Forwarding CCTV ports - problem

Hi,

I’m using RB750GL. My problem is that I’m trying to get CCTV access from one of my subnets. I’ve forwarded ports used by DVRs (web service - port 80) and everything went fine, until I’ve logged in to one of my DVRs. There is no video preview. DVRs are using three ports: HTTP - 80, TCP - 5000 and RSTP - 554.

So, my network scheme is:

WAN - xxx.xxx.xxx.xxx
LAN1 - yyy.yyy.yyy.yyy (Primary network)
LAN2 - zzz.zzz.zzz.zzz (Mikrotik network)

xxx.xxx.xxx.xxx is my WAN address, primary LAN network is based on yyy.yyy.yyy.yyy address pool (LAN1). My DVR network is based on LAN2 zzz.zzz.zzz.zzz address pool. So I took one of my primary network address (yyy.yyy.yyy.yyy) and make it as WAN for RB750GL. Then I’ve forwarded 80 and 5000 TCP ports, using single port for each DVR:

  • DVR1 - yyy.yyy.yyy.yyy:8001 → zzz.zzz.zzz.zzz:80
  • DVR1 - yyy.yyy.yyy.yyy:8001 → zzz.zzz.zzz.zzz:5000
  • DVR2 - yyy.yyy.yyy.yyy:8002 → zzz.zzz.zzz.zzy:80
  • DVR2 - yyy.yyy.yyy.yyy:8002 → zzz.zzz.zzz.zzy:5000
  • DVR3 - yyy.yyy.yyy.yyy:8003 → zzz.zzz.zzz.zzx:80
  • DVR3 - yyy.yyy.yyy.yyy:8003 → zzz.zzz.zzz.zzx:5000

and so on.

Still, I get no video. I can login to web service of DVRs, but I don’t get anything more. When I’ve connected my laptop directly to Mikrotik, I could login and take a video preview without a problem. But from my primary network it doesn’t work.

Any ideas?

Packet capture on the client and see what ports it’s trying to connect to.

Not sure I understand this bit:

  • DVR1 - yyy.yyy.yyy.yyy:8001 → zzz.zzz.zzz.zzz:80
  • DVR1 - yyy.yyy.yyy.yyy:8001 → zzz.zzz.zzz.zzz:5000

How can 8001 be forwarded to two ports at once? Why haven’t you forwarded port 554? Perhaps that’s key to the lack of video. A quick google suggests that RTSP is likely to be the media stream.

Do you really need to NAT between these two networks? This is one of the kind of problems that NAT introduces.

Finally, “Forwarding Protocols” isn’t really intended to cover questions about port forwards, but I can understand why about half the questions in this forum are about port forwards :slight_smile:

My mistake. It’s naturally, that I should forward ports like this:

  • DVR1 - yyy.yyy.yyy.yyy:8001 → zzz.zzz.zzz.zzz:80 (TCP only)

  • DVR1 - yyy.yyy.yyy.yyy:5000 → zzz.zzz.zzz.zzz:5000 (TCP/UDP)

  • DVR1 - yyy.yyy.yyy.yyy:554 → zzz.zzz.zzz.zzz:554 (TCP/UDP)

  • DVR2 - yyy.yyy.yyy.yyy:8002 → zzz.zzz.zzz.zzy:80 (TCP only)

  • DVR2 - yyy.yyy.yyy.yyy:5000 → zzz.zzz.zzz.zzy:5000 (TCP/UDP)

  • DVR2 - yyy.yyy.yyy.yyy:554 → zzz.zzz.zzz.zzy:554 (TCP/UDP)

  • DVR3 - yyy.yyy.yyy.yyy:8003 → zzz.zzz.zzz.zzx:80 (TCP only)

  • DVR3 - yyy.yyy.yyy.yyy:5000 → zzz.zzz.zzz.zzx:5000 (TCP/UDP)

  • DVR3 - yyy.yyy.yyy.yyy:554 → zzz.zzz.zzz.zzx:554 (TCP/UDP)

So, I’ve done it and video showed up, but then I’ve disabled port 5000, because I wanted to find out, which of those ports are responsible for video stream. It stopped working, so I’ve enabled port 5000 again. Nothing. It doesn’t work again…Router reboot, nothing. Cleared browser cache, nothing. Tried to login from other PC, nothing. Video is not working again…‘Connections’ tab shows, that connection is established on port 554 (TCP only), but also there are a lot of entries:

  • last ack
  • time wait
  • fin wait,
  • syn sent.

on port 554 too. All those connections refer to DVR address.

