how do you isolate cameras from the inetent?

[MrRodgers]

I access my cameras by a VPN that runs on a UDM-Pro and a POE Switch by the same Mfg all my cameras have a static IP, Is there a simple way to stop these cameras form getting online? and do you need to do more like keep them from seeing my local shared content? I have a content server.

I think this can be done with VLANs but i don't know where to start and once you do isolate them how do you test it?

Thanks in advanced!

 

[Flintstone61]

Some guys here, running Blue Iris, will have 2 network interfaces or NIC's. I accomplished this by accident by running my internet connection on a USb wifi connection at 172.0.0.xxx , and the computer has a NIC which is 192.168.1.100, and so all the camera hardware, router, switch, DVR, is in that 192.168.1.xxx IP addressing scheme.
i'm picking up an Xfinity signal (2 bars) that allows me to to ( as a subscriber) login to the public side of some homeowners Xfinity Modem. It's not great,...
We are meeting with a keyless FOB entry guy tomorrow at 10. apparently this service requires internet....( YEAH!) and It'll be Comcast Business ( yeah!) so I'll be able to get a feed from BI (yeah!)

 

[samplenhold]

It is important to isolate your cams from the rest of your LAN and the internet. There are many way to do this, but the two most use here is either with VLANs or Physical Isolation.

You did not say what VMS you are using. Is it an NVR or software like BlueIris?

Personally I use Physical Isolation and BlueIris. My cam part of the LAN is on 192.168.2.x while the rest of the home systems are on 192.168.1.x and the cam sub-net has no physical connection to the rest of the LAN or internet. I use two NICs in two different computers to be able to access the cams and the rest of my LAN from those two different computers.

See the diagrams below:

 

[MrRodgers]

I use BI, i would like to do this using VLANS it is why i bought a UDM-Pro. I don't know much about networking.

I would like to try and test it out on one camera before moving all of them over. That is why i want to know how to test it once i try.

If all your cams are using .2 and all your stuff you trust is using .1 can they not talk to one another?

 

[Arjun]

I'm in the process of doing this right now @MrRodgers Just got my UDM-Pro recently. Prior I was maintaining two separate physical networks and used 2 NICs on one computer. I prefer VLANS and Firewall combination while still maintaining two NICs as well that way I can manage all devices on the network on one ecosystem and be able to safely VPN my way through wherever I go. You can definitely set up VLANS and put everything on one large physical network. Can definitely guide you through once I undergo the transition. I am migrating from the USG to the UDM-Pro due to the bandwidth limitation on the USG when the intrusion detection and prevention services are enabled

I use BI, i would like to do this using VLANS it is why i bought a UDM-Pro. I don't know much about networking.

I would like to try and test it out on one camera before moving all of them over. That is why i want to know how to test it once i try.

If all your cams are using .2 and all your stuff you trust is using .1 can they not talk to one another?

 

[samplenhold]

If all your cams are using .2 and all your stuff you trust is using .1 can they not talk to one another?

No. Not if they are physically isolated. There is no physical path from the 2 sub-net to the 1 sub-net. NO PHYSICAL CONNECTION. This means that the two sub-nets cannot talk to each other.

You say you don't know much about networking, so how do you think you are going to design and implement VLANs correctly? There have been a couple of threads here where folks with minimal networking skills have had issues with VLANs. For me, it was so much easier to just go the physical isolation route rather than the VALN route. It has never failed me.

 

[The Automation Guy]

VLANs is probably the best method of isolating devices - from the internet and/or the rest of your network.

That being said, you can go into the manual ip address section of each camera (in the camera's GUI) and set a bogus gateway address. Normally the gateway would be your router/firewall device's ip address, but setting it to a non-functioning address should keep it from "finding" the gateway and therefore keep it off the internet. Of course this has to be manually done for each device and you won't be able to use DHCP (because it won't find the DHCP server) so set a static IP address at the same time, but it is possible to block device from the internet at the device level without any special/professional level networking equipment.

 

[Teken]

Also just to add to the conversation when a network is simply isolated via software or managed by a central firewall router appliance like pfSense.

Rules can be made to allow any network to be accessed and routed to.

Regardless, anyone who is serious about video security will not have the same on the regular LAN. Nor will they allow any physical connection to the Internet whether in or out.

