I am being recommended to setup a VPN on the router that will connect a DVR to the internet so that I can monitor it remotely. The idea is that by doing this VPN setup it would be harder for an unauthorized party to gain access to the DVR. However I couldn't find any explanation as to why - what does a VPN router do to protect the DVR?
As SmokeDispenser already explained, most consumer-grade and enterprise routers and firewalls have such default settings (UPNP disabled, no port on the Internet interface forwarded to a LAN IP address, etc) that will not allow devices connected on the LAN side to be accessed from the Internet side.
So, which options do you have when you need to access a device on the LAN from the Internet side? As you already know...
- You could make static NAT configurations in the router or firewall in order to forward all needed ports on the Internet interface towards ports needed in the LAN device you need to connect to
- You could configure a VPN on the router or firewall that connects to the Internet so that when you connect to the VPN you can access the resources connected in the LAN side.
Option 1 is more straightforward and can be easily accomplished even with the most simple home routers. But it also has several disadvantages:
- You have to know in advance which ports are required by the application you are trying to use when connecting to the LAN device and then forward all of them. For instance, working with DVRs I have found a few models that need port TCP/80 (HTTP) and TCP/554 (RTSP) forwarded to be able to login and watch the composite of cameras connected to the DVR.
- All forwarded ports will be accesible from Internet and therefore exposed to port scaners, vulnerability scanners, exploitation attempts etc. That means all forwarded ports will be part of the attack surface an attacker could use. In worst cases, I have seen scenarios where all ports in the Internet interface have been forwarded to a given device in the LAN, exposing to Internet not only the minimum required ports to work but also the management interfaces and unexpected services.
- There are limitations if you need to access the same port on two different LAN devices. Lets say your LAN hosts two devices A and B needing port TCP/80. If your forward port TCP/80 on the Internet side to device A then you can not get TCP/80 on the Internet side forwarded to device B and you will need a different port, lets say TCP/81, forwarded to TCP/80 of device B. This can sometimes complicate the setup.
- By using NAT, any security for the traffic will have to be provided by the application. If this is not the case, any intermediate element between client and the server would be able to eavesdrop on the traffic. Let´s say the DVR has only HTTP login interface but not HTTPS. Login credential will be carried unencrypted through the Internet and event the video streams will be carried unencrytped if the application does not care itself about the encryption.
Option 2 is usually harder as it requires understanding of most advanced networking concepts, some cryptography background and even may require specific hardware. That´s why its usually not as common as NAT in home or small business environments. But it has several advantages from the security point of view:
- If the VPN is set up in the router or firewall connecting to internet there is no need to forward ports and any application on the LAN side will be accesible as soon as you connect to the VPN, even using the same port on different LAN devices (which was problematic to accomplish with NAT) If the VPN is set up in a DMZ or LAN device, you only need to forward the ports needed to establish the VPN. For instance, OpenVPN would only need UDP/1194 and IPsec would only need UDP/500 and UDP/4500. This way, forwarding only one or two ports you can establish the VPN and then access any application on the LAN side. This would usually need much more ports to be forwarded if using NAT. So you can see that attack surface is smaller when using VPN
- The software running the VPN is usually designed with security in mind, so even if exposed to its own vulnerabilities, in average the number of vulnerabilities in this software will be lower than in general purpose software such as a web or e-mail server.
- Since VPNs leverage cryptography, traffic between the VPN client on the internet and the router/firewall will be encrypted even if the application traffic is not encrypted by the application itself (i.e.HTTP). You can not obtain this additional protection at all using NAT.
- VPN do require authentication in order to connect to it. This allows tracking connections of legitimate users and also prevents unauthorized users from even reaching the any port on the LAN side. Again, this can not be accomplished by using NAT: if you forward port TCP/80 anyone can connect to it, what allows credential bruteforcing attempts, exploitation attempts, etc.
Taking into account this comparison of NAT vs VPN, I would always recommend using VPN whenever LAN resources need to be accessed from the Internet only by authorized users.
Your question is rather broad, as it does not explain your setup sufficiently.
Usually, COTS-Routers offer Internet access to devices by means of network address translation, as Mark mentioned in the comments. If ports are not directly forwarded and upnp is disabled, your device should be well enough protected against run of the mill IoT-botnet-making exploits.
If however you do have remote access to the DVR set up (for example for remote scheduling of recordings), this usually means at least one port has been open and your DVR is at risk.
In this scenario the way to go is to only offer that service within your local network, not on the internet, and connect remotely to your local network via a VPN connection.
VPNs are often recommended as a mean for access control in this manner rather than encryption of the actual media streams - which are not a usual attack vector and neither a simple one.
General rule of thumb is: consumer routers do not need to have open ports to the internet; if you need access to your local network remotely (for example for webcams or DVR scheduling), the only available port should be a VPN service.
the video stream will be encrypted so will be difficult for hackers to remote access your DVR or to watch the feed