Help securing a web cam

[kicko]

Hi all!

I have a problem with my web cam. I am using N66U with Merlin FW 380.57. My web cam is connected to the guest network which is setup with Access Intranet = Disable. I also have port forwarding from a non standard port to the web cam's access port. The web cam is setup to get an IP via DHCP, but on the router side I have it in the manually assigned IP list.
My problem is that I have no access to the web cam unless I enable the "Access Intranet" on the guest network. Is that normal?
I tried accessing it both via the internal IP and the external one. If I enable the intranet access on the guest network I can connect to the camera.
It was working OK before, when I was using Tp-link Archer C7 as the main router and the Asus N66U as an AP. The Tp-link has similar setting called "Allow Guest To Access My Local Network" and it was Off.
My idea behind this setup was that if somebody hacks the camera, he should not have access to my other devices from it.

 

[RMerlin]

This works both ways. If the camera is unable to access the intranet, then nobody on your intranet will be able to access it either.

 

[kicko]

What about accessing it from the outside then? I have the port forwarding, shouldn't I be able to access it from the Internet?

What are my other options to set it up so it is secure and accessible?

 

[RMerlin]

What about accessing it from the outside then? I have the port forwarding, shouldn't I be able to access it from the Internet?

It should work, as long the client accessing it is really outside of your network, but I have never tried it.

What are my other options to set it up so it is secure and accessible?

Don't expose your webcam to the WAN. Use a VPN to access them remotely. Only way to be truly safe.

 

[martinr]

As an aside and just for info, last year I bought 2 Motorola Focus66 cameras, contact with which is made using their Hubble app. I should have done my homework before buying rather afterwards, but I contacted Motorola to ask to what extent the cameras might compromise my network. The answer was reassuring:

"Thank you for contacting the Hubble Customer Support Desk.

We fully understand your concern about security.

Unlike most 'IP Cameras" we do not actually keep open ports on your home router. Your camera requests data from our servers every second, and tells us securely what port it can be accessed on for the next minute. We use a network protocol known as STUN (https://en.wikipedia.org/wiki/STUN) to call out from your internal LAN network to our servers, and then traverse the path backwards for the server to send data direct to your camera.

This method allows for the port your camera is working on to constantly change, and to only allow for encrypted and validated connections to get through your router, and into your camera."

I include this only for interest's sake; it's by no means an endorsement of Motorola's cameras or their design. (However, I did suggest they might consider including such information on the packaging to aid in the decision making of prospective buyers.)