Unable to stream camera out of LAN, have done loads before.

[pkbristol]

Hi guys, i haven't been on this forum for a few years, i could do with some help please.
I have an RT-AC68, merlins build 380.62, (yes i know it's old but it's been solid).
I have 9 wireless cctv cameras, mostly of android variety which stream mjpeg, i've had no trouble with these devices, give them static ip, port forward that static ip, view from outside my lan using tinycam monitor app on phone or tablet, all good.
However, i've just bought a couple of new cameras, made by EZViz, which is rebranded Hikvision, these cameras use the EZViz app, all working as it should on lan and wan using the EZViz app, however i want to view these cameras on tinycam app, i can stream the cameras fine on my lan to tinycam app but not to wan.
I've done the static ip, and port forwarding but i just cannot get a stream outside my lan.
Inside my lan on tinycam i can see the stream when using the ip address of the camera, 192.168.0.x, however when i change the ip to my asus hosting name, no go, i even tried directly to my wan ip, still no go.
The new cameras use protocol RTSP over TCP (H264?H265), they work ok on my lan.

PS.I couldn't post in the Lan and Wan article discussions due to "You have insufficient privileges to post here."
Thanks, Paul.

 

[pkbristol]

Ok so i have managed to get one camera streaming outside my lan, i had to also open another port for the camera, port 554, so that's 2 ports per camera. However if i set up a 2nd camera, give it static ip, open different port and then also the RTSP port 554 i get the message from my router "This entry has been in list." I've tried opening port 555 and changing the RTSP port on tinycam app to 555, no good, i can't see the stream.
Pulling hair out here. Can anyone advise please.

 

[bbunge]

Without changing the port on the cam, just use different port in and out on port forward. Or set up a Zoneminder server on your LAN and view all your cams in a web browser with one port forward.

Edit You can set up your router to use OpenVPN server and access your lan via secure tunnel

 

[pkbristol]

Without changing the port on the cam, just use different port in and out on port forward. Or set up a Zoneminder server on your LAN and view all your cams in a web browser with one port forward.

Edit You can set up your router to use OpenVPN server and access your lan via secure tunnel

Hi bbunge, i don't understand what you mean. I could do with a step by step tutorial.
I just want to simply stream multiple video streams out of my lan for remote viewing, i thought i'd cracked it when i opened 2 ports for camera 1, i opened ports 554 and 11554 for ip address 192.168.0.5 and i could view remotely.
Camera 2 is 192.168.0.4, i opened port 10554 added, apply, ok, then when i tried to open/add 554 i'm told that's already in the list.
Out of interest i deleted port 554 from camera 1, THEN i could apply port 554 to camera 2, THEN i could view camera 2 remotely.
I don't know how to proceed. With mjpeg cameras there was just one port forward required per ip address/camera.
I use tinycam monitor app on android devices, i just add the camera details, ie, hostname, port opened for that camera, passwords etc, i have about 9 mjepg streams working fine, have been for years, i can't get these new cameras streaming out though.
Thanks for your help, Paul.

 

[distilled]

bbunge gave solid advice, especially about a VPN.

The easiest and certainly safest thing to do is just set up a VPN server on your router, export a config file and import it onto your phone. TinyCam can work with this, I do it myself. (TinyCam is AWESOME too, isn't it? I use Blue Iris for NVR features and motion detection and TinyCam for remote, but TinyCam could actually do it all).

Just set up an OpenVPN tunnel, then use the OpenVPN client on your phone. Doing this requires no forwarding of ports. If you need help doing it, just mention what kind of router you have. Assuming it supports OpenVPN, setting it up is a cakewalk.

 

[pkbristol]

bbunge gave solid advice, especially about a VPN.

The easiest and certainly safest thing to do is just set up a VPN server on your router, export a config file and import it onto your phone. TinyCam can work with this, I do it myself. (TinyCam is AWESOME too, isn't it? I use Blue Iris for NVR features and motion detection and TinyCam for remote, but TinyCam could actually do it all).

Just set up an OpenVPN tunnel, then use the OpenVPN client on your phone. Doing this requires no forwarding of ports. If you need help doing it, just mention what kind of router you have. Assuming it supports OpenVPN, setting it up is a cakewalk.

Hi thanks. I have zero experience of doing the VPN server procedure, my router is RT-AC68U, i've had it for years, it's been solid, merlins firmware, 380.62.
I Just don't understand why i can't just open port for these new cameras, just like i've been doing for years with the android mjpeg cameras, then add that camera to Tinycam. The reason i want to do all this, it that the cameras i have EZViz (Hikvision), the EZViz app supports maximum 4 live cameras streaming at once, i need more, tinycam will let me add more than 4 cameras.
When you talk about VPN server, how do i then add those cameras to my tinycam ? This is where i'm getting confused. I'd rather stick to what i know if it's possible, ie assign static ip address to the device (camera), open a port/ports for that ip address. If it's not possible for me to just simply open ports then can someone just tell me that.
Thanks, i really do appreciate the advice.

 

[distilled]

You can certainly do it any way you like, it should function fine either way. Just know that cameras are notoriously insecure, so by opening up ports, you expose your entire infrastructure. There are still pretty severe ONVIF vulnerabilities in lots of cameras.

The VPN route is actually easier than managing all that port forwarding, anyway. It might be new to you, and what you are already familiar with certainly seems easier, but it really isn't.

On your 68u, just go to VPN and then the VPN Server tab. Turn Server 1 on, Apply and press the Export button.

Then put that file you exported on your phone and install the OpenVPN client on your phone. If it is an Android, go here:

https://play.google.com/store/apps/details?id=net.openvpn.openvpn

Then run the client you just installed, hit the + and import the config file you exported from your router.

Now you have a much more secure way of accessing your entire home network from your phone.

You can have TinyCam scan the IP addresses of your cameras (use Advanced Scan) and it will identify and configure them for you.

ThisI is from memory and if I left out any steps, hopefully someone will say something, but this should do it. It is about a million times safer than opening up your firewall and exposing cameras.

 

[pkbristol]

You can certainly do it any way you like, it should function fine either way. Just know that cameras are notoriously insecure, so by opening up ports, you expose your entire infrastructure. There are still pretty severe ONVIF vulnerabilities in lots of cameras.

The VPN route is actually easier than managing all that port forwarding, anyway. It might be new to you, and what you are already familiar with certainly seems easier, but it really isn't.

On your 68u, just go to VPN and then the VPN Server tab. Turn Server 1 on, Apply and press the Export button.

Then put that file you exported on your phone and install the OpenVPN client on your phone. If it is an Android, go here:

https://play.google.com/store/apps/details?id=net.openvpn.openvpn

Then run the client you just installed, hit the + and import the config file you exported from your router.

Now you have a much more secure way of accessing your entire home network from your phone.

You can have TinyCam scan the IP addresses of your cameras (use Advanced Scan) and it will identify and configure them for you.

ThisI is from memory and if I left out any steps, hopefully someone will say something, but this should do it. It is about a million times safer than opening up your firewall and exposing cameras.

Hi, distilled, thanks for the reply, like i said, i have multiple cameras forwarded already, i only want to add/forward a few more without a headache then just add them to tinycam, i just can't open more than one instance of port 554, this is where i'm getting confused. I have camera number 2, set it with static ip, i just want someone to tell me what ports to open, these new cameras need 2 ports, 554 and (another port), i can only use 554 for one camera though, that's where i'm getting stuck.
Regarding my AC68 merlins interface, i click on VPN tab (not VPN server) then i have options tabs along the top as follows
VPN status,PPTP Server,OpenVPN Servers,PPTP?L"TP Client,OpenVPN Clients, TOR.
I've just had a quck watch of some Youtube tutorials, none of them show that many tabs.
I understand that you're all trying to point me to the VPN but i'm not concerned with the security side of things,my heads already spinning, i just need to know how to get these cameras going the way i know. They are going to be installed at multiple properties for me to watch unwell relatives, i need to be able to view them all on tinycam. All properties have asus routers which i've already installed there, virgin media superhubs in modem only mode, all working fine for years.
Thanks, Paul.

