Disabling P2P on Dahua cameras only temporary. Reactivates and my pihole shows over 1 million attempts to access: devaccess.easy4ipcloud.com in a day

[medzec]

PiHole Blocked Domain Count:	Hits
devaccess.easy4ipcloud.com	944654
www.easy4ip.com	12725
www.easy4ipcloud.com	2124

Model: IPC-B5442E-Z4E Dahua
FirmwareVersion: 2.800.15OG004.0.R, Build Date 2020-10-19

After disabling, after a few weeks it re-activates itself and tries to call home to easy4ip. I notice it when the dns blocker log fills up with a million attempts for two cameras in a day.


maybe I need to use one of the specific firmware in the camera wiki?

 

[Mike A.]

Hmmm... Hadn't looked at that since it's one of the things that I turn off when first setting up cams. But you're right. I'm sure that I had that turned off and now see that it's enabled again on two cams running that same firmware. I don't see the same with others running V2.840.15OG008.0.R, Build Date: 2022-02-18. Mine aren't Z4Es but same firmware. I don't see a ton of calls to easy4ip but I may have blackholed that in another way so might not be as apparent.

 

[looney2ns]

I would get up to date firmware from the vendor you purchased the cam from.
Also this: How to Secure Your Network (Don't Get Hacked!) | IP Cam Talk

 

[Mike A.]

Also, not sure how you have things set up there but best to block Internet access by the cams if you can no matter what firmware.

I don't see the calls to easy4ip since I have the gateway and DNS on the cam pointed to its own IP. That should at least stop cluttering up your logs. That's not assured to stop any trying though since I've seen some cams that will use hard-coded values to reach google's DNS or by IP 8.8.8.8/8.8.4.4 if they don't find a valid DNS and in a similar way some that search for other gateways out. And I've also seen some Dahua cams that still tried to reach easy4ip no matter how you had that setting. But that was a long time back.

 

[medzec]

I used the router to block outside access but the loopback and VLAN might be best option to keep them from muddy the lan.

Thanks for the link @looney2ns . I'll try to find some updated firmware.

 

[samplenhold]

FirmwareVersion: 2.800.15OG004.0.R, Build Date 2020-10-19

I had used that firmware to upgrade my LPR cams back in Jan 2021 and had problems with it. Not the same issues you are having, but had multiple restarts daily. I installed V2.800.0000000.22.R 2020-11-19 and have not had any issues since.

I have the same cam, the B5442 Z4E which is running V2.800.0000000.10.R, Build Date: 2019-11-18 (that is the version that came with the cam) and I do not have your issue. The P2P has remained unchecked since it was installed in 2020.

But I do not use a VLAN. Mine are physically isolated from the internet. No connection to a router or modem.

 

[Holbs]

PiHole Blocked Domain Count:	Hits
devaccess.easy4ipcloud.com	944654
www.easy4ip.com	12725
www.easy4ipcloud.com	2124

Model: IPC-B5442E-Z4E Dahua

FirmwareVersion: 2.800.15OG004.0.R, Build Date 2020-10-19

After disabling, after a few weeks it re-activates itself and tries to call home to easy4ip. I notice it when the dns blocker log fills up with a million attempts for two cameras in a day.

View attachment 151479
maybe I need to use one of the specific firmware in the camera wiki?

where did you buy the camera from?

 

[awonson]

@medzec, this problem was also raised in a thread back in April 2021 regarding the 3rd December 2020 firmware. Look at messages 62, 63 and 64 in this thread: IPC-T5442T-ZE IPC-T5442TM-AS latest new firmware General_IPC-HX5XXX-Volt_MultiLang_NP_Stream3_V2.800.15OG004.0.R.201203

It happened on my 5442 camera and I solved the issue back in 2021 by downloading the firmware from the official Dahua site and not using the 3rd December 2020 version. I too had noticed the calls to the easiy4ip websites in my PiHole (where they were blacklisted).

 

[medzec]

where did you buy the camera from?

Here is the order info:
https://www.amazon.com/gp/product/B07ZGF9BRW/ref=ppx_yo_dt_b_search_asin_title?ie=UTF8&psc=1

Loryta IPC-B5442E-Z4E 4MP Starlight+ WDR IR 8mm-32mm Motorized Lens Bullet AI Network Camera English Version
Loryta
Sold by: EmpireTech-Andy

 

[medzec]

I just used the Dahua website to load firmware

https://www.dahuasecurity.com/asset/upload/uploads/cpq/prm-os-srv-res/smart/datasheetzipfiles/IPC-HFW5442E-Z4E_datasheet_20220712.pdf

Device TypeIPC-HFW5241E-Z12ESystem VersionV2.840.0000000.18.R, Build Date: 2022-06-29Found New VersionRFID VersionISP VersionWEB VersionV3.2.1.1261216
is what web system stating.

Looks good, went SUPER easy. Chose the DH branded version. I did use the Microsoft EDGE browser and clicked IE mode. Took ~ 3 minutes after spending an hour trying to decide if I should risk bricking $500 of cameras.
Now, the cam previews are working without IE mode, on EDGE browser without plugin. So that is a small win.

 

[CCTVCam]

This is why IP Cam, Talk suggests using dual network cards with the cameras on a unreachable addess.

 

[truglo]

I have to thank you all for posting about this. I have cameras and iot confined to a range of ip's, and that range has a script that sets up iptable drop for any outside requests (no chance to phone home). Normally logs stay mostly quiet and network stays happy this way. After reading this, I checked my router logs and I'll be damned...



I immediately verified my script was for some reason not started. It could have been problems with power while I was gone over the weekend. My homeassistant did notify my of a brief outage, but router and cams are on a 40min ups. So the mystery remains until I have time to dig through logs and test things. It was just a new d6bi doorbell cam making all that traffic, but my 5442 is not phoning home (both have been running several weeks now). Anyhow, I restarted the drop rule script on my router and now it's walled off safely... just need to investigate why it was not started. Until I figure that out I put on belt and suspenders by blocking internet from that doorbell and the rest of the cam/iot using the router's built in features.

[edit: That is of course, not to say that what I have is better than hardware separation, vlans, etc.]

 

[Mark_M]

My NVR52x-I has P2P disabled.

But notifications on DMSS still come through without my VPN connected.
Video and notification images do not come through however.

 

[truglo]

If you follow best practice mentioned a few times above (block or drop outbound connections), things like DMSS likely will not work, or at least not without complicated networking workarounds. Since you use a VPN to connect remotely, there's no reason to allow outside connections from the dvr or cameras. These days it's popular for manufacturers of cameras and nvr's to have backdoors. So operating them securely requires blocking related phone home traffic on your network. You may already have a router that makes doing this simple (I know asus routers have the ability to block internet access for any client). Here's how much data my ipcam firewall rules blocked since I posted last night... that doorbell cam is chatty!


I don't think it even matters where a camera is manufactured either... just gotta keep the bases covered period.