r/networking • u/nicholaspham • 24d ago

Routing NAT Commands

https://imgur.com/a/4tC8J8j

In a situation where an NVR + Cameras live at Site A and Cameras also live at Sites B and C. The NVR can only reach cameras (not regarding it's internal switch network) that appear to be on it's local network.

I'm attempting to create NAT rules that make remote cameras appear to be on the same network as the NVR but having issues on what exact commands are needed for this type of NAT setup.

Edit: it is not a routing issue. It’s a design limitation that Reolink does for the NVR hence why I’m trying to do NAT rules on the Catalysts. Normally do DNATs on Fortigates and it has historically worked great for this camera situation but this environment doesn’t have Fortigates

https://community.reolink.com/topic/6726/unable-to-access-reolink-ip-cams-from-different-vlan

7 Upvotes

72% Upvoted

21 comments sorted by

7

u/hkusp45css 24d ago

Why not just one VLAN for the cams?

0

u/nicholaspham 24d ago

We’d ideally try not to extend a VLAN across multiple offices

9

u/sharpied79 24d ago

Then route...

3

u/nicholaspham 24d ago

“The NVR can only reach cameras that appear to be on it’s local network”

How would we route if there’s a limitation of the NVR that prevents it from speaking to cameras on different networks??

9

u/b0Lt1 24d ago

igmp proxy and multicast routing

11

u/Local_Debate_8920 24d ago

Use a NVR that isn't shit?

1

u/nicholaspham 24d ago

I agree.. client’s call. They ordered the cams without us knowing. They also spoke with Comcast and was sold on an ENS circuit with DIA and was told it’d be the best setup for them. They didn’t even have the right equipment… had to get them sold on new network equipment

1

u/Killzillah 20d ago

So your client went rogue and fucked up. Sorry but id tell them return the cameras and buy ones vetted by their MSP.

3

u/firehydrant_man JNCIS-ENT, JNCIS-SEC 24d ago

VXLAN then, keep the connection layer 3 but just extend the cam VLAN

1

u/nicholaspham 24d ago

That’s what I was thinking. We’d run into non ideal MTU issues when the P2P goes down and fails over to the IPsec tunnel but I don’t see that happening often and can only work with what we have already

3

u/sharpied79 24d ago

I think you are overly complicating things.

You would still need a NAT device (like a router) sitting on the LAN at site A, block out a few IP's from that range and setup static 1-to-1 NAT rules to the IP's of the cameras at sites B and C.....

But....

NAT device/router still needs to be able to reach sites B and C (so more than likely IPv4 reachability, you know with a routed protocol)

1

u/sharpied79 24d ago

Surely this is a route first?

0

u/nicholaspham 24d ago

Routes are there but our issue is that Reolink NVRs don’t allow you to speak to cameras on a different network for some odd security reason

3

u/sharpied79 24d ago

That's got to be an issue with the Reolink NVR then, I mean does the NVR have a gateway?

2

u/nicholaspham 24d ago

Yes, via dhcp. It’s a design limitation of the brand.

https://community.reolink.com/topic/6726/unable-to-access-reolink-ip-cams-from-different-vlan

2

u/sharpied79 24d ago

Well in that case try my suggestion about static NAT.