Accessing ONVIF cameras on OpenVPN tunnel

NinthWave

My home network is on 10.0.0.0/24
All my devices have static IP.

The OpenVPN Tunnel is on 10.0.8.0/24

I successfully connect to the VPN server from my Android Phone using OpenVPN apps.

My actual need is specifically to access the camera feeds but I guess it will be the same for all other devices after that.

I did some reading on Netgate Docs and am still confused on how to access the devices.

One port forward rule for each device ?
Outbound NAT?

Thank you for helping me,

johnpoz

Do your camera's not have gateways set? Once you connect to the vpn - you would be able to connect to anything on your 10.0.0/24 network.. As long as you setup the local network in the vpn configuration.

If your camera's do not have gateways - or have some filtering that only allow local access then sure you could do an outbound nat on your lan so that your vpn client looks like its coming from your pfsense IP on the lan..

For example this outbound nat allows my vpn clients to talk to that 192.168.9.101 address, since it has no gateway set.. Traffic looks like it cam from my pfsense lan IP 192.168.9.253

NinthWave

@johnpoz said in Accessing ONVIF cameras on OpenVPN tunnel:

Wow, that was quick. I do have gateway on the cameras:

If my Android phone is within the LAN, the Onvifer app connects to 10.0.0.40:554.

While I am on LTE and connected through OpenVPN client, the same Onvifer app keeps saying : unable to connect to 10.0.0.40:554 so either there is something I do not understand or something is not enabled somewhere.

NinthWave

@ninthwave
SOLVED

I changed two things so I don't know which one did it.

I initially set LAN to 10.0.0.1/24 instead of 10.0.0.0/24 which I corrected.
I initially did not give a dns domain name and I corrected by entering the same domain as in General Setup/Domain.

I can now access the camera feeds.

johnpoz

Since your accessing via IP, dns had nothing to do with it.

But a wrong setting for your lan network in openvpn settings yeah that would do it. 10.0.0.1/24 is a host address not a network. So yeah that wouldn't of worked.