Hitting cameras web pages with a laptop in an NVR with POE

[agnj]

Hello,
I added a router with LAN attached to internet router and WAN attached to POE switch on NVR. I am able to access 10.1.1.1 via a static route on my internet router. But, I cannot access any other 10.1.1.x IP (same problem as some users listed above). Has anyone figured out the fix? Thanks!

 

[Thedy Bratu]

Hello,
I added a router with LAN attached to internet router and WAN attached to POE switch on NVR. I am able to access 10.1.1.1 via a static route on my internet router. But, I cannot access any other 10.1.1.x IP (same problem as some users listed above). Has anyone figured out the fix? Thanks!

Hi,
What is on 10.1.1.1?
How does your static route look like?
Cheers
Thedy

 

[agnj]

Hi,
What is on 10.1.1.1?
How does your static route look like?
Cheers
Thedy

Internet router/gateway: 192.168.1.1
NVR POE switch: 10.1.1.1
NVR: 192.168.1.129
Cam1: 10.1.1.65
Cam2: 10.1.1.66 and so on....

Extra router:
LAN: 192.168.1.101
DHCP disabled
WAN: 10.1.1.101

Static Route on internet router:
Destination IP: 10.1.1.0
Subnet Mask: 255.255.255.0
Gateway IP: 192.168.1.101

TRACERT data:
Trying 10.1.1.1
Traceroute has started…
traceroute to 10.1.1.1 (10.1.1.1), 64 hops max, 72 byte packets
1 192.168.1.1 (192.168.1.1) 1.740 ms 2.920 ms 0.961 ms
2 192.168.1.101 (192.168.1.101) 1.204 ms 1.176 ms 1.083 ms
3 10.1.1.1 (10.1.1.1) 2.342 ms 1.782 ms 1.275 ms

Trying 10.1.1.66
Traceroute has started…
traceroute to 10.1.1.66 (10.1.1.66), 64 hops max, 72 byte packets
1 * 192.168.1.1 (192.168.1.1) 4.243 ms 3.318 ms
2 192.168.1.101 (192.168.1.101) 5.736 ms 6.098 ms 1.234 ms
3 192.168.1.101 (192.168.1.101) 3048.398 ms !H 2998.470 ms !H 2999.853 ms !H

It never reaches any cameras, only the NVR at 10.1.1.1

Thanks!

 

[Thedy Bratu]

I assume the NVR POE switch has the gateway set to 10.1.1.1 .
This bit looks really strange: 3 192.168.1.101 (192.168.1.101) 3048.398 ms !H 2998.470 ms !H 2999.853 ms !H
Have you deactivated the UPnP and other "fancy" stuff on the extra router?
I cannot recall what was the default setting on the NVR, but I disabled UPnP on it as well.
On the NVR TCP/IP settings, did you put the DNS 192.168.1.1?
What happens if you try to open the web GUI of the cameras? does it time out?
Cheers
Thedy

 

[CJD]

@Gilean I have had similar problems with my 4208-8P-4KS2

Something between the NVR recognizing the cameras in the Registration area and assigning them to the Switch when you add them is messed up and inconsistent. Its buggy firmware

Though Dahua uses port 37777, this is NOT what you want to see under the "Port" column on the Registration page. As the cameras are added to the Bottom pane, you should see a port # of 1,2,3 etc as mine below. This is displaying the "port" of the internal switch.

Any camera I had in the bottom pane of the Registration page that had a port of 37777 I was not able to connect to using the Web Browse icon like you describe. I believe the two cameras showing in your list with port display of 1 and 4 are duplicate cameras trying to connect. You may remove the conflicting IP's showing port 37777 and try to connect with those shown in red currently.

View attachment 32645

Here's what I did;
1- Update to the latest firmware. Scroll down page to 'Downloads" tab and then download "Firmware"

https://www.dahuasecurity.com/products/productDetail/8261

1B- update firmware on NVR
1C- reboot NVR
2- Delete all cameras on the bottom of the Registration page.
3- Now disconnect the ethernet cables leading to cameras from the back of the NVR
4- Wait a few minutes....(leave NVR running)
5- Reconnect each ethernet cable from the cam to the POE ports on the NVR
6- At the top of the Registration page hit the Device Search button. This should find all cameras. It can take a minute or two, so be patient
7- Add all of the cameras that appear and have a port number like 1, 2, 3 etc but do NOT add ones that appear in the top pane with a port of 37777
8- With any leftover cameras at top (with a 37777 port number showing) I just navigated away from the page, disconnected and reconnected the ethernet cable for that camera, and returned and ran another "Device Search" until I got cameras showing port #'s in the single digits. Once I did I added them as well to the bottom pane.
9- Then I manually clicked on the "Modify" icon for each camera, enter the expected login and password and the cameras connected (this can take some time) and frequently I had to open the Modify dialog box a couple of times and tell it to Connect again before it actually did.