The obvious benefits of following this simple and common sense approach is zero impact to the existing LAN as it pertains to bandwidth.

If something is physically (island) isolated it’s near impossible to breach the system without being on site tapping into the same!

Running a dual NIC is definitely the easiest to deploy for anyone. Those who rely on software VLAN’s also benefit from the ease of segregation and isolation but should NEVER ever forget. Any software can be compromised and history has proven VLAN’s are not immune to a breach.

Cisco the largest network company has patched up no less than five VLAN issues during the course of five years. The industry as a whole has either fixed, identified, or left open holes in VLAN implementation depending upon who the vendor is!

This also applies to the use of VPN. There have been no less than 25 incidents of compromise or breaches mostly as it relates to services vs the tunnel communications.

If one takes the time to Google any encryption you will quickly learn every known system as broken. Hence the depreciation of SSL and many other so called keys.

Ultimately if one applies all of the industry best practices & techniques you’ll surely be further ahead vs doing nothing! Just don’t fall prey to thinking nothing can ever happen as every government that has more money & resources than God has been hacked!

Name any 3 letter government agency = Hacked. Any industry = Hacked. Any business = Hacked

As such always update, patch, iterate, and stay informed with the latest news and possible solutions to mitigate the same!

 

[MrRodgers]

You say you don't know much about networking, so how do you think you are going to design and implement VLANs correctly? There have been a couple of threads here where folks with minimal networking skills have had issues with VLANs. For me, it was so much easier to just go the physical isolation route rather than the VALN route. It has never failed me.

Design? i will use a GUI it can't be that hard what is the worst that could happen.

 

[MrRodgers]

I do have two NICs in my BI PC, i switched to 10GIG network so my MB has a unused 1GIG NIC card.

I'm not sure if that way will work for me as i have multiple poe switches. I have two outside alone but i guess it still could.

 

[sebastiantombs]

It's not how many switches are involved, it's the total Mb/ps of video being sent. With 20 cameras, a mix of 2MP and 4MP CBR on all cameras, 2MP at 2048 and 4MP at 8192, my gig network card is seeing about 140Mb/ps. A 1 gig connection is fine.

 

[MrRodgers]

Yes, design. If you are going the VLAN route, you need to come up with the topology design. One can't just plug it all in and expect the switches to know what you want them to do.



Here is an example of multiple POE switches.
View attachment 103461

All i did was change the IP cams address made a VLAN ID in UnFi assign it to the switches ports that the cams are using made some firewall rules to block.

 

[CCTVCam]

This may help. I found an excellent video explaining port forwarding vs VPN's, the best I found so far. You may wonder the relevence. Well whilst it doesn't show you how to setup a VLAN specifically, it does explain it and show a typical setup diagram.

Maybe Fenderman could consider this video link as a sticky in the Wiki. I'm going to see if this guy has a follow up for setting up OpenVPN:

 

[Jkgcvh]

As a complete newbie here, I think I grasp the concept of physically isolating the cameras from the rest of the internet via separate NICs. And I also think I understand the concept of Blue Iris having access to both networks for remote access purposes. What I’m less clear about is how to manage the risk that Blue Iris itself could end up compromised. Is Blue Iris considered more secure than the cameras? I guess what I’m getting at is why should we be more alarmed by the notion that cameras are on the same network as the rest of the home internet, than the notion of Blue Iris doing the same?

I’m currently on the fence about whether to have the system completely isolated from the internet altogether, though I would like to have the option for remote access.

 

[wittaj]

As a complete newbie here, I think I grasp the concept of physically isolating the cameras from the rest of the internet via separate NICs. And I also think I understand the concept of Blue Iris having access to both networks for remote access purposes. What I’m less clear about is how to manage the risk that Blue Iris itself could end up compromised. Is Blue Iris considered more secure than the cameras? I guess what I’m getting at is why should we be more alarmed by the notion that cameras are on the same network as the rest of the home internet, than the notion of Blue Iris doing the same?

I’m currently on the fence about whether to have the system completely isolated from the internet altogether, though I would like to have the option for remote access.

Blue Iris is ran on a Windows computer and Windows associated virus and firewall programs (or a paid program if you go that route) are constantly being updated to fix the latest vulnerabilities.

Cameras and NVR firmware are rarely or never updated. My last NVR never had a firmware update. If lucky you may see a camera or NVR get one firmware update. That is the difference.

