Hikvision POE LAN segment - access to cameras without virtual host or extra wiring.

[alastairstevenson]

Here's an interesting thing I just tried - inspired by a thread or 2 here where people need to access their POE camera directly (for fine configuration, not streaming) but by default can't easily as they are on an isolated POE network segment on the Hikvision NVR.

*Warning* Don't experiment with this unless you're reasonably network and Linux savvy, and accept that there is some risk when delving around in the internals of an embedded Linux box.
But for the occasional need to access POE-connected cameras directly, this method may be worth exploring.
Note also that I have only so far tried it, for the ease of testing, using a PC as the POE port network device instead of a camera. It's easy to configure and has plenty of tools to see what's going on - and I don't have a spare camera on the shelf just now. Note also that I haven't assessed in detail what effect if any on performance would result, though none was obvious.

Essentially - a Linux installation by default does not have IP routing (aka IP forwarding, not to be confused with port forwarding) enabled by default.
The Hikvision NVR with POE ports has 2 network interfaces, one for the normal LAN, and one to service the POE switch ports on a different network segment, but by default no active facility to route or forward IP packets between them.
However - it's possible to enable that facility within the Linux environment.
With root access using the Linux shell, we can see that by default, IP forwarding is switched off.

[root@dvrdvs /] # cat /proc/sys/net/ipv4/ip_forward
0

We can switch IP forwarding on, with immediate effect. But note - this specific change does not survive a reboot as we're not changing the configuration origin of the value.

[root@dvrdvs /] # echo 1 > /proc/sys/net/ipv4/ip_forward
[root@dvrdvs /] # cat /proc/sys/net/ipv4/ip_forward
1

IP forwarding is now active within the Linux kernel of the NVR.
But we also need to establish a route to the previously isolated POE segment. This can be done either on the individual PC or workstation, or more conveniently on the LAN default gateway/router.
Assuming that the POE segment has the default value of 192.168.254.0/24 ( ie 0-255) and the NVR LAN address is for example 192.168.1.100 the router should allow us to add a static private (ie LAN not WAN) route that will work for all devices on the normal LAN where it is the default gateway.
Destination network 192.168.254.0, mask 255.255.255.0, gateway 192.168.1.100, some metric such as 2.

At this point - cameras on the POE ports should be able to be accessed directly from the LAN by their actual 192.168.254.x address, with no extra wiring or other changes.

To turn IP forwarding back off, use

[root@dvrdvs /] # echo 0 > /proc/sys/net/ipv4/ip_forward
#

Thoughts and comments welcome - but please take care.

 

[aster1x]

Re: Hikvision POE LAN segment - access to cameras without virtual host or extra wirin

I have the 7604NI/SEP with firmware 3.0.9 build140928. From this firmware version onwards, HIK has enabled the telnet and also the the virtual host setting which I have enabled and it is working properly. Therefore I can access my cameras officially with the Virtual host feature (essentially a port forwarding internally to the NVR). However I wanted to test your proposal for other reasons.

I telnet to my NVR and the ip_forward value is 1. I defined a static route in my router as you propose. Unfortunately the camera IP (192.168.254.X) is not accessible from my LAN.
Have you successfully accessed yoor cameras with your proposed solution?

The actual reason I wanted to test your proposal, is because I want to be able to have the camera connected to the NVR internal PoE switch (thus saving an extra external PoE switch), preserve the cameras different IP LAN segment as defined by the NVR and finally enable the cameras to communicate to the outside world through the NVR LAN port (thus enable all the communications like the different motion detections from the camera to the LAN and sending of snapshots). Currently the cameras cannot communicate to the external LAN because they are on a different LAN segment. Do you have any suggestions on this?

 

[alastairstevenson]

Re: Hikvision POE LAN segment - access to cameras without virtual host or extra wirin

Well, it turns out I should have taken some more time to test this out with an actual camera before posting - post in haste, repent at leisure!
I took out a DS-2CD2032-I and hooked it up to test, instead of the PC I used in the first instance. It turns out there are various consequences when using the camera that, I think, makes this idea not practical.
So to anyone beyond aster1x who has spent time trying this without success - please accept my apologies.

