dvr login password failure...

RouterOS General
1

Hi! I have a problem with my dvr! I can acces it from my network with username and password but when i try to login from otside,my dvr replay me a message thet says:“cant login,try again!”. Im using a mikrotik routerOS. port forwording works but i dont know if i have to do something else! my script is:

/ip firewall nat add chain=dstnat dst-address=x.x.x.x protocol=tcp dst-port=17000
action=dst-nat to-addresses=dvr ip to-ports=80

only from port 80 my router nated me to dvr,if i change this port i cant acces it from outside
My dvr has:
3357->control port
3356->udp port
80-> http port
Thankyou!

2

Is it possible the DVR only allows access from the local network? If so add another NAT rule in source NAT with a masquerade action so the DVR thinks the traffic comes from the router itself.

3

Thank for the question… Dvr works in outside because ive tryed it with a public ip with another ISP…
This is /ip firewoll export

ip firewall connection tracking
set enabled=yes generic-timeout=10m icmp-timeout=10s tcp-close-timeout=10s tcp-close-wait-timeout=10s tcp-established-timeout=1d tcp-fin-wait-timeout=10s
tcp-last-ack-timeout=10s tcp-syn-received-timeout=5s tcp-syn-sent-timeout=5s tcp-syncookie=no tcp-time-wait-timeout=10s udp-stream-timeout=3m
udp-timeout=10s
/ip firewall filter
add action=accept chain=forward comment=“” disabled=no dst-address=x.x.x.xprotocol=udp
add action=accept chain=forward comment=“” disabled=no dst-address=x.x.x.xprotocol=tcp
/ip firewall nat
add action=masquerade chain=srcnat comment=“” disabled=no out-interface=pppoe-out2 src-address=192.168.2.9-192.168.2.88
add action=dst-nat chain=dstnat comment=“” disabled=no dst-address=x.x.x.xdst-port=17000 protocol=tcp to-addresses=192.168.2.84 to-ports=80
/ip firewall service-port
set ftp disabled=no ports=21
set tftp disabled=no ports=69
set irc disabled=no ports=6667
set h323 disabled=no
set sip disabled=no ports=5060,5061
set pptp disabled=no
[admin@MikroTik] >
dvr login.JPG

4

Don’t forget defaul ip service www. is port 80, example if your dvr ip is 192.168.1.10 http port have you cange to port 1700 try to
/ip firewall nat add chain=dstnat dst-address=xxx(your ip public static) protocol=tcp dst-port=1700 action=192.168.1.10 to-port=1700
to connecting your dvr from another ip public is xxx:1700
that’s my configuration in my dvr network with RB750G :slight_smile:

5

thnx 4 your replay. I have tryed that configuration but i it dident worked…i think is somthing else i have to do. something with firewoll to allow the trasmition of password… if i dont specify a port 4 exp:
/ip firewall nat add chain=dstnat dst-address=x.x.x.x protocol=tcp
action=dst-nat to-addresses=dvr ip
yes i can log in but i dont wont this because i cant acces my mikrotik…!!!

6

I mean default ip service www. is 80 so change to… (up to you,maybe port 80 change to 99) because that ip for your router mikrotik. You can still login webfig with your ip public xxx.xxx.xx.xx:99
If you want several ip to connect your dvr just:
/ip firewall nat add chain=dstnat src-address=just ip do you want (may be 100.10.100.1-100.10.100.5) protocol=tcp dst-address=(your ip public static) action=dst-nat to-addreses=your ip dvr
:slight_smile:

7

sorry
/ip firewall nat add chain=dstnat src-address=just ip do you want (may be 100.10.100.1-100.10.100.5) protocol=tcp dst-address=(your ip public static) dst-port=1700 action=dst-nat to-addreses=your ip dvr

If your dvr H.264 model for secure run pppoe client & your mikrotik router set pppoe-server with limit only one=yes,use encryption=yes change tcp mss=yes.
than set configuration nat
/ip firewall nat add chain=srcnat src-address=up to you (may be 200.200.200.1) out-interface=your dial ISP action=masquerade

configuration dvr for mobile need different port
:slight_smile:

8

really thenx for your replay…im trying but its not working?!? :frowning:

9

yaaaa… you can login dvr but not to your router, becouse hhtp port dvr=80, http port default router mikrotik 80. Sooo… change http port mikrotik, login winbox IP>>>Service http default 80 change to 81 (or up to you). I’m sure you can login your router & dvr. :slight_smile:

10

I think you’ve forgot to include the statement of the udp protocol, try this code… and good luck

/ip fi na
add action=dst-nat chain=dstnat comment="AccessTo DVR " disabled=no \
    dst-address=PUBLIC_IP dst-port=8888 protocol=tcp to-addresses=\
    DVR_IP to-ports=80
add action=dst-nat chain=dstnat comment="" disabled=no dst-address=\
    PUBLIC_IPdst-port=3357 protocol=tcp to-addresses=DVR_IP \
    to-ports=3357
add action=dst-nat chain=dstnat comment="" disabled=no dst-address=\
    PUBLIC_IP dst-port=3356 protocol=udp to-addresses=DVR_IP \
    to-ports=3356
11

you are great man…really thanx,IT WORKS! THANKS TO ALL! bye

12

and then don’t forget give me karma, ha ha ha lol…

13

Mr. Janti…
thank for the gift of karma…, succesfull for you…:slight_smile: