0

I have ip cam in my router network. Is it possible to secure it's stream using some openwrt package? I can secure router ui by https with uhttpd package, but as far as I understand it will work with router lua ui. I have certificate on router which used for it's ui, and I have plans to reuse it for ip cam stream. Ip cam itself has certificate and I am able to access https stream by port forward, but I have idea to do it using router. May be it's possible to convert cam http stream (inside lan) to https?

UPDATE

I used nginx on my router. Below is change in nginx config I made to achieve my goals:

server {
    listen 4000 ssl default_server;
    listen [::]:4000 ssl default_server;
    server_name  localhost;

    ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
    ssl_prefer_server_ciphers on;
    ssl_ciphers "EECDH+ECDSA+AESGCM:EECDH+aRSA+AESGCM:EECDH+ECDSA+SHA384:EECDH+ECDSA+SHA256:EECDH+aRSA+SHA384:EECDH+aRSA+SHA256:EECDH:DHE+AESGCM:DHE:!RSA!aNULL:!eNULL:!LOW:!RC4:!3DES:!MD5:!EXP:!PSK:!SRP:!DSS:!CAMELLIA:!SEED";
    ssl_session_tickets off;

    ssl_certificate /etc/nginx/mycert.crt;
    ssl_certificate_key /etc/nginx/mycert.key;

location / {
    proxy_set_header Host $host;
    proxy_set_header X-Real-IP $remote_addr;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header X-Forwarded-Proto $scheme;
    proxy_pass http://192.168.1.111;
    proxy_read_timeout 90;
}

Now when I access https://myrouterIp:4000 request passed to http://192.168.1.111 which is ip of my ip cam in lan

6
  • 2
    Sure it's possible, external HTTPS termination is a regular part of deployed internet applications today. Most reverse proxies can do it. The question is: Does your router have the required resources?
    – Daniel B
    Commented Jan 20, 2022 at 16:02
  • Why would you not just use the https stream from the camera directly?
    – davidgo
    Commented Jan 20, 2022 at 16:08
  • 2
    @davidgo, I think the concern is that the name on the camera cert won't match the routers public dns name, so the port forwarding will make browser mad about it (or the camera cert may be self-signed). I think he wants to use the existing cert on the routers front-end to secure the transaction rather than let the camera's cert do it. It does sound like a reverse proxy would be indicated. Commented Jan 20, 2022 at 16:25
  • @FrankThomas exactly Commented Jan 20, 2022 at 16:54
  • @DanielB thanks for idea Commented Jan 20, 2022 at 16:55

0

You must log in to answer this question.

Browse other questions tagged .