Viewing IP cameras on 1 network through BI on PC on 2nd network

[mbcam6]

Hello everyone,

I have a couple dozen Amcrest IPM-721S IP cameras placed throughout a factory for security. These are normally being monitored through Blue Iris 4.0, and connect to the rest of our network via Wi-Fi. A second network was set up parallel to the first, strictly for Wi-Fi-based access to the Internet only (the first network can access corporate servers as well as the Internet) due to a large number of network-connected devices (supervisors cell phones, etc., in addition to regular computers). My superiors would like to have these cameras set up on the second network in order to conserve available network addresses on the first. However, a problem has arisen. If a camera is initially configured for the first network, then assigned an address on the second network, computers connected to the first network can no longer connect to the camera. This becomes a problem as these cameras are normally monitored by management, whose computers are only connected to the first network. The two networks both can connect to the Internet through the same firewall appliance, with access to the second network controlled by port forwarding and a separate network interface (one goes to the original network and a third goes to our ISP). My boss set these cameras up, and I think that most of the cameras were set up through my boss’s laptop (tying in the plug-in network connection to the second network and leaving the Wi-Fi interface on the first). Access to the cameras is not needed outside of our corporate network (although I don’t know if it would be needed in the future).

My question is how to make these devices visible across both networks? I don’t think it’s necessarily a Blue Iris issue, because I can search for cameras using the Amcrest IP Config software and Amcrest's monitoring software, and only see the cameras connected to the first network.

Thanks in advance.

 

[nayr]

you need a router that will route traffic across the two subnets; then you can use firewall rules to say: this group of IP's can access this group of IP's, but by default nothing else can

going to need a enterprise grade router with multiple interfaces or vlan support, which will be alot more complicated to configure/setup.. consumer/soho routers are typically just routing from one internal subnet to the internet and nothing else; you need to setup routes between multiple internal subnets and also the internet.

and you might want to go even deeper, setting up vlans and multiple subnets.. so one group of people go on one network, another on another network, etc.. then you configure there ports to be on whatever network they belong and then use firewall rules on the router to define what subnets of devices can talk to other subnets of devices, if at all.

You can dig even deeper down the rabbit hole and do auth based vlan's and tie authentication into your own auth server.. people will login to the wifi or a network port and based upon login decides what network they go on.. if they dont login and just get access to a default network thats tightly controlled, or no network access at all.

One way or another your going to have to get up to speed on subneting/routing/vans/firewalls to have any hope at all of doing this correctly..

 

[mbcam6]

Thanks for the reply, nayr.

Sounds like I've got my work cut out for me, but it should be possible. Our firewall is on a dedicated server (Dell PowerEdge R220 running Smoothwall) that gets our ISP signal on one NIC, then splits off to the first and second networks on separate NICs. Traffic for the Internet-only network is routed to a dedicated switch (via a port-forward rule), which connects through dedicated cables to the wi-fi routers for this network. The hard part is my boss is off for a couple of days, so I will need to check with him on his return to see who exactly will need access, so I can draft the appropriate firewall rules as to who can access these cameras, and their addresses (I was not given that information although I could probably figure it out).

Thanks again for your help. I'll post an update the first chance I get.

 

[nayr]

your router should be capable of doing whats needed; many firewalls will let your specify MAC Addresses instead of IP Addresses as source addresses, and also allow you to build groups of addresses you can reference.. I'd suggest firewalling by mac address if possible as on most networks people's IP's are subject to change..

First you'd get subnet routing setup so both networks can talk directly to eachother, then you'd make a firewall group called: management, figure out all there mac addy's and put em in that group..

Next you'd setup your firewall rules between your subnets/interfaces so default is to block-all, with a rule to allow tcp/udp traffic from Management Group to IPCamera subnet..

you'll have to maintain that list of management's addresses; but thats not too hard..