Securing Surveillance Camera Networks

[@LAWRENCESYSTEMS]

Basic Setup and Configuring pfsense Firewall Rules For Home kzbin.info/www/bejne/mJvVYaWjbpiojKM Synology Surveillance Station With Amcrest AI Advanced Detection kzbin.info/www/bejne/q2HapapugJiJoac Synology DVA1622 Review:Face Detection, Licences Plates, People Counting and More! kzbin.info/www/bejne/bIrOpYGMpamGf6M Synology How to set up AI-powered analytics on DVA Series kzbin.info/www/bejne/oXnXlH9shr5rf9U Amcrest Night Color AI IP5M-T1273EW-AI amzn.to/3dIl3qe Amcrest 4K POE Camera AI Human/Vehicle Detection IP8M-T2669EW-AI kit.co/lawrencesystems/nvr-surveillance-systems/5592146-amcrest-ultrahd-4k-8 Synology NVR Selector www.synology.com/en-us/support/nvr_selector ⏱ Timestamps ⏱ 00:00 ▶ Securing Camera Networks 01:26 ▶ Network Layout 02:58 ▶ The Firewall Rules 05:17 ▶ Synology Settings 06:06 ▶ Understanding the risks

[@DanielSMatthews]

Beware of IP Cams running an out of date version of embedded linux as their NTP client may be a security risk, I have also come across at least one such device that also changed back the IP address of the NTP server so that it stayed pointed at a PLA controlled server in mainland China. Yep, it would let you change the value, but when you checked it later it was reset to the original value! Can you see how that backdoor works? Seriously if you can afford it don't touch anything coming out of China.

[@Sperosful]

0:52 1:02

[@ClassicCarOverhaul]

I have been watching your videos for a while now. I have been wanting to separate an NVR with cameras to a separate network. I'm no network guru and only know enough to get me in trouble lol. After figuring out how to config an older cisco switch with vlans and trunking which really was not that hard and once I configured the vlans on pfsense I was stuck on the rules. I applied the same rules you showed and works like a charm! Thank you for the videos!!!

[@LAWRENCESYSTEMS]

Good to hear you got it working.

[@berndeckenfels]

What you also need to watch out for is attackers getting access to network cables on outdoor devices. So it’s good to not allow them traffic to internal networks. That should include NAS read access.

[@LAWRENCESYSTEMS]

Statistically unlikely but these rules work for that as well. And while they would have access to the Synology, they would also have knowledge of some flaw to get into the Synology and exploit that flaw before someone noticed the camera being off.

[@marcogenovesi8570]

they have to record the footage somewhere so they need some form of access to the NAS or the recording server.

[@marcogenovesi8570]

@@LAWRENCESYSTEMS I know we are going up high on the "statistically unlikely" ladder but ethernet (and fiber) taps exist (and you can DYI one with a small managed switch) so they would not need to disconnect the camera for long to get semi-permanent access to the network

[@KrisLowet87]

@@marcogenovesi8570 on the NVR, you log in at the cameras. The cameras don't log in at the NVR.

[@grocerylist]

@@marcogenovesi8570 You could setup Port Security and only allow access to specific MAC addresses for your cameras and other devices.

[@Deraco1]

I'm glad that putting the cameras and the NVR on the same subnet in this video. Was wondering if that was "good practice" or not as I've been doing that same thing with my IT job too 👍

[@ShaneL295]

Definitely gotta get motivated to redo all my device networking and throw my risky IOT plugs/cameras/switches in a firewalled VLAN. Not looking forward to redoing all of it and trying to figure out what the heck I missed in the migration, lol.

[@benargee]

Do a network scan to gather inventory then move to different VLAN/LAN/WLAN and scan the networks to confirm migrated network inventory and check off what's been moved.

[@ShaneL295]

@@benargee Great tip, thanks!

[@benargee]

@@ShaneL295 yeah for sure. Definitely also helps to catalogue MAC addresses and hostnames.

[@Tony-rl2fr]

Ugh, same here. Boo, hiss 👎🏻

[@JasonsLabVideos]

Freaking BRILLIANT! Thanks Tom, not that i use Pfsense, BUT this applies to OPNSense too !!

