Cctv remote access for hikvision ip camera

[rakeshbaden2hotmail.com]

Hi all expert people please help me with my cctv remote access . I tried all advice been given so far still no joy. I added my setup network pic please advice
Many thanks
Rb

[kejianshi]

Install a vpn server on pfsense, vpn in from your remote computer, access your cameras as if you were on the lan with them (bandwidth permitted).

[rakeshbaden2hotmail.com]

hi kejianshi

thanks for your advice, like i have mention in my post i would like to see my cctv when i am away from home. i looking around how to do this like you said do openvpn. i have found this website link https://www.highlnk.com/2013/12/configuring-openvpn-on-pfsense/  but still no joy.

please advice i been at it for weeks now

many thanks

rb

[kejianshi]

Well - Lets assume you get pfsense properly configured with a public IP on the WAN

And you have a switch on your LAN

And the cameras attached to that switch.

Then you install a very basic openvpn configuration on pfsense

Then install the package openvpn client export on pfsense.

If you are using a windows machine, use the client export function to download the vpn client into windows and install it (right click - run as admin)

after that you should be able to connect to it and to see your cameras from a windows machine.

[rakeshbaden2hotmail.com]

hi kejianshi

thanks for getting back to me so soon really appreciate your time and input. i am able to see my cctv within my house without of help of openvpn on my window pc and my mobile phone. only problem i have accessing my cctv on my mobile while i am away from house. i hope that make sense what i am try to say.

sorry my english is not very good. so apologise in advance.

many thanks

rb

[kejianshi]

That probably means that you are port forwarding connections from your WAN to your IP CAMs?

Thats not a good habit to be in unless you want those to get hacked.

I'd close the ports, disable the cams uPNP.  Give the cams static IP reservations at the bottom of the DNS Server page.

Give your entire system static reservations actually.

Then configure openvpn and only use the vpn to access your cam and other things.

[rakeshbaden2hotmail.com]

hi kejianshi

i have closed all the port after your advice, and used grc.com to check if all the ports closed or not. its come up pass and you have mentioned disable the cams upnp ok i will do that. but please advice how how will i do the static ip reservations from DNS server page another thing i wanted to mention is i have 4 ip camera connected via NVR Recorder. so do i only need to use static ip on NVR ? and again is there idiot guide to this openvpn for remote access to my cctv while i am away from home
sorry i been at it for quite a long time and still asking same old questions.

sorry once again
to take up your time

many thanks

[kejianshi]

You can run DHCP for the cams

Then go to Status: DHCP leases

click the + button to the right of the IP cams (one at a time)

This will enable you to make static reservations.

Make sure you assign them IPs above or below where LAN DHCP is assigning IPs automatically.

[rakeshbaden2hotmail.com]

hi kejianshi

would i need to still add my ip camera one at a time even though they all four get plugged in back of NVR Recorder and so on.

i am lost all together now

sorry

many thanks

rb

[kejianshi]

Are your cameras IP cams?  Are they plugged into a switch connected to pfsense LAN by CAT5 cable?

[rakeshbaden2hotmail.com]

hi kejianshi

yes i have hikvision 3 of these ip cameras( http://www.hikvision.com/Es/Products_show.asp?id=8722)
and 1 of this one (http://www.hikvision.com/Es/Products_show.asp?id=8724)
all these ip cameras connected via NVR (Hikvision DS-7616NI-SE/P )(http://www.hikvision.com/Es/Products_show.asp?id=7294)

if you see my first post it has the setup pic how my system is setup for home network to cctv cameras NVR with CAT5 cable

many thanks
rb

[kejianshi]

My question though is once those IP cameras are plugged into the NVR is can you access the camera directly on the LAN or only from the NVR?

[rakeshbaden2hotmail.com]

hi kejianshi

sorry i can only view through my NVR ip address.
i hope i understood the question right.

many thanks

rb

[kejianshi]

OK - Then its your NVR address you need access to.  No problem then.

Build your pfsense.  Add the settings for openvpn.  Add the client export packages for openvpn.  Export a package.  Try to access the NVR remotely.

[rakeshbaden2hotmail.com]

hi kejiansi

this is good news! so far you have understood my problem. but, is there an idiot proof guide i can follow step by step so that i don't make any more mistakes and waste any of your valuable time.

many thanks

[doktornotor]

@rakeshbaden2@hotmail.com:

is there an idiot proof guide i can follow step by step so that i don't make any more mistakes and waste any of your valuable time.

https://doc.pfsense.org/index.php/OpenVPN_Remote_Access_Server

P.S. On a totally unrelated note - unless you love spam, you might consider asking some forum admin to change your username. (As an added bonus, it will stop breaking the forum layout :P)

[kejianshi]

Not really.

