WyzeCam and Pfsense
-
@djskott It's been a busy day. Here is my pf filter I'm new to pfsense as a home user since like 2 weeks ago besides using it in my work capacity. Which file would you like to see?
[EDIT]
Also this will help change those zeros on the up and down rates for the cameras. Run this link x number of cameras.https://view.wyze.com/live
[EDIT-EDIT]
I know when I worked in the NOC sites we setup traffic shaping for their events. When it was time to turn it off and on a lot of times it was not as obvious where the on and off switch was. It was never where you'd think it would be.
-
So I nuked the box and started Fresh today.
Set the PFSENSE Box on my Modem/Gateway's DMZ (Temp)
I am blocking all v6 traffic on WAN.
Set the Firewall to allow ALL ports on All net's In and out. (all/all) (Temp)
Setup the VLAN for Guest
Set DNS to my managed DNS Service for restricting access to certain sites
Set the firewall rule for this VLAN to open all/all
VLAN is online. Speeds are inline with the AP specs.
Setup the VLAN for IoT/Cams.
Blocked VLAN for Guest (in/out)
Set the firewall rule for this VLAN open for all/all
VLAN is online. Speeds are inline with the AP Specs.No Traffic shapers
No Bufferbloat setupThis config really should let everything pass. Yet I'm still getting buffering when trying to view WyzeCam's via the internet.
LAN the cams stream fine.
I am truly at a loss now. /headdesk
-
How are you testing? Some dedicated phone app?
I assume they have some 'cloud' service that serves to negotiate the link between cameras and client. Does that have anything to show the cameras are registering correctly?
My money would still be on either static port NAT or UPnP
-
@stephenw10 yes the wyze app on my phones.
-
Ok, and it links to your account which is some cloud based service that the cameras also connect to?
It's very unlikely their service actually handles the video streams between the clients and cameras, that would be a massive amount of data. Much more likely it handles address/port negotiation between them to setup a direct connection. If that is the case it could rely on UPnP or be broken by outbound NAT changing he source port. What do the docs show the camera connection requires?
-
https://support.wyze.com/hc/en-us/articles/360031479511-What-ports-are-necessary-for-Wyze-Cams-to-operate-
I've setup an alias for the cams ips and and alias with all these ports.
I've tried port forwarding. I've enabled upnp.
I wonder of this is an artifact of the modem not being in bridge mode.
-
@djskott said in WyzeCam and Pfsense:
I wonder of this is an artifact of the modem not being in bridge mode.
if your behind a double nat, for you to allow port forwards on pfsense, the ports would have to be forward on the device doing nat in front of pfsense. Look on your isp device for something called dmz host, where it forwards all traffic to IP you set, ie pfsense wan IP.
Then your pfsense forwards can work, pfsense can not forward traffic it never sees.
-
Those look like outbound ports which shouldn't be a problem.
How exactly does it fail in the app when you test?
It sees the cameras as available?
-
@johnpoz I have PF on the DMZ for my Modem/Router.
@stephenw10 Yes the App sees the cams as online and pulls a thumbnail. Its when I go to view live streams. The app shows a KBPS and it will range from a low speed say 3-5KBps and then jump up to 50 and then down to 4 and then hangs out at zero for a while and then maybe will spike up to 14 or 20 and then back to zero.
When on Cellular
When On LAN
-
Hmm, interesting. Is it actually updating the image during that time?
What sort of bit rate do you get when connecting locally?
-
Between 60-170 KBps The attached links to Youtube above show the behavior and rates.
-
Ah, yes I missed that second link, thanks. So it doesn't actually fail. You can see the timestamp incrementing still.
That looks more like MTU issue or a TCP windowing error. Try looking at a pcap of that traffic. Is it full of errors and/or retransmissions?
-
The cap is below See file attached, wyzeCAP.txt This is from when I loaded the cam in the App from my Mobile Phone. So the stream is coming through Port 10001 (UDP), I see a Secure HTTP from wyze to my phone prob to auth, and then starting to stream. The packet lengths vary. It seems that its a direct connection from the Cam to the App for this stream, its not uploading to the cloud (If Im reading this right).
Currently NO rules blocking TCP/UDP are in play.
This is all new to me so forgive me for any ignorance.
I tried finding my MTU.
└─$ ping -M do -s 1500 8.8.8.8
PING 8.8.8.8 (8.8.8.8) 1500(1528) bytes of data.
ping: local error: message too long, mtu=1500└─$ ping -M do -s 1472 8.8.8.8
PING 8.8.8.8 (8.8.8.8) 1472(1500) bytes of data.
76 bytes from 8.8.8.8: icmp_seq=1 ttl=58 (truncated)└─$ ping -s 1472 -M do 8.8.8.8
PING 8.8.8.8 (8.8.8.8) 1472(1500) bytes of data.
76 bytes from 8.8.8.8: icmp_seq=1 ttl=58 (truncated)
76 bytes from 8.8.8.8: icmp_seq=2 ttl=58 (truncated)$ ping -s 1473 -M do 8.8.8.8
PING 8.8.8.8 (8.8.8.8) 1473(1501) bytes of data.
ping: local error: message too long, mtu=1500So 1472 + 28 = 1500, so the MTU is 1500 or 1472?
Then MSS
MSS = 1500 - 20 - 20 - 8 = 1452 bytes.
Or
MSS = 1472 -20 -20 - 8 = 1424 bytes
Am I on the right path?
-
This post is deleted! -
1500 is the default so that's expected. Where were you testing that from though?
I note the maximum packet size the camera is sending is 1117. Or at least that's the largest packet captured. Where was that pcap taken?
-
@stephenw10 I was pinging from my laptop connected to the VLAN the cams are on. The cap was taken from Pfsesnse's packet capture tool.
-
@djskott what specific version of camera is this? I half a mind to order one to play with..
-
@johnpoz I have a Mix of the V3 and Floodlights w/ V3 cams.
https://www.amazon.com/Vision-Indoor-Outdoor-Camera-Assistant/dp/B08R59YH7W/ref=sr_1_5?crid=13FLV3G805FJ7&keywords=Wyze+v3&qid=1693310484&sprefix=wyze+v3%2Caps%2C348&sr=8-5
-
@djskott said in WyzeCam and Pfsense:
I would think the pan model would be exactly the same when it comes to networking.. Which is less than $2 more..edit: Well my v3 "pan" will be here tmrw ;)
-
@djskott said in WyzeCam and Pfsense:
The cap was taken from Pfsesnse's packet capture tool.
On which interface though?
If that was on WAN try looking on the VLAN. There might be more traffic there that isn't shown on the WAN. Which would be a big clue.
