is scanning these high ports for a webservice. Personally, I would secure your NVR in a seperate vlan just to avoid being able to be scanned anyways, then you just allow specific ips to connect to intervlan port forwards only.

Mike A. · Nov 4, 2018

catcamstar said:
From the manual (http://www.dahuasecurity.com.ph/download/dhi-nvr5208_5216_5232-8p-4ks2_user_manual_20160822.pdf) on page 228, I deduct that you could throw HTTP port to 37337 for example, not sure whether (or not) someone is scanning these high ports for a webservice...

Everything gets scanned 24x7 these days. Common ports get hit more frequently but trying to obscure things on high ports doesn't do anything now beyond maybe delaying it being found for some number of days. e.g., From my logs just now over a couple of minutes (DPT= destination port):

Nov 04 14:02:33 xxxxxxx kernel: DROP IN=eth0 OUT= MAC=70:8b:cd:de:0e:98:f4:b5:2f:07:b0:c3:08:00 SRC=176.119.4.35 DST=xxx.xxx.xxx.xxx LEN=40 TOS=0x00 PREC=0x00 TTL=247 ID=22980 PROTO=TCP SPT=57288 DPT=65429 SEQ=3343457006 ACK=0 WINDOW=1024 RES=0x00 SYN URGP=0
Nov 04 14:03:29 xxxxxxx kernel: DROP IN=eth0 OUT= MAC=70:8b:cd:de:0e:98:f4:b5:2f:07:b0:c3:08:00 SRC=112.112.38.139 DST=xxx.xxx.xxx.xxx LEN=44 TOS=0x00 PREC=0x00 TTL=243 ID=19907 PROTO=TCP SPT=58784 DPT=1433 SEQ=2992895205 ACK=0 WINDOW=1024 RES=0x00 SYN URGP=0 OPT (02040400)
Nov 04 14:04:46 xxxxxxx kernel: DROP IN=eth0 OUT= MAC=70:8b:cd:de:0e:98:f4:b5:2f:07:b0:c3:08:00 SRC=194.28.115.243 DST=xxx.xxx.xxx.xxx LEN=40 TOS=0x00 PREC=0x00 TTL=247 ID=1384 PROTO=TCP SPT=53562 DPT=44789 SEQ=2747537186 ACK=0 WINDOW=1024 RES=0x00 SYN URGP=0
Nov 04 14:06:12 xxxxxxx kernel: DROP IN=eth0 OUT= MAC=70:8b:cd:de:0e:98:f4:b5:2f:07:b0:c3:08:00 SRC=176.119.4.27 DST=xxx.xxx.xxx.xxx LEN=40 TOS=0x00 PREC=0x00 TTL=247 ID=15044 PROTO=TCP SPT=56700 DPT=6332 SEQ=2073534151 ACK=0 WINDOW=1024 RES=0x00 SYN URGP=0
Nov 04 14:06:32 xxxxxxx kernel: DROP IN=eth0 OUT= MAC=70:8b:cd:de:0e:98:f4:b5:2f:07:b0:c3:08:00 SRC=77.72.85.185 DST=xxx.xxx.xxx.xxx LEN=40 TOS=0x00 PREC=0x00 TTL=242 ID=38646 PROTO=TCP SPT=55822 DPT=3464 SEQ=2794072001 ACK=0 WINDOW=1024 RES=0x00 SYN URGP=0
Nov 04 14:06:36 xxxxxxx kernel: DROP IN=eth0 OUT= MAC=70:8b:cd:de:0e:98:f4:b5:2f:07:b0:c3:08:00 SRC=194.55.142.100 DST=xxx.xxx.xxx.xxx LEN=40 TOS=0x00 PREC=0x00 TTL=242 ID=53054 PROTO=TCP SPT=51422 DPT=54006 SEQ=4125401463 ACK=0 WINDOW=1024 RES=0x00 SYN URGP=0
Nov 04 14:07:06 xxxxxxx kernel: DROP IN=eth0 OUT= MAC=70:8b:cd:de:0e:98:f4:b5:2f:07:b0:c3:08:00 SRC=184.105.247.236 DST=xxx.xxx.xxx.xxx LEN=40 TOS=0x00 PREC=0x00 TTL=248 ID=54321 PROTO=TCP SPT=36351 DPT=5900 SEQ=1704502854 ACK=0 WINDOW=65535 RES=0x00 SYN URGP=0

And once something gets tagged as begin open you can often watch multiple remote hosts then start to target that host/port specifically.

Search

Easiest Way to Secure Camera System

SouthernYankee

scquestions

Getting the hang of it

SouthernYankee

scquestions

Getting the hang of it

scquestions

Getting the hang of it

scquestions

Getting the hang of it

scquestions

Getting the hang of it

TonyR

scquestions

Getting the hang of it

SouthernYankee

scquestions

Getting the hang of it

looney2ns

scquestions

Getting the hang of it

scquestions

Getting the hang of it

catcamstar

Known around here

cuz

Getting the hang of it

catcamstar

Known around here

cuz

Getting the hang of it

catcamstar

Known around here

Mike A.

Known around here