The initial problem I found when using an actual camera is that the Hikvision NVR automatically configures the camera (plug&play mode) with the same default gateway as that on the NVR, ie that of the normal LAN, in this case 192.168.1.1
With this setting, the camera has no way to reach that network segment. There is no defined route on the camera to make it forward packets to the NVR via the NVR POE LAN interface address of 192.168.254.1
If I manually change the default gateway on the camera to 192.168.254.1, traffic to and from the camera then routes normally. That's the value I used on the PC when testing.
After that change, accessing the camera on the POE LAN from the normal LAN shows normal connectivity.
For example, I can SSH on to the camera (192.168.254.14) from a PC on the normal LAN (192.168.1.99), and reach the normal LAN, and the internet from within the camera.

# netstat
Active Internet connections (w/o servers)
Proto Recv-Q Send-Q Local Address Foreign Address State
tcp 0 0 192.168.254.14:8000 192.168.1.99:49131 SYN_RECV
tcp 0 0 192.168.254.14:8200 192.168.1.99:49131 SYN_RECV
tcp 0 0 192.168.254.14:554 192.168.1.99:49131 SYN_RECV
tcp 0 0 192.168.254.14:http 192.168.1.99:59144 SYN_RECV
tcp 0 0 192.168.254.14:http 192.168.1.99:49131 SYN_RECV
tcp 0 0 192.168.254.14:9010 192.168.1.99:49131 SYN_RECV
tcp 0 0 192.168.254.14:22 192.168.1.99:49131 SYN_RECV
tcp 0 0 192.168.254.14:7001 192.168.1.99:49131 SYN_RECV
tcp 0 0 192.168.254.14:443 192.168.1.99:49131 SYN_RECV
tcp 0 132 192.168.254.14:22 192.168.1.99:59128 ESTABLISHED

The next problem that I saw, and in fact the most serious, is that it looks like the NVR is filtering Port 80 or HTTP traffic. Despite port 80 on the camera being open from the normal LAN, the camera web server does not respond to HTTP requests.
I suspect this is the NVR rather than the camera - and could speculate that it may be part of a partially implemented 'virtual host' in the 3.0.8 firmware of my NVR.

So - if aster1x has the virtual host in the 3.0.9 build for 7604NI/SEP, maybe it will be coming along when the 7816N-E2/8P 3.0.8 firmware is next updated.

Apologies again to anyone who spent time trying this without success - as I said, I should have held back to be more sure it truly did what I thought it did.

 

[alastairstevenson]

Re: Hikvision POE LAN segment - access to cameras without virtual host or extra wirin

I had an hour free the other evening and thought I might re-visit this topic that had looked like it would be pretty useful at the time, but was found to have some flaws when used with a Hikvision camera.
To re-cap - cameras connected to the POE ports on a Hikvision NVR are not directly accessible (for configuration, viewing etc) from the normal LAN if the NVR does not have the ‘Virtual host’feature. This is not ideal.
One way to fix this is to join a spare POE port to the normal LAN and when IP addresses are changed suitably, access becomes possible.

What I explored that appeared to work OK was simply a couple of configuration changes:
Activate ‘IP forwarding / IP routing’ on the NVR to enable traffic flow between the NVR LAN interface and the NVR POE switch interface.
Define a network route either on the LAN router/gateway or on the PC being used to connect, that directs traffic for devices on the NVR POE interface to the NVR LAN interface.
With a PC as the test device on a POE port, this worked fine. But not with a Hikvision camera.

So what were the flaws that made this approach not useful for a camera?
1) When a Hikvision camera is connected to a POE port in NVR ‘Plug and Play’ mode, new network settings are applied, but (and I believe this is actually a bug in the v3.0.8 firmware) the NVR LAN interface default gateway IP address is applied to the camera as default gateway. This should really be the NVR POE interface IP address, so that the camera has a valid route for traffic.
2) When attempting to access the POE-connected camera on the default 192.168.254.xxx segment from the normal LAN with a browser, the NVR was filtering or ‘swallowing’ the default port 80 traffic. It wasn’t getting to the camera.