You need either a static IP on the WAN or a dynamic DNS service.  I use both dyndns and no-ip.  I like dyndns better because they are pretty fire and forget.  There are others.

Do your best to set that up.

Then do your best to set up openvpn.

Then come back and post your configuration and people can start helping you get it working.

[kejianshi]

uhhhhhh yeah.  I probably wouldn't use my email address as my username.  (don't change it to your bank account number either)

[rakeshbaden2hotmail.com]

hi guys

done the easy bit changed the user name lol. now i need to try to do the hard thing follow your instructions.

many thanks

rb

[kejianshi]

Its not so hard - Once you get it configured, even if its broken at least we can tell you what fields to change.

Right now there is nothing to work with.

[rakeshbaden2hotmail.com]

hi kejianshi

https://www.highlnk.com/2013/12/configuring-openvpn-on-pfsense/

can i follow this above link to setup or not please advice.

many thanks

rb

[kejianshi]

Follow what doctornotor sent.

https://doc.pfsense.org/index.php/OpenVPN_Remote_Access_Server

[rakeshbaden2hotmail.com]

hi kejianshi

cool i will try this tomorrow eve, now its time for bed.

thanks very much

rb

[rakeshbaden2hotmail.com]

hi guys

openvpn installed thank god and ofcourse your help too. now what i need to do to access my cctv remotely please.

many thanks

rb

[kejianshi]

Install a openvpn client on your computer
run it
connect
browse to the ip address of that camera box on the lan

[rakeshbaden2hotmail.com]

Hi

I am looking to view my cctv on my mobile phone while, I am away from my house out and about on the road. I can view my cctv on my phone while I am using wifi with openvpn. But as soon i turn wifi off its stopes to work

Any idea what I am doing wrong

Many thanks

RB

[kejianshi]

You aren't doing anything wrong!

That sounds exactly perfect.

[rakeshbaden2hotmail.com]

hi kejianshi

i am still not getting to do what i want at the first place. was that to view my cctv while i am abroad or away from home. i thought by port forwarding i can do that but still no joy. i done port forwarding its still shows not open with this prog http://www.yougetsignal.com/tools/open-ports/).

i also notice in my pfsense setting
STATUS GATEWAYS

WAN DHCP  ONLINE

WAN_ DHCP6    UNDER RTT SETTING (PENDING)  LOSS (PENDING)    STATUS (PENDING)

please advice i am going mad what am i doing wrong to do port forwarding its can't be this hard i have cctv system at work which i can access remotely over my mobile phone. i just want to do the same for my home cctv

please please advice

many thanks

[kejianshi]

Don't use port forwarding.  Use VPN.

[rakeshbaden2hotmail.com]

hi vpn still not working outside house. only works while i am in the house on wifi

please advice

many thanks

[kejianshi]

Post your vpn settings.

[rakeshbaden2hotmail.com]

hi

did you also see my previous message about wan_ dhcp6 pending.
also where shell i give you the vpn setting from please

thanks

[kejianshi]

here - post screen shots of all your configs and problems.

[mikeisfly]

VPN would be the most secure way, but why not just use a port forward to solve this guy's issue. Who makes your NVR and what ports are they telling you to use? I set up IP camera systems all the time and this should not really be an issue as long as you have your NVR setup with non-default passwords. Also what I like to do is use non-default ports too which I can show you how. The problem with a VPN is that it adds overhead to your stream which may / or may not affect your video depending on how much bandwidth you have.

[kejianshi]

Because port forwarding services to the wan like IP cam isn't smart…  Its the opposite of smart...
Its begging for bad things to happen, especially depending on what these cameras are pointed at.

[rakeshbaden2hotmail.com]

hi see first pic


[rakeshbaden2hotmail.com]

hi my NVR and ip camera make is Hikvision

[rakeshbaden2hotmail.com]

another problem may be causing with my pfsense

please see


[mikeisfly]

@kejianshi:

Because port forwarding services to the wan like IP cam isn't smart…  Its the opposite of smart...
Its begging for bad things to happen, especially depending on what these cameras are pointed at.

I disagree with this but to each his / her own. If it is done right I don't see an issue. Any system can be hacked as we have seen over the past year. If you want a system to be truly safe then keep it in the box. I have installed Hikvision Cams just use the tool from the website to change the username / Password for each camera. Don't expose the cameras to the Internet. Make sure you are not using the default username / password for your users on your NVR. Your NVR is really just a Web Server.

As far as ports that need to be forward you never mentioned the model number but a quick bing search shows that ports 80 and 8000 should be forwarded to your NVR. I personally user Blue Iris for my NVRs.

Again I'm not arguing that VPN is the safest solution, but sometimes I think we have a tendency to over engineer a solution to a really simple problem. A strong password and not using  a default port number is all you really need.

Both solutions will work, just depends on how you want to attack the solution. 8)