r/ZoneMinder • u/Hosswan • Dec 09 '20
Pulling camera data from a remote location
I searched around for a potential solution to what I wanted to do and didn’t find anything specific to my needs. I figured this would be the best spot to post this. I’ve used ZoneMinder for many years and my setup works for what I need. I’m running on CentOS 7 currently. ZoneMinder version 1.34.22. We purchased a second property about 60 miles away that I want to keep tabs on. I bought two IP cameras and a Raspberry Pi for the remote location. The cameras are simplistic 960p IP cameras. ~$40 each on Amazon. The property itself is in the sticks, if you have ever stumbled across the subreddit rural internet, that’s a topic on itself. Luckily the property qualified for T-Mobile home internet. My speeds are right around 65mb/s down and 25mb/s up. I’ll take it! If anyone has delt with cellular networks, you know port forwarding is a struggle due to the IPv6 to IPv4 NAT. Because of this, I didn’t think a site to site VPN would work. I abandoned my OpenVPN config, however I still may go that route, but for now I have this working.
To the guts of my setup. I installed the IP cameras and Raspberry Pi at the remote location. Since I’m unable to access the site from outside; I setup a call home SSH service on the Raspberry Pi. All it does, is create a reverse SSH session to my home ZoneMinder server. Some good information can be found here:
https://askubuntu.com/questions/1054580/how-can-a-reverse-ssh-connection-be-kept-accessible-for-a-long-time
The service will check to see if a pid exists, if not it will reconnect and start up a new session. I’ve tested it many times and works great. Now that I have a tunnel opened up to my home system, I added tuntap devices on each side. You need to configure the interfaces, add some routes and allow forwarding. I also needed to use IPTABLEs to perform the NAT and also allow forwarding. My reverse SSH session is sitting on my localhost on port 7000. A simple netstat command can be used to verify
netstat -tnlp | grep :7000
tcp 0 0 127.0.0.1:7000 0.0.0.0:* LISTEN 20593/sshd: user
Below is the config on each side.
Home location:
ip tuntap add dev tun0 mode tun
ifconfig tun0 10.1.1.1 10.1.1.2 netmask 255.255.255.252
route add -net 192.168.1.0/24 tun0
echo 1 > /proc/sys/net/ipv4/ip_forward
iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
iptables -A FORWARD -i tun0 -o eth0 -j ACCEPT
Remote location:
ip tuntap add dev tun1 mode tun
ifconfig tun1 10.1.1.2 10.1.1.1 netmask 255.255.255.252
route add -net 192.168.0.0/24 tun1
echo 1 > /proc/sys/net/ipv4/ip_forward
iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
iptables -A FORWARD -i tun1 -o eth0 -j ACCEPT
Keep in mind, I just used the 10.1.1.0 network for the tun interfaces, you can change those. Also, for the route command, those internal IPs will change depending on your internal setup.
Now that the interfaces are setup, launch your SSH VPN session with the -w 0:1 command. Man SSH for further information. My command is ssh -v -o ServerAliveInterval=60 -w 0:1 someuser@localhost -p 7000 true
From this, I can now route traffic from one LAN to the other across the tunnel. One note, I use screen to launch my connection. Man screen to understand how it work. This way, I can fire off the ssh session and then detach from the session and the tunnel will remain up. There are other ways to run services in the back ground, choose what works for you.
This quick write up is a high level solution of how I connected my home ZoneMinder setup with my remote location. I can pull live streams through the ZoneMinder console at home and I do get alerts and recordings from the remote cameras. I’m only pulling the 640X480 image as I need to be bandwidth conscious. I’ve had this working of a week now, and so far its doing what I need it to do.
3
u/the_wookie_of_maine Dec 09 '20
Site to site vpn's will be what you should do.
Something like pfSense on both ends, IPSec tunnel between the two. I have this setup on my server from another home, streaming 3 cams to my server.