Off site Blue Iris server question

Eric Bernhardt

Young grasshopper
Joined
Oct 4, 2019
Messages
38
Reaction score
4
Location
United States
I have a Blue Iris server at one location (location A), and want to set up 2 cameras off-site (location B) to connect to the server at location A. What value should I be using in the camera IP field in BI when adding the cameras? I know I should use the public IP plus port number, but I'm confused as to which port to use and which port to change/use for the second camera. Any insight would be appreciated.
 

Attachments

biggen

Known around here
Joined
May 6, 2018
Messages
2,607
Reaction score
2,919
You don't really want to port forward to an IP camera do you? Ideally, you would have a site-to-site VPN and then connect through that.

Discovery would be port 80 and RTSP would be 554. But you would have to change one of the cameras to two different ports since you can't port forward the same ports to two different IPs. But don't do this anyway. You need to use a VPN if you are intent on having a BI installation offsite.
 

Eric Bernhardt

Young grasshopper
Joined
Oct 4, 2019
Messages
38
Reaction score
4
Location
United States
You don't really want to port forward to an IP camera do you? Ideally, you would have a site-to-site VPN and then connect through that.

Discovery would be port 80 and RTSP would be 554. But you would have to change one of the cameras to two different ports since you can't port forward the same ports to two different IPs. But don't do this anyway. You need to use a VPN if you are intent on having a BI installation offsite.
Lets say yes, I do want to do this. So I would change the HTTP to port 8080 (for example) and RSTP to 1554, then match that up in BI?
 

wittaj

IPCT Contributor
Joined
Apr 28, 2019
Messages
25,235
Reaction score
49,164
Location
USA
If you do port-forward, keep in mind that it opens up your system to being hacked due to security vulnerabilities in security cameras (ironic I know). Last thing you need is some hacker get into your system, not to look at your cameras, but to employ a DoS attack originating from your IP address...or worse....and with it an offsite location, you would have no idea it is happening until your ISP cuts your service.

An older article, but I bet most of these still have the vulnerability as most do not push out firmware to fix holes in security:


New IoT Botnet Rises Feeding on Vulnerable Security Cameras
A new botnet is slowly building critical mass on the back of unsecured webcams and IP cameras, currently mass-scanning the Internet for vulnerable devices.
www.bleepingcomputer.com
www.bleepingcomputer.com
 

bp2008

Staff member
Joined
Mar 10, 2014
Messages
12,682
Reaction score
14,043
Location
USA
You're completely ignoring the existence of the NAT. I know you don't know what that is, but it is true nonetheless.



Don't change the port numbers in the camera's web interface.


Here's an outline of what you should do:

1. Turn off UPnP in the routers at locations A and B. This will prevent things being forwarded without your knowledge.
2. Set up port forwarding rules in the router at location B. 4 total ports need forwarded. As an example, assuming the public IP address at location A is 8.8.8.8, and camera LAN addresses are 192.168.0.100 and 192.168.0.101, your rules would look something like this:

ProtocolSource AddressExternal PortInternal PortInternal AddressDescription
TCP8.8.8.82110180192.168.0.100Cam 1 HTTP
TCP8.8.8.821102554192.168.0.100Cam 1 RTSP
TCP8.8.8.8
21103
80192.168.0.101
Cam 2 HTTP
TCP8.8.8.821104554192.168.0.101Cam 2 RTSP
I know not all routers have a clean and simple interface for port forwarding like this. But hopefully you can translate to whatever your router has.


Your router might not allow you to specify the source address, in which case you can still do this but you'll be opening up the cameras to the entire internet which will probably get them hacked. I would not recommend port forwarding to a camera if you can't restrict the source address.

For the external ports you can use just about any number you want between 1 and 65535. The ones in my example would be fine, I just pulled them out of my butt. By using high numbered ports like this you will drastically reduce the number of intrusion attempts coming in from the internet and reaching your cameras.

You can omit the HTTP ports if you don't need PTZ control. Or perhaps 2-way audio. Not sure what port that normally uses.

3. In Blue Iris you enter the public IP address of location B into the host name area, and 21101 for the HTTP port, 21102 for the RTSP port. That would be for the first camera.
 
Last edited:

Eric Bernhardt

Young grasshopper
Joined
Oct 4, 2019
Messages
38
Reaction score
4
Location
United States
Thank you everyone. I figured it out. All I had to do was change the RSTP port of the cameras so they're unique, and port forward those ports on the router where my BI server is. While I truly appreciate the concern of the vulnerabilities of port forwarding, it wasn't my question.
Thanks again
 

biggen

Known around here
Joined
May 6, 2018
Messages
2,607
Reaction score
2,919
Keep in mind that not only are there some decent security concerns here, but if either location looses internet service then you will get ZERO recordings for the duration of either side being down. You may realize that but I wanted to make sure it was noted if anyone else found this post via a search.
 
Joined
Apr 26, 2016
Messages
1,090
Reaction score
852
Location
Colorado
I've had something similar running for over 3 years, but I went the site-to-site VPN route. My main router opens an OpenVPN connection to remote site using DDNS. Would recommend you investigate moving to that configuration as it avoids many of the risks associated with opening ports/port forwarding. For all intents and purposes it puts the remote devices on a local subnet without compromising the firewall settings or exposing insecure devices to the internet.

Next time I am onsite at the remote location I will setup a small remote Blue Iris system to record higher framerates locally, because recording multiple cameras across VPN over a 3Mbps upload connection really limits my available frame rate. You might face the same problems, as your recording capability will be limited by both your remote upload speed and local download rate will also be consumed.
 
Last edited:
Top