Multiple Dahua locations trying to gain access to NVR

N

Nick70068

Getting the hang of it
Mar 11, 2019
127
96
Fairhope, Al
I installed a new network security appliance (Firewalla) and in a short time I noticed multiple Dahua locations from America, Germany, Japan, Russia( malicous site) and Singapore trying to gain access to the NVR. And of course there were numerous

Is there any reason Dahua is access the NVR?

Attached are several Firewalla triggered alarms displaying the access.

BTW, system is a DHI NVR5208-8p-4ks2e (V4.002.0000007.R, Build Date 2024.07.17)
 

Attachments

  • capture 1.JPG
    capture 1.JPG
    51.8 KB · Views: 16
  • capture 2.JPG
    capture 2.JPG
    59 KB · Views: 12
  • capture 3.JPG
    capture 3.JPG
    51.3 KB · Views: 11
  • capture 4.JPG
    capture 4.JPG
    55.5 KB · Views: 11
  • capture 5.JPG
    capture 5.JPG
    37.5 KB · Views: 11
  • capture 6.JPG
    capture 6.JPG
    51 KB · Views: 10
Many questions:

  • have You open port to NVR on router?
  • have You enabled P2P on NVR (network -> p2p)?
  • have You enabled uPnP on NVR (network -> uPnP)?

Can You tell from firewall logs on which port numbers (source & destination) and which protocol (tcp, udp) those transmissions were done?
this will allow to specify method used to those attacks..
 
Can You tell from firewall logs on which port numbers (source & destination) and which protocol (tcp, udp) those transmissions were done?
this will allow to specify method used to those attacks..

Yes, I have the standard 37777 port open for remote viewing and of course port 80 for webviewer.
No UPnP ports open


Firewall can't give me the port numbers or if it was tcp,udp protocol.




Like Quote Reply

Report
 
Nick70068 said:
Yes, I have the standard 37777 port open for remote viewing and of course port 80 for webviewer.
No UPnP ports open
Click to expand...

Man, You opened both NVR ports to full internet and then you complain that the entire internet are trying to connect to it :)
Congratulations :)

there are millions of internet crawlers which try to connect to each ip address and each port..
to check which services is open to public & can be hacked...
millions cams were hacked that way..

There are public website with databases of open services & ports...
Check:
Almost milion opened Dahua cams & NVRs...

Screenshot 2024-09-28 at 19.04.59.png

Disable opened ports & migrate to VPN..
Or if VPN is too difficult You can use Dahua P2P as much more secure option comparing to opened ports..
 
Nick70068 said:
I thought P2P still required an open port? If not how does it penetrate the router/firewall?
Click to expand...

in P2P mode cam / NVR have non stop opened connection (but no open port) to stun / proxy server..
Clients (DMSS) informs NVR that want to connect using this proxy server.
If NVR accept that connections, both NVR & clients do 'UDP hole punching' on firewalls on both ends, get from stun server own public ip/port combination, informs
second end about its public ip & ports using proxy server and start stable UDP connection over those created UDP holes...

Process is very technical - but is used by most voice/video real transmission apps, WebRTC clients, torrent clients, some games...
Big plus - there is no open 24/7 port.. there is one hole punched UDP port, but it's open only at time of connection.

UDP hole punching - Wikipedia

en.wikipedia.org en.wikipedia.org

STUN - Wikipedia

en.wikipedia.org en.wikipedia.org
 
  • Like
Reactions: Valiant, tigerwillow1 and looney2ns
Thank you for the explanation. I disabled all port forwarding on my main ISP router. I did a open port scan from my public IP address side and everything looks closed now.

I still like to know why Dahua from multiple locations are accessing the NVR.
 
Nick70068 said:
Thank you for the explanation. I disabled all port forwarding on my main ISP router. I did a open port scan from my public IP address side and everything looks closed now.

I still like to know why Dahua from multiple locations are accessing the NVR.
Click to expand...
The way I read those warnings is that it is telling you what device is being hit on your network.
Not that it's Dahua doing the connection from the outside.
 
Nick70068 said:
Thank you for the explanation. I disabled all port forwarding on my main ISP router. I did a open port scan from my public IP address side and everything looks closed now.

I still like to know why Dahua from multiple locations are accessing the NVR.
Click to expand...

In P2P mode, Dahua cam or NVR will have 2 UDP connections with 2 IP addresses.
One is for stun / proxy server (which is required for P2P work and which is easy to debug because it is using open text protocol encapsulated in UDP).
Second is bigger mistery - it's encoded. But probably it is connection to notification servers, which are used to send notifications to mobiles.

Also if You use NTP time synchronization, there is third cyclic UDP connection with time server.

If you totally paranoid, you can disable P2P and use VPN.
I disable P2P on all cams, but I enable P2P on all NVRs and intercoms to have normal connection without VPN on clients (DMSS, SmartPSS).
Never had problems. And never found any strange connections in P2P mode and I use more advanced options on firewall.
Many times in history I debugged connection done by Dahua cams / NVR using tcpdump / Wireshark.
 
  • Like
Reactions: looney2ns and bigredfish
looney2ns said:
The way I read those warnings is that it is telling you what device is being hit on your network.
Not that it's Dahua doing the connection from the outside.
Click to expand...

yes, if there were opened ports on router in past then for many days / weeks / months there will be more tries to connect with those ports..
those public ip and port combinations are in many public opened port databases..
 
Your open ports on your router were the main culprit.

Dahua P2P does ping various servers on their cloud, thats what makes P2P work. Its not a problem as described above

With the firewall appliance you're just seeing it for the first time
 
  • Like
Reactions: looney2ns
Like @steve1225 I disable P2P on the cameras themselves, but turn it on at the NVR.

The P2P connections you'll see repeated every couple of minutes as it keeps touch with the P2P cloud servers and looks for push messages and/or video connections.

Notice on mine you also see the connections to my mail server host

Like this
Firewalla-NVR.jpg
 
Last edited:
  • Like
Reactions: looney2ns
You must log in or register to reply here.
Top Bottom