Need Crash Course in IP Addresses/Port Forwarding - HELP!!!

[Sir Veillance]

Hello all!

I'm the new guy that decided to setup an IP surveillance system in my home to replace the aging Logitech Wi-Life system that I currently have in place.

A little background: I'm okay with computers and am not afraid to get involved with these types of projects. I've done some Cat 5 cabling, serial cabling, phone cabling, etc. When it comes to networking, though, I guess I was absent that day.

I've had my wife's car broken into a couple of times and our mailbox knocked down half a dozen times over the past few years, so I decided to pick up a Wi-Life system in order to help identify the perpetrators. Since installing this system, I was able to nab two of the people that knocked over our mailbox and was able to see the vandal that ransacked my wife's car.

After not being able to clearly identify the freeloading asshat that vandalized my wife's car, I decided to upgrade our home's surveillance system.

For now, I'd like to start with a couple of cameras to replace the ones I currently have in place, but, in the near future, I'd like to add a couple of cameras at a time until I reach a total of eight cameras covering the front, sides and rear of our home's property.

After much reading on this site and others, I decided to start purchasing the items necessary for this installation.

Here's what I have picked up, so far:

1 - Hikvision 2332 turret
1 - Hikvision 2032 bullet
1 - HP Procurve Switch (Managed 8-port POE w/gigabit uplink)
1 - 1000' spool Cat 5e ethernet cable
50 - RJ-45 Cat 5 connectors

I already have an i7 PC hooked to U-Verse's Arris NVG589 4-port modem/router. I'm using this PC for the Wi-Life system, so I'd like to do the same for this system, as well. I also have the crimper, cutter, and Cat 5 tester from my previous installations.

After receiving the Hikvision cameras, I ran SADP and assigned each camera its own IP address. I'm using 192.168.1.201 for camera one and 192.168.1.202 for camera 2. The modem/router is 192.168.1.254, so I used that as the gateway address. For port forwarding of the cameras, I assigned 8201 for camera one and 8202 for camera 2.

I assigned 192.168.1.200 to the HP Procurve switch, which gave it a static IP address, not an assignable one.

Here's how everything is hooked up:

Starting from the end, the two cameras are hooked up via ethernet cables to the HP Procurve switch (ports 1 and 2, but that supposedly doesn't matter).
The HP Procurve switch is hooked up to the U-Verse modem/router via an ethernet cable from the uplink port (port 9) to one of the four ports on the modem/router.
The i7 PC (192.168.1.65) is hooked up to the modem/router via an ethernet cable from the LAN card to one of the four ports on the modem/router.

I entered the Firewall section of the U-Verse modem/router and found (after a lot of reading) that there are two sub-sections in here that I should be modifying. One is "NAT/Gaming" and the other is "IP Passthrough".

I have tried every conceivable combination in these two sub-sections and I always get one of two results:

One result is that I can "see" the cameras through a browser by typing in each of their individual IP addresses. I can also open up SADP and see them there. The problem is, then I can't access the NVR software via my external IP address. Using the open port check tool, port 80 is closed.

The other result is that if I change things in this Firewall section, I'll then be able to access the NVR software via my external IP address, port 80 is open, but then I can't access my cameras with a browser or through SADP.

I have loaded Milestone's XProtect Essential and the Hikvision NVR that came with the cameras. Neither one of these software packages have been able to access the cameras via their respective clients, either locally or via the internet.

I've been at this for a few days now and have finally hit the wall of frustration.

What do you all think I'm doing wrong and is there a website that I can go to or a post that you can point me to which would explain an A-to-Z of what it is that I need to do in order to get this surveillance system up and running? I know that it's probably something basic that I'm missing, so any help would be greatly appreciated.

Thanks in advance for your time and efforts!

Have a good evening,

Vic

 

[nayr]

Majority of residential ISP's block incoming port 80 (along with others like 25-mail) to prevent residential accounts from hosting internet services.

Try changing it to a higher, non-standard port such as :8080 or :8000

 

[LittleBrother]

Hardware wise you sound like you're setup great. I don't think you need to give the switch a static IP, though it can't hurt anything.

Remember, the cameras have (at least) two ports. On your local network: 192.168.1.201 is the same as 192.168.1.201:80, because 80 is the default port for TCP, so your browser assumes it. Either of these addresses let you login to the camera via a browser, correct?

The other port for the camera is by default 8000. That port is the port you give NVR software (e.g. if you're using a mobile app), and THAT port is the one you are concerned about here with port forwarding. There is definitely a simple screen somewhere for your router that lets you specify three things: 1) incoming port, 2) outgoing port 2)IP. Here you could put in, say, 5050 as an incoming port, 8000 as your outgoing, and 192.168.1.201. Now when you access the router externally with port 5050, the router instead sends that to port 8000 at ip 192.168.1.201. You could also have another port mapped from, say 4819 to 80.

