0

I am not that good at network problems, so I apologize in advance if I am unable to explain the question well enough. I started working at the company which deals with IP cameras and security systems. They have this network installed and they're fine with it, but I'd like to help them make it better and I have two questions.

This is the general sketch of the network:

enter image description here

I made up the IP addresses and stuff. They have two connections to the Internet, cable and ADSL. Each router has its DHCP server turned on, and they give the IP addresses corresponding to the subnets 192.168.200.1-254 (cable) and 192.168.1.1-254 (ADSL).

On the cable router, we usually set-up port forwarding so we can access to the IP cam from the outside. We setup the DynDNS to point towards our dynamic IP address and we choose a port and forward it to the static private IP address of the IP camera.

They have the ADSL connection as well, because you can't access to the IP camera if you're on the same network with it, i.e. you need to access it from the outside, and I tried to illustrate this situation in the image below:

enter image description here

So, we need ADSL to be physically on a different network when we access our IP cameras, and then port forwarding works.

My first question is, why does it not work in the first case? When I am on the same network? The way I see it, I type the address myfirm.dyndns.com:445 in my browser, DynDNS translates it and I get the address 82.13.45.96:445 and I try to establish the connection with it aaaand... port forwarding doesn't happen? Why?

The second question is about NAS. I'd like to access NAS when I am on the ADSL connection as well. Right now I can't, since the NAS is in the 192.168.200 subdomain with its static IP address (there is an error in the picture showing the NAS belongs to the other domain, I made a mistake while drawing it). Is there a way to make this possible?

8
  • Your questions makes no sense, how can they have ADSL and Cable coming from 1 "source of internet"??? those are 2 different services. Are you saying they paying for 2 different service which makes up the "internet" as a whole. if thats the case, WHY. Feb 9, 2014 at 19:06
  • 192...are LAN IPS, you refer to them as ISP Services. It scares me that, you're attempting to FIX their network setup and have very limited knowledge on networking period, i'd suggest hiring a networking tech instead. Feb 9, 2014 at 19:07
  • I am sorry if you had that impression. It was just one bubble to designate the Internet in general, of course it's not the same source. One is ADSL, the other one is cable, they're connections to the internet, hence one bubble. I don't understand your second remark, what are you talking about?
    – Lyn
    Feb 9, 2014 at 19:09
  • Why on earth are they paying for 2 separate services that's creating 2 LAN addresses. Separate routers: on 2 separate ISP, thats your first problem right there, eliminate the ADSL, use 1 router from 1 source of "internet" and start from scratch. Feb 9, 2014 at 19:11
  • 1
    I am not that good at network problems + They have this network installed and they're fine with it, but I'd like to help them make it better - These two concepts cannot exist together. You can't help them make their network better if you don't understand networking. Are you one of those employees who comes into a company thinking it's their mission to find everything that's wrong and fix it? Is it your job to fix the network? If not, why are you attempting to do so?
    – joeqwerty
    Feb 10, 2014 at 0:12

2 Answers 2

2

My first question is, why does it not work in the first case? When I am on the same network? The way I see it, I type the address myfirm.dyndns.com:445 in my browser, DynDNS translates it and I get the address 82.13.45.96:445 and I try to establish the connection with it aaaand... port forwarding doesn't happen? Why?

Port forwarding does not rewrite the source, only the destination. That works if the source is outside the network because those packets go to the router already. But if the source is inside the network, then the router never gets the reply packets and cannot rewrite them.

Here's what happens:

  1. The local machine tries to make a connection to the public address.

  2. Since that address is not local, it sends the packets to its default gateway, the router.

  3. The router, since it's configured to port forward, rewrites the destination address and forwards the packet to the server.

  4. The server forms a reply to the packet, but it notices that the destination of that packet is local. So it sends the reply directly to the source machine.

  5. The source machine sees a response with a local IP address as the source and cannot match it to the origin request it sent, since that request had a non-local destination IP address. That is, because the router rewrote the request but cannot rewrite the reply, the replies no longer match the requests.

You need some form of dual NAT such as hairpin if you want this to work. Port forwarding cannot do it.

The second question is about NAS. I'd like to access NAS when I am on the ADSL connection as well. Right now I can't, since the NAS is in the 192.168.200 subdomain with its static IP address (there is an error in the picture showing the NAS belongs to the other domain, I made a mistake while drawing it). Is there a way to make this possible?

Statically assign the machine an IP address inside each subnet.

4
  • Thank you very much for your answer! It made things clearer for me, and I think I may have found the solution here Regarding your response to the second question, I'm not sure I understand; how can I assign two IP addresses to a NAS? Or did you think I should manually change the address everytime I switch to another network?
    – Lyn
    Feb 10, 2014 at 10:14
  • @Lajka Most NAS devices allow you to assign them as many IP addresses as you want. What NAS is this? Feb 10, 2014 at 10:16
  • IT's PLANET NAS-7201, I'm trying to find out now if there is something in its manual.
    – Lyn
    Feb 10, 2014 at 10:46
  • Dammit, I'm unable to find it in the manual. There is only an option for a single IP address/gateway/DNS server. Oh well...
    – Lyn
    Feb 10, 2014 at 11:22
2

I've read your question 3 times now, and looked at your diagrams multiple times.

You're setup is all wrong unfortunantly. You do NOT need a separate connections to access your IP camera.

So, we need ADSL to be physically on a different network when we access our IP cameras, and then port forwarding works. <- wrong.

You need to connect to the ip camera on LAN using the LAN ip, not the Physical IP the ISP Gives you when you are at work. This is the core mistake of your thinking.

I work in the same industry (security) and i've setup networks for the last 10 years, you don't need 2 internet connections.

Your diagram has 2 Internet sources connected to 1 switch, which makes no sense to me and i have no idea how anything you have setup is even working. But that doesn't actually matter to the correct setup.

This is how you set up your network.

Remove the ADSL, Keep the Cable modem, Everything runs through that. Since your IP Camera is already setup on that Device, and the ports are forwarded, when you are on the Same network, you use the IP camera's LAN IP to access it, when you are outside of work, you use the Physical IP (which portforwarded). you can not use the same Physical IP while on the same network to access that camera. You don't need to forward port when you're on the same network, Ports are used as a firewall to not allow access from the outside work into your network. It's silly to think you'd need to forward ports in the same building your working in.

If there is more than 1 IP camera, it would be

Camera 1: http-IP address:Port1

Camera 2: http-IP address:Port2

and so on.

All the rest of your questions correspond to the fact you have the 2 separate connection problem which would be solved if you use this setup instead.

Eliminating the 2nd connection will also save your boss's company money for not having to pay for 2 separate connections as well.

1 Internet Source, 1 Network, 1 Setup of Lan IPS, Will work and solve all your issues. Any network tech would of told you this is how you set up a proper network.

If you would of said something like, we need 2 separate connections because of bandwidth issues, i would of said call your cable ISP and upgrade your services to get faster internet, NOT to get a separate line.

1
  • Thanks for writing down your thoughts in this manner, I see better now where your previous comments were coming from. I should have written this in the question, since it's not obvious: the whole idea is to test if the URL given by the dynDNS provider works; of course I can access the cameras using their local IP addresses! :D But surely there was a time you wanted to test the URL to the camera to see if it works, and you didn't want to go through the hassle of logging onto a different network.
    – Lyn
    Feb 10, 2014 at 9:51

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .