Prevent CCTV camera access from WAN inside LAN

[sanke1]

I have configured asus DDNS service and port forwarded the right port for viewing CCTV cameras on my mobile in our business premises. I can now access my cameras from anywhere in the world. But even if I am in LAN, my mobile accesses the cameras from WAN side and it consumes data with my ISP. Is it possible for Asus router to hand over the connection to LAN when I am trying to access CCTV cameras from my LAN network? I have read somewhere that it is possible.

 

[ColinTaylor]

It should not be consuming any data when you're connected to your LAN by WiFi.

 

[sanke1]

It should not be consuming any data when you're connected to your LAN by WiFi.

When my phone is connected via Wifi and I manually disconnect internet from router’s GUI, the cameras stop showing on my phone. That means the data is still going over through WAN.

 

[ColinTaylor]

When my phone is connected via Wifi and I manually disconnect internet from router’s GUI, the cameras stop showing on my phone. That means the data is still going over through WAN.

That doesn't prove it's going via the internet. Without knowing anything about your setup it's hard to know for sure. But it could simply be that your phone can't resolve the DDNS address now that you have disabled internet access on the router. Look at the actual data (mobile vs. wifi) being consumed as reported on your mobile phone.

EDIT: Thinking a bit more about it... disabling the router's internet connection would probably break it's NAT loopback function which would explain why you loose the camera connection.

 

[sanke1]

I have read that it (NAT loop back) should work without any configuration. Because I have used RT-AC68U and disabling WAN still allowed cameras to function.

 

[ColinTaylor]

Because I have used RT-AC68U and disabling WAN still allowed cameras to function.

Sorry, I don't understand. Is that a question or a statement?

 

[sanke1]

It used to work correctly on rt-ac68u but doesn’t work on rt-ax88u latest stock firmware.

 

[ColinTaylor]

It used to work correctly on rt-ac68u but doesn’t work on rt-ax88u latest stock firmware.

It's still working correctly. You connect your phone to your router's WiFi and you can access the cameras using your router's WAN IP address (from inside your LAN).

 

[MyPal]

I have configured asus DDNS service and port forwarded the right port for viewing CCTV cameras on my mobile in our business premises. I can now access my cameras from anywhere in the world. But even if I am in LAN, my mobile accesses the cameras from WAN side and it consumes data with my ISP. Is it possible for Asus router to hand over the connection to LAN when I am trying to access CCTV cameras from my LAN network? I have read somewhere that it is possible.

You should have internal DNS resolution to resolve the LAN address of your device.

Similarly, assign your public IP address to an external DNS server for your hosts.

Use the same FQDN for both internal and external DNS zones.