NVR requires open ports for NTP function

[ChorleyCake]

Long time reader first post. Firstly thankyou to all, a great forum, I've learned all I can just reading but now I'm stumped.

I own an NVR from UK company called X-Vision (X2R32EN). I suspect it is a DigiMerge based product as the hardware version is DM-203. Googling around I found an analogue DigiMerge product, and the software is although non functioning looks of the same design.

Now the problem for me is the NTP function is using a connection to AWS service (or China based server) on ports 8000-8002. This also allows the remote app service to work (alarm notification) which I don't use outside of my network (the app alarm notification hardly works and requires these ports open even within my own network). I run an OpenWrt router behind my ISP's router and IPC/NVR are on their own VLAN which is entirely blocked to the WAN except of course 8000-8002 specifically to my NVR. Upnp is also disabled (router and NVR) and I have no ddns(NVR). ISP router also has forwards on 8000-8002.

My NVR's choices for NTP are time.windows.com, time.nist.gov or pool.ntp.org. Non of which are actually connected to as observed on OpenWrt. What is connected is amazonaws on 8001. And when I activate my app (bare in mind all within my network, no ddns etc) I get multiple connections. Two more connections are more amazonaws on 8001 but worryingly are the...other connections. Always changing, some times China and atm 5-144-128-173.static.hostiran.name, two on 8001 an one on 8002. Whois finds nothing on these. Usually the Chinese ones can be whois-ed.

Xvision (via yk3 the parent company I think) have no solutions for me, every so often I phone them and ask again but I don't think they want to help.

I have a Raspberry Pi NTP server which I would use for the X2R32EN. I want to shut this 8000-8002 nonsense down without the clocks going batshit crazy and have a completely WAN blocked VLAN.

Any ideas folks?


Sent from my D6503 using Tapatalk

 

[nayr]

Run your own DNS service and hijack time.windows.com/time.nist.gov/pool.ntp.org and point em at your local NTP Server.

 

[ChorleyCake]

Thank nayr, I sort of had that idea (without the actual details).
There is no connection made directly to time.windows.com, time.nist.gov or pool.ntp.org though. It is all through these servers (amazonaws etc). I suspect the NVR NTP choices are just an illusion of choice.

Sent from my D6503 using Tapatalk

 

[nayr]

those hosts are pools with IP address and they change constantly and can return various results for many reasons, like where you are; most are cloud based now..

for example, my laptop here connected to work VPN:

# host time.nist.gov
time.nist.gov is an alias for ntp1.glb.nist.gov.
ntp1.glb.nist.gov has address 216.228.192.69
ntp1.glb.nist.gov has IPv6 address 2610:20:6f15:15::27

and here is my home automation server using my home-business connection:

$ host time.nist.gov
time.nist.gov is an alias for ntp1.glb.nist.gov.
ntp1.glb.nist.gov has address 216.229.0.179
ntp1.glb.nist.gov has IPv6 address 2610:20:6f15:15::27

Your ISP could also be hijacking those DNS them selves

 

[ChorleyCake]

I am familiar fairly familiar with ntp, it was my first project with Raspberry Pi about 3 years ago, and indeed there are 4 ntp connections to the RPi, on the usual port 123. As this nvr uses ports 8000-8002 for various functions, alarm, ntp, and whatever...and I am not even sure it is using ntp as in an actual ntpd service (some proprietary cloud based function perhaps).
I had the idea of mirroring the NVR port in my switch and use wireshark somehow but I really don't know what to look for.

Sent from my D6503 using Tapatalk

 

[nayr]

sounds like you should offload that NVR and go w/something a bit more suited to your needs..

 

[ChorleyCake]

Perhaps,, just bought a car though so a no go atm.
Just mirrored the port and wireshark-ed it, some Telnet activity going on there but nothing jumped out at me, it's scraping the limits of my understanding to be fair. Anyway thanks for the replies, I think with all the will in the world it is what it is and that is that!

Sent from my D6503 using Tapatalk