[@LAWRENCESYSTEMS]

Yes it does :)

[@TheDillio187]

or any firewall really for that matter.

[@MarkRiker]

I even enable AP isolation (for the cameras that are on wifi) and port isolation on the switch. I don't want the cameras to be able to talk to each other. Might look like cameras but most of those are full capable linux boxes running on the lan. They can do everything.

[@peterwroot]

I have a cheap TP-link tapo camera at home. For only £20 it’s really good for the price… initial setup needs internet access as far as i’m aware, but after I add it into my home automation system, RTSP streaming is setup and I can block internet access.

[@BindasBadshah]

Very important information. Thank you

[@LAWRENCESYSTEMS]

You're welcome

[@doug347]

Will you please do a step-by-step video going through the process Setting up camera network for people learning how to use PF sense

[@EthanWord]

Forgive me if I'm misunderstanding something here, but the allow inverted RFC1918 rule DOES NOT block the connections to IPs in that alias (local IPs), that would be the default deny rule that handles that AFTER the allow rule. So putting that in isn't a rule that is explicitly blocking access to those IPs and IMO it shouldn't be said as such.

[@LAWRENCESYSTEMS]

It blocks any RFC1918 matching address destinations requested from the Synology.

[@EthanWord]

@@LAWRENCESYSTEMS That's not how I understand it though. An allow rule with a inverted alias is going to ALLOW everything OTHER than the alias, it's not blocking anything it's allowing something. It's why I use this exact rule to allow internet access on my subnets. But the default deny in pfSense is what is BLOCKING RFC1918 since there are no allow rules for RFC1918. Basically, if the rule wasn't there, it'd still be blocked anyway. Or am I misunderstanding something? According to Netgates documents, an inverted match will match all traffic EXCEPT what is in the value to trigger the rule, so this I guess IMO this shouldn't be stated as a rule to block RFC1918 because the rule is NOT doing that, this rule wouldn't be triggered by RFC1918 traffic.

[@LAWRENCESYSTEMS]

I am inverting the destination to make sure it's not going to a local network

[@EthanWord]

@@LAWRENCESYSTEMS right but it's the default deny rule that would actually deny anything going to an internal network. Since this rule is a pass rule with inverted RFC1918. What I'm getting at is this rule isn't the rule that prevents local destinations. This rule just allows external destinations. The rule wouldn't be matched in pfsense for a local destination since this rule ONLY matches for the inverse of that which would be external. Point is creating this rule allows the default deny rule to block internal networks it it's not the rule actually doing it since a given packet wouldn't be matched to it. Point being if, for example purposes, a allow any destination rule was below this, then local networks would still be accessible by the synology since the above rule isn't matched with a packet that has an internal (RFC1918) destination. I guess it's all just wording that's bugging me since the description of the rule is block local access but this rule doesn't actually do that. I personally use the same rule but just label it "allow internet access" since the default deny is what prevents local access to other subnets.

[@soniclab-cnc]

I have all my cameras on their own network. I use a second nic on my NVR server for all the cams and they run with no DHCP. When I add a new cam I plug them temporarily into my main network and assign it a manual IP. Then I move it over to the POE switch and add it to my server. Makes them inaccessible from anywhere....

[@tokoiaoben3842]

Thanks Tom . I don't see the rule where you allow your trusted network access to the camera/synology network/vlan.

[@LAWRENCESYSTEMS]

I have an "Allow ALL" rule on my trusted network.

[@michaelmiller4834]

How many NICS are you using on Synology? Normally for IP video systems, we use dual NICs on the servers. One for cameras and the other for the corp network. The camera network is isolated from everything else.

[@LAWRENCESYSTEMS]

This particular model only has one, but for most of our business installs we use larger units that have more than one and set it up that way.