Plus under the dual NIC system, your cameras are not on your home network. The cameras are on one IP address range and your home internet is on another IP address range. The BI computer is the only one that can talk to the cameras as it has physical access to the IP address of the cameras via the 2nd NIC.

 

[Jkgcvh]

Blue Iris is ran on a Windows computer and Windows associated virus and firewall programs (or a paid program if you go that route) are constantly being updated to fix the latest vulnerabilities.

Cameras and NVR firmware are rarely or never updated. My last NVR never had a firmware update. If lucky you may see a camera or NVR get one firmware update. That is the difference.

Plus under the dual NIC system, your cameras are not on your home network. The cameras are on one IP address range and your home internet is on another IP address range. The BI computer is the only one that can talk to the cameras as it has physical access to the IP address of the cameras via the 2nd NIC.

Thanks, that is helpful perspective.

 

[samplenhold]

@Jkgcvh do you run any other programs on your computer? BI is no different than Word or Excel when it comes down to internet security. If you access any part of your home LAN from outside of the LAN, then you really should do it over a VPN or something like Team Viewer.

One isolates the cams from the internet (and the rest of your LAN) to stop them from reaching out to the internet themselves, and to stop someone outside your LAN from exploiting their vulnerabilities that rarely get patched. Most programs, BI included, are not set up to be accessed from outside your LAN unless you specifically set it up.

 

[xmfan]

It is important to isolate your cams from the rest of your LAN and the internet. There are many way to do this, but the two most use here is either with VLANs or Physical Isolation.

Personally I use Physical Isolation and BlueIris. My cam part of the LAN is on 192.168.2.x while the rest of the home systems are on 192.168.1.x and the cam sub-net has no physical connection to the rest of the LAN or internet. I use two NICs in two different computers to be able to access the cams and the rest of my LAN from those two different computers.

See the diagrams below:
View attachment 103346View attachment 103347

Reviving this thread

@samplenhold - I have been fixated with the two attachments you provided. First, really appreciate you showing the diagram at the simplest form, I (non techie) was able to follow it.

Of the two diagrams you provided, the one with VPN router would be where I fit in. Today, I have a Ubiquiti USG...but...getting rid of that and purchasing a Firewall Gold VPN router.

Onto my question. In layman's terms to implement your diagram:

Would I need to do these steps ?
1) Create a VLAN with 192.168.2.x network
2) use a POE switch and assign it a 192.168.2.X IP address
3) give each of the cams a static 192.168.2.x IP address
4) connect the cams to that switch.
5) install a 2nd NIC in my BI server machine
6) assign NIC 1 to have the 192.168.1.xx static address - This NIC will have access to the internet
7) Assign NIC 2 to have the 192.168.2.xx static address.
8)Assign the 2nd NIC to the 192.168.2.xx Poe Switch where the cameras are connected.

9) Block VLAN 192.168.2.x from accessing the internet

There's more to your diagram and I have more questions but I'll start with just the above.

Thank you !!

 

[toastie]

I suggest your first line of defense is to tighten down what your router allows in and out, no PnP Plug and Play anywhere, or service and maintenance ports open. Often cameras, TVs etc have software which keeps needing them to talk back to mother, to report back just what you've been doing with their product. Have a separate good long passwords or passphrases, at least for each class of devices you have. Keep all software and firmware updated. When you've got things set up keep checking your logs just to be sure all is well, checking that nothing looks suspicious. As others have suggested there are hardware solutions like having dual NICs (a separate Network Interface Card for the cameras dedicated to their own IP range different from your main LAN's IP)
I have a Raspberry Pi 4 running WireShark VPN server to access back to my system LAN when away from home using my Android phone. There is a hole in the routers firewall for that and one for keeping my CCTV systems in time, (UDP or TCP on port 123), even that might possibly be a risk, I'm not 100% sure.

 

[Mike A.]

There is a hole in the routers firewall for that and one for keeping my CCTV systems in time, (UDP or TCP on port 123), even that might possibly be a risk, I'm not 100% sure.

Shouldn't need that for NTP. The open ports on your router generally are for unsolicited incoming traffic or some required response channel(s) back on another port. Since the NTP request is originating from inside of your network, the router permits the response back through from the remote server without opening a port to do so.

You do need the open port for Wireguard since your access is originating outside of your network.