Traffic seems to be ignoring rules

NightlyShark

@spgeise It just hit me: if your cameras are getting their IP via DHCP, (in some models/brands) the manually set NTP could be overridden by the NTP given by DHCP (pfsense ?). I haven't observed this with hikvision, but some cheaper brands, I have seen doing all sorts of crazy stuff.

johnpoz

I just setup a NVR and some poe cameras.. I don't recall what the nvr ntp was on before I set it to mine.

But I can tell you the camera's are not reaching out to the internet via their own IP. Because they connect to the switch on the back of the NVR for poe and talking to the NVR. And this is on a different network than the network the NVR is on.. The NVR gets the ip from the network I connected it to 192.168.110.110

I created a leg into this 10.1.1 network behind the nvr, so I can get to the cameras directly - you can see from their settings they are talking to the NVR 10.1.1.1 IP for its gateway.. Which must be doing nat if the cameras are going to talk to the internet, because some 10.1.1.x address would never work via the rules on my 192.168.110 network

I just looked at the cameras directly and they don't even have ntp enabled - they must be pulling time from the NVR.. They have the correct time.. So will have to look into that a bit more..

NightlyShark

@johnpoz That is the setup meant here? I thought they had ONVINF cameras via WiFi or something... In my hikvision poe nvr at least, your mind doesn't even go there, because the security camera streams are from the beginning only accessible via the NVR and its app. Only the doorbells and remote-location cameras have anything to do with the internet... I suspect they got in this whole mess because of some video timestamp thing...

NightlyShark

@johnpoz No, they specifically say: I have a VLAN with 3 cameras and an NVR. Must be one of those NVR that have a LAN iface only.

johnpoz

@NightlyShark yeah I have a NVR on my camera vlan ;) But the cameras are actually behind the NVR in my setup.. I am new to the whole NVR scene.. I have played with stand alone IP cameras before that you just setup on whatever network you connect them too, etc. But my take which maybe flawed and only how this company does it.. The cameras are behind the NVR.. This is an isolated L2, running its own L3 space.. And it is not bridged that is for sure - I tried to see if I could see the camera's macs from my network through the NVR.. Its not bridging the interface it has on my network to the camera network.

To get to the cameras directly I had to connect another network into the poe switch on the nvr, and then outbound nat (source) nat on pfsense so my PC could even talk to the camera's IPs.

I will play with having the camera's directly try talking to my ntp server and see what I see for source IPs, etc.. I will have to do some reading on how the cameras actually sync time - would assume off the NVR..

edit: ok yeah my system is using IPC to sync the cameras time with the nvr time.. So there is zero need for the cameras to talk to any ntp server

spgeise

Thanks everyone for the conversation. Got some interesting takeaways. This is what ultimately got things working correctly for me:

"Cameras" alias is my 3 IP cameras on the VLAN.
"Cameras_NTP" are 0.north-america.pool.ntp.org and DNS servers 9.9.9.9,4.4.4.4
"Cam_External_Ports" are 53 (DNS) and 123 (NTP).

The cameras have 0.north-america.pool.ntp.org set as their NTP server. Everything working correctly now.

johnpoz

@spgeise said in Traffic seems to be ignoring rules:

"Cameras_NTP" are 0.north-america.pool.ntp.org and DNS servers 9.9.9.9,4.4.4.4

You understand that that pool.ntp.org is going to be constantly changing right.. Why would you not just allow NTP on port 123 if you want your devices to be able to talk to NTP servers out on the internet?

Also why not just use pfsense as your ntp for any devices on your network.. Now you know all your devices are syncing to the exact same source.. And the traffic is local..

spgeise

@johnpoz said in Traffic seems to be ignoring rules:

You understand that that pool.ntp.org is going to be constantly changing right.. Why would you not just allow NTP on port 123 if you want your devices to be able to talk to NTP servers out on the internet?

Of course I understand that. That's why quad 9s and 4s are allowed out.