 

[distilled]

I won't be much help with forwarding ports, that is a really cumbersome and complicated way of doing what you want, but for what it is worth:

Say you have a camera that uses the standard RTSP port 554. That camera has an IP of 192.168.50.50. So you make a port forward that points 192.168.50.50:554 to external port 55400. Then in TinyCam, change the RTSP port to 55400 and volia, camera magic.

Honestly it gives me a headache just thinking about exposing 554, but no need to beat a dead horse. But you *are* potentially exposing the good people you are watching over, too. Just something to think about.

In your VPN config, go to OpenVPN Server. Turn it on, export a config, import that config to your phone, then close all those ports that you have open, then scan with TinyCam. Boom, like magic all your cameras will be accessible, and your infrastructure is vastly safer for everyone involved. Dead horse, I know, but it is important enough to emphasize.

 

[pkbristol]

Ok so i'm going get the cameras going this way then i'm going to get into this VPN stuff.
So for now, i have camera 2,static ip address 192.168.0.4, on the router port forwarding tab i've filled
Service name (camera name)
Port range 10554
Local IP 192.168.0.4 (i can't add :554 after .4)
Local port 10554
Protocol Both
For the camera that does stream out i've done the same as above but 2 port forward rules, 11554 and 554. I'm not being allowed to use 554 again though, that's my sticking point.
Thanks, Paul.
PS, brains thinking about ths VPN stuff now, and you say it works in Tinycam ?
Thanks, paul.

 

[distilled]

What you can do is change 554 in TinyCam to something else, and forward your camera's 554 to a different external port. This is how to open the same port for different LAN devices. 192.168.50.50:554 is just a way of describing the connection. Sorry for the confusion.

Yeah TinyCam works splendidly with OpenVPN.

You and I both have a 68u router running Merlin, several Hikvision cameras and TinyCam. We have essentially the same setup. What you are doing is expending huge effort in order to do this the wrong way. The fact that the wrong way works is incidental. (It is just a preference, no way is really wrong, but...well, it *is* wrong )

 

[pkbristol]

What you can do is change 554 in TinyCam to something else, and forward your camera's 554 to a different external port. This is how to open the same port for different LAN devices. 192.168.50.50:554 is just a way of describing the connection. Sorry for the confusion.

Yeah TinyCam works splendidly with OpenVPN.

You and I both have a 68u router running Merlin, several Hikvision cameras and TinyCam. We have essentially the same setup. What you are doing is expending huge effort in order to do this the wrong way. The fact that the wrong way works is incidental. (It is just a preference, no way is really wrong, but...well, it *is* wrong )

Ok so i've just tried the port forward the way you described,i think.
For the ip address 192.168.0.4 i opened 2 ports,
port 1,,, 10554 (Port range and local)
Port 2,,55400
I then go into tinycam i added web port number as 10554 and RTSP port as 55400. No stream showing .
Thanks, Paul.

 

[distilled]

Ok so i've just tried the port forward the way you described,i think.
For the ip address 192.168.0.4 i opened 2 ports,
port 1,,, 10554 (Port range and local)
Port 2,,55400
I then go into tinycam i added web port number as 10554 and RTSP port as 55400. No stream showing .
Thanks, Paul.

Why exactly are you opening a port range? Just open the port or ports that you need individually.

You want to open 192.168.0.4 port 554 on the inside and port xyz (55400 or whatever) on the outside. Add 80 and, say, 8000 too, if need be (it shouldn't be needed, but...)

No range is involved.

 

[pkbristol]

Just installed open VPN on my phone, i'll get into that soon then, if you can help me my way first then i'll get into that after, thanks.
I also allow one relative to view one of my camera streams of the front of my house, he has android tablet/phone, tinycam,asus router etc. So i will also have to install the open VPN app on his phone ? Or can i just manually copy in individual camera details from my tinycam to his ? Don't want him watching all my cameras !!!

 

[pkbristol]

Why exactly are you opening a port range? Just open the port or ports that you need individually.

You want to open 192.168.0.4 port 554 on the inside and port xyz (55400 or whatever) on the outside. No range is involved.