[@aaron6841]

Hi Tom if you exposed the ports to the camera over the internet could the footage be viewable or is it encrypted? Thanks

[@LAWRENCESYSTEMS]

I would not recommend exposing camera ports no they're not encrypted most of the time

[@aaron6841]

@@LAWRENCESYSTEMS brilliant thanks for the response! Much appreciated have a good day Tom

[@jkw75]

I have been watching your videos for a while and I must say they are very educational, I am not a network guru so my apology for the ignorance, what is the best practice of setting the ip address of the Synology has? is it by setting the static address within the Nas itself or through DHCP reservations in pfsense for the above setup

[@riccardoventurelli894]

Synology support suggests to set up a reverse proxy to avoid port forwarding. What do you say about it?

[@LAWRENCESYSTEMS]

it works

[@bbgarnettTotallyNotABot]

Keep up the great work

[@LAWRENCESYSTEMS]

Thanks!

[@adamwhite3820]

Just the video I was looking for! Thanks Tom!!

[@LAWRENCESYSTEMS]

Glad to help!

[@deadlymarsupial1236]

Perhaps it is time to have a look at bosch? Resellers can get online training once registered.

[@LAWRENCESYSTEMS]

There are other brands such as Bosch, Axis, etc.., but they are all substantially more expensive.

[@deadlymarsupial1236]

@@LAWRENCESYSTEMS I agree and perhaps I should have expanded on my comment - as they have the level of security and redundancy that satisfies the government stipulations. It has for me (at least) worth knowing about them to aid in pre-sales as well as support of IT installations that have them as we have had service calls to get office PCs running the client app where the knowledge of the Controllers, Storage & Cameras were very helpful. The clients we came across using bosch were shopping centers and sporting clubs & stadiums so it's not all government and correctional facilities. What I found interesting however is the last two types of installations would use transparent conduit so the cables could be visually inspected for interference.

[@Delphinus-Keya]

We have 3 separate industrial buildings we rent out to 3 separate renters. Is it possible to have the recordings for all 3 properties in one central place, But also allow our renters access to the cameras for their buildings? Or would it be better just to set up 3 independent systems? In case It's confusing I'll give an example. Something like your local Walmart having access to their cameras, But yet corporate can still see everything all the time.

[@cpuuk]

Yea, those IoT devices like to call home to Winnie the Poo.

[@slip0n0fall]

Could you comment or report on how to best utilize the dual LAN ports on many Synology NVRs, from a security perspective?

[@LAWRENCESYSTEMS]

One for the cameras one for the internet access. kzbin.info/www/bejne/d2KsYp5vg8inY6M

[@daphbobo]

As a general rule, deny internet to everything that dont need internet. Also restrict internet basic access is 80,443.. if other access is required do the only specific ports needed.

[@podcaster_emeritus]

Would this work the same way if using a UniFi NVR instead of the synology? Or are there any quirks with UniFi? Maybe to allow remote access to work, for example?

[@godelrt]

Thank you for the information! How would one do this on unraid that has frigate docker that the cameras record to? Set up frigate on that same separate vlan?

[@LAWRENCESYSTEMS]

I have never used frigate, but yes that sounds like it would be the way to go.

[@user-xg1dy]

Is it possible then to access my NVR from external network using these firewall rules? I want to block internal access like this video but also be able to access the NVR from external network.

[@maxmeier532]

If I have lan with only the cameras and the PC to watch the video on, can I do a simplified version of this in the Windows Firewall? I am thinking, all I want is the PC to be able to initiate the communication to the cameras, but deny the cameras to initiate- like you apparently do with pfSense. I already have a POE managed switch, there I can put the cameras on their own vlan which I would prefer. So that cams are on Vlan X and the PC is on Vlan Y. I need a simple rule, that just says: PC (with Blue Iris) can access cameras, but the cameras (or whatever is connected to that port) cannot access the PC. And from other comments here I assume, if I want more different Vlans for camera and PC I need to also define a gateway?

[@cal3751]

I have my cameras on their own VLAN. Instead of Synology, my NVR is a Blue Iris PC that doubles as a Plex server (so it needs to access the internet for metadata). I currently configure the PC on the main/trusted network. Is it better to put the PC on the camera VLAN like Tin shows his Synology NVR?

[@BrianSimmons]

Yes. Your BlueIris computer should be on a dedicated PC without internet or LAN access. Running it on the same computer as your Plex machine is not very secure because you have to grant access to both the internet and the rest of your LAN network for the Plex related functions.

