1

I have a Ubiquiti UniFi camera and am trying to setup a NAT policy to allow external RTSP access. I can see that the policy is getting Tx packets but nothing for Rx and the video player doesn't connect.

The URL I'm using to access is rtsp://OUR_PUBLIC_IP:554/live/ch02_0 but no luck. When I view the active connections on the SonicWALL I see my connection come in but the source port seems to always change (in the 59000 range) so I wonder if that's messing up the translation?

This is what I see in the Active Connections Monitor

Here's a shot of the actual policy. You'll notice #2 and #3 are similar but only #3 is enabled - this is just from various testing. the Video Camera - Lobby service maps to the internal IP of the camera; Video Camera Port - Standard maps to TCP port 554 (same as RTSP service object below it).

NAT Policy View

Any suggestions would be great appreciated.

  • Perhaps I have misunderstood something, but it looks like you're sending unencrypted rstp video over the internet. It's better to build a site to site vpn than unnecessarily expose your lobby camera traffic to evesdropping. – Mike Pennington May 16 '14 at 12:44
  • Mike - Thanks but no worries, I'm going to lock down the firewall so it's only accessible from a particular external IP address. That address is a Citrix deployment so we don't have the option for a VPN. Any thoughts on the problem itself? – Ryan Brooks May 16 '14 at 16:42
  • Did any answer help you? if so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could provide and accept your own answer. – Ron Maupin Aug 8 '17 at 20:17
2

Your NAT policy has some problems. Currently you're translating source traffic to your WAN IP, and then translating any destination traffic to the camera. It kinda works, but it's not correct. This is what the setup should look like:

Original Source: Any
TranslatedSource : Original
Original Destination: WAN Primary IP
Translated Destination: Video Camera - Lobby
Original Service: Video Camera/RTSP (whatever you call it)
Translated Service: Original.

Try that and let us know. Make sure there's a firewall rule allowing the RTSP traffic to the WAN Primary IP.

| improve this answer | |
  • Thanks, Jim - I just made these changes but still no luck. When I enable packet monitor in SonicWALL I see the packets are properly forwarded to the camera but it's not working. The odd part is that if I set the packet monitor to filter on the camera's IP as the source, I don't see anything coming back out. I think the NAT setup is right, but I'm beginning to think the issue is on the camera side. Works fine on the LAN though (obviously using local IP in that case) so very strange. I even allowed any/any on the firewall as a test to let everything in and out - no luck. – Ryan Brooks May 17 '14 at 16:19
  • The first time you created the rule, did you check the box to "create a reflexive policy"? If so, that could be breaking return traffic. – Jim G. May 19 '14 at 16:27
  • I would delete all custom NAT rules related to the camera, recreate the rule above, and test. If it still doesn't work, create an outbound NAT rule - Orig. Source: Camera, Translated Source: WAN IP, Orig. Dest: Any, Trans Dest: Original, Service: Video Camera. See if that helps? – Jim G. May 19 '14 at 16:28

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.