It’s not directly listed in IP>Firewall>Service Ports under 7.2rc3.
But have you tried using the “sip” ALG there with your RTSP port listed? ALG really deals with SDP, so the “sip” ALG may not care it’s actually RTSP. Hard to know, but might be possible.
Alternatively, Mikrotik does support UPnP which some/most cameras support, that combined with scripts/firewall rules might also work to deal with multiple subnets of cameras. In UPnP, you can control the “internal”/“external” interface – and nothing says the “external” UPnP interface has to be a WAN.
We definitely need this to be implemented in RouterOS v7. The lack of this feature is negatively affecting to all MikroTik users in Spain, under the major ISP provider in this country, Movistar. This ISP uses this helper for mapping UDP ports for IPTV on demand traffic. Flow starts with a tcp packet to 554 that can identify in mangle and mark accordingly, but all we can do later is to DMZ all traffic to the source IP opening this communication, due to the lack of this helper, with the help of a script.
But, if you have more than one tv box (very common), you need script constantly running for doing this tricky NAT mapping, alternating between destination IPs. With the helper, the random negotiated ports for UDP RTSP traffic will be automatically mapped to the source IP opening this connection, but, as we don’t know these port range in advance, we cannot use, as far as I could understand from the last comment, the SIP ALG.
Correct me if I’m wrong, we may be totally wrong and missing some magic hidden feature, but after squeezing my brain a lot, I can’t figure out how to workaround the lack of this very basic feature you can find, in other hand, in cheap crappy routers, but not in MikroTik. My only guess is this is already implemented in a way we don’t understand, and we are just stupid not finding it out. Or it is just a totally forgotten feature, because nobody else uses.
Guys from MikroTik, please take this request seriously. You have a very nice community of users loving your products in Spain. But the lack of this feature is a very annoying thing we have been suffering from quite a long time already. So please, if it is in your hands, do implement it, for Gods shake. And, if it is already implemented in a weird obscure manner, please let us know, we will be glad to keep learning.
Nope, it SIP ALG needs at least some SIP BEFORE fixing the SDP fields (which is used by BOTH SIP and RTSP) – so overloading the SIP ALG is NOT a workaround here.
I don’t deal with cameras that often, but avoid ever needing ALG for anything… But get that not always possible.
What I do know is OpenWRT does support an ALG for RTSP. Seems it’s a kernel patch that’s likely missing in the kernel that RouterOS uses: https://openwrt.org/packages/pkgdata/kmod-ipt-nathelper-rtsp But obviously a missing kernel patch isn’t fixable by an MT admin.
I hope they will include this soon, now that v7 brings a new kernel and, as you mention, it is already supported at kernel level, such as in OpenWRT. All spaniard colleagues will be very happy if this ever happen.
Not that its likely or a solution but it moviestar doing something non-standard, why is this only Spain?
How should they provide their service? Perhaps that is also another angle to tackle?
In other words, I can see this as more likely if its a global phenomena…
Is not just about Movistar using RTSP for their VOD solution (by the way, about 3,8 million customers only in Spain.. if only tiny percent currently uses or think on using Mikrotik for their setups… these are LOTS of routers). Many CCTV camera system also uses the same protocol and will highly benefit from having this kind of helper implemented in our routers. What I can’t really guess to understand is how this helper is implemented in many crappy routers that I will never buy, but not yet in Mikrotik.
Hope they finally pay attention to this, think they don’t really imagine how many potential customers they could have in Spain if this is properly implemented.
That’s exactly what I mean. How can we actually increase that number? What is the correct way of requesting this feature, using the appropriated channel? I can spread out this if correct instructions are given, so many people can actually come and request it.
Will still be valid if we keep a single post like this top high in comments? I mean, for not having too many replicas flowing throughout the forum, asking for the same.
OK; let’s try first by inviting people to comment on this topic, and if it doesn’t have the expected result, give them the ability of opening their own support tickets.