So if your external ip is 164.23.23.65, which is easiest found at whatismyip.com, you can browse with a browser to http://164.23.23.65:4819. That would go to the login screen of the camera. Secondly, if you had your NVR software setup with 164.23.23.65 and port 5050, it will hit your router and your router will send to the camera's ip, but with port 8000 internally, which lets the app connect directly to the camera, not through the browser.

nayrIs there any increased safety in exposing not port 8000 for the camera externally but some other port? if 8000 is the default, it seems people trying to brute force into cameras by randomly searching the web with 8000 would be more likely to find a camera on that external port, right...?

 

[nayr]

it dont matter what port you run it on; a full port scan takes very little time and its pretty easy to tell whats running by its response to the scan... running it on a non standard port is called security through obscurity; it provides very little real security but a good feeling you did something, its more security theatre.

the only secure way to remotely monitor cameras is to setup a VPN to get into your LAN from the outside; I would not trust anything less.

example: anyone else in range of an unencrypted WiFi can see your traffic; including ip/port and more importantly login information travel in plaintext as your laptop/mobile is broadcasting it to anyone listening.. even if your on an encrypted WiFi or LAN the Network Admin is probably logging what URL's people are requesting and they could just as easily get this info.. you trust your work IT to not look at your personal security cams? I dont.

not to mention you cant trust Cellular networks at all with local/federal law enforcement and generic hackers able to deploy dummy cell towers.

 

[LittleBrother]

it dont matter what port you run it on; a full port scan takes very little time and its pretty easy to tell whats running by its response to the scan... running it on a non standard port is called security through obscurity; it provides very little real security but a good feeling you did something, its more security theatre.

the only secure way to remotely monitor cameras is to setup a VPN to get into your LAN from the outside; I would not trust anything less.

example: anyone else in range of an unencrypted WiFi can see your traffic; including ip/port and more importantly login information travel in plaintext as your laptop/mobile is broadcasting it to anyone listening.. even if your on an encrypted WiFi or LAN the Network Admin is probably logging what URL's people are requesting and they could just as easily get this info.. you trust your work IT to not look at your personal security cams? I dont.

not to mention you cant trust Cellular networks at all with local/federal law enforcement and generic hackers able to deploy dummy cell towers.

Oh dear, something else I need to explore getting setup.

 

[Sir Veillance]

Majority of residential ISP's block incoming port 80 (along with others like 25-mail) to prevent residential accounts from hosting internet services.

Try changing it to a higher, non-standard port such as :8080 or :8000

nayr, thank you for the information. I took the advice of someone on a forum that recommended the website "CanYouSeeMe.org" and checked port 80. It's showing green and opened, so I'm okay there. My ISP is AT&T (U-Verse), so I don't think I have a problem with them. If anything, I'm really concerned with the complexity of their Arris NVG589 modem/router. It's not user-friendly like the menus I've seen in other modem/routers.

Hardware wise you sound like you're setup great. I don't think you need to give the switch a static IP, though it can't hurt anything.

Remember, the cameras have (at least) two ports. On your local network: 192.168.1.201 is the same as 192.168.1.201:80, because 80 is the default port for TCP, so your browser assumes it. Either of these addresses let you login to the camera via a browser, correct?

The other port for the camera is by default 8000. That port is the port you give NVR software (e.g. if you're using a mobile app), and THAT port is the one you are concerned about here with port forwarding. There is definitely a simple screen somewhere for your router that lets you specify three things: 1) incoming port, 2) outgoing port 2)IP. Here you could put in, say, 5050 as an incoming port, 8000 as your outgoing, and 192.168.1.201. Now when you access the router externally with port 5050, the router instead sends that to port 8000 at ip 192.168.1.201. You could also have another port mapped from, say 4819 to 80.

So if your external ip is 164.23.23.65, which is easiest found at whatismyip.com, you can browse with a browser to http://164.23.23.65:4819. That would go to the login screen of the camera. Secondly, if you had your NVR software setup with 164.23.23.65 and port 5050, it will hit your router and your router will send to the camera's ip, but with port 8000 internally, which lets the app connect directly to the camera, not through the browser.

nayrIs there any increased safety in exposing not port 8000 for the camera externally but some other port? if 8000 is the default, it seems people trying to brute force into cameras by randomly searching the web with 8000 would be more likely to find a camera on that external port, right...?

LittleBrother, thank you for the detailed explanation. When I get a moment to work on the camera project again, I'll read through your post and see if I can get this issue fixed. Again, I appreciate the time you took to help me out! Have a good one, buddy!