NAT needs to be between those two networks.

What is going on?

P.S. Sorry for wrong place. Maybe administrator can move my thread to proper place?

OK, my mistake. I’ve made corrections, and now my port forward looks like below:

  • DVR1 - yyy.yyy.yyy.yyy:8001 → zzz.zzz.zzz.zzz:80

  • DVR1 - yyy.yyy.yyy.yyy:5000 → zzz.zzz.zzz.zzz:5000 (TCP/UDP)

  • DVR1 - yyy.yyy.yyy.yyy:554 → zzz.zzz.zzz.zzz:554 (TCP/UDP)

  • DVR2 - yyy.yyy.yyy.yyy:8002 → zzz.zzz.zzz.zzy:80

  • DVR2 - yyy.yyy.yyy.yyy:5000 → zzz.zzz.zzz.zzy:5000 (TCP/UDP)

  • DVR2 - yyy.yyy.yyy.yyy:554 → zzz.zzz.zzz.zzy:554 (TCP/UDP)

  • DVR3 - yyy.yyy.yyy.yyy:8003 → zzz.zzz.zzz.zzx:80

  • DVR3 - yyy.yyy.yyy.yyy:5000 → zzz.zzz.zzz.zzx:5000 (TCP/UDP)

  • DVR3 - yyy.yyy.yyy.yyy:554 → zzz.zzz.zzz.zzx:554 (TCP/UDP)

and so on…

I was able to see a video from first DVR, but when I tried to find out, which port is responsible for video, suddenly it stopped working. The only thing I’ve done was to disable forwarding port 5000. When I’ve enabled it again, video didn’t show. ‘Connections’ tab shows, that connection is set on port 554 (TCP), but also there are a lot of entries like :

  • last ack,
  • fin wait,
  • time wait,
  • syn sent,
  • established (that’s OK, but still no video)

All those connection status refers to port 554. I’ve checked from other PC, nothing. Cleared browser cache, nothing. Reboot router, nothing.

There must be NAT between those two networks.

What’s wrong then? Maybe I should change all ports for each DVR to unique, like this:

  • DVR1 - yyy.yyy.yyy.yyy:8001 → zzz.zzz.zzz.zzz:80

  • DVR1 - yyy.yyy.yyy.yyy:5000 → zzz.zzz.zzz.zzz:5000 (TCP/UDP)

  • DVR1 - yyy.yyy.yyy.yyy:554 → zzz.zzz.zzz.zzz:554 (TCP/UDP)

  • DVR2 - yyy.yyy.yyy.yyy:8002 → zzz.zzz.zzz.zzy:80

  • DVR2 - yyy.yyy.yyy.yyy:5001 → zzz.zzz.zzz.zzy:5000 (TCP/UDP)

  • DVR2 - yyy.yyy.yyy.yyy:555 → zzz.zzz.zzz.zzy:554 (TCP/UDP)

  • DVR3 - yyy.yyy.yyy.yyy:8003 → zzz.zzz.zzz.zzx:80

  • DVR3 - yyy.yyy.yyy.yyy:5002 → zzz.zzz.zzz.zzx:5000 (TCP/UDP)

  • DVR3 - yyy.yyy.yyy.yyy:556 → zzz.zzz.zzz.zzx:554 (TCP/UDP)

P.S. Maybe administrator could move my thread to proper place. Sorry for that :wink:

Is there a reason why you don’t want to forward 5000? Bear in mind that not every protocol will “just work” if you change the ports with a port forward.

HI Lucas83 you are solved your port forwarding problem ?

Maybe can i help you.?