I made a couple of changes that get round these flaws, at the expense of some extra setup work. But the end result is that POE-connected cameras appear to be fully accessible from the normal LAN at their 192.168.254.xxx address.
The first change.
Change the web port of the camera to something other than 80. I used 90, others will likely work as well, but I didn’t explore further. We just need a port where the NVR will pass the traffic through as opposed to filtering or swallowing it.
The second change.
On the NVR POE port configuration,specify ‘Manual’ mode for camera addition, instead of ‘Plug and Play’ mode. The downside is the need to manually configure the camera network settings to the 192.168.254.xxx range, and (this is the important bit) specify the IP address of the NVR POE interface as the default gateway, default is 192.168.254.1 This can conveniently be done with the very good tool SADP when the camera is plugged in to the normal LAN. And configure the NVR POE port with the IP address chosen for the camera. The model of the camera can still be Hikvision, with 8000 as management port.

And it all seems to work just fine. Not Plug and Play, and probably more for the network-savvy person, as there are a few details to get your head around.
Comments welcome.

 

[DaveP]

Re: Hikvision POE LAN segment - access to cameras without virtual host or extra wirin

Hi alastair

I really shouldn't encourage you, cos what with the downsides and the hack not sticking.. I'd of shelved the idea.

But there was talk of accessing the cameras via the nvr on ports 650XX

http://www.ipcamtalk.com/showthread.php?1681-Remote-camera-access-possible-behind-an-NVR-DS-7608NI-SE

But I'll stick to the easy peasy loop back method

 

[alastairstevenson]

Re: Hikvision POE LAN segment - access to cameras without virtual host or extra wirin

Yes indeed, DaveP. But I do like tinkering with things, and some others may do too lol.

On Hik NVRs with the 'Virtual host' facility, the ip_forwarding is enabled by default, and I suspect those NATted ports are a product of the virtual host also - they don't exist on mine.
I have pondered getting the 'virtual host' by updating the firmware from the current v3.0.8 to the v3.0.10 CN_STD that's available on the Hikvision Chinese site - but at least via the web GUI it complains of a firmware mismatch. It may well allow it using TFTP but I'm a bit loath to try it. I think it's a Chinese region device. Also I don't want to start seeing it complain about language mismatches when connecting cameras. I think Hikvision are starting to introduce measures to inhibit the use of 'grey imports'.
I'm not sure if the seller has tweaked my DS-7816N-E2/8P NVR to give the English language, and I don't have a copy of the original v3.0.8 firmware as a fallback. When I've asked about firmware updates, the response is something like 'best don't touch it'.

Christmas Wishes to you and yours!

 

[Durzel]

Re: Hikvision POE LAN segment - access to cameras without virtual host or extra wirin

Am wondering if anyone can help.. I followed these instructions and have lost access to one of my cameras in the NVR.

I have a Hikvision DS-7608NI-SE/P NVR that currently has 3 cameras attached, on the default "plug-and-play" 192.168.254.x network.

Last night I tried to get the cameras visible on the internal LAN (192.168.0.x), and enabled ip_forwarding on the NVR, and added a route on the local PC. This all worked fine, I could access http://192.168.254.4 in a web browser but RTSP didn't work and pinging 192.168.254.4 didn't work. Following the thread I noted that I needed to change the default gateway on the camera from 192.168.0.200 to 192.168.254.1.

Once I did this the camera could be pinged from my local PC, and I could access the RTSP stream on 554 - mission accomplished! The problem is the NVR can no longer see the camera, even though I can actually ping 192.168.254.4 from the telnet interface of the NVR.

I can still access http://192.168.254.4 in a web browser but whenever I try and log in as "admin" I get an error message that says "This account is locked, please try again in 20 minutes". I have left it overnight not logging into it, with no change.

I have tried rebooting the NVR, which I presume would've rebooted the camera at the same time because it is powered by POE. This did not fix anything.

The NVR reports the camera as "Offline (Parameter error)". I tried changing the camera from "Plug and Play" to "Manual" from the NVR interface, but nothing changes. Interestingly if I set it to "Plug and Play" it gets a different IP, but still doesn't work and 192.168.254.4 persists as the camera's actual IP. It's as if the NVR can't communicate with it at all now.

The change that seemed to cause this problem was me changing the default gateway on the camera from 192.168.0.200 (the IP on the LAN segment) to 192.168.254.1 (the IP on the POE segment). I think as has been said before it should be 192.168.254.1 anyway but due to a bug in the firmware it isn't.

I did not change any of the other ports on the camera - so they are default (including port 80). I also unfortunately did not enable SSH/telnet on the camera either.

Can anyone think of any ideas that I could try before I have to climb up a ladder and manually reset it?

 

[alastairstevenson]

Re: Hikvision POE LAN segment - access to cameras without virtual host or extra wirin

This diagnostic:

I can still access http://192.168.254.4 in a web browser but whenever I try and log in as "admin" I get an error message that says "This account is locked, please try again in 20 minutes". I have left it overnight not logging into it, with no change.

suggests that the camera is using firmware 5.2.5 or higher, and that something is trying to regularly access the camera with an incorrect ID and / or password. So you need to check the NVR camera configuration settings. And anything else you may have pointed at the camera.
On my 7816 NVR this method has been working just fine - but only after changing the camera web port away from 80 (I used 90) as the NVR 'swallows or intercepts' port 80 traffic and it doesn't reach the camera.
And it's important to have the PoE port in Manual mode so the NVR does not configure the camera IP settings for default gateway wrongly. And of course you need to set the NVR PoE port IP address to match what you have set on the camera.

But I suspect you have a password mismatch problem somewhere.

 

[Durzel]

Re: Hikvision POE LAN segment - access to cameras without virtual host or extra wirin

From memory it is using 5.2.5 or later, though not 100%.

There is nothing pointing at the camera as such, it is just connected to the NVR. I did have Sighthound running on a PC to test motion detection (the point of me trying to get local LAN access to the cameras).

I did change the administrator password on the camera from 12345 to a 6 digit one, because the camera web interface told me I had to change it the first time I logged in. I entered the same password on the camera configuration on the NVR:

Here are the camera IP configs:

The NVR PoE IP address is the default one - 192.168.254.1.

Incidentally I didn't change any of the ports on the camera, including the default port 80 for web - but I could still access it ok from my PC (on 192.168.0.x network with static route to 192.168.254.x).. is this right?

Thanks for your help!

 

[alastairstevenson]

Re: Hikvision POE LAN segment - access to cameras without virtual host or extra wirin

That setup looks like it should work - apart from the ability to still use port 80 for the camera web GUI. That wouldn't work for me as the NVR itself was listening on port 80 at the PoE port camera IP address.
Have you tried re-applying the camera password in the NVR camera configuration settings?
I'm not sure if an NVR reboot would do a power cycle on the PoE port. Are the PoE ports accessible enough to power-cycle the camera?

A bit of a dumb question - presumably you don't have the 'Virtual host' facility on your NVR? To be enabled I think under Network | Advanced settings.

 

[Durzel]

Re: Hikvision POE LAN segment - access to cameras without virtual host or extra wirin

I do have "Virtual Host" facility on the NVR, but it's switched off currently. I tried to use that to being with before getting into IP forwarding but couldn't see a way of getting third party software to be able to get a video feed from the http://192.168.0.200:650xx addresses. Nothing I tried seemed to work anyway.

I did try switching that on, but http://192.168.0.200:65000 (where you'd expect to be able to access IP Camera 1) also doesn't work.

I do have access to the PoE ports/the NVR to power cycle the camera, but not in front of it at the moment so will have to try that later.

Not quite sure why I could access the camera web GUI on port 80 (default) when you couldn't? To clarify - you mean that the NVR was listening on http://192.168.254.4 (for example) instead of the camera itself?

 

[harrijs]

Re: Hikvision POE LAN segment - access to cameras without virtual host or extra wirin

Are you just needing one of these? I am not really sure based on the OP what you are trying to accomplish here, but it sounds like you need the PoE from the NVR to power the camera, but you want to be able to access the camera directly at the same time. Is this just for mounting and initial configuration or are you wanting this access during operation? If just needed for installation, check out the device I linked to below.

Amazon.com : LAN POWER LPIPEYE IP CAMERA FIELD FOCUS ADAPTER TOOL : Security And Surveillance Products : Camera & Photo

 

[alastairstevenson]

Re: Hikvision POE LAN segment - access to cameras without virtual host or extra wirin

Durzel - my 7816 with 3.0.8 firmware does not have the virtual host facility - which is why I created an alternate method.
And that will be why yours is behaving a little differently, eg not needing to change the web GUI on the cameras.

To clarify - you mean that the NVR was listening on http://192.168.254.4 (for example) instead of the camera itself?

