VPN coupled with Stunnel Clarification

[MrRouter]

Hi Guys,

I have been reviewing a few threads here on this forum as well as others on the internet regarding proper camera configuration and set up to allow remote viewing of cameras running Blue Iris while away from your local network. I wanted to get a better understanding on the use of VPNs and if there is a need to couple a VPN with Stunnel for secure remote viewing.

So far I have been able to gather that you do not want to forward any ports on your router and this will potentially leave you vulnerable to a host of issues. I believe the ideal method for connecting to a home blue iris server is to establish a VPN connection on your home router. Many people suggest using OpenVPN to achieve this. Is the purpose of the VPN in this case only to allow a remote device, says a cellphone, to appear as if it is actually connected to the local area network or would a VPN in this case also offer encryption? I have heard members on the forum express concern that when logging into their blue iris server it is not HTTPS enabled. The response has typically been this is not really an issue because the actual user name and password is not sent to the server but rather a secured hash. However, when viewing the cameras remotely because the connection is made via HTTP the camera feed would theoretically be able to be sniffed.

My understanding is that by adding Stunnel and port forwarding ports 80/443 you can achieve HTTPS on your blue iris server.

So my main questions are:

1) If I am using a VPN but visiting a http site I assume the traffic would be able to be sniffed by someone else on the same LAN as me but not by someone external to the LAN?
2) Is the use of port forwarding that is needed to use Stunnel acceptable to route my traffic more securely or am I opening myself up to issues by port forwarding?
3) Is using only a VPN to access my home network to remote view my blue iris cameras over HTTP leaving myself susceptible to others viewing my feeds?

Any help with this would be greatly appreciated!

Thank you!

 

[awsum140]

A VPN encrypts your data typically at a 128 bit encryption level. That should stop any but the most sophisticated hackers with high horsepower computers from "reading" your data.

If you take the steps of configuring your router to prevent the cameras from accessing the internet and disable all the un-needed features, such as PnP, you're fairly secure from the garden variety intrusions..

 

[MrRouter]

A VPN encrypts your data typically at a 128 bit encryption level. That should stop any but the most sophisticated hackers with high horsepower computers from "reading" your data.

If you take the steps of configuring your router to prevent the cameras from accessing the internet and disable all the un-needed features, such as PnP, you're fairly secure from the garden variety intrusions..

So are you saying that my LAN http traffic when viewed over a VPN is still encrypted?

 

[awsum140]

Yes, that's what a VPN does.

 

[MrRouter]

Yes, that's what a VPN does.

Ok great thank you, I guess my confusion was why people were adding Stunnel in order to view their blue iris servers remotely. If the VPN encrypts the video feed then Stunnel would be acting as a secondary encryption on top of the VPN encryption?

 

[awsum140]

Yes, it would. Another layer of encryption could be good, but would probably cause additional latency, for one thing, due to the added encryption. Generally speaking setting up a VPN with a "modern" router is a simple, point and click, operation while stunnel needs more detailed configuration. With the VPN you also need to install a credential file on the client side, but that's another point and click operation.

Here's a thread discussing stunnel stunnel

 

[Whoaru99]

Ok great thank you, I guess my confusion was why people were adding Stunnel in order to view their blue iris servers remotely. If the VPN encrypts the video feed then Stunnel would be acting as a secondary encryption on top of the VPN encryption?

Possibly because they are not using VPN and accessing through the WAN side on HTTP?

 

[Rednick69]

Hi Guys,

I have been reviewing a few threads here on this forum as well as others on the internet regarding proper camera configuration and set up to allow remote viewing of cameras running Blue Iris while away from your local network. I wanted to get a better understanding on the use of VPNs and if there is a need to couple a VPN with Stunnel for secure remote viewing.

So far I have been able to gather that you do not want to forward any ports on your router and this will potentially leave you vulnerable to a host of issues. I believe the ideal method for connecting to a home blue iris server is to establish a VPN connection on your home router. Many people suggest using OpenVPN to achieve this. Is the purpose of the VPN in this case only to allow a remote device, says a cellphone, to appear as if it is actually connected to the local area network or would a VPN in this case also offer encryption? I have heard members on the forum express concern that when logging into their blue iris server it is not HTTPS enabled. The response has typically been this is not really an issue because the actual user name and password is not sent to the server but rather a secured hash. However, when viewing the cameras remotely because the connection is made via HTTP the camera feed would theoretically be able to be sniffed.

My understanding is that by adding Stunnel and port forwarding ports 80/443 you can achieve HTTPS on your blue iris server.

So my main questions are:

1) If I am using a VPN but visiting a http site I assume the traffic would be able to be sniffed by someone else on the same LAN as me but not by someone external to the LAN?
2) Is the use of port forwarding that is needed to use Stunnel acceptable to route my traffic more securely or am I opening myself up to issues by port forwarding?
3) Is using only a VPN to access my home network to remote view my blue iris cameras over HTTP leaving myself susceptible to others viewing my feeds?

Any help with this would be greatly appreciated!

Thank you!

1. Possibly sniffed on the LAN, but not the WAN.
2. I cant speak from experience or knowledge but it seems to be an acceptable way here. I recommend VPN rather than this.
3. If by "others" you mean me or the fine folks at ipcamtalk.com, no.

Even with a VPN you have to have 1 port open into your network. It is only one though and then you can access all of your LAN. I use OpenVPN which is free for 2 users and easy to setup. You can buy a Raspberry Pi and with case for like $50 and set it up easily. Although the PIVPN setup didn't suit me quite right and I made one change.