Remote View works on private networks, fails from internet

Comments

• Ben

  January 2018

  I'm a bit confused by some of this information. You write: "I disabled UPnP on my routers and in Security Spy and set up Port Forwarding. This allows me to reach the server from the internet" but then you write "Security Spy will complete the TCP handshake when I'm on the local network, but not when I'm on the internet." - could you explain this apparent contradiction?
  
  If your router is operating on subnet 192.168.1 but your Eero WiFi system is operating on subnet 192.168.7, then the Eero system is acting as a router itself, in addition to your ISP router. This double-router configuration is undesirable, as it will make setting up port forwarding difficult.
  
  There are two solutions to this: 1. set your Eero system to bridge mode and leave it connected to your ISP router. Or 2: if you have a separate router and modem from your ISP (rather than a combined router-modem device in one box), disconnect your ISP router, and connect the Eero system directly to the modem. In both these scenarios, you achieve one single LAN operating over one subnet, which is ideally what you want.
  
  Alternatively, if you want to keep your ISP router, then you should connect the Mac running SecuritySpy by wired ethernet directly to the ISP router, rather than to the Eero system.
  
  The main thing is to make sure that there is only one router between the Mac running SecuritySpy and the Internet, not two.
  
  Finally, it's not clear from your info whether UPnP was working before with your old Mac. If it was, then it should work with your new Mac, but you may have to restart your router(s) so that it (they) clear their NAT tables and can accept new UPnP commands for the ports in question.
• glennwilliams

  January 2018

  ********
  "I'm a bit confused by some of this information. You write: "I disabled UPnP on my routers and in Security Spy and set up Port Forwarding. This allows me to reach the server from the internet" but then you write "Security Spy will complete the TCP handshake when I'm on the local network, but not when I'm on the internet." - could you explain this apparent contradiction?"
  ********
  
  What I mean is that UPnP was not setting up a way to reach the new server. Neither router give me any insight into UPnP, so I removed it from the equation. I set up the port forwarding so that I could ensure I could reach the server (as evidenced by the SYN packet reaching the server), but the server is not responding to the SYN for the TCP handshake.
  
  Here's the basic topology - both Macs are behind the Eero.
  
  ISP Router ----Eero----Mac 1
  |------ Mac 2
  
  Port Forwarding has been set up on the ISP router to forward the incoming TCP traffic on port 8082 to the Eero on port 8082, and the Eero is set up to forward the incoming TCP traffic on port 8082 to the new Mac. I've tried different ports (like 8001, 8080), as well as using HTTPS and HTTP.
  
  
  
  ********
  "If your router is operating on subnet 192.168.1 but your Eero WiFi system is operating on subnet 192.168.7, then the Eero system is acting as a router itself, in addition to your ISP router. This double-router configuration is undesirable, as it will make setting up port forwarding difficult."
  ********
  
  Yes, this is correct. The port forwarding is just a second hop, and the forwarding is working correctly for both Macs. I can see the incoming packets coming in to either one, it's just that the new one won't respond. I moved the new Mac to the ISP private side, but the results were the same (see packet capture linked below).
  
  UPnP was working fine for the old Mac. When I set up the new Mac it was not working (but only for the new Mac). I checked the firewall on the ISP router and found that it was dropping the packets destined for the new Mac, but letting the packets for the new Mac through. Once I configured port forwarding, no packets were dropped and I can see the SYN packets making it to the new Mac. I can make the old Mac work with either UPnP or with port forwarding.
  
  The ISP router, the Eeros, and both Macs have been rebooted multiple times with no change.
  
  New Mac on ISP private side (before Eero):
  
  http://bit.ly/2EjKUiF
  
• Ben

  January 2018

  Is the new Mac running standard macOS, or is it running macOS Server? If the latter, there are additional firewall controls that may have to be configured to allow incoming connections. If the packets are actually reaching the Mac, but it's not responding, then a firewall is the most likely explanation. I presume you've double-checked all the ports, so that SecuritySpy is listening on the correct port that is being forwarded through your routers?
• glennwilliams

  January 2018

  That was it! Both Macs are running MacOS Server. I checked and the new Mac was set up to accept connections only on private networks. I suspect I changed that at install time. I entered an exception for the appropriate port and I could immediately reach it and view the cameras.
  
  I won’t be able to check the other Mac until later, but based on this I’m sure I’ll find that it’s configured to accept the connections.
  
  Thanks!
• Ben

  January 2018

  Great to hear it's now working! macOS Server has many more firewall options than standard macOS so it can sometimes be a bit tricky to configure correctly when you have incoming connections from various legitimate sources but still want good protection by the firewall from nefarious connection attempts.