Yes, that's what I meant. The port 80 connection request sent to the camera via the NVR as gateway was not passed through the NVR to the camera but was accepted by the NVR. But port 90 was passed through OK.

 

[Durzel]

Re: Hikvision POE LAN segment - access to cameras without virtual host or extra wirin

Are you just needing one of these? I am not really sure based on the OP what you are trying to accomplish here, but it sounds like you need the PoE from the NVR to power the camera, but you want to be able to access the camera directly at the same time. Is this just for mounting and initial configuration or are you wanting this access during operation? If just needed for installation, check out the device I linked to below.

Amazon.com : LAN POWER LPIPEYE IP CAMERA FIELD FOCUS ADAPTER TOOL : Security And Surveillance Products : Camera & Photo

I'm essentially evaluating offloading the motion detection (or the whole NVR) to a secondary device. In my experience thus far the motion detection on the NVR/cameras has been pretty unreliable - catching shadows, reflections, etc even on low sensitivity settings. I didn't have a POE switch handy, and wanted to preserve the NVR continuously recording the cameras in case of any incident, so thought the easiest way would be to expose the IP cameras to the LAN.

Durzel - my 7816 with 3.0.8 firmware does not have the virtual host facility - which is why I created an alternate method.
And that will be why yours is behaving a little differently, eg not needing to change the web GUI on the cameras.

Yes, that's what I meant. The port 80 connection request sent to the camera via the NVR as gateway was not passed through the NVR to the camera but was accepted by the NVR. But port 90 was passed through OK.

I followed your suggestion and unplugged the camera having issues from the NVR, double checked that the NVR was using the right password for the admin account, then plugged it back in again - and it reappeared straight away. It seems like your analysis was correct - the NVR must've been hammering the camera with login attempts and because it was still connected even if the username & password was correct at that point it just reset the 20 minute "Account is locked, please try again in 20 minutes" timer.

I managed to get the other cameras visible on the LAN using the same methods as I originally used, though this time I made sure I had configured them as "Manual" in the NVR first!

Thanks very much for your help.

 

[asaf23]

Re: Hikvision POE LAN segment - access to cameras without virtual host or extra wirin

We can switch IP forwarding on, with immediate effect. But note - this specific change does not survive a reboot as we're not changing the configuration origin of the value.

Thanks for the tip - it works on my DS-7108N-SN/P. But how we can auto config that value at the start of the NVR?
I can telnet to the NVR and then copy via tftpd32 "start.sh" from /home/hik so I can change it and put back.
But give me a hint, please, shoudl I write some scrpit with "echo 1 > /proc/sys/net/ipv4/ip_forward" command to execute from start.sh?
This command need busybox/shell running?
My linux is .. I'm from .NET

 

[alastairstevenson]

Re: Hikvision POE LAN segment - access to cameras without virtual host or extra wirin

Well done for getting this working!
To make this change permanent, it would be necessary to get a copy of the same firmware that's on the NVR, split it down into its component parts, modify start.sh in the way you have suggested, and re-assemble and apply the firmware. For 76xxN and 78xxN the installed firmware can be backed up from the NVR itself - I'm note sure about yours as it uses a different flash arrangement.
Then apply this modified firmware image to the NVR.
This should be possible for firmware versions below 3.0.13 using the very useful 'Hiktools' from here: http://www.ipcamtalk.com/showthread.php/2733-Hikvision-FIRMWARE-TOOLS-change-language-extract-files-and-create-own-firmware
Firmware 3.0.13 and over has the components encoded/encrypted.

 

[asaf23]

Re: Hikvision POE LAN segment - access to cameras without virtual host or extra wirin

OK, it seems that I found the way to make this change permanent, at least it worked with my DS-7108N-SN/P.
I will explain the method but be aware it's not for casual user
We need telnet programm (PuTTY for windows) and tftp32 (can find in Google in first line -do not confuse with TFTP from HikVision!)
1. DVR in the LAN 192.168.19.0/24 (yours may be other, it is for examle only) and its static IP is 192.168.19.100
2.Connect your notebook to this LAN, let assume it get IP 192.168.19.201 from router's DHCP.
3.On notebook save tftp folder at C:\ root and execute tftpd32.exe - server will start, choose your notebook IP in Server interfaces (192.168.19.201).
Start telnet and connect to the DVR (to 192.168.19.100 port 23)
4.In telnet session enter login: root (attention - root not admin etc.) and password which you use to connect with DVR.
5. then enter

cd /home/hik
tftp -p -l start.sh 192.168.19.201

The start.sh script will be copyed to the tftp folder on your notebook. Do not close telnet session - we need it later.
5. We have to add next line at the end of the start.sh:

echo 1 > /proc/sys/net/ipv4/ip_forward

and save file (do not save as..) I use AkelPad to change file. Below is my changed start.sh file

