Member Avatar for admiralchip

Hi,

I hope I'm posting this in the right place. :) I've also posted the problem I was facing on the Mikrotik forum, but it takes a while for a reply to be approved and I really want to solve this problem quickly. I'm trying to set up a remote surveillance system for my house.

I'm a newbie when it comes to using Mikrotik. I'm using a Mikrotik Metal 2SHPn. I've got 4 Wireless IP cameras that I want to be able to view remotely from wherever I am. The problem is, I'm not sure how to configure my router to do this so I need help right from router configuration to remote viewing of IP cameras. I've been stuck on this for days. I've tried using Quickset and set the Mikrotik configuration mode on "router", but I wasn't able to connect to the internet once I plugged my Mikrotik in my modem, neither was I able to see my cameras both internally and remotely. I've tried putting the mode to "bridge" and I was able to connect to the internet once I plugged my Mikrotik in my modem but I wasn't able to see my cameras internally or remotely. After getting some help, I'm now able to access the internet through the Mikrotik (but it's not set on bridge). The problem now is that I can't access my IP cameras.

Most of the sites and videos I've checked on setting up a mikrotik router use bridge to access the internet. How exactly does this work? Someone recommended using bridge as well when it comes to setting up the ip cameras with the router, but I don't really understand how.

I've got a static IP from my ISP. The modem they gave me is one of those "router+modem" types. Do you think this might make it difficult for me to set up my surveillance system? The subnet mask looks kind of funny as well (255.255.255.255).

My cameras connect to the mikrotik wirelessly.

Thanks in advance!

  • 3 Contributors
  • 5 Replies
  • 3K Views
  • 1 Week Discussion Span
  • Latest Post Latest Post by himlamq7

Dani AI

Generated

first confirm whether your MikroTik is actually the edge device. In WinBox, check the IP shown on your WAN interface. If it is private (10.x, 172.16-31.x, 192.168.x, or 100.64-100.127), your ISP’s modem/router is doing NAT too. In that case either put the ISP box in true bridge mode or at least forward/DMZ all traffic to the MikroTik. Also, a 255.255.255.255 mask on a static WAN can be normal; it just means the default route points to the ISP gateway separately and is not the cause by itself.

Once the MikroTik has the public IP, add a specific dst-nat and (if you use a drop-by-default forward chain) one allow rule. Example for one camera on TCP 8090:

/ip firewall nat
add chain=dstnat in-interface-list=WAN protocol=tcp dst-port=8090 \
    action=dst-nat to-addresses=192.168.88.10 to-ports=8090

/ip firewall filter
add chain=forward in-interface-list=WAN connection-nat-state=dstnat action=accept

If you want to reach the same camera from inside your LAN using the public IP (common gotcha), add hairpin NAT:

/ip firewall nat
add chain=srcnat src-address=192.168.88.0/24 dst-address=192.168.88.10 action=masquerade

Repeat dst-nat rules per camera/port, and include any secondary ports the camera uses (e.g., HTTP UI plus RTSP 554). MikroTik’s NAT helpers include an RTSP helper under IP -> Firewall -> Service Ports if your stream relies on it. (help.mikrotik.com)

To ’s point about secondary ports and logs: verify traffic flow on the WAN with Torch, and capture a short pcap to inspect in Wireshark if needed:

/tool/torch interface=<WAN> port=8090
/tool/sniffer/start interface=<WAN>
/tool/sniffer/stop
/tool/sniffer/save file-name=camera.pcap

Download the pcap and open it in Wireshark to see if SYNs reach you and whether replies leave the camera. Torch shows packets before firewall filtering; the Packet Sniffer can save captures for offline analysis. (help.mikrotik.com)

Security tip: if possible, consider using a VPN (e.g., L2TP/IPsec or WireGuard) and avoid exposing camera ports directly.

Recommended Answers

All 5 Replies

Member Avatar for CimmerianX

Something is acting as your perimeter device. Theis perimeter device will show the static IP on the WAN interface.

Getting your cameras viewable to the public simply involves forwarding the port used for remote viewing 'through' the permiter device using port forwarding or pinholing (whichever your device supports).

What port does your camera system use?
What device is on your perimeter?

Member Avatar for admiralchip

Thanks for your reply! :)

From what I understood from your post, my router (Mikrotik) is my perimeter device. I've done port forwarding on the Mikrotik device but when I checked it in canyouseeme.org, it said the port was still closed. Here is my rule:

/ ip firewall nat

add chain=dstnat dst-address=publiciphere protocol=tcp dst-port=8090 \
action=dst-nat to-address=mycameraip to-port=8090`

I believe this is correct. When i try accessing my camera using the public ip and the port, i receive packets (i can see that on winbox), but i can't access my camera on the browser.

At this point i'm thinking my modem/router could be the problem.

As for the devices on my perimeter, it's just my cameras.

P.S. what i meant by "modem/router" is when i'm not using a router and i just want to access the internet on my laptop wirelessly, i can connect wirelessly to my modem.

Edited by admiralchip because: formatting my rule
Member Avatar for CimmerianX

Perhaps your camera application is trying to open another set of secondary ports. Just a guess. If you can wireshark the connection internally or find reference to it in the manual, that might help.

On the router, does it log dropped packets somewhere?

Member Avatar for admiralchip

what do you mean by wireshark? How do I do that?

Member Avatar for himlamq7

Why do not you ask your experts do better than that. I admire you. Good Success

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.