Question I want someone to school me on port forwarding and upnp (To set up remote access for my security camera).

[iamgenius]

Hi, how is it going?

This may seem very basic to some people but bear with me. In the past, I used to set up port forwarding and DDNS to remotely access my security IP cameras installed at home. It has been sometime since I have done it last time. Now, I'm doing a new setup for a new home security system but there is something that I don't get right. I just discovered that you can use UPnP instead of port forwarding to access your cameras from outside. Some of the new cameras I bought have their UPnP enabled by default and this somehow missed me up. As I'm talking everything is working fine but something doesn't add up and let me tell you what it is. I discovered that when UPnP is enabled in the IP camera setting, the UPnP mapping table in my router configuration page will be filled automatically (My router is Netgear R7000) and I will see the internal IP address of the camera along with port number configured for the camera. Now if I enter my ddns host name followed by the specific port number I will be forwarded to the camera web page successfully. If I enable UPnP in another camera, the table in my router will be filled again and forwarding will work successfully. This is what is happening now and all my cameras can be accessed remotely. While UPnP is enabled, I don't seem to be able to set up port forwarding in my router (It says something like: The specified port(s) are being used by other configurations ) even If I want to do it for another device!!!... Is this right or normal?

I wanted to do remote access my old fashioned way via port forwarding page in my router. So I disabled UPnP, and went to configure port forwarding but it didn't work. What should you do anyway? You should choose port forwarding>select the service name (HTTP for example)>enter the server IP address (the camera internal LAN address)> and then input the external / internal start port which is the port number configured for the camera in its web page. I did this but it didn't work. My external ip address is synced with my ddns host name but when I entered my hostname followed by the port number used by the camera it didn't forward me to the camera page. I don't know why! And why can't I set up port forwarding for a different device (For example my NAS device) which obviously uses a different LAN ip address when UPnP is enabled for some other devices? I'm missing something. Can't UPnP and port forwarding be used simultaneously?

Can I use UPnP for one camera and port forwarding for another ?

 

[iamgenius]

After some reading, it turns out that upnp is like automatic port forwarding that is highly insecure and should never be used. I will switch.

 

[JackMDS]

There are different type of Cameras and each type has it Unique steps that need to be taken.

The type that goes through the camera's providers services (like Nest) are the easiest to install. But there is more issues of security and cost and your Video/Audio files are also in a 3rd party hand.

The IP type need to be handle by the owner locally might be less expensive and more secure, but needs more personal care.

Disable uPnP. Configure each camera with a Static IP that is out of your Regular Network IP's on the same IP band. As an example if your DHCP is set to provide Auto IP from 192.168.0.20 to 50 Use static IPs 192.168.0.100 and above for the cameras.

After setting the Camera to Local IPs Open these IPs in the Router Table for open Ports. When done, check if see each of the Cameras from one regular computer/laptop that is on the same LAN.

If you want to see the cameras from remote, you can get a service like DynDNS etc. each one of these services has instructions on their site to do the connection.

 

[ch33zw1z]

The OP figured out the difference on his/her own, kudos to you!

just one note from me, if your router has vpn functions, you could try vpn’ing into your house to see cameras

 

[iamgenius]

Okay it is working now with normal port forwarding. Thanks for all the help. No more UPnP, it is disabled.

 

[ch33zw1z]

Okay it is working now with normal port forwarding. Thanks for all the help. No more UPnP, it is disabled.

This is the way

 

[iamgenius]

I still have a question though. All is fine, but remote access is so slow. I mean I can see the video, but I can barely control the camera. Playing with PTZ is not smooth. Why is it so slow even though my internet speed is fast? The cameras are connected via WiFi which is bad I know and will introduce some more latency but I did it for convenience. Local access is fine while still using wifi. The camera that is connected directly to my router wifi is the slowest which shouldn't be the case I guess. When I ping it I get like 40ms. Other cameras which are further away and connected via access points get like 3 ms. The slow camera is old, maybe that's the reason? I don't know.

Thanks.

 

[ch33zw1z]

What’s your upload.

when you requesting data on the wan side, that’s what makes a difference primarily

 

[iamgenius]

What’s your upload.

when you requesting data on the wan side, that’s what makes a difference primarily

My internet speed is 500/200 Mbps. 200 Mbps is plenty for just controlling a camera and viewing its video.

 

[ch33zw1z]

My internet speed is 500/200 Mbps. 200 Mbps is plenty for just controlling a camera and viewing its video.

yes, this is true. I’m jelly of that upload. So is the camera firmware at the latest, any QoS running on the network, etc…

 

[aigomorla]

Well i use upnp on a on a separate VLAN which is isolated.
That way i don't need to manually forward every last port for specific things.

I would never do it on a the primary VLAN tho, as its a way to get access to your data, but if someone wants to breach my camera VLAN they can go ahead. They still need to hack the PW in order to access it.

But you should read and learn what VLAN's are and setup separate VLAN's, especially for smart devices.

 

[ch33zw1z]

Well i use upnp on a on a separate VLAN which is isolated.
That way i don't need to manually forward every last port for specific things.

I would never do it on a the primary VLAN tho, as its a way to get access to your data, but if someone wants to breach my camera VLAN they can go ahead. They still need to hack the PW in order to access it.

But you should read and learn what VLAN's are and setup separate VLAN's, especially for smart devices.

Not a bad solution at all!

I have an isolated VLAN for server type stuff e.g. minecraft, plex. but it's only a couple ports so just forwarded them. If you have many types of services, maybe upnp would be helpful.

I could have used this (no SOHO gear available) back in xbox 360 days when it really wanted upnp to use xbox live, but alas....there was no cost effective solution.

 

[iamgenius]

yes, this is true. I’m jelly of that upload. So is the camera firmware at the latest, any QoS running on the network, etc…

Not all cameras have the latest firmware but I don't think it is related because it happens with all of them. I don't want to update them via wifi and I'm lazy to bring them all down and hook them to a cable for a firmware update. No QOS running.

Well i use upnp on a on a separate VLAN which is isolated.
That way i don't need to manually forward every last port for specific things.

I would never do it on a the primary VLAN tho, as its a way to get access to your data, but if someone wants to breach my camera VLAN they can go ahead. They still need to hack the PW in order to access it.

But you should read and learn what VLAN's are and setup separate VLAN's, especially for smart devices.

Well, that will be something good to learn. How is it done in a typical home setup? Can you do it with a standard router? Will I need more hardware to use it? From what I remember you can define a vlan by ports or by mac addresses. I think I need a managed switch for this.