Is it possible to isolate the NVR(s) behind a second router? Can it work and is there any potential issues doing this? I'm just trying to make it harder for someone to find and hack the NVRs
Isolate NVRs behind a second router?
- Thread starter JPmedia
- Start date
I tried this once too. It doesn't work
The problem is the 2nd router gives unfettered access to main router.
Let me see if I can find the post that pointed it out.
The problem is the 2nd router gives unfettered access to main router.
Let me see if I can find the post that pointed it out.
So, the NVR accesses the first router through the second router then? How about traffic coming the other way like from the outside? Someone on the outside would have to get through the first router to be able to attempt to access the second router in line, yes? By the way, there would be no Wi-Fi accessibility on the second router, only hard-wired ethernet cables.
if you're isolating it behind a 2nd, but then opening it (and the first) to the internet via port forwarding, then you're not protecting anything at all.
The only way it might work was if you had a VPN to the 1st router and that coudl access the NVR via the 2nd....but then why not just have an vpn endpoint on the 2nd router in the first place.
I really dont see any benefit at all. You'd be better to vlan it off and/or only ever allow access via a vpn
The only way it might work was if you had a VPN to the 1st router and that coudl access the NVR via the 2nd....but then why not just have an vpn endpoint on the 2nd router in the first place.
I really dont see any benefit at all. You'd be better to vlan it off and/or only ever allow access via a vpn
It can be done, but gets rather messy, use a single router with even basic VLAN and firewall capabilities - it will be much cleaner and probably more secure.
I have NO idea how to set up a VLAN for the NVR(s). I'm not even sure if I have the proper equipment to do so. My goal is to help prevent the NVR(s) from being hacked by outside sources.
I have a feeling that I have an account on my old NVR which just bypasses the main admin account. I can't remove it and it seems someone has unrestricted access to the NVR. Before I go and set up a new NVR, I want to try and protect it from someone repeating the same move.
It's quite frustrating to say the least
"My goal is to help prevent the NVR(s) from being hacked by outside sources."
how are you providing access to your NVR? port forwarding? And then exposing NVR to login? regardless if you go dual router, or every put it behind cloudflare tunnels, the biggest weakness is letting the NVR authenticate someone.
Remove the public exposure for the NVR and use a vpn, a vpn via tailscale or cloudflare access where there is a more secure authentication is "safer".
how are you providing access to your NVR? port forwarding? And then exposing NVR to login? regardless if you go dual router, or every put it behind cloudflare tunnels, the biggest weakness is letting the NVR authenticate someone.
Remove the public exposure for the NVR and use a vpn, a vpn via tailscale or cloudflare access where there is a more secure authentication is "safer".
Many routers allow a port (or maybe the last port) to be VLAN with a simple radio button in the GUI. But that only prevents it from hacking i to your other devices.
But yes hosting your own VPN is what most feel is the best way to isolate your NVR as close to an air gap as possible.
But yes hosting your own VPN is what most feel is the best way to isolate your NVR as close to an air gap as possible.
bigredfish
Known around here
These are great imho
I have the Purple, it’s out of stock right now due to memory supply issues
The Orange is about the same.
Small learning curve but very versatile. Comes with 2 VPN choices and easy to set up VLANs
I have the Purple, it’s out of stock right now due to memory supply issues
The Orange is about the same.
Small learning curve but very versatile. Comes with 2 VPN choices and easy to set up VLANs
Ok, I'm curious. Since this item isn't cheap and to justify the expense, in a nutshell, how does it help prevent an outsider from accessing the device. And would there be any issues with receiving notifications to my phone from the NVR? (I seem to remember reading something about getting notifications from the NVR with a VPN somewhere here at some point)
bigredfish
Known around here
It’s a robust firewall appliance with many features and IPS.
It enables you to use a VPN as well as many VLAN options.
I have no problem getting notifications, but depending on how you configure your network it could, like ANY network, interfere with your notifications.
It may be too pricey and/or too complicated for some
It enables you to use a VPN as well as many VLAN options.
I have no problem getting notifications, but depending on how you configure your network it could, like ANY network, interfere with your notifications.
It may be too pricey and/or too complicated for some
Last edited:
I guess I have some reading up to do. Would it be worth purchasing one used? I've seen them used for as low as $175
bigredfish
Known around here
I dont know why not, no moving parts
I'm certainly not an expert on them nor in network security.
But its a good value for a firewall appliance according to many smarter folks
Last edited:
Did just a quick look on the setup of the firewall. I currently have an ATT modem with router in pass-through mode to my Asus router and then one of the LAN ports from the Asus router to a 16-port network switch and, all but one TV and our phones, connected through ethernet cables to the 16-port network switch.
Just thinking out loud, but it seems the best place to install the Firewalla, would be between the Asus router and the 16-port switch, yes? This way it could monitor the Wi-Fi connections from the Asus router as well outside traffic from the internet. Am I correct in that assumption?
Just thinking out loud, but it seems the best place to install the Firewalla, would be between the Asus router and the 16-port switch, yes? This way it could monitor the Wi-Fi connections from the Asus router as well outside traffic from the internet. Am I correct in that assumption?
Okay, I don't know the backstory or exactly which NVR model is involved, but determining whether someone is actually accessing your NVR from the outside is actually quite easy. You could check the NVR's log, the router's log, or - if necessary - capture the WAN traffic using a tool like Wireshark.
And before you spend money on a firewall solution, you should probably educate yourself a bit more on the subject. Learn about how and why devices can be segmented into different areas using VLANs, and what the potential implications might be. Also, understand exactly what a firewall can and cannot do. Also, for example, what double NAT is and what it entails.
Put it this way: I personally would never consider buying a firewall solution just because I suspected an unknown admin account might exist on an NVR - an account that could potentially be accessed from the outside.
In other words, I would rather address the root cause than try to buy or set something up just so I can keep living with it. 
Oh, and by the way, firewall solutions aren't just available as off-the-shelf hardware; you can also build your own using a tiny or mini PC and software like OPNsense (or something similar).
bigredfish
Known around here
Okay, I don't know the backstory or exactly which NVR model is involved, but determining whether someone is actually accessing your NVR from the outside is actually quite easy. You could check the NVR's log, the router's log, or - if necessary - capture the WAN traffic using a tool like Wireshark.
And before you spend money on a firewall solution, you should probably educate yourself a bit more on the subject. Learn about how and why devices can be segmented into different areas using VLANs, and what the potential implications might be. Also, understand exactly what a firewall can and cannot do. Also, for example, what double NAT is and what it entails.
Put it this way: I personally would never consider buying a firewall solution just because I suspected an unknown admin account might exist on an NVR - an account that could potentially be accessed from the outside.
Oh, and by the way, firewall solutions aren't just available as off-the-shelf hardware; you can also build your own using a tiny or mini PC and software like OPNsense (or something similar).
Of course.
I didnt say or imply adding the firewall appliance would magically fix the existing issue, IF there is one.
But adding a firewall appliance after doing so isnt exactly a bad idea
And I could build my own car but I'm lazy and prefer someone more knowledgeable to do it for me
It isn't, but I get the impression that @JPmedia is oversimplifying things and currently lacks sufficient knowledge of the subject. In my view, buying a firewall solution just because of a supposedly unknown admin account on an NVR is "nonsense". And yes, I realize the whole issue arose because @JPmedia originally "introduced" (brought something up) a second router without VLAN support - thereby creating a double-NAT scenario.
bigredfish
Known around here
Yes, buying a firewall just because of an unverified compromise on an NVR is overkill.
It was suggested as a way to easily create a VLAN addressing a question, with the added benefits it naturally comes with. I also happen to be familiar with its ease of use for non-technical types.
It has the power to do what one might with "X"sense but the user isn't required to go off the deep end to understand writing rules etc.
It was suggested as a way to easily create a VLAN addressing a question, with the added benefits it naturally comes with. I also happen to be familiar with its ease of use for non-technical types.
It has the power to do what one might with "X"sense but the user isn't required to go off the deep end to understand writing rules etc.
Mike A.
Known around here
- May 6, 2017
- 4,210
- 7,097
You should be able to block any direct Internet/outside access to the NVR at the Asus router. Which would be a more simple way to "firewall" it vs installing a whole other device. But I don't know what outside access you may need to it.
Actually, it should already be blocked from the outside unless you've opened it in some way.