What are you using/doing to make your camera more secure?

Discussion in 'Cyber Security' started by TL1096r, May 5, 2019.

Share This Page

  1. TL1096r

    TL1096r Pulling my weight

    Joined:
    Jan 28, 2017
    Messages:
    864
    Likes Received:
    197
    There are a lot of great threads that talk about securing you camera but some of the step by step instructions that really help the noobs like myself are mixed around. I wanted to make a thread to share my experience with setting up stunnel so it is all in one place.

    -----

    Knowing why you should secure your camera really helps. Thank @nayr for creating the awareness:
    VPN Primer for Noobs

    -----

    Quick second to thank a lot of great forum members here that create informative threads/posts or even helped me with questions through PM:
    @fenderman, @Mike, @looney2ns, @Dasstrum, @Walrus, @TonyR, @bp2008 @SouthernYankee - I probably missed someone.

    -----

    I am currently using Stunnel to connect my BI computer to my BI app.

    Download the Stunnel program here:
    stunnel: Downloads

    Most will need to download this file from the link above:
    "stunnel-5.55b2-win64-installer.exe - 30th May 2019"
    Or whatever is most updated file at the time for win64


    This video by @Dasstrum will get you started and suggest watching it first:

    *NOTE* in video disabling TLS 1.3 doesn't always allow you to connect to UI3 in Chrome.
    @Walrus figured out that you can use zerossl website to create a self signed certificate (see setup below this video):



    Website used for SSL:
    Free SSL Certificate Wizard and other SSL Tools @ ZeroSSL

    See steps below to set this up:
    Issues:
    Sometimes GUI gives you issues on restart - @Walrus has some tips here to get it to work:

    Pros:
    -Do not have to open any other programs once this is setup
    -No need for any other phone apps except for Blue Iris
    -No need to setup anything on your router
    -Easy setup with a few steps

    Cons:
    -Requires custom SSL to get UI3 to work with chrome
    -GUI can be glitchy after computer restart for some
    -You need to forward a port on your router

    More info in this thread:
    stunnel

    Share what setup you are using. Please list what you did and used: website, app, programs, products, any issues you ran into and how you fixed it. Please credit any other Forum Member & threads that helped you with your setup.

    PM me or post here if I should add/remove anything about setting up Stunnel and I will edit it in this post to have it all in one place.

    Thanks
     
    Last edited: Jun 8, 2019
    gwong86 and Mike like this.
  2. catcamstar

    catcamstar Getting comfortable

    Joined:
    Jan 28, 2018
    Messages:
    961
    Likes Received:
    583
    Hi,
    I started, like many others, with Asus with Rmerlin firmware. Very stable, and lots of features like the well praised OpenVPN service in the VPN Primer. My AC87U router provided everything I needed, however due to a dual-networking chipset, vlans were were partly doable. So basically a flat network (like many others) but will parental controls (to block internet-access) and decent firewalling.

    So I ditched the Asus as "main" router for an Edgerouter from Ubiquity: bit of a learning curve (command line is not for everyone), but you can go all the way with vlans (all variants: ports, trunks, you name it), routing, firewalling, QoS. With such a setup, you can easily "privilege" any device (eg which mobile can see which cam), with all the perks of the Asus router too (eg. OpenVPN). The Asus is now demoted in one of the Edgerouter's vlans and still provided Wifi access.

    On all my devices, I have the OpenVPN app in "always-on" and "killswitch" mode, ideal for being on the road with (unsafe) wifi hotspots, but my cams (including intercom) are always one fingerclick away. No need of any other tunnels, SSLs, certificates. Works on Android ànd iOS.

    Combined with physical switch "security", black-hole vlan, isolated guest wifi access, I tried to make any intruder's life difficult. But I am not a financial institution nor Fort Knox, but I like to have my stuff well arranged :p

    Happy with this setup for one year, had only 3 router downtimes due to firmware updates.

    Bye!
    CC
     
    TL1096r likes this.
  3. SouthernYankee

    SouthernYankee IPCT Contributor

    Joined:
    Feb 15, 2018
    Messages:
    1,946
    Likes Received:
    1,125
    Location:
    Houston Tx
    I keep it simple.

    I have two nic cards in my BI PC, one connects to my main home network. The other nic card connects to a seperate switch, which coneccts to POE switches, which connect to my cameras. All cameras are hardwired, no wifi. This physical isolates the cameras from my home network and the internet.

    I use openVPN on an ASUS router to access my BI pc.
     
    TL1096r, concord and J Sigmo like this.
  4. TL1096r

    TL1096r Pulling my weight

    Joined:
    Jan 28, 2017
    Messages:
    864
    Likes Received:
    197
    Thanks for sharing everyone. 2 NIC Cards sounds like a great idea.

    Stunnel has seemed to updated it software to address some issues with the GUI.
     
  5. TL1096r

    TL1096r Pulling my weight

    Joined:
    Jan 28, 2017
    Messages:
    864
    Likes Received:
    197
    I am not sure if anyone else with stunnel has seen this but I am able to still use http vs https to connect to UI3 after setting up stunnel. And I know https is working as only way to connect to camera when away from computer on phone is https (not connected to wifi).