P2P Safety & Secure?

[Rockjaw]

Good morning everyone,

I have watched a few Youtube videos as well read online and I am very conflicted if I should use P2P vs. a VPN from my router (looks a lot harder to setup).

What is everyone's thoughts on this? I would like to get notifications on my phone through DMSS, is this something that is okay to turn on?

 

[bigredfish]

I'm running it on a number of NVR's including my own.

Is a VPN such as OpenVPN or Watchguard a bit safer? yeah probably. But security is always a matter of degrees and risk profile.
I havent heard of a case of Dahua P2P being hacked? but anything can be hacked

 

[wittaj]

If it is connected to the internet, it has a risk, even VPN.

But if you want notifications from DMSS, you need to use P2P.

Using P2P you are relying on the security of another device you do not control. When a system such as this has lots of people using it becomes a target rich environment for hackers.

Also we see instances where a P2P server goes down in some part of the world and people lose their alerts.

But the P2P question comes up from time to time. Here is a recent thread with some comments and links to read:

Is P2P traffic for dahua encrypted by default?

Is P2P traffic for dahua encrypted by default?

ipcamtalk.com

Heck even Dahua in their wiki says one should disable P2P LOL

DahuaWiki


And the threat is the same for any camera using P2P. Don't think this is only a Dahua issue.

 

[Rockjaw]

I understand the risks if your NVR is on your 192.168 network but if your NVR isn't on your network and on a 1.1.1.8 internal network, it's not possible to gain access to your LAN. It's completely separate and not attached in anyway.

The only risk I think would be your phone that might be compromised scanning that QR code.

Thoughts?

 

[wittaj]

192.168.x.x is an internal network and whether the NVR is on that or whatever subnet your router spits out, if it is connected, it can be compromised.

1.1.1.8 isn't in the reserved ranges that are reserved for the "home side" of the service:

10.0.0.0 – 10.255.255.255
172.16.0.0 – 172.31.255.255
192.168.0.0 – 192.168.255.255

1.1.1.8 came up as a cloudfare server

So how is your NVR on whatever internal IP you give it going to access the internet to send a push alert if it is not attached in any way?

 

[Rockjaw]

Okay, I thought maybe it was possible to forward everything through a cloud and then use your phone to attach keeping it off your home network. I know their would be a delay but wasn't sure if that was possible.

Okay, so it's either VPN off your router or P2P for the DMSS app. Is there a good link on setting up a VPN? I run a webserver and a few ports forward led so I'm familiar with that stuff.

Easier with a step by step guide if anyone has one?

Thank you

 

[bigredfish]

FYI with a Dahua Poe NVR, if you plug the cameras directly into it, they are allocated IPs by the NVR 10.1.1.x
They can’t be reached from the Interwebs directly* even if you can get to the NVR. It’s a nice added security feature.

*unless you come in on a vpn in which case you are now inside your network

Regardless you’ll need P2P for your DMSS alerts.

 

[Rockjaw]

Yeah, I know plugging them in directly (POE in NVR) and just using a monitor will keep everything off the Internet.

But I want to be able to see the cameras and alerts from the NVR to my phone.

That's why I was asking if anyone has a good VPN video tutorial

 

[Rockjaw]

FYI with a Dahua Poe NVR, if you plug the cameras directly into it, they are allocated IPs by the NVR 10.1.1.x
They can’t be reached from the Interwebs directly* even if you can get to the NVR. It’s a nice added security feature.

*unless you come in on a vpn in which case you are now inside your network

Regardless you’ll need P2P for your DMSS alerts.

Can anyone chime in? I was under the impression you didn't need to enable P2P to be able to get alerts on your phone, I thought you could leave P2P disabled and use a VPN?

 

[looktall]

10.0.0.0 – 10.255.255.255
172.16.0.0 – 172.31.255.255
192.168.0.0 – 192.168.255.255

My new annke fcd600 constantly tries to make connections to the IP address 192.168.252.2.
13 times in the last hour.
What's interesting about that is that it's trying to do it via the wan interface.

 

[wittaj]

My new annke fcd600 constantly tries to make connections to the IP address 192.168.252.2.
13 times in the last hour.
What's interesting about that is that it's trying to do it via the wan interface.

That is weird! Is that your router IP address or even your subnet (192.168.252.x)?

I wonder if it is trying to reach a NTP?

 

[looktall]

Is that your router IP address or even your subnet

Subnet is currently 192.168.1.x
I intend moving the cameras onto a new vlan soon (something i couldn't do with my old router), will be interesting to see if it still tries that subnet.