[@rodrimora]

Great video! I personally just use a VPN and my wife has learned to use it hahahah

[@gregorypierce2697]

Hey Tom can you comment on which of the cameras you list here you like best? the 5mp or the 4k one? specifically for night vision Thanks. I'll be combining it with a synology 923+ nas. I also see the new IP8M-2779ew-ai which looks nice but it's not listed on the synology compatibility list.

[@LAWRENCESYSTEMS]

These are good kit.co/lawrencesystems/nvr-surveillance-systems/5592146-amcrest-ultrahd-4k-8

[@NedumEze]

Any idea where Lorex Cameras are designed and manufactured? Also, preventing Cameras access to the internet robs the owner of the instant alerts in the event of say, burglary while you're at work. Is it impossible to restrict it to a few IPs while connected to the internet?

[@LAWRENCESYSTEMS]

The Chinese company Dahua owns Lorex.

[@NedumEze]

@@LAWRENCESYSTEMS Wow! Whatever happened to manufacturing in America! As it stands, there's not a single, decent Network CCTV system made in America???

[@Spirch]

i know it might not be the place to ask but can you do a new video on tp-link? look like the latest one that i can find is about >1 year old

[@Fryn_Hayn]

Complete noob here... I am between ordering an Amcrest or Reolink camera system.. Just want to make sure I'm following along accurately. So if I go with an NVR from either brand I would not be able to achieve a truly "secure system"? Thanks in advance. Trying to help setup a system for my parents house.

[@LAWRENCESYSTEMS]

I would not use a Reolink or Amcrest branded NVR.

[@tpfeffer6964]

I have pfSense Plus, a Synology DS920+, three Amcrest POE surveillance cameras and a dedicated managed POE switch to power the cameras. The DS has two rj-45 ethernet ports. Could I configure the DS to use a separate subnet for Surveillance Station isolated on one of the two ethernet ports and have firewall rules in place to prevent the two ports from communicating? That way I could use the other DS ethernet port for my regular network traffic? Would this allow for separation as you discussed in your video without having to dedicate a separate DS for the cameras?

[@bluesquadron593]

Network traffic can be separated, but both networks have physical access to the DS itself. So that is the week point.

[@LAWRENCESYSTEMS]

The bigger issues is that if you had the system publiclly expose and a flaw was found in the software that flaw might compromise the entire system.

[@gerardlunow567]

I have the DS920 and pfSense as well and vlaned them out. Anytime there is a commonality there is an not well understood risk. I only view one camera through OpenVPN which was slow but usable. It appears that the internet has been upgraded and speed have been much better.

[@WoodUCreate]

Any suggestions about limiting the cameras without using PFSense? I want to connect one site to my house. I was thinking of having a site to site VPN. I just want to make sure I'm thinking about the best method before I go down the wrong path. I do have a cisco POE switch at the site I could set up VLANS too on, but I'm looking to keep it as uncomplicated as possible, at least initially once I get it set up I can do some more. Thanks for any help.

[@LAWRENCESYSTEMS]

Depending on what model Cisco you have you could create the rules there to block the cameras.

[@WoodUCreate]

@@LAWRENCESYSTEMS I was kinda hopeful I could. It's a Cisco 2960 POE I believe. A bit older but I got it for free. The "NEW" tp-link unit came and POE didn't work. Got to send it back.

[@Cyber_Homestead]

+1 for "The Internet" picture. 😄

[@familyplans3788]

I only need the internet for my security cameras to sync the time on it , for that i have a hard switch that i click on and wait for a minute for the time to set itself but then switch it off

[@jonneymendoza]

So how do u remote check your camera's?

[@firefon326]

You could also just run your own ntp server...

[@firefon326]

Or create a firewall rule specifically allowing access to your public ntp server of choice

[@familyplans3788]

@@jonneymendoza i have no need to , but if i needed too then i would just switch my switch on and leave it , but 99% of the time i dont need to remotely use it

[@familyplans3788]

@@firefon326 true true but i like the idea that my switch is hardwired and not hackable

[@noggan]

Those cameras look nice. However it doesn't look like they sell them in the EU. Any suggestion on something that is sold in eu?

