How do I secure the network of an outside the house IP-camera

Question

I have 3 IP-Camera's outside my house, they are all connected via network(RJ45) to my 8 port POE switch (D-LINK XXXX). The POE switch is connected to a 18 port switch (D-LINK XXXX), and finally that is connected to my router (UNIFI Security Gateway).

The camera's are used by a Synology NAS on my local network, to record the video to the NAS.

The Camera's are mounted with screws, and can be taken down. Anyone could take the network cable and plug it into a laptop, and access local network and/or use my internet.

Is there any way I can make the camera network isolated and still let my Synology NAS connect to them?

Answer 1

I think the main problem is likely to be the piggy-backed switches. Without managed switches, you will not likely be able to create a segregated virtual network (a VLAN) without including other devices connected to the large switch.

What you should try to achieve is to send all of the insecure devices to a single port on your router and define a VLAN against that port. I'm not familiar with your router so I don't know if it supports VLAN's.

An alternative would be to get a 2nd, cheap, router and connect them to that. Then apply firewall rules to restrict access by PORT. Basically treating the camera's as untrusted, external devices.

Answer 2

Setting up a VLAN, as described by Julian Knight, is part of the solution.

You might also however add some extra precaution with your firewall.

1. Set up the firewall so that only a MAC address of your cameras can connect from the given position.

This command is OS-specific. If you were to run Linux on your gateway, for instance, it would be

  while read MAC; do
       iptables -A INPUT -i eth0.1 -m mac --mac-source $MAC -j ACCEPT
  done < mac-list-file
  iptables -A INPUT -i eth0.1 -j DROP

where eth0.1 is the VLAN's interface and mac-list-file is a text file including the MAC addresses of your cameras, one per line. The above shell script code snippet will allow input from the legitimate cameras, while dropping everything else.

2. Prevent the cameras from reaching WAN and the rest of the LAN. This too is OS-specific, and one again the Linux solution is:

   iptables -A INPUT -i eth0.1 -o eth0 -j DROP
   iptables -A INPUT -i eth0.1 -o eth1 -j DROP
   

where I assumed that your gateway only has two more interfaces, eth0 toward the LAN and eth1 toward the WAN. If you have more interfaces, add them accordingly.

Though I am unable to specify these rules for your gateway, I hope this will at least give you further ideas on how to secure your apparatus.

Answer 3

I do not know the products you are using but you must understand which way the traffic goes (specifically : where it is initiated from).

• if your Synology connects to your IP camera and gets some data from it then you will be able, with the VLAN and firewalling mentioned in other answers to completely segregate the vulnerable network. In other words, someone who connects to your cable outside will see nothing. No traffic can be initialized from this network so he cannot go and poke around. There will still be one possibility of attack : he can act as the camera and send to the Synology box whatever, including possibly malicious traffic (exploiting some possible vulnerabilities). This said, this is a much weaker position to have for the attacker.
• if it is the camera which initiates the traffic then you must limit it to the Synology box and make sure that it is up to date (unfortunately these devices may horribly lag behind with some fixes).

If you do not know which party initializes the traffic, you can plug in everything to a cheap hub and watch the traffic with Wireshark. You can also check if you do not have a "port mirroring" option on your switch.