Once I had all port numbers showing 1,2,3 and all green connected lights, the Web Browse function worked as expected allowing me into each camera's web interface.

When you click on the Web Browse icon for a camera, it opens a new window and in my case using the NVR subnet of 192.168.1.X and a seemingly random port number. If it tries to connect to a camera page using 10.1.1.X it wont open the camera page as it can't talk to that IP range.

Hope this helps

Thank you for posting this, Bigredfish.
This worked for me as well, not quite the way it was explained, by the same process described above unplugging camera for a few minutes.

The symptoms:
The Camera Registration (Explorer link) browser icon for the given forwards to the 10.1.1.x IP address of the camera which doesn't work (at all) to talk to the camera via the browser. The system needs to link to the IP of the NVR itself with a specific port which presumably is some kind of port forwarding to the camera.

You need it to route to 192.168.1.x[port number]
In my case it's: 192.168.1.150:10080
That is, prior to running the process above, it was trying to forward to 10.1.1.128 (the camera IP address), which didn't work at all.

You cannot use that link directly. That is, typing into the browser URL the

http://192.168.1.150:10080

doesn't work. It only works when selecting that Explorer link from the Camera Registration page.

The firmware is very flaky. I'm running the v4.000.0000001.5 2019-12-06 version on N52B2P NVR.
That is, once connected to a camera using Windows 10, it crashes frequently. Also, the Private / 37777 port on my camera won't connect to the NVR as shown on the Camera Registration page. This just started after the upgrade to the latest firmware mentioned above. It's saying something like "Login return time is timeout," which is frustrating. This is a sub

To be more precise, following the upgrade to v4.000.0000001.5 2019-12-06, it was working fine (routing to

https://192.168.1.150:10080

). However after rebooting the system, it was trying to route from that Explorer icon to the 10.1.1.128 again.

=============================================================================================================================
I have a recommendation to Dahua.... if you're listening....

That is, I presume the reason Dahua doesn't allow the "switch" on the NVR to route packets from the 10.1.1.x network (camera subnet) back to local IPs on the NVR network (192.168.1.x in my example) is due to security. That is, I can see why Dahua would want to disable that routing to avoid hackers from getting in. However, it creates enormous issues for users trying to setup/ maintain cameras.

The suggestion is simply this... provide a temporary "routing mode" with a 2-hour automatic timeout to allow packets to route from the PC through the NVR to the cameras and back. This would allow customers to temporarily access the cameras directly using the browser. This would eliminate a lot of otherwise very clumsy work to setup / maintain a camera.
===============================================================================================================================
Thanks,
CJD

 

[c hris527]

Thank you for posting this, Bigredfish.
This worked for me as well, not quite the way it was explained, by the same process described above unplugging camera for a few minutes.

The symptoms:
The Camera Registration (Explorer link) browser icon for the given forwards to the 10.1.1.x IP address of the camera which doesn't work (at all) to talk to the camera via the browser. The system needs to link to the IP of the NVR itself with a specific port which presumably is some kind of port forwarding to the camera.



you need it to route to 192.168.1.x[port number]
In my case it's: 192.168.1.150:10080
That is, prior to running the process above, it was trying to forward to 10.1.1.128 (the camera IP address), which didn't work at all.

You cannot use that link directly. That is, typing into the browser URL the

http://192.168.1.150:10080

doesn't work. It only works when selecting that Explorer link from the Camera Registration page.

The firmware is very flaky. I'm running the v4.000.0000001.5 2019-12-06 version on N52B2P NVR.
That is, once connected to a camera using Windows 10, it crashes frequently. Also, the Private / 37777 port on my camera won't connect to the NVR as shown on the Camera Registration page. This just started after the upgrade to the latest firmware mentioned above. It's saying something like "Login return time is timeout," which is frustrating. This is a sub

To be more precise, following the upgrade to v4.000.0000001.5 2019-12-06, it was working fine (routing to

https://192.168.1.150:10080

). However after rebooting the system, it was trying to route from that Explorer icon to the 10.1.1.128 again.

=============================================================================================================================
I have a recommendation to Dahua.... if you're listening....

That is, I presume the reason Dahua doesn't allow the "switch" on the NVR to route packets from the 10.1.1.x network (camera subnet) back to local IPs on the NVR network (192.168.1.x in my example) is due to security. That is, I can see why Dahua would want to disable that routing to avoid hackers from getting in. However, it creates enormous issues for users trying to setup/ maintain cameras.

The suggestion is simply this... provide a temporary "routing mode" with a 2-hour automatic timeout to allow packets to route from the PC through the NVR to the cameras and back. This would allow customers to temporarily access the cameras directly using the browser. This would eliminate a lot of otherwise very clumsy work to setup / maintain a camera.
===============================================================================================================================
Thanks,
CJD

It Depends how the NVR see's the cameras, In My example, cams with the 37777 (65 and 66)are in fact on the NVR switch but I cannot open them it the Reg screen, Both Cams are the same make and model. And are using 37777 to talk to the NVR, that was the ONLY way I could get them to work, They are re branded Dahua 4mp bullets. Its definitely a firmware Issue with the Cameras, Notice it did not pick up a S/N.
Cams 66 through 70 are USA Dahua Units and the NVR picked up the port number and the S/N, These work fine when using IE Through the Reg screen. The NVR is a USA region 24 port POE. 30.1.1.6 is in another building on our lan with a static IP and yes that does not work either but I have 2 nic's in my PC and I can get it direct if I use the 30.x.x.x subnet on the second lan. Its all about how the NVR see's and assigns the cams.

 

[bigredfish]

***PSA for those whith a DAHUA NVR with Built-in PoE switch

 

[bigredfish]

If using the bullt in Poe switch, the ones with port 37777 can’t be reached via the interface as noted. Usually see this if you try to add them manually from the top pane to the bottom. If you let the NVR assign and pass credentials by itself, they’ll show up as port 1,2,3 etc and you’ll be able to access them via the IE button

 

[Fozzie Bear]

I've read through this thread numerous times and I am still unclear how the IP address ranges relate to each other.
Is there routing and NAT translation going on inside the POE NVR?
My POE internal ethernet address is 11.151.151.1 with a subnet mask of 255.0.0.0 (which If i understand correctly gives a massive (16 million) IP scope in comparison with 254 addresses with 255.255.255.0)?
However the cameras have various IP addresses on a completely different range such as 169.254.87.82, or 169.254.205.3, or 169.254.36.77. I'm assuming there is DHCP working on the camera side of the internal NAT, UNLESS the cameras are all pre-configured with the above random static IP addresses and the subnet is created to be as wide as possible in order to cover all those ranges.
When I configure my second router with a WAN IP of something like 11.151.151.20 so as to be in the same range as the internal NIC what address should I put in the browser to hit the various cameras 169.254.87.82, or 169.254.205.3, or 169.254.36.77 as above and will the NVR route to those IP addresses or should the Wan IP be something like 169.254.87.83 in which case it will only see one of the cameras as the remainder are on a different scope?
It would be interesting to hear from someone from a CCTV camera manufacturer to understand the logic behind the IP address allocation on cameras. There must be more than 16 million cameras out there around the world so surely there could be a possible IP address conflict eventually
Confused!!!!
Fozzie

 

[alastairstevenson]

Is there routing and NAT translation going on inside the POE NVR?

Yes, can be done with the 'iptables' tool in an embedded Linux device.

However the cameras have various IP addresses on a completely different range such as 169.254.87.82, or 169.254.205.3, or 169.254.36.77. I'm assuming there is DHCP working on the camera side of the internal NAT, UNLESS the cameras are all pre-configured with the above random static IP addresses and the subnet is created to be as wide as possible in order to cover all those ranges.

That's unusual - what's the brand/model of NVR?
Usually the NVR will administratively handle a subset of a camera configuration items, including the IP address.

There must be more than 16 million cameras out there around the world so surely there could be a possible IP address conflict eventually

Public addresses on the internet must be unique - but these are private addresses, so duplicates do not matter.

 

[Fozzie Bear]

Its a Qvis (Ony-X) Falcon NVR with 8 POE ports. There is no Virtual Host facility and I want to access the cameras to use their rtsp stream to use in a smart home setup.
Yes I am aware this is a private address but with the millions of cameras manufactured although unlikely, at some point someone might purchase two cameras with the same fixed IP address. I suppose manufacturers rely on most systems being installed by a professional who would know what to do in that rare instance.
Question is could I change the subnet mask to a class C private scope e.g. 255.255.255.0 and if so I assume I have to give each camera a new static address e.g. 192.168.1.2 - 10? Would the internal NIC address need to stay as is?
Fozzie

 

[alastairstevenson]

Private addresses are not routed, so it does not matter if multiple IP addresses the same exist.

 

[Mlda]

NVR5416-16P-4KS2E, System Version 3.216.0000000.0

My feedback

I can login to my NVR Web Service using this method,

I thought it might be interesting for some users, that Dahua added a port forwarding functionality to their new firmware. So now it is possible to access cams behind NVRs PoE ports. I don't know if they did this to all new firmwares or will do this in future. I've got a NVR5232-16P-4KS2 and with the new NVR5xxx-4k firmware it works like a charme.

from my laptop, through my router (WiFi or Ethernet cable) or using the OP method, wiring the laptop to the network port of the NVR.

Then, I can hit the cameras Web Service, by clicking on the IE Icon of the NVR Web Service.

The only difference is I have to use the NVR IP address in my router, followed by the HTTP port number: 192.168.XXX.YYY:Z, where Z = NVR HTTP port number.

Otherwise, I can´t get trough. Maybe that is because I changed the default HTTP port number in the NVR.


Internet Explorer (IE) didn´t work in laptop with W10 (returned saying I need to get an App from Microsoft Web Store, but if I try to get the App it said it coulnd´t find it), but Edge did work (no live view). I had to make IE my default browser in W10 settings and IE started working, but no image, even if I execute the plugins.

Either way, search in the browser address bar has to be disabled or the browser tries to do a Bing search with the NVR IP that I write.


My Question

Inside the NVR Web Service, the Image > Registration doesn´t have the Status, Firmware and Upgrade tabs that I can see in the monitor directly wired to the NVR, so I can´t upgrade the cameras this way.

Clicking the IE Icon, I go inside a camera Web Service, I can factory default the camera, but I can´t upgrade its firmware. It says it is upgrading but it never does.

Is it possible to upgrade a camera this way? How? (Or do I have to get a power injector to go directly to the camera?)


Thanks.

 

[bigredfish]

I’ve never been able to either. I’ve resorted to plugging them into a handy PoE switch and allowing them to get an assigned IP from my router and then hitting them direct to perform a fw upgrade.

 

[catcamstar]

That's strange, but parts of it I recognize: I cannot upgrade the camera through the IE icon (local forward) in the GUI of the camera itself.

However, in the "next" tabpane of "camera registration" of the NVR's UI, I can upload camera firmwares through the NVR webservices towards the camera's. Works like a charm.

What I would suggest: change the local (web) ports of the NVR back to normal (because let us be honest: this is security by obscurity: one can simply portscan your IPs and find that port in 10 milliseconds), reboot and try again.

Happy Camming!
CC

 

[Mlda]

Thank you guys.

@catcamstar I don´t have a next tabpane in IE. But I defaulted network settings in the NVR and rebooted it. I can enter NVR Web GUI now without the HTTP port number, but still no Upgrade tabpane with IE.
Edge and Chrome do have the Upgrade tabpane now and I managed to upgrade FW of first camera. Unfortunately I got the red triangle issue. One more thing to sort out.

PS. I only changed those port numbers as instructed by the NVR Manual Cybersecurity Recommendations.

Thanks again.

 

[catcamstar]

@Mlda : I had a spare moment to login to my webinterface of the NVR.

So on top left menu, you enter Camera, what do you get?

Then you should get something like this:


Can you show us what YOU get on these screens?

Thanks!
CC

 

[Mlda]

@catcamstar, I think you missed my post for a minute. I now get



As I wrote in my previous post, I got the red triangle. The only way to sort that out now is to get a power injector, or a POE switch, because IP Config doesn´t allow me to hit the camera trough the router/NVR path, right?

Thanks a lot ,mate.

 

[catcamstar]

Sorry, I don't see a red triangle on your screenshot? I only see green tickboxes?

Any reason you are not on v4 firmware?

 

[Mlda]

The red triangle is on the camera Web GUI.

IPC System Information before update:



IPC System Information after update:



Now I am not able to do IVS and will have to fix this as per these instructions.