3 ms·

Anyone know how the cameras specifically punch through firewall? I have a number of Apexis cameras which I believe are essentially rebranded Foscams. I set them

by rufugee 11y ago

Anyone know how the cameras specifically punch through firewall? I have a number of Apexis cameras which I believe are essentially rebranded Foscams. I set them up with static DHCP leases, placed them in a DMZ, and specifically blocked all outbound communication from those cameras to the outside world. Now I'm curious whether this would be enough if they had this p2p feature. In my case, all they seem to do is register with a Chinese based dynamic DNS service. Still, I don't need them to communicate with the outside world and would prefer to prevent it.

soylentcola 11y ago
I'm also interested in this. Most of the Foscams (and rebadged Foscams and similar) I've seen and used were OK once you made sure the DDNS stuff was disabled. But these were mostly the previous gen as I've moved on from Foscam for the most part and I'm not familiar with their latest IP cameras. The one thing I've noticed in general is that a lot of these IP cameras and NAS devices have DDNS or some other type of automatic forwarding on by default because users just want to plug something in and be able to access it from their iphone. The ability to do this with no more effort than pointing at a picture on a phone screen is apparently a selling point. The idea that you'd need to set up your own port forwarding or firewall rules is enough to turn a large percentage of potential buyers off to a product. It's an unfortunate situation and it's the one good case I can see being made for the whole "cloud" dependent devices like Dropcam and friends. If the only thing leaving your LAN is an encrypted stream from the camera, at least in theory it's harder for casual snoopers and Shodan tinkerers to find something sensitive to look at. Personally I prefer to have my IP cams connected to a separate LAN and record to a NAS hidden in a closet but in this day of "there's an app for that" and "plug and play" being the norm, it's interesting to see how companies sell networked devices to end users with the basic capabilities they want while not opening up home networks and sensitive data to anyone with the right search terms and the latest exploit.
dimman 11y ago
Hole punching is nothing spectacular, let me explain simply: You're on your computer connected to a regular home router. You hit google.com in your browser. What happens is that you create an outgoing request towards google.com port 443 (TLS/HTTPS). The router opens up a temporary firewall rule allowing responses from google.com port 443. (Without it you wouldn't get any response) Holepunching is simply using that fact, your device A and B shares their external IP:port with eachother (outside of STUN/TURN scope) and then does a simple connect() to eachothers external ip:port. When A does connect(B_IP:B_port) it opens up for B to respond to that channel, and since B is doing connect(A_IP:A_PORT) his request will be let through and they can connect to eachother. A direct connection, a P2P (peer to peer) connection between those two clients, no one else. Imagine it as a temporary port forwarding that's most importantly limited to one specific IP and PORT that can use it: the other device. (There's some technical limitations to this like the type of NAT/firewall you have, but for the simple home router the above usually works.)
- rufugee 11y ago
  I'm still not sure I follow you regarding how the above applies to my situation. I believe in your case, you mean to say that A is a local machine and B is a remote machine, and if they're complicit together, allowing A to connect outbound to B then allows B to communicate back to A, which could allow the two of them to do things you really don't want. However, if I have the cameras on a completely separate subnet and network interface on the firewall and block communication from this subnet to my regular lan and to the outside world, I should be immune to this, correct? A is in my DMZ, and can't communicate with the outside world based on my firewall rules, so A would never reach B.
  - dimman 11y ago
    If the device can't communicate outbound then no you're completely safe. There's no magic into this, hole punching is just a silly name for a simple technique. Hole punching works when both A and B are behind NAT. It also allows B to contact A if A is behind a NAT (no matter if B is behind one or not). If both A and B have public IP's then the hole punching is "already done", they can already connect to eachother.

by rufugee 11y ago

soylentcola 11y ago

I'm also interested in this. Most of the Foscams (and rebadged Foscams and similar) I've seen and used were OK once you made sure the DDNS stuff was disabled. But these were mostly the previous gen as I've moved on from Foscam for the most part and I'm not familiar with their latest IP cameras. The one thing I've noticed in general is that a lot of these IP cameras and NAS devices have DDNS or some other type of automatic forwarding on by default because users just want to plug something in and be able to access it from their iphone. The ability to do this with no more effort than pointing at a picture on a phone screen is apparently a selling point. The idea that you'd need to set up your own port forwarding or firewall rules is enough to turn a large percentage of potential buyers off to a product. It's an unfortunate situation and it's the one good case I can see being made for the whole "cloud" dependent devices like Dropcam and friends. If the only thing leaving your LAN is an encrypted stream from the camera, at least in theory it's harder for casual snoopers and Shodan tinkerers to find something sensitive to look at. Personally I prefer to have my IP cams connected to a separate LAN and record to a NAS hidden in a closet but in this day of "there's an app for that" and "plug and play" being the norm, it's interesting to see how companies sell networked devices to end users with the basic capabilities they want while not opening up home networks and sensitive data to anyone with the right search terms and the latest exploit.

dimman 11y ago

Hole punching is nothing spectacular, let me explain simply: You're on your computer connected to a regular home router. You hit google.com in your browser. What happens is that you create an outgoing request towards google.com port 443 (TLS/HTTPS). The router opens up a temporary firewall rule allowing responses from google.com port 443. (Without it you wouldn't get any response) Holepunching is simply using that fact, your device A and B shares their external IP:port with eachother (outside of STUN/TURN scope) and then does a simple connect() to eachothers external ip:port. When A does connect(B_IP:B_port) it opens up for B to respond to that channel, and since B is doing connect(A_IP:A_PORT) his request will be let through and they can connect to eachother. A direct connection, a P2P (peer to peer) connection between those two clients, no one else. Imagine it as a temporary port forwarding that's most importantly limited to one specific IP and PORT that can use it: the other device. (There's some technical limitations to this like the type of NAT/firewall you have, but for the simple home router the above usually works.)

rufugee 11y ago
I'm still not sure I follow you regarding how the above applies to my situation. I believe in your case, you mean to say that A is a local machine and B is a remote machine, and if they're complicit together, allowing A to connect outbound to B then allows B to communicate back to A, which could allow the two of them to do things you really don't want. However, if I have the cameras on a completely separate subnet and network interface on the firewall and block communication from this subnet to my regular lan and to the outside world, I should be immune to this, correct? A is in my DMZ, and can't communicate with the outside world based on my firewall rules, so A would never reach B.
- dimman 11y ago
  If the device can't communicate outbound then no you're completely safe. There's no magic into this, hole punching is just a silly name for a simple technique. Hole punching works when both A and B are behind NAT. It also allows B to contact A if A is behind a NAT (no matter if B is behind one or not). If both A and B have public IP's then the hole punching is "already done", they can already connect to eachother.