Monday, January 5, 2009

Broken Port Forwarding



I've spent over an hour trying to get my new D-Link DCS-910 working from outside my home network. I've done this kind of thing a hundred times, basically I'm setting up port forwarding so incoming connections to my home router will get forwarded to my camera.

I was forwarding port 8085 to 10.1.1.205:8085 but it just wasn't working. Inside my network I was able to go to 10.1.1.205:8085 but I wasn't able to get to foo.mine.nu:8085 (where foo.mine.nu resolves to my home network courtsey of DynDNS). After trying lots of different ports and even reloading the firmware on my Netgear WPN824, it turns out it was something simple and had nothing to do with the Netgear. The problem was the default gateway setting on the D-Link camera. I had setup the DCS-910 to use the static IP address of 10.1.1.205. I didn't bother to set the default gateway. For some reason, this worked fine when I was going from some other machine on my 10.1.1.x network, but failed miserably when trying to connect from outside.

I don't disagree that leaving the default gateway set to 0.0.0.0 is a problem, I'm just suprised that the camera would work on my LAN but fail when accessed via port forwarding.

If you have a similar problem with port forwarding, make sure the device you're forwarding to has its default gateway properly set! Lesson learned.

Disclaimer: My camera really isn't at foo.mine.nu. I'm just using this FQDN as an example.

6 comments:

Pablo said...

I'm guessing you either gave it or it guessed the network mask. 255.255.255.0 would always be reasonable for a home network. What it means is that the device knows how to route traffic to 10.1.1.x, it addresses the packet to the source. The next layer does an arp-whois for the local IP, the local device responds with its MAC address. The ethernet frame is composed to that mac address.

When it's an off