Tag Archives: web server

Remote Access Without Port Forwarding

The usual way to set up remote access to our macOS CCTV software SecuritySpy running on your Mac is via port forwarding (see Installation Manual – Remote Access). This method allows direct incoming connections to SecuritySpy from the Internet, and is enabled by some configuration in your router (which, for most routers, SecuritySpy can do automatically). This method is great for most users, as it usually allows high-performance remote access with minimal configuration.

However, some users may want to consider other methods for the following reasons:

  • Port forwarding only works when your ISP gives you a true public IP address, which is not always the case, especially with cellular or satellite internet connections (e.g. 4G, 5G, Starlink).
  • If you have two routers between the Mac and the Internet (e.g. your ISP router plus your own router), port forwarding configuration is difficult – the usual solution is to switch one of these routers to bridge/passthrough mode, but this isn’t always possible.
  • ISP routers sometimes prevent users from setting port forwarding rules.
  • Institutions with very strict network policies may have a blanket ban on allowing any kind of incoming connections from the Internet.

If you can’t use port forwarding for any reason, the solution is to set up a VPN or Tunnel (sometimes called a proxy) via a third-party service in order to access your system. A number of these solutions are described below, with setup instructions.

The two VPN solutions described below are “peer to peer” systems: a central server sets up the connection between clients, who then communicate directly (in the minority of cases where this is not possible, the system falls back to relaying data via the server). On the other hand, with tunnel/proxy solutions, the data is always relayed via a central server.

Many tunnel/proxy providers apply data transfer limits, so you should take steps to minimise your bandwidth usage when accessing remotely, such as avoiding viewing live video in web browsers where streaming is done using high-bandwidth JPEG encoding, avoiding large file downloads, and generally using the connection sparingly.

All installation and setup must be done on the Mac running SecuritySpy. You will also need to enable SecuritySpy’s HTTP web server (even though the connection to SecuritySpy is via plain HTTP, this connection is happening within the Mac itself – when data leaves the Mac to travel over the Internet, it is encrypted by the VPN/Tunnel software).

Virtual Private Network (VPN) Solutions

VPN client software is installed on the SecuritySpy Mac and on all devices you want to use for remote access. All devices on the VPN can communicate freely with each other, via their VPN IP addresses, just as though they were on the same physical local network. Devices are not accessible outside the VPN.

Continue reading

How to purchase and install an SSL certificate for SecuritySpy

[NOTE 1: As of version 5, SecuritySpy automatically obtains official SSL certificates when using its free built-in viewcam.me domain name system, so this post should be ignored unless you wish to use your own domain name to access SecuritySpy.] [NOTE 2: This more recent blog post outlines an easy way to use your own domain name to access SecuritySpy’s web server: Using Your Own Domain Name With SecuritySpy.]

SecuritySpy has built-in support for HTTPS (HTTP Secure), which allows you to set up an encrypted web connection to your SecuritySpy server over the internet.

In order to set up any HTTPS server, an SSL certificate is required (SSL being the protocol that provides the security features to HTTPS). With some web servers this can be a complicated process, but we have designed SecuritySpy’s HTTPS server to be a simple as possible to set up: you simply enable the HTTPS option in the Web Server Settings window and SecuritySpy will do the rest for you. SecuritySpy will automatically create and use a “self-signed” certificate for this purpose, which gets you up and running immediately and provides a fully encrypted connection. The downside of such a certificate though is that it won’t be automatically trusted by any client software that you use to connect to SecuritySpy (e.g. a web browser such as Safari), so you will get a warning message to this effect. In this case though, as you are the one setting up the server, you can be assured of its authenticity, so it is safe to ignore such warnings.

The other option is to purchase an official certificate for your SecuritySpy server from a recognised Certificate Authority (CA). Any web browser connecting to SecuritySpy will automatically trust such a certificate, so the person viewing the web interface will see the reassuring padlock icon and no warning messages. This may be preferable, for example, if your server is to be viewed by people outside your organisation. Below are instructions on how to do this.

Note: these instructions are for SecuritySpy versions 4.1.5 and later, with the location of the SecuritySpy folder being within the Home folder (i.e. at ~/SecuritySpy/). If you are using an earlier version, note that your SecuritySpy folder will be at ~/Documents/SecuritySpy/.

Continue reading

Setting Up SecuritySpy Over SSL

UPDATE 4 JUNE 2014: SecuritySpy now has built-in support for HTTPS, so the setup described below is no longer needed for setting up SecuritySpy over SSL (although it may still be useful for generating SSL keys, certificates and certificate signing requests for other purposes). See the Web Server Settings section in the SecuritySpy user manual for information about the built-in HTTPS feature.

Secure Sockets Layer (SSL) is a cryptographic protocol that provides secure communications on the internet. It uses two keys to encrypt data: a public key and a private key. URLs that require an SSL connection start with https:// insead of http:// and operate on port 443 instead of 80 by default. SSL increases security as it makes it impossible for someone intercepting the stream of data to decode any information from it.

SecuritySpy does not have built-in support for SSL, however Mac OS X comes with Apache, a fully-featured and powerful web server, that can be used to set up the secure communication between the internet and SecuritySpy. In this way, Apache will be acting as a secure “reverse proxy” web server for SecuritySpy. This post describes how to set this up.

Continue reading