Spoiler

#!/bin/sh
[ -e /usr/sbin/telnetd ] && /usr/sbin/telnetd 32
[ -e /proc/sys/vm/min_free_kbytes ] && echo 2048 > /proc/sys/vm/min_free_kbytes
echo "start decompress $(date)"
/bin/tar xzf /home/hik/dvrCmd.tar.gz -C /usr/bin/
/bin/tar xaf /home/hik/app.tar.lzma -C /home/app
/bin/tar xaf /home/hik/hicore.tar.lzma -C /home/app
/bin/tar xaf /home/hik/versionctr.tar.lzma -C /home/app
#/bin/tar xaf /home/hik/iscsi.tar.lzma -C /home/app
echo "show logo $(date)"
/home/app/showlogo

mv /home/app/pppd /usr/bin/
mv /home/app/pppoe /usr/bin/
/bin/tar xaf /home/hik/webs.tar.lzma -C /home/app
/bin/tar xaf /home/hik/hisi.tar.lzma -C /home/app
echo "end decompress $(date)"
#/bin/chmod 777 /usr/bin/dvrCmd/dvrtools
/bin/chmod a+s /usr/bin/dvrCmd/dvrtools
/bin/chmod 777 /dev/hikio
/bin/chmod 777 /dev/ttyS0
/bin/chmod 777 /dev/ttyS3
/bin/chmod 777 /dev/rtc0
/bin/chmod 777 /dev/watchdog
#cp -f /home/hik/player.bin /home/app/
#cp -r /home/hik/ntfs-3g /home/app/
cd /home/app/modules
/usr/bin/dvrCmd/loadModules load3520D
rm -rf /home/app/modules
rm -f /home/app/logo.jpg
rm -f /home/app/showlogo
cd /home/app
#/bin/chmod u+x ./iscsi/iscsid
#./iscsi/iscsid&
./pppoed&
ulimit -n 8192
echo 3 > /proc/sys/vm/drop_caches
./hicore&
echo 1 > /proc/sys/net/ipv4/ip_forward

Here I also add at first line start of the telnet daemon but it's up to you

6. Go back to the window with telnet session and enter:

tftp -g -r start.sh 192.168.19.201

So we put changed start.sh back to the NVR.
Close tftp server, telnet and reboot NVR.
telnet again to it and check with next line:

cat /proc/sys/net/ipv4/ip_forward

Answer should be 1 - DONE

 

[alastairstevenson]

Re: Hikvision POE LAN segment - access to cameras without virtual host or extra wirin

Interesting, and well done!
Your NVR flash isn't organised as a 'cramfs image' as per the 76xx and 78xx series - which being a read-only file system requires a re-write of the firmware to make changes permanent.
Hence my suggestion about creating new firmware.
But you've shown that's not required for your NVR, as the change survives a reboot.

 

[asaf23]

Re: Hikvision POE LAN segment - access to cameras without virtual host or extra wirin

the 76xx and 78xx series - which being a read-only file system requires a re-write of the firmware to make changes permanent.

Ups, I see.
but at least for the 71xx we can try with changing only start.sh (If they will not change it with new firmware ).

 

[zhang2xy]

Re: Hikvision POE LAN segment - access to cameras without virtual host or extra wirin

Now I can access the camera behind NVR(192.168.254.x) from my LAN (192.168.1.x) following your instructions. However, it looks like the camera is not able to visit WAN for some reason. Do you know why? I'm pretty sure it's not my router(192.168.1.1) because I tried to set up a similar subnet using my other router, the subnet can access WAN without any problems. I also tried putting a laptop behind the NVR(192.168.254.x) it can visit the router(192.168.1.1) but it's not able to visit WAN. Does your camera have access to NTP or email SMTP servers on WAN?