Accessing CCTV vlan from Main vlan using Android app

I have a simple goal:

  1. block CCTV from outside world
  2. Access CCTV from main LAN using android app

Things I have done:
I manage to create two separate vlan.

  1. Main LAN (vlan99)
  2. CCTV (vlan3)

Things I have done but not sure if done correctly since I cannot access my camera through my mobile phone.

Can someone please have a look at my settings and point me to the right direction as I have been trying to work this out for a week? Please refer to my settings below.

VLAN filtering

Interface

LAN

CCTV

WIFI

LAN

CCTV

Firewall

Port Forward

Traffic Rules

Android app showing offline when I connect to main LAN WIFI (WIFI-5ASD4F)

Another thing I have done before to access CCTV from main LAN was to create a new bridge interface and listed br.lan3 and br.lan99 in bridge port section, made necessary settings in the firewall and it worked but the problem was both CCTV and LAN zone was both blocked from the outside world and I cannot remember how I did that as I did a lot of trial and error.

You should contact your cctv vendor you are hiding here. There is no generic protocol called cctv

1 Like

I would not do any vlans. Simply traffic rule in your firwall, like mines:

I only hid mac address, IPv6 (not sure if there are any security issues sharing it),and other zones to make it clear.

The CCTV you are seeing is just a name I created myself and have nothing to do with the vendor.

I already considered that solution before but not sure if my camera randomized its mac each time its connected. I will have a look closer and try again, maybe I was looking at a different device.

Setup a static IP and block that IP. I am not using Mac filters
Kr
K

It worked but only when I connect on same LAN. It does not work when I VPN to the server from outside. I cannot view my CCTVs. Im using tailscale for my vpn

It is unclear to me if you have a Tailscale setup issue and/or a CCTV Android App setup issue.

Do you have Tailscale working for other tasks or are you setting up Tailscale for the first time?

1 Like

Great!
What is the app and who is the vendor and what model?

I found your app.

I do not know why the mystery but I do not care either.
#1 is handled by the cameras/devices because they need a password to stream; regardless the app, penetration, etc.

#2 The app is designed to work if you are on the same LAN; since #1 is mitigated through a very strong password, I'm sure, you can safely use the app as it is intended: on your primary lan, each device handshaking with the app and settings/passwords stored.

Sorry if my explanation is too vague and as far people try to ask more information, its the only time im realizing that im missing some important information.

Tailscale is working fine I assume. I added the CCTV subnet 192.168.8.0/24 to Openwrt Tailscale subnet route and approve it in Tailscale admin console.

When I am away, I can ping the ip address of the cctv camera but when using the app, its showing offline

Isn't that the purpose of VPN is to let all your devices think that they are on the same LAN which means they should see each other?

I tried playing with firewall rule, port forward, and traffic rules but still no luck.

No...
A VPN encrypts traffic from point to point.

And so do your cameras and the app but I have no idea what encryption they use.
I'm sure it's on the page I linked.

There appears to be two ways to add devices to your Phone App, have you tried to manually add the devices?

FAQ - V380

How to add a networked device to your phone

Method one: Manually add 
1, open the [device list] interface, click [+] in the upper right corner 
2, select [WiFi connection completed] or [other ways] 
3, after entering the ID and password [OK add], the system jumps to the device List, the newly added device is displayed in the first place in the device list.

oh i see, I never knew about that, I thought VPN is all about tunnel and redirecting traffic.

apologies for my ignorance as networking is not really my thing but I am keen to learn since it is very useful.

About the encryption, in case I found the information how the data is being encrypted, is there any in the openwrt setting that needs setting up to make it work?

I 've done this steps, and camera can be viewed perfectly fine when I am at home connected through wifi. But when I am away, I do connect to my home nas via tailscale which is fine but cannot view the camera since it is always showing offline. I can ping the camera ip though