Guest User!

You are not Sophos Staff.

Thread Info
  • State Suggested Answer
  • Locked Locked
  • Replies 3 replies
  • Answers 1 answer
  • Subscribers 4 subscribers
  • Views 12094 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

UTM Home : Nat / Masquerading / Web Filtering and Remote access to IP Cameras

MatJean

Hi all...

Im new to Sophos, but i think i have a pretty good grasp on it so far.

I bought a Qotom mini PC box with 4x LAN ports on it and run a Billion 7800N in bridge mode to one of the ports on the Qotom as a "WAN" interface.

I have setup the remaining 3x ports as a bridge with a single IP of 10.1.1.1

I have a firewall rule for Lan (Network) -> Any -> Any  (and internet is working fine for all lan clients)

I have 3x IP cameras on my network and have setup the following NAT and Firewall rules

Any -> Port XXX -> <internal IP>

I also found i had to setup a masquerading

LAN (Network) -> WAN (Interface) 

This was working well, i could browse the net, from inside, Remote out, vpn out, etc.
I was also able to reach my internal cameras from outside (Remote to my work PC and test coming through the mydlink website and also turn my WIFI off my phone and use 4G to use the dlink apps).

Once i turn Web Filtering on, despite all my efforts to exclude the internal IP addresses and even adding my work IP range and 4G range to a "Safe IP" group, it seems to break that ability to come in and view the cameras.

Now i know the cameras, in a way operate as small web servers, so im assuming the web filtering is blocking / getting involved with the connection...

Was just hoping for some pointers on this one?

I have foillowed quite a few guides on configuring the web filtering and have tried turning certain options off, testing, back on, another option off, testing etc. but i cant get it to work unless i totally turn the Web Filtering off.

I dont mind so much about the web filtering, because the purpose of me doing this was to basically restrict which IP's could come in and see the cameras, but the web Proxy was a nice benefit for leaving it on.

 

Thanks in advance.



This thread was automatically locked due to age.
Parents
  • 0

    For incoming traffic you need to create a DNAT rule like this:

    For traffic from: any *
    Using service: <configure right port to use>
    Going to: External WAN (Address) 

    Change destination to: Your internal IP
    And the service to: Leave blank if same as incoming service, otherwise configure local port

    Tick 'Automatic firewall rule' to automatically create a firewall rule belonging to this DNAT rule.

    * In stead of any in "for traffic from:" you can create a list of IP's you want to have access to your camera's.

  • 0 in reply to apijnappels

    Oh im sorry, i didnt make it clear (i left out a step when describing my NAT)

    I did have it already set to

    Traffic : SAFE -> Port XXX -> Wan (Address)
    Destination : Internal IP + Port XXX

    And here are my Firewall rules

  • 0 in reply to MatJean

    ok, i managed to get it working.

    And this is more for reference for anyone else in the future.

    The dlink websites needed to be excluded from the web filtering rules... i could see in the logs that it was getting involved in the https stuff. 
    anyhoo, i had to add all the dlink websites that run the mydlink connection to the exclude list.

    I also added my internal cameras http://<ip address> and that seemed to fix it.

    There is still the firewall rules that are limiting connection based on external IP and or MAC so its still safe.

    Hopefully this will help someone in the future with similar problems.

Reply
  • 0 in reply to MatJean

    ok, i managed to get it working.

    And this is more for reference for anyone else in the future.

    The dlink websites needed to be excluded from the web filtering rules... i could see in the logs that it was getting involved in the https stuff. 
    anyhoo, i had to add all the dlink websites that run the mydlink connection to the exclude list.

    I also added my internal cameras http://<ip address> and that seemed to fix it.

    There is still the firewall rules that are limiting connection based on external IP and or MAC so its still safe.

    Hopefully this will help someone in the future with similar problems.

Children
No Data