Disable Hikvision Camera Internet Access?

[Josh-n-droid]

Hey All,

I have been running a setup consisting of 2 x hikvision domes and 2 x secuity cams and just picked up 2 x Annke hiklvision 1080p rebrands (which i have flashed to hikvision firmware).

After thinking I had set up the system rather securely utilising blue iris and stunnel and kaspersky, I have a feeling these might be still able to be contacted from the outside world (the cameras individually, not only through the blue iris apps).

I was wondering what people have done to ensure the cams cant be accessed/seen from the outside world? I know nothing is fool proof but hey.

I think i had read somewhere that you can use the SADP tool to put in an incorrect subnet or gateway to stop outside access but still allow it to be utilized correctly with blue iris is this correct? Is there another way I should be handling this?

There is only the server PC with port forwarding listed in router and the camera internal ip ranges are blocked within the router firewall for any outbound connection. I have turned off UPnP for each camera and I don't see them listed within the router's UPnP table.

I also have access to a VPN service that offer's port forwarding should I be looking at this as well?

Lastly, i dont have some of the more specific control functions within the router for more advanced blocking and was potentially thinking of using some spare bits i have here to build myself a pfsense box but that is a topic for another day.

Thanks all

 

[Securame]

Just leave the DNS on the cameras blank (I assume you have them, configured with fixed IP, not DHCP), so they will be unable to resolve domain names to connect to external servicoes (like hik-connect for P2P, NTP for time sync, etc).

You can also configure a wrong gateway just in case, if your router is for example 192.168.1.1 just change it to something else on the network, any unused IP (192.168.1.x).

 

[alastairstevenson]

I have a feeling these might be still able to be contacted from the outside world (the cameras individually, not only through the blue iris apps).

As you have enabled port forwarding (risky also to the PC not just to embedded Linux devices) it would be worth checking that what is accessible from the outside is what you expect to be accessible from the outside.
This is easily done with a service such as ShieldsUp! GRC | ShieldsUP! — Internet Vulnerability Profiling  
Use the full port stealth scan, not the UpNP checker.