[@LAWRENCESYSTEMS]

I don't really know what is for sale in the EU market.

[@a.g8517]

just set a static IP without gateway\dns at all cameras

[@ThePopolou]

Without a gateway set, they won't know where to send packets when you connect to them...which you will undoubtedly need to do.

[@LAWRENCESYSTEMS]

Removing the gateway breaks the ability to manage them from other networks.

[@Marin3r101]

Someone took a routing 101 course Tom! In all seriousness A.G. gateway/router is needed as devices are 2-way communicators. If it was just a sensor and you pointed the reader at it directly that would work.

[@ThomasEricWendt]

thanks for the vid

[@Foiliagegaming]

Ugh. People not wanting secure networks over convivence. I understand why people want it. I find myself leaning towards easy. But it is not as rewarding. Thank you for the great videos!

[@olympusmons4089]

I learn so much from your videos, Tom! In order to have this setup with multiple subnets, I would need two seperate physical networks with associated LAN ports on my PFSense? I assume this same setup would be possible with VLANs and a managed switch to reduce the network hardware needed? Thank you for the knowledge you share!

[@LAWRENCESYSTEMS]

Yes

[@scottfeagan5003]

Even if they are isolated and not internet connected, you still would not be compliant with government regulations and would fail an audit. Having those cameras on the network at all is not allowed according to the US government for it's contractors

[@LAWRENCESYSTEMS]

Correct, and we don't use cameras on the ban list for gov jobs and neither should anyone else.

[@nolmono9593]

May I know what is the application u use to draw the LAN, Camera, and Pfsense..?

[@LAWRENCESYSTEMS]

diagrams . net kzbin.info/www/bejne/o6GpYpxvqMt4gJI

[@notathome13]

A group I consult to deploys and re-engineering a lot of “professional” camera setups. What have we learnt - all camera will talk home, it’s a fact of life vendor lie and hackers find holes in code. Make sure you have a pair of local ntp sources for correct time at camera and nvr. Don’t set dns. Camera don’t it. Don’t allow nvr to communicate to internet…. All nvr get owned over time. Use vpn clients for remote access.

[@MrLawks]

Agree on the NTP part, having date & time correct on all the devices is crucial to proper security setups as it makes it easier to track a security event that involves multiple cameras. My camera network actually allows DNS because it does not use a local (in the same subnet) NTP server, but traffic other than NTP and DNS is blocked.

[@DJaquithFL]

My reply and then I read yours. Basically we agree. "The question is why bother with these Chinese cameras??? The only way I would even remotely trust them is to air gap them. At that point there is no point. Listen. I barely trust the couple camera companies that are US company owned. Cameras are a 100% two-way street for security and non-security."

[@MrLawks]

@@DJaquithFL I think it mostly comes down to cost. Companies don't care if their cameras are sending data back to china or the vendor is possibly involved in human rights violations, because they're exceptionally cheap and high performance. Why consider us-owned-but-chinese-manufactured cameras when you can go right to the ODM and save money, and then make it the security team's problem to deal with.

[@Marin3r101]

This isn't a discussion. Clear it is a know-it-all leaving a perceived "pro-tip"... no sense in replying and wasting your time friends

[@curtispavlovec]

Yes on all points. Lock it down.

[@Phaser1980]

Admin 88888 😂😂😂

[@WereCatf]

This is more-or-less what I do with several Chinese IP-cameras. Those cameras have absolutely atrocious firmware, including multiple vulnerabilities and a couple of deliberate backdoors; even if you disable e.g. P2P-access to them from the settings, they still attempt to open the connection and they'll just pretend that they're not doing anything. This is all why I deny them access to everything aside from NTP and DNS.

[@dfgdfg_]

You can get traffic out inside DNS and NTP requests

[@WereCatf]

@@dfgdfg_ the DNS and NTP run on the pfSense-box, so no. The cameras do not have access to internet at all, so there is no way for them to get anything out.

[@Fryn_Hayn]

@@WereCatf Is it possible to have them with zero internet access but still view via mobile app?

