Howto configure CCTV in dmz with webserver protection?

Question

Hi everybody 
 
 i've utm 9 with webserver protection active. Ive a VCR CCTV with different address from the local lan. 
 My lan is in: 10.1.1.x 
 My dmz is in: 192.168.1.x 
 My wan1 has a public ip same the wan2 (eth4). 
 Now i've pubblished the vcr web site externally and i can login with the webserver protection. Firewall has WAN2->CCTV network open same the other direction (CCTV->WAN2). 
 Also i've got a masq on CCTV subnet to wan2. 
 My problem is that i cannot see the streaming from the webcams. What can i do? Firewall doesnt block nothing but no streaming. 
 Someone can help me?

DouglasFoster · Answer

Device is probably switching to an alternate port, which waf will not allow. Check using wireshark or web proxy logging from an internal pc to confirm. 
 If it uses a plugin that invokes a custom protocol like httx://, waf will block that as well. 
 Worksround is firewall rules instead of waf, or logging into an internal device using vpn or equivalent, then running tbe app internally.

HuberChristian · Answer

This app seems to use Real-Time Streaming Protocol which is not HTTP. So this cannot be secured trough WAF. You have to create a DNAT for this.