My ip cams problem

[octopus]

I'm trying to get my ip cameras working from my IOT-network (br53) I have FORWARD's rules to br0 and they seem get populated,
can se packet counter changing.
In my Reolink app I can see speed counter (kbps) get full speed.
Problem is when I have ip-camera on bridge br53
I can't see any stream on bridge (br0), but packet counter getting full speed.
That get me wonder if I missing any port from br53 to br0 forwarding.
In that case it's (58200)
I scrats my head about this, any thoughts or hints?

iptables -I FORWARD -i br0 -s 192.168.50.0/24 -d 192.168.53.12 -j ACCEPT
iptables -I FORWARD -i br53 -s 192.168.53.12 -d 192.168.50.0/24 -j ACCEPT

Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination
260 15600 ACCEPT all -- br53 * 192.168.53.12 192.168.50.0/24
545 32700 ACCEPT all -- br0 * 192.168.50.0/24 192.168.53.12

 

[bbunge]

I feel it is best to have the IP Cams on the same network as the NVR. That way you do not have to fuss with port forwarding rules that do not always work. Use cams from a trusted manufacturer, keep the firmware up to date and set each cam with a static IP address.

 

[bennor]

I'm trying to get my ip cameras working from my IOT-network (br53) I have FORWARD's rules to br0 and they seem get populated,
can se packet counter changing.

If you haven't done so already, you may want to see the other discussions on using firewall-start file scripting under 3006 firmware. Some are finding that extra work is needed to get certain devices that reside on the main network to access or see devices on the Guest Network Pro/VLAN networks.

Iptables functionality on 3006.102.4

Dirty upgrade from 3004 to 3006.102.4 on my AX88u-Pro a couple days ago. All looked good so far, except I have some iptables rules in firewall-start that do not seem to work anymore. One set of rules dnat'd any DNS other than those in the cleanbrowsing ranges. Ie, if a device used any...

www.snbforums.com

Trying to understand Guest Network Pro limitations

Using an AX-86U Pro on FW 3006.102.4_beta1, I'm experimenting with Guest Network Pro and VLANs and I must be missing something. I've created a VLAN (tagged as 3) and set ethernet port 3 as an access port tagged with that VLAN. I've then created a new guest network with that same VLAN, turned on...

www.snbforums.com

mDNs / Bonjour / Multicast

Mostly, but Apple devices default to that for other services as well (airplay, airprint are a couple of examples). Also recall also that Win10 uses mDNS for resource discovery as well (along with all the other methods)... Also Linux makes significant use of avahi services, at least with Ubuntu...

www.snbforums.com

And make sure you don't have Set AP Isolatated enabled on the Guest Network Pro network.

 

[octopus]

I feel it is best to have the IP Cams on the same network as the NVR. That way you do not have to fuss with port forwarding rules that do not always work. Use cams from a trusted manufacturer, keep the firmware up to date and set each cam with a static IP address.

Yes I have them now in main network and it working fine, I can have them in iot-network with networkaccess on and ap isolation off.
Then I have at least them in other (br??) network.

I have read @bbunge and @bennor post about iot networks that inspire me to test things.
Seems that is little wobbly as everytime you have to reboot to get new settings to take.
Service restart_firewall isn't always doing it's jobb. You can try service restart_net_and_phy also.

 

[octopus]

I feel it is best to have the IP Cams on the same network as the NVR.
That way you do not have to fuss with port forwarding rules that do not always work. Use cams from a trusted manufacturer, keep the firmware up to date and set each cam with a static IP address.

I have tested a lot and I agree with you, best ta have ip camera on main network.

 

[Seth Harman]

I have tested a lot and I agree with you, best ta have ip camera on main network.

I have a significant number of both wired and WiFi security cameras and an NVR on an IoT Guest Network Pro instance and they work perfectly fine so it's unclear to me why you'd think it's "best" to have them on the main network. In fact, I'd argue from a security perspective that it's better not to have them on the main network with all the rest of your devices.

 

[octopus]

I have a significant number of both wired and WiFi security cameras and an NVR on an IoT Guest Network Pro instance and they work perfectly fine so it's unclear to me why you'd think it's "best" to have them on the main network. In fact, I'd argue from a security perspective that it's better not to have them on the main network with all the rest of your devices.

I want to be able to reach them from my main network.
Both from the mobile phone and the ip camera app.

 

[Seth Harman]

I want to be able to reach them from my main network.
Both from the mobile phone and the ip camera ap

Easy, you create a one-way path in your firewall ruleset to allow access to the IoT network from the main network (which is what I did). Bennor's post above links to posts that describe how to do it.

Edit: What I should have also pointed out is the people responding to you are assuming you've got your apps setup properly to allow for remote access to your cameras from a different network because if you don't it won't work. I don't personally own any Reolink products but I'm familiar with them enough to know in some cases you may have to specifically set that up as described HERE.

 

[octopus]

Okey, thanks for that, I haven't seen it.
I don't have the main unit only cameras and using mobil app and program to windows.

I have tried what Bennor have posted but than I haven't it working.
I will do more tests going forward, it should work.

 

[Seth Harman]

Okey, thanks for that, I haven't seen it.
I don't have the main unit only cameras and using mobil app and program to windows.

I have tried what Bennor have posted but than I haven't it working.
I will do more tests going forward, it should work.

Based on what I read at that link it appears Reolink's app can be configured several different ways:

Auto-discovery: Finds the cameras automatically and allows access but likely only works if the cameras are on the same network as the one the app is on
Connect via IP: If you manually assign the IP of each camera the trick with the firewall rules should work but will not allow you to access the cameras from any network that doesn't have firewall rules setup, including once you connect to a remote network (like when you leave your house and are on mobile data or another WiFi network)
UID: Allows the mobile app to connect to Reolink's cloud server to complete a connection to a camera in another network; this option shouldn't require you to do anything to your firewall or any port-forwarding

I'd suggest you add by UID and see if that solves the problem (this assumes you want to be able to access the cameras from outside your house).

 

[octopus]

I'd suggest you add by UID and see if that solves the problem (this assumes you want to be able to access the cameras from outside your house).

it works but i don't know how worried I need to be when using UID to access cameras from internet.

 

[Seth Harman]

it works but i don't know how worried I need to be when using UID to access cameras from internet.

Personally, if it's a choice between connecting through a cloud server via UID or punching holes in my firewall I'm choosing the cloud server.