@johnpoz said in Traffic seems to be ignoring rules:

Also why not just use pfsense as your ntp for any devices on your network

I still haven't been able to get that to work for some reason. Not sure if the cameras are being stupid or if the rules aren't quite right. But ntp.org is the only thing to work so far.

NightlyShark

@spgeise Quad 9 and quad 4 are DNS servers, not NTP...You have the option to just setup the PfSense NTP server, and allow the cameras to access the VLAN 25 address(that means the pfsense address on that subnet) port 123 UDP. You can also setup the PfSense DNS Resolver and allow the cameras to access VLAN 25 address port 53 TCP/UDP.

spgeise

@NightlyShark said in Traffic seems to be ignoring rules:

Quad 9 and quad 4 are DNS servers, not NTP...

You are correct. I was answering the other question asking if I understood about the pool address changing. By allowing access to those DNS servers, they can resolve the pool address.

@NightlyShark said in Traffic seems to be ignoring rules:

You have the option to just setup the PfSense NTP server,

I understand this as well. The problem is that, so far, I have not been able to get this to work on my camera VLAN. I'm still trying to figure out what the issue is in my rules.

I appreciate all input in this. But I would THINK that no one digging this deep into VLANs, deny rules, DNS, NTP, etc. would need to be asked if they understand the difference between the protocols.

NightlyShark

@spgeise Can you please provide all rulesets from all active subnets (LAN, VLAN25...)? Don't forget to erase any public IPs in the photos.

NightlyShark

@spgeise Also, show us what you tried when attempting to activate the PfSense NTP and DNS.

spgeise

@NightlyShark

NTP was always configured in the pfSense, with all interfaces included. It just refused to function on the VLAN25 interface. Strangely enough, specifying the VLAN25 address wasn't enough. Once I set the port to 123 I started to get some hits.

We'll go with this for now.

NightlyShark

@spgeise Do you have any floating rules, by any chance?

spgeise

@NightlyShark Nope.

johnpoz

@spgeise said in Traffic seems to be ignoring rules:

That's why quad 9s and 4s are allowed out.

Has nothing to do with pool changing..

By allowing access to those DNS servers, they can resolve the pool address

The problem is pfsense needs to resolve them, and default would do that every 5 minutes.. And the TTL on those entries is only 130 seconds

;; ANSWER SECTION:
pool.ntp.org.           130     IN      A       69.10.223.130
pool.ntp.org.           130     IN      A       65.100.46.166
pool.ntp.org.           130     IN      A       162.159.200.1
pool.ntp.org.           130     IN      A       5.78.89.3

If you want your cameras to use quad9 for their dns - sure that is fine.. But for pfsense to allow sometyhing.whatever.tld that you resolve, it has to have resolved that to an IP and put it in an alias.. When those don't match up your device is not going to be allowed.. So if pfsense resolve it to 1.2.3.4 and says ok devices can go to that IP on 123 udp.. But your client resolves and wants to go to 4.5.6.7 its not going to work..

NTP on pfsense should work right out of the box.. There should be nothing you need to do to have it syncing time.. I even think its enabled out of the box... If pfsense ntp is not working?? Or your saying you can not get clients to sync with pfsense ntp? What does pfsense show for its ntp service?

edit: And again your cameras should be able to sync time with your NVR via IPC sync.. And no need to talk to any ntp servers be local or public.

NightlyShark

@johnpoz Kind of an up-in-the-clouds thing, sorry (you say "don't PM me"), and sorry for the mini hijack, but, what program do you use for screenshots? I'm stuck with the Win11 snipping tool. Sorry...

johnpoz

@NightlyShark I use faststone capture - have been using it for years and years. Back when it use to be free, but that changed - best 20 bucks spent on software I think ;)

https://www.faststone.org/FSCaptureDetail.htm

NightlyShark

@johnpoz Thank you!

johnpoz

@NightlyShark I love it.. Does anything you could ever want, its lightweight - even can do a portable install. And they keep adding features.. There are updates maybe a few times a year.. Well worth the 20 bucks that is for sure.. Pretty sure they have a like free trial for 30 days or something even.

I have been using it prob 20 years or so.. ;) Or getting real close to that long.