iptables rule creation on rt-ax58u for restricting wansview cameras access to the internet

[aoshea]

Thank you admin for approving my account access, last account had expired and couldnt reactivate it
note: originally posted on qnap surveillance forum

restrict wanview camera access to internet please

Dear qnap support guru’s I bought a few wansview Q5 cameras for my mum during her palliative care last year, but sadly lost her battle in december, in her 92 year of life. I went through the trouble to integrate 2 of these onto my qnap surveillance system ONVIF profile and a lot of trial and...

community.qnap.com

if there is an existing post already available, please kindly appraise me of its existence. thank you

++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Dear kind asus merlin guru's

I bought a few wansview Q5 cameras for my mum during her palliative care last year, but sadly lost her battle in december, in her 92 year of life.


I went through the trouble to integrate 2 of these onto my qnap surveillance system ONVIF profile and a lot of trial and error, but all good.


OK, cut to the chase the question here.


so now i have it operational, albeit the alarm recordings dont work, but the H.264 640x360 stream 2 is stable and viewerable in the mobile app


I now want to prevent the streaming to the wanview cloud service as dont want the chinese looking at what i’m doing or at my front door, but i’d like ability to turn this on and off as would prefer to use the Pan and Tilt function to move the capture area on occasions.


I have an asus merlin router, that supports iptables, I guess this is the best method to restrict the cameras from streaming to the internet, but guess i still need to allow DNS for NTP server name resolution and also NTP to allow camera time stamps to be accurate.


anyone here please kind enough to advise my approach is sound before i have to read and craft an iptables rule set and associated bash script to turn on and off the restrictions please?


KR, Adrian

 

[ColinTaylor]

but guess i still need to allow DNS for NTP server name resolution and also NTP to allow camera time stamps to be accurate.

I would assume that cameras only need to contact an NTP server once (during power on) to set the date and time. Anything after that would be just to correct for minor drifts in the local clock.

So the simplest approach might be to simply enable the "Block Internet Access" option in the Network Map's Client list and see what happens.

 

[bennor]

I have an asus merlin router, that supports iptables, I guess this is the best method to restrict the cameras from streaming to the internet, but guess i still need to allow DNS for NTP server name resolution and also NTP to allow camera time stamps to be accurate.

If the cameras can be configured to use specific NTP servers, then an easy option is to enable the NTP Server within the Asus-Merlin firmware (Administration > System). Then reconfigure the cameras to point to the router for NTP rather than some time server on the internet. Then you can use the Network Map > Client popup dialog that @ColinTaylor mentioned to block Internet access to the specific network client. The client should still be able to set it's time via the router's NTP time server but not access the Internet. This way you wouldn't have to mess with iptables or scripting via SSH.

PS: From the Asus-Merlin wiki: Setting up an NTP time server for your LAN