My other cameras that are trying to reach out to the internet are going to typical internet addresses and the annke camera also tries to go out to several internet address as well as that 192 address.
eg. 54.67.x.x, 152.67.x.x (they all look to be various Amazon addresses)

Only about half of my cameras are on the 192 subnet, the others are swinging off one of my NVR's so i can't log them.
The annke and Tiandy cameras reach out constantly as does my Reolink POE floodlight.
So much so that i makes it difficult to see how often my Dahua cameras reach out.
I've only managed to see one of them reach out once so far in the last week.

Another interesting factoid, my annke camera and reolink floodlight tried connecting to the same IP address this morning, presumably not for the first or last time.

At any rate, this all relates back to the topic at hand by showing if your cameras are able to reach the internet, they will be constantly talking on it.
There's no reason to expect that an NVR with connectivity to the internet also wouldn't be talking on it frequently.
Obviously with p2p enabled it will be pinging the p2p servers constantly, but it could be talking to other servers as well.

That's not necessarily a problem (some of it will be devices checking for updates), but it is something to be aware of.

 

[Valiant]

My new annke fcd600 constantly tries to make connections to the IP address 192.168.252.2.
13 times in the last hour.
What's interesting about that is that it's trying to do it via the wan interface.

Just about every router under the sun would block that ip address on an outbound interface, unless there is a misconfiguration?

Any manufacturer coding their device to do that appears stupid.

 

[bigredfish]

Can anyone chime in? I was under the impression you didn't need to enable P2P to be able to get alerts on your phone, I thought you could leave P2P disabled and use a VPN?

Yes you need P2P enabled on the NVR to get push notifications.

Yeah, I know plugging them in directly (POE in NVR) and just using a monitor will keep everything off the Internet.

But I want to be able to see the cameras and alerts from the NVR to my phone.

That's why I was asking if anyone has a good VPN video tutorial

You misunderstood , this was about security.

I mean with the NVR connected to the internet, using the Poe ports /internal switch will not allow an outside ip address (hacker) access them directly. You can of course access the NVR but you won’t be able to access the camera themselves without a vpn or local login

 

[bigredfish]

Ok just tested again

With P2P disabled on the NVR I am still able to get notifications while I’m on the local network (my home wifi) with an IP config profile) BUT you still have to be logged into the Dahua account on the DMSS app.

I have two profiles on DMSS, one using P2P and one for local by IP address. (which is what you would use when local or on VPN)

 

[looktall]

one using P2P and one for local by IP address. (which is what you would use when local or on VPN)

Would you not just still use the p2p connection?

 

[bigredfish]

I do when Im out of wifi range. It simply a matter of which profile I open on DMSS.

I keep P2P on 24/7 and I use WireGuard as a backup as its built into my firewall appliance, I can toggle it on/off via the phone app

P2P can lag and slow down a lot any given day. Thus I use local when local

 

[Nick70068]

I'm running it on a number of NVR's including my own.

Is a VPN such as OpenVPN or Watchguard a bit safer? yeah probably. But security is always a matter of degrees and risk profile.
I havent heard of a case of Dahua P2P being hacked? but anything can be hacked

Just last week I saw my NVR (Dahua 5208-8p-4KS2E) had rebooted around midnight. I checked the logs and saw a couple of different IP addresses (European IP address) had gain access to the NVR. Luckily, nothing malicious was done, just viewing cameras. I have very strong password for the log in so I very much doubt that they used my password, yet they were able to log into the NVR. I believe there must be a backdoor or other means of logging into the system. I got to admit that the firmware was old (3.216.0000004.0), so I took the system offline and updated to the latest firmware (4.002.000000.7.R Build date 2024-07-17) and changed the passwords.

I am not sure if they got into the system via P2P, or through the web interface.

 

[bigredfish]

Did your logs show access and an ip#? Did they use “admin”?

How are you accessing the NVR ? Port forwarding? Depending on the age of your machine and FW they don’t have to crack your password. Put a non updated 5+ year old windows PC exposed via port 80 forwarding on the internet and see how long it lasts.

Have you posted your QR code or serial number to the web?

Can’t be sure you were really hacked. Lots more to know

 

[Rockjaw]

Did your logs show access and an ip#? Did they use “admin”?

How are you accessing the NVR ? Port forwarding? Depending on the age of your machine and FW they don’t have to crack your password. Put a non updated 5+ year old windows PC exposed via port 80 forwarding on the internet and see how long it lasts.

Have you posted your QR code or serial number to the web?

Can’t be sure you were really hacked. Lots more to know

My thoughts exactly after reading it.