That's the way i've always done it, the way the tutorials showed me years ago,it just works.
When you say "inside" and "outside", i don't know what you mean.
I just need to know what numbers to type where, if it works then i'll probably understand it then.
I'm about to give up with all this.
Thanks.

 

[ColinTaylor]

@pkbristol I believe you are getting confused over the internal and external ports numbers. The external port numbers (shown in the "Port Range" column) must all be different.


EDIT: corrected typo in picture

The external ports numbers are what you use when connecting from the internet.

 

[distilled]

You can get that relative watching you in lots of ways. One would be to export your camera configuration to .XML and just edit the .XML file manually to cut out things you don't want that person to have. Alternatively, you can back up your own full config to .XML, wipe your config and re-add just what you want that person to have, export that config as .XML and send it to them to import. They would also need to import your OpenVPN config, yes. You can restrict what that config gives them access to, but this is a little outside of the super simple VPN config I have described.

Seriously tho, in the time it has taken to discuss this just so far, you could be watching your cams in OpenVPN. It is a lot easier, and the giant step up in security is a bonus. There are kids using tools like Shodan, masscan and zmap to scan the entire internet address space in under an hour looking for cameras and other vulnerabilities. Having 554 open essentially guarantees you will be probed many times a day, all day. If there is even the slightest vulnerability in anything that you have exposed, it is a given that it has been hacked, and you likely wouldn't even know it. This is the same as being a litterbug or a shoplifter because even if you are only participating unknowingly in a DDoS botnet, you are contributing to a problem that impacts every internet user. When I hear "Oh I just open ports on my router" I see someone flinging an empty McDonalds bag out the window of a moving car. And I feel like that native American in that old 70s commercial...

 

[pkbristol]

@pkbristol I believe you are getting confused over the internal and external ports numbers. The external port numbers must all be different.

View attachment 23562
EDIT: corrected typo in picture

The external ports numbers are what you use when connecting from the internet.

I just made the changes you described
EZVC1 Port range 10554
Ip 192.168.0.4
Local port 554
protocol BOTH
No stream.

The camera that does stream out is as follows, 2 port forward rules
C6-1 ( camera name)
Port range 554
ip 192.168.0.5
Local port 554
Protocol BOTH

AND
Port range 11554
ip 192.168.0.5
Local Port 11554
Protocol BOTH

Thanks, Paul.

 

[pkbristol]

You can get that relative watching you in lots of ways. One would be to export your camera configuration to .XML and just edit the .XML file manually to cut out things you don't want that person to have. Alternatively, you can back up your own full config to .XML, wipe your config and re-add just what you want that person to have, export that config as .XML and send it to them to import. They would also need to import your OpenVPN config, yes. You can restrict what that config gives them access to, but this is a little outside of the super simple VPN config I have described.

Seriously tho, in the time it has taken to discuss this just so far, you could be watching your cams in OpenVPN. It is a lot easier, and the giant step up in security is a bonus. There are kids using tools like Shodan, masscan and zmap to scan the entire internet address space in under an hour looking for cameras and other vulnerabilities. Having 554 open essentially guarantees you will be probed many times a day, all day. If there is even the slightest vulnerability in anything that you have exposed, it is a given that it has been hacked, and you likely wouldn't even know it. This is the same as being a litterbug or a shoplifter because even if you are only participating unknowingly in a DDoS botnet, you are contributing to a problem that impacts every internet user. When I hear "Oh I just open ports on my router" I see someone flinging an empty McDonalds bag out the window of a moving car. And I feel like that native American in that old 70s commercial...

Ok i see your point. Is there a step by step tutorial anywhere for all the steps ?
Thanks, Paul.

 

[distilled]

I don't know what you mean by "Port range 10554" this is what I keep asking about. Why are you opening up a range? You likely only need one port - 554 - for each RTSP camera. I use a VPN which doesn't involve all this cumbersome port forwarding, IMHO doing that was made obsolete (at least for our purposes) many years ago by VPNs, so I may be wrong, but you should only need the one single port on TCP (UDP RTSP is possible but it should work fine without).

I do not know if a paint by numbers exists for exporting your camera config, but there are many great tutorials for both TinyCam and XML.