How to view off site cameras via a browser

[Ralph_Boone]

First off I’m a networking newbe and new to the Fortigate product. So thanks in advance for your experience and help. What I need to do is view remote security cameras by using a web browser at a site that will be connected via a cable modem. I want to allow just a single IP address to come in from the Internet and view individually addressed cameras (192.168.1.1-20). I was thinking about using port addressing. Like camera 1 (192.168.1.1) = port 9001, camera 2 (192.168.1.2) = port 9002 etc. I have a Fortigate-20C. Your help in this config is surely appreciated. Also I’m open to any and all suggestions on how to do this as long as I can restrict access from the internet to a single IP address. Thanks again

[ede_pfau]

Hi, and welcome to the forums. What you are planning can be done with the help of Virtual IPs. For each camera, create one VIP as follows: go to Firewall>Virtual IP>Virtual IP Create New name: camera01 External interface: WAN (whatever it' s called with your FGT) Type: Static NAT External IP: <your public IP address, e.g. 10.10.10.1) Mapped IP: 192.168.90.1 (for example) Port Forwarding: enable Protocol: TCP External Service Port: 9001 Map to Port: 80 (for HTTP) or 443 (for HTTPS) Create all VIPs you need, one for each camera. You cannot use an external port number twice. All other parameters can be used multiple times (e.g. the one public IP address). Now, create a VIP Group (just below in the GUI). This will make your life easier. Then, use the VIP group in a policy: Firewall>Policy>Policy Create New WAN -> internal source addr: all dest addr: <the VIP group> service: HTTP or HTTPS schedule: you might restrict access by time of day, ' always' otherwise action: ACCEPT NAT: no Now try to reach a camera via browser. Note that you cannot ping it. For security I would strongly recommend you put a login page on the access policy. In Fortigates it' s called ' Identity Based Policy' . This way, you authenticate in the browser prior to accessing any camera (but only for the first camera). Cookbook is OK, get the FortiOS Handbook as well if you haven' t already. If you need more hints, you' re welcome.

[rwpatterson]

Additionally, if you use dynamic IP addressing, you could use 0.0.0.0 as the external IP. It' s the wildcard in VIP-land.

[Ralph_Boone]

Thank you both for your help. Is this a case where I' d want to use " Transparent" mode?

[rwpatterson]

Transparent mode is if you have a current border device and you wish to place the FGT inline to use it' s filtering capabilities without reconfiguring your network. If you want to place the FGT at the end and terminate Virtual IPs, you need to have it in route/NAT mode.

[Ralph_Boone]

Thanks Ede & Bob. Ede is the diagram I inserted correct for what you wrote? In policy would my source addr be 172.13.145.23 to restrict access just to that one address?

[ede_pfau]

Nice post, if only more people would take the effort to do that...life would be too easy then. What I see from the diagram is that the cable modem is a router - it' s got 2 interfaces in different subnets. So NAT with port forwarding must be done at the modem' s WAN port. After that, you can only deal with private IP addresses (192.168.x.x) which you can' t address from the internet. So, in short, the FGT must be your edge device in order to work with VIPs. What you could do (and what I do often with a modem setup) is that you switch the cable modem into ' bridging mode' and let the FGT be the gateway. I don' t know the details of the cable interface but I guess you configure the FGT' s WAN interface for DHCP or PPPoE, provide the credentials and let it connect through the modem. Then you can use the VIPs like posted above. In the incoming policy WAN->internal, you specify your unique remote IP address (172.x.x.x) as source address to narrow down access. From a security point of view, Identity based policy would be much better. And it ain' t complicated at all. So maybe someone else from the U.S. can give you more advice how to let the FGT handle the handshake with your cable provider. Access to the modem' s configuration is required in any case, either for switching it into bridging mode or for port NAT, so that' s crucial.

[Ralph_Boone]

Thanks again Ede, I have it working. I could not get the cable modem in a bridging mode. So I ended up doing a double port forward. Modem ->FGT ->Cameras

[ede_pfau]

you' re welcome, I' m glad it' s working now. Many roads lead to Rome...