Accessing ONVIF cameras on OpenVPN tunnel

  • My home network is on
    All my devices have static IP.

    The OpenVPN Tunnel is on

    I successfully connect to the VPN server from my Android Phone using OpenVPN apps.

    My actual need is specifically to access the camera feeds but I guess it will be the same for all other devices after that.

    I did some reading on Netgate Docs and am still confused on how to access the devices.

    • One port forward rule for each device ?
    • Outbound NAT?

    Thank you for helping me,

  • LAYER 8 Global Moderator

    Do your camera's not have gateways set? Once you connect to the vpn - you would be able to connect to anything on your 10.0.0/24 network.. As long as you setup the local network in the vpn configuration.

    If your camera's do not have gateways - or have some filtering that only allow local access then sure you could do an outbound nat on your lan so that your vpn client looks like its coming from your pfsense IP on the lan..

    For example this outbound nat allows my vpn clients to talk to that address, since it has no gateway set.. Traffic looks like it cam from my pfsense lan IP


  • @johnpoz said in Accessing ONVIF cameras on OpenVPN tunnel:

    Wow, that was quick. I do have gateway on the cameras:

    If my Android phone is within the LAN, the Onvifer app connects to

    While I am on LTE and connected through OpenVPN client, the same Onvifer app keeps saying : unable to connect to so either there is something I do not understand or something is not enabled somewhere.

  • @ninthwave

    I changed two things so I don't know which one did it.

    1. I initially set LAN to instead of which I corrected.

    2. I initially did not give a dns domain name and I corrected by entering the same domain as in General Setup/Domain.

    I can now access the camera feeds.

  • LAYER 8 Global Moderator

    Since your accessing via IP, dns had nothing to do with it.

    But a wrong setting for your lan network in openvpn settings yeah that would do it. is a host address not a network. So yeah that wouldn't of worked.