0

TL;DR

Multiple locations with local CCTV. How to remote access all of them, with an ISP that services IPv4 behind CGNAT and the DVR doesn't supports DDNS for IPv6. DVR also offers API, SDK, P2P and PPPoE:

  1. API: Needs an HTTP connection to make the calls, CGNAT on the way.
  2. SDK: Not sure how to leverage the SDK. Maybe I can embed software in the DVR, but don't know how to do it or where to start.
  3. P2P: Don't know how to reproduce this connection. Also, it probably only allows live footage, which I already have with RTSP.
  4. PPPoE: Not sure if it is even related to the problem.
  5. Read somewhere about ipv6 to ipv4 tunneling, still reading about it, unsure if this is a solution.

Intro

My family owns a local business that have 2 stores and a warehouse. They all have CCTV footage locally stored. I'm developing a side project for me to access those images remotelly, process them in a ML model and raise more relevant alarms.

I have a limited knowledge in Networks, but my understanding is:

  1. For all the locations, the ISP services us with IPv4 behind a CGNAT, meaning my public IPv4 is not only "mine".
  2. I was able to access the live feed of the cameras using RTSP protocol with my IPv4, by configuring the local router (in each location) a port forwarding for port 554. AFAIK this shouldn't be possible behind the CGNAT. The delay is sometimes ok (~2 sec) and sometimes awful (~20sec).
  3. I've tried configuring port forwarding of ports 80, 8080, 37777 and 443 so I could be able to access the DVR interface remotely. That didn't work, I got either ERR_CONECTION_TIMED_OUT or ERR_EMPTY_RESPONSE. I've tried all these ports just to be sure, but internally in the network I can access the DVR interface by acessing http://192.168.15.93:8080, so just port 8080 should be enough. (Yes, I'm using the public IP when trying to access from outside the network)

My understanding is that I can't access the DVR interface because of the CGNAT, but shouldn't that also mean that the RTSP should also fail?

Problem

I don't want to process all cameras 24/7 through RTSP, for a number of reasons: bandwith use, cost of executing the model 24/7 * {nr of cameras}, large delays with RTSP sometimes (probably caused by network conditions?), etc

I managed to get API docs and SDK for the DVR. I will be honest and say that I have no idea what to do with the SDK, as most of my programming has been for online platforms. I suppose that it's for embedding the software in the DVR or Cameras? I'd love to do that, but have no idea where to start.

With the API I can listen to the events the camera's raise, so I can process images only when there are events. However I can't reach the DVR remotely because of the CGNAT. I could, in theory do it through IPv6, but it's a dynamic IP and that means I'd have to reconfigure every time it changes. The DVR supports DDNS, but apparently only for IPv4.

Finally, there are two other types of connection supported by the DVR:

  • One is called P2P, I can use the camera's APP to connect to it so I can see footage, but I don't know how to reproduce this connection so I can retrieve the image myself and process it. Not sure if this allows me to reach the API though.
  • The second is PPPoE, which I also don't know how it works, and a quick google fu didn't help. It may not be related to the problem at all.

Note: Read somewhere about ipv6 to ipv4 tunneling, still reading about it, unsure if this is the right path.

Question

How can I connect remotely to my DVR if it's behing a CGNAT in IPv4, and IPv6 doesn't have DDNS support (in the DVR)?

Ideally I'm looking for a solution that runs remotely and not running locally on each location. (Besides the DVRs, obviously)

3
  • What kind of router or FW do you have?
    – Ron Trunk
    Commented Dec 20, 2023 at 20:06
  • @RonTrunk No firewall, router MitraStar GPT2741GNAC-N2 (Provided by ISP) in 2 locations. The other I'd need to check. Commented Dec 20, 2023 at 20:10
  • Unfortunately, questions about home/residential networks are explicitly off-topic here, as are questions about hosts/servers and consumer-grade network devices. You could try to ask this question on Super User.
    – Ron Maupin
    Commented Dec 20, 2023 at 21:03

1 Answer 1

1

Whatever you do, use VPN. VPN is a good, hard authenticator and its encryption protects you from eavesdropping. Don't depend on the cameras' functionalities but use an additional VPN router. That prevents you from being locking in by any vendor and it's future proof.

Three basic approaches to get at the streams:

  1. Replace the ISP to get a public, static IPv4 address - allowing you to connect inbound, into your locations.
  2. Use IPv6 (assuming a CG-NAT ISP offers native IPv6) - allowing you to connect inbound, into your locations.
  3. Connect outbound to a central service with a static IP, cloud or not. Broker all internal connections at that central service. You'll need proper CG-NAT that doesn't break VPN sessions.
4
  • Thank you @Zac67 but I don't fully understand your answer. Is the VPN a requirement for the 3 approaches you mentioned? Or it a mention regarding security good practices? Also about the approaches: 1. I will definitely look into static IP, but it seems like a short term solution, as I believe the CGNAT will become the norm for IPv4. 2. IPv6 is native, but the DVR doesn't support DDNS for IPv6, unless the VPN is somewhat related here? 3. Would this mean to direct all internet traffic to a static IP and then route the camera ones as I want? Sorry, but network is really my weak spot Commented Dec 20, 2023 at 20:56
  • 1
    Yes, VPN solves your problems and it's secure. Don't expose unhardened devices like cameras to the hostile Internet. You can use IPv6 for tunneling, carrying IPv4 inside. DDNS on the camera is irrelevant when you've got a dedicated router. Also, you cannot connect inbound to IPv4 behind CG-NAT at all, you can only connect outbound.
    – Zac67
    Commented Dec 20, 2023 at 21:49
  • Thank you @Zac67, I don't want to bother but if you don't mind a quick follow up: So what I need is a physical device that will do the VPN routing for me, and not just learning how to config a VPN on the existing router, right? I'm definitely going to have to do my reading on this, but this means all traffic must then go to the VPN or I can segregate only the camera traffic to the VPN? I really appreciate the help. Commented Dec 20, 2023 at 22:41
  • 1
    You can configure the routing on the VPN devices, so it's your choice what runs through the tunnel. I don't know whether that ISP router does VPN or not.
    – Zac67
    Commented Dec 20, 2023 at 22:57

Not the answer you're looking for? Browse other questions tagged or ask your own question.