bigredfish
Known around here
If you want to manually "factory default" all of your cameras and NVR before you start the above process, knock yourself out
Isolate NVRs behind a second router?
- Thread starter JPmedia
- Start date
If you want to manually "factory default" all of your cameras and NVR before you start the above process, knock yourself out
Yes, I am of course aware that the P2P security vulnerability that once existed in Dahua systems was patched in 2024; however, I generally don't trust clouds or cloud services, so I try to avoid them wherever possible. It makes no difference to me who provides the cloud or the cloud service. 
I use exactly one cloud service here (knowingly) - setting aside Google/Android - and that is the Nabu Casa cloud for Home Assistant. That is all I need; all my devices here - including my cameras and NVR - have no internet access and do not require a manufacturer's cloud.
Besides, I had also written:
Remind me again: why did you get that extra, additional firewall?
But anyway, I’ve provided @JPmedia with the relevant information, and how he chooses to implement it is up to him.
I use exactly one cloud service here (knowingly) - setting aside Google/Android - and that is the Nabu Casa cloud for Home Assistant. That is all I need; all my devices here - including my cameras and NVR - have no internet access and do not require a manufacturer's cloud.
Besides, I had also written:
Yes, but that doesn't automatically mean I can't - or shouldn't - try to achieve the highest possible level of security here, even though I'm connected to the Internet.
Remind me again: why did you get that extra, additional firewall?
But anyway, I’ve provided @JPmedia with the relevant information, and how he chooses to implement it is up to him.
bigredfish
Known around here
The only caveat I will add to this, is given that you cannot fully audit the implementations of both these systems (well Tailscale is partially open source, so technically.... Well anyway that would likely be in favour of Tailscale, and I don't know about you but I haven't the time for that), we cannot compare the two with absolute certainty.
So in this situation we may make a judgement based on, at least partially based on, the track record of the vendors.
As far as I know, Tailscale has a pretty decent history, no software or system is perfect, but it's reasonable. Dahuas P2P has a history riddled with vulnerabilities and patchy implementations.
This is why I never use Dahua P2P (or really any IP cams built-in P2P). I love using most of the Dahua cams, but P2P, no thanks.
Although I appreciate that I am in the field of networks etc and for many it might be a bit of a task to get all VPN etc setup...
I appreciate your input, but I'm not trying to set up an enterprise solution here. I'm just trying to set this up in an uncomplicated fashion and help keep what happened before from repeating. It realistically could have just been an issue with old firmware and hacked P2P servers, who knows for sure.Yes, I am of course aware that the P2P security vulnerability that once existed in Dahua systems was patched in 2024; however, I generally don't trust clouds or cloud services, so I try to avoid them wherever possible. It makes no difference to me who provides the cloud or the cloud service.
I use exactly one cloud service here (knowingly) - setting aside Google/Android - and that is the Nabu Casa cloud for Home Assistant. That is all I need; all my devices here - including my cameras and NVR - have no internet access and do not require a manufacturer's cloud.
Besides, I had also written:
Yes, but that doesn't automatically mean I can't - or shouldn't - try to achieve the highest possible level of security here, even though I'm connected to the Internet.
Remind me again: why did you get that extra, additional firewall?
But anyway, I’ve provided @JPmedia with the relevant information, and how he chooses to implement it is up to him.
I am looking for a straightforward solution in which most users take to set up a simple home security camera system with an NVR and be able to be notified as well as review events. Nothing is completely safe from the internet, but we must use it if we are to be able to view and monitor the system remotely.
As I mentioned, the firmware on both Dahua NVRs is V4.002.0000000.8.R.241030, which is the most up to date firmware for this series of NVRs.
Currently, each camera has its own password as I originally initialized the cameras first and then added them to the NVR. The NVR has a different password. My logic was to create another hurdle to access the individual devices. Me thinking I was creating a more secure setup.
I guess should be setting up the NVR first and then adding the cameras with the factory default settings, waiting for them to connect one at a time?
bigredfish
Known around here
When you take a step back and look at the comments received, you will see there is no consensus, so you have to take the information provided, and the credibility of those providing it, to decide the path you want to go.
On a site like this for the NVR users, it is probably 60% P2P, 30% VPN, and 10% port forward.
My post #30 on this thread provided a wall of text at a high level pro/con to each one.
Most here will agree port forward is the least secure.
P2P seems to be secure, but you are relying on Dahua systems to be secure with a firmware in your case last updated in 2024.
With VPN on the router, you are at least going to be running a more recent version than 2024.
As pointed out many times, anything can be hacked. Maybe P2P is secure but it is an older router not updated and it is the device getting attacked and exploiting the NVR.
Having done all 3 at some point in the past, I can basically setup any of them in about the same amount of time. Personally I would go with the system that will provide the most firmware updates and that would be a VPN on the router.
And again, most do not get hacked, it just sucks if it is your number called.
On a site like this for the NVR users, it is probably 60% P2P, 30% VPN, and 10% port forward.
My post #30 on this thread provided a wall of text at a high level pro/con to each one.
Most here will agree port forward is the least secure.
P2P seems to be secure, but you are relying on Dahua systems to be secure with a firmware in your case last updated in 2024.
With VPN on the router, you are at least going to be running a more recent version than 2024.
As pointed out many times, anything can be hacked. Maybe P2P is secure but it is an older router not updated and it is the device getting attacked and exploiting the NVR.
Having done all 3 at some point in the past, I can basically setup any of them in about the same amount of time. Personally I would go with the system that will provide the most firmware updates and that would be a VPN on the router.
And again, most do not get hacked, it just sucks if it is your number called.
bigredfish
Known around here
And the advantage with VPN is that you can access the camera GUI, which you cannot do with P2P.
And yes, outside of this forum, the clear majority of folks UPnP and port forward.
And yes, outside of this forum, the clear majority of folks UPnP and port forward.