A Tale of Two Cameras & VPN

[TranceKat]

Hello All,
I was referenced to this area of this site to post my tale of woe (aka request for help).

As background - I'm a very technical person with experience with network security architecture, penetration testing, digital forensics, etc. I've set up many VPNs, most for fortune 15 companies.

I'm exhausted from having a new born and may have missed something.

I have a DD-WRT router running OpenVPN 2.4.4 arm-unknown-linux-gnu [SSL (OpenSSL)] [LZO] [LZ4] [EPOLL] [MH/PKTINFO] [AEAD] built on Feb 19 2018 library versions: OpenSSL 1.1.0g 2 Nov 2017, LZO 2.09.

I am using OpenVPN Client (bycolucci-web.it) that supports TAP (or TUN). I've tried with both TAP and TUN, but currently use TAP.

The internal network is 192.168.0.0/24. I have no VPN issues; I can get to all elements inside my home network, including the one problem camera, via ICMP echo request/reply.

I have 2 cameras inside my home. I've set up iptables to drop all outbound traffic from the camera subnet except for ntp; I see no reason my video feed has to leave the local network. Effectively, they are only accessible from inside the local environment.

One camera is a Wansview Q2 (192.168.0.33), the other is a Vitorcam (192.168.0.34). I have tested with the apps from each camera vendor (Wansview's App, and EyeCloud), as well as TinyCam (free, I'll buy the pro version if I can get this to work). Via VPN (my VPN address is 192.168.0.99), I can't connect to either camera with the apps (I guess they require a WiFi connection to be active on the same network as the cameras?); with TinyCam, I get a video feed from the Wansview camera over VPN, but not the Vitorcam camera. The odd thing is that both work perfectly well (with TinyCam and their respective apps) when I don't use VPN.

Here are screenshots to illustrate the situation:
I can ping 192.168.0.34 from my mobile device (192.168.0.99) connected via VPN:
Screenshot_20180508-145710.jpg

Wansview sends video via VPN:
Screenshot_20180508-145927.jpg

Vitorcam sends bupkiss via VPN:
Screenshot_20180508-145906.jpg

Before I start doing network captures and really burning all my free time on this, I am asking for help from anyone who have have experience with this. Any ideas how what may be causing this? Do I need to replace the Vitorcam?

Thank you in advance for taking the time to read this and help me out.

 

[crw030]

is RTSP over UDP the correct setting for the Vitorcam? On the other you are using RTSP over TCP.

A quick Google reads like RTSP over UDP requires multicast to receive the return stream, so is it possible your VPN connection is configured to block multicast packets (this might even be the default to avoid flooding the VPN tunnel)? If so can this camera use RTSP over TCP ?

 

[bp2008]

I've had devices that just didn't want to communicate over VPN. For example I have a remote network that is permanently connected/bridged to my home network by OpenVPN on two routers running Tomato firmware (one router is the server, the other the client). So from my home I can talk to everything on that remote network as if it were on my LAN. Everything except this one Microtik router on the remote network. Fortunately all the cameras on that network work fine and I don't care about the Microtik so unfortunately I never figured out the solution.

 

[TranceKat]

is RTSP over UDP the correct setting for the Vitorcam? On the other you are using RTSP over TCP.

It is, but you made an excellent point! I set it up to use TCP and viola! It now works as expected! If I had the time I would set up all the necessary protocols to make multicast work, but I'm knee deep in diapers.

Thank you very much for the keep eye and excellent insight! Very much appreciated.

 

[crw030]

@bp2008 For what it is worth, when I configured my VPN I had to setup routes so that the remote network router knew where to send packets addressed to my local LAN IPs.

In my case remote LAN was 192.168.77.XX and local LAN was 192.168.20.X and the VPN endpoints were 10.0.8.X

route 192.168.77.0 255.255.255.0 10.0.8.1; push "route 192.168.20.0 255.255.255.0"

Maybe since you say the Microtik is remote router you are in the same boat. I am probably interpreting this wrongly, but I read that as "ROUTE all traffic from the local router travelling to 192.168.77 subnet over 10.0.8.1 (remote vpn endpoint)" and "PUSH the route back to 192.168.20 subnet to the remote vpn endpoint so traffic can return".

Regardless I was able to login to everything remote, including the remote router admin interface which is configured to only allow access from LAN side.