Block cameras from everything but email
-
John,
i probably could have cleaned up that traffic a little. i have a Firetv in my kitchen that constantly streams RTSP on port 554 from my cameras so we can watch them on the TV. Here is the config screen from the camera, i just blacked out my email and user names. It's weird that it can go through with the any/any but not with the smtp rule..
-
Well any any it could do dns..
How how does your camera figure out what IP mail.shaw.ca is when your rules do not allow for any dns traffic.
Your any any rule would allow it. Does your camera point to pfsense or something else for dns.. You have to allow it to lookup mail.shaw.ca or no its never going to work.
-
John,
soon as I allowed DNS, it worked instantly. Thank you so much, another problem you solved. Can I ask you one more thing. No matter what I do, i cannot get encrypted mail working with the cameras. How important is that when they are all but blocked and connecting to my home ISP for mail?
thanks again man!!
ps. looked at the camera and the only setting was gateway and it was 192.168.50.1 the camera vlan
-
Did your camera get IP via dhcp, if not maybe it uses default something for dns like 8.8.8.8 many a device does this.
If your not using encryption then the auth to send mail is more than likely being sent in the clear. Which since your using your own isp prob doesn't go far, etc. But it is very bad practice to be sure. Why don't you sniff and see if your password is sent in clear? Just sniff to port 587 and have it send a test mail or something. Then download that sniff into wireshark and look if it sends your password in the clear.
All comes down to how tight your tinfoil hat is.. If your going to send in the clear prob wouldn't use your main email account.. Use a sub account with different password, etc.
If I had to guess to why encryption not working would be your camera doesn't trust the cert being presented, etc. You could test and see this with testing from cli access to your mail server and seeing what cert is presented… I can show you how to do that if you want.
Does your smtp server even require auth before sending. Some ISP mail servers when your coming from their own network do not require auth, etc.
edit: Another option if your isp allows outbound out on 25 is to just have the iot device drop off the mail on the dest smtp server directly to your address.. Sometimes that will work as well - then does not require auth..
Your sending directly to the MX record for the domain your sending to - so for example if sending a gmail address..
; QUESTION SECTION:
;gmail.com. IN MX;; ANSWER SECTION:
gmail.com. 3600 IN MX 20 alt2.gmail-smtp-in.l.google.com.
gmail.com. 3600 IN MX 40 alt4.gmail-smtp-in.l.google.com.
gmail.com. 3600 IN MX 30 alt3.gmail-smtp-in.l.google.com.
gmail.com. 3600 IN MX 5 gmail-smtp-in.l.google.com.
gmail.com. 3600 IN MX 10 alt1.gmail-smtp-in.l.google.com.So for the smtp server you would put in gmail-smtp-in.l.google.com and 25.. But many an IP block 25 outbound to other smtp servers so that might not work, etc.
-
thanks for the answer John, i will go through this and figure out what is going on and what I am comfortable with.
-
turns out I was able to get the Gmail with encryption working now after that dns entry so thanks again!
-
Yup things tend to need DNS to work ;) heheheeh
See lots of threads where internet doesn't work have a any any rule!!
No you have a tcp any rule.. So kind of hard to lookup www.google.com when DNS is udp ;)
-
apparently, thanks John!
-
But many an IP block 25 outbound to other smtp servers so that might not work, etc.
Correct, many ISPs won't pass outbound port 25 traffic. For those you generally have to use an upstream provider via secure SMTP connections on port 587. It does not have to be the ISP, it can be any SMTP server on which you have access. Bearing in mind that if your upstream provider's DNS records don't match your domain then you might have spam filtering problems on the receiving side. But for stuff like cameras that's a pretty unlikely issue.
So run an internal SMTP relay (configured to use an upstream relay, if necessary), configure the cameras to use it and then block the cameras from ever using the outbound firewall ports. The you'll have a choke-point at which you can monitor/log or otherwise 'manage' any messages devices inside your network want to send via e-mail.
-
Port 587 is the submit port, not 537.
-
Port 587 is the submit port, not 537.
Thank you, edited for correction. Must've been lack of coffee for that one…
