Accessing RTSP over VPN

[PatrickTMC]

I've got a remote site that is connected to the main site via a site-to-site VPN. I can access the camera at 10.3.1.60 from my local subnet 10.2.1.0/24 and can view the RTSP feed in our old NVR (on the same subnet as the new Acti ENR-130), but the camera does not connect when I add it to the Acti? Is there a firewall on the ENR-130 or something else that would prevent it from being accessible? No VLANs on either the local (10.2.1.1) or remote (10.3.1.1) sites.

Thanks!

 

[Phil]

Is the root problem that you cannot get the ACTi ENR-130 NVR to accept the camera?
Is it an ACTi camera?
The camera make and model please?
If it's a third-party brand, then ONVIF etc. will add a degree of complexity ...

 

[David]

@PatrickTMC to help us understand better please post a photo of a hand drawn basic network diagram

are the routers setting up the VPN connection?
Is RTSP enabled on the NVR

 

[PatrickTMC]

The router at each location sets up the VPN and everything on the 10.2.1.1 subnet is able to access everything on the 10.3.1.1 subnet and vice versa.

RTSP is enabled - I've got several RTSP feeds connected to the NVR on the 10.2.1.1 subnet, it's just the sources on the 10.3.1.1 subnet that are not connecting.

 

[PatrickTMC]

The cameras are Reolink cameras - I've got 3 of the same make/model camera in use already - they are all just on the 10.2.1.1 (local) subnet. It's just the remote camera that I'm unable to connect to from the ENR-130. I am able to connect to the RTSP feed in an alternate DVR.

ENR-130 (10.2.1.240) - Router (10.2.1.1) - VPN - Router (10.3.1.1) - Reolink Camera (10.3.1.60)
I can access the RTSP feed at 10.3.1.60 from the old DVR at 10.2.1.41 without issue so it makes me believe the network isn't the issue.

 

[David]

hopefully I've got this right..
if the ENR-130 and reolink camera have ping utilities try....

from ENR-130 (main) ping 10.3.1.60
from reolink cam 10.3.1.60 (remote) ping 10.2.1.240

from the main site (10.2.1.1) can you http into reolink cam 10.3.1.60?

check all logs (routers / camera / ENR-130) for any connectivity / protocol errors.

 

[PatrickTMC]

I am unable to ping the NVR (10.2.1.240) from the 10.3.1.1 subnet or access the NVR web console. I am able to ping any other device on the 10.2.1.1 subnet from the same device on the remote (10.3.1.1) subnet. I see the traffic pass on both the 10.3.1.1 firewall and the 10.2.1.1 firewall but am getting no response for either ping or HTTP traffic. I am able to ping the camera (10.3.1.60) from the local (10.2.1.1) subnet and access the camera web console.

 

[David]

I am unable to ping the NVR (10.2.1.240) from the 10.3.1.1 subnet or access the NVR web console. I am able to ping any other device on the 10.2.1.1 subnet from the same device on the remote (10.3.1.1) subnet. I see the traffic pass on both the 10.3.1.1 firewall and the 10.2.1.1 firewall but am getting no response for either ping or HTTP traffic. I am able to ping the camera (10.3.1.60) from the local (10.2.1.1) subnet and access the camera web console.

Disable both router firewalls, vpn may go down but should come back.

 

[David]

@PatrickTMC did camera 10.3.1.60 work when connected to the old DVR 10.2.1.41?

 

[PatrickTMC]

Correct. I add the RTSP feeds back to the old DVR and stream video without issue and I can view the RTSP feeds in VLC from workstations on the 10.2.1.1 subnet. Basically the only device unable to communicate with the camera at 10.3.1.60 is the ENR-130 at 10.2.1.240 and there are no firewall rules blocking any traffic to/from the device. Everything seems to point to the ENR not being able to connect to devices on another subnet, but I'm not able to find any firewall settings on the device to explain it.

 

[PatrickTMC]

So this is working now and I'm not exactly sure why - What I did was connect the second NIC and assign it a static IP of 10.2.1.251 - I watched the FW and where I was seeing no traffic coming from NIC1 when I was trying to add the camera and failing, I saw the expected traffic coming over NIC2 when I tried to add the camera again and the camera is now displaying properly. I don't know the reason why it wasn't making the connection from NIC 1 - the traffic wasn't blocked at the firewall, it just wasn't there. But now we are good - Thank you so much for your help.

 

[David]

Correct. I add the RTSP feeds back to the old DVR and stream video without issue and I can view the RTSP feeds in VLC from workstations on the 10.2.1.1 subnet. Basically the only device unable to communicate with the camera at 10.3.1.60 is the ENR-130 at 10.2.1.240 and there are no firewall rules blocking any traffic to/from the device. Everything seems to point to the ENR not being able to connect to devices on another subnet, but I'm not able to find any firewall settings on the device to explain it.

it looks as though the ENR is the problem, are the ENR protocol port numbers correct?

did you find a ping utility on the ENR or Camera 10.3.1.60 and try to ping each device from the camera / ENR? I want to see if there is a route for ICMP traffic across the VPN link.

 

[David]

So this is working now and I'm not exactly sure why - What I did was connect the second NIC and assign it a static IP of 10.2.1.251 - I watched the FW and where I was seeing no traffic coming from NIC1 when I was trying to add the camera and failing, I saw the expected traffic coming over NIC2 when I tried to add the camera again and the camera is now displaying properly. I don't know the reason why it wasn't making the connection from NIC 1 - the traffic wasn't blocked at the firewall, it just wasn't there. But now we are good - Thank you so much for your help.

maybe a strange routing problem, good to hear its working.