[@WereCatf]

@@Fryn_Hayn Depends. If the mobile app uses a direct RTSP-connection to the cameras' feeds, then yes, and if you need to access the feeds from outside your LAN, you'd need to be using a VPN into your home or you'd need a proper NVR-solution.

[@Fryn_Hayn]

@@WereCatf Is there a way I could message you regarding a couple more questions I have? If not its all good you just sound like a helpful source.

[@Sperosful]

😊

[@pepeshopping]

No, no, no, no. If you don't trust the device, you: Never let it connect to other devices. In this case, you also: Never let it connect to the Internet. But this false security of a logical barrier by just using a different subnet, is easy to subvert if it is truly a rogue device: Simply sniff the network to find what other subnets are around (even in a switched network) and then add an IP alias with an address in the other subnet that, even if it has no Internet, now this rogue system can now talk to your production systems and find/abuse a vulnerability etc, etc. If serious, you must keep the IP Cameras on a physically different network! Use VLANs if you must, but nothing beats having the NVR with 2 ethernet cards: One for the LAN/Internet and the other only for the cameras network.

[@sexualsmile]

I'm pretty sure Tom knows what he's doing 😂😂😂😂 incel

[@jacksoncremean1664]

Simply not port forwarding a NVR in itself provides a lot of security, it stops random bots on the internet from probing your NVR. When Lawrence is saying "Use a different subnet" he means a different VLAN, VLANs are by default completely isolated to each other. You can open up ports between VLANs as needed but in general attack surface is dramatically reduced when you use a seperate VLAN and not port forward the NVR to the internet.

[@lance_nickel]

I had the same thought. On my home network I have a PC running Blue Iris on one VLAN. It is port forwarded for remote access (not the most secure but I accept the risk). The Blue Iris network cannot access the internet besides NTP as the PC does not need internet access outside of routine maintenance and patching. The cameras are on another VLAN that has no rules (deny all). The setup works just fine and I have the peace of mind that the cameras, if one does somehow go rogue, can't get anywhere.

[@LAWRENCESYSTEMS]

"Simply sniff the network to find what other subnets are around" that is not going to work when you have a proper setup with the rules setup as I did in the video and a separate VLAN or physical network setup.

[@marcogenovesi8570]

He didn't show it but imho it's implied (as it's industry standard) that the subnets are on different vlans, set on a VLAN-aware managed switch, not on the untrusted devices so they can't just reconfigure their network to escape the sandbox. Decent managed switches allow you to limit the interfaces or VLANs they show the management interface on, so the cameras are unable to talk to the switch either.

[@RESPEKTOS]

my wifes rice cooker is made by Xiaomi and connects to wifi. When you block internet access out, it spazzes out and sends millions of requests until one finally makes it out..... I have nfi what its sending out, but I can imagine everything about my network

[@marcogenovesi8570]

why does it need to be connected to wifi

[@jollibee2802]

@@marcogenovesi8570 it only has one button but about 100 features, you need the app to control it

[@DJaquithFL]

The question is why bother with these Chinese cameras??? The only way I would even remotely trust them is to air gap them. At that point there is no point. Listen. I barely trust the couple camera companies that are US company owned. Cameras are a 100% two-way street for security and non-security.

[@LAWRENCESYSTEMS]

Comes down to price and most people don't want to buy the more expensive ones. I don't trust them and locking them down as I did in this video means I don't have to.

[@marcogenovesi8570]

Because the "US designed" expensive ones aren't better as far as security goes so why paying more if you have to sandbox them anyway. I've seen enough presentations from hacking experts in yearly hacking events (available also on youtube), all IOT is an absolute dumpster fire and cannot be trusted

[@DJaquithFL]

@@marcogenovesi8570 .. Meanwhile, by Chinese law, all of your data gets routed right back to China regardless of your laughable settings. So the question is would you rather deal with somebody that has some laws that are available to protect you .. or would you rather be 100% SOL with China and the Chinese legal system?

[@marcogenovesi8570]

@@DJaquithFL Pfft yeah because US law doesn't allow thre-letters to tap whatever they want. The only laws that can protect me from spying are the laws of networking.

[@DJaquithFL]

@@marcogenovesi8570 .. The mere fact that you believe that any networking protects you is humorous.