3

We have a building with n cameras connected to a Digital Video Recorder that has been attacked, this DVR provides a web server in port 90 that can be accessed from the internet. All the system were recovered by using backups, DVR Firmware could not be updated since manufacturer deprecated it in 2014. How is it possible to add an extra layer of protection to this stack without loosing the connectivity to the web server from the internet?.

2 Answers 2

4

Assuming that the connections are HTTP based, set up a web server (e.g. nginx / Apache) as a reverse proxy in front of the DVR, and require inbound connections to that web server to be authenticated over HTTPS with a client certificate. This way the DVR is never directly routed to the internet.

If you require access to other protocols, e.g. RTSP for video, I'd suggest creating an isolated network that contains the DVR and cameras, then setting up a VPN endpoint so that you can remotely access the DVR environment.

11
  • Regarding the second idea, setting up a VPN won't allow me to use the HTTP application from internet, right? thanks for your answer. Dec 14, 2017 at 16:16
  • @AlejandroMorán You'd VPN into the network and then access the HTTP application through a browser like you normally would.
    – Polynomial
    Dec 14, 2017 at 17:29
  • 3
    And seriously consider updating off a platform that is now 4 years out of support. This answer is a good idea, which I've upvoted, but you're really putting a bandage on a larger problem and just enabling it to limp along longer. Dec 14, 2017 at 18:16
  • VPN could also be replaced with SSH port forwarding. A bit more of a lightweight setup if you already have Linux machines. Dec 14, 2017 at 19:17
  • @korockinout13 SSH forwarding is more ad-hoc, though, and makes things more awkward if you're trying to connect from a mobile platform.
    – Polynomial
    Dec 14, 2017 at 19:55
3

You can always set up a VPN server on your local network so that any user who wants to watch the video , has to be connected and authenticated. This way you will be able to access the camera as if you were on the LAN.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .