Redirect request from local network to behave like a request from internet

Question

I've setup some cameras on local IP 192.168.1.220 and the device is listening on ports 60000:60001. We use Zyxel USG20-VPN if that helps. We have a static address (for sake of example STATIC_IP).

I've setup the NAT and policy control to be able to connect from an external source (internet) to the cameras. This works perfectly. Ie. EXTERNAL_IP -> STATIC_IP:60001.

The problem is that when I'm connected on the local network (wifi); this does no longer work. My understanding of this area is very vague, but as far as I understand it - the router does not have any sense of 'own' static IP.

Of course we can make another setting and connect directly to the local device. The problem is practicality - we have 4-5 such camera devices and so when you connect through local wifi, the users would have to manually deselect "external" connection and select the same 4-5 devices for "internal" connection. This will get tedious.

What is the solution to this? Ie. be able to connect to the cameras, that are on local network, from within the local network using our STATIC_IP.

P.S.: We use HIKVISION to connect to the cameras.

Answer 1

Simply don't use the public WAN address (requiring hairpin NAT) but the camera's internal, private address. That way you completely bypass the router and eliminate any problems from SNAT -> WAN -> DNAT -> LAN.

To avoid fiddling with IP addresses from outside or from LAN, you setup 'mirrors' of the public DNS entries on your internal DNS server, pointing to the LAN addresses - that way, the desired IP address is used automatically (split-brain DNS).

That said, you should never map devices directly to the Internet that have not been hardened for public use. They will be attacked in a matter of minutes or days. IP cameras are very rarely hardened.

A safer approach involves using VPN to gain access to the LAN cameras. Or at least limit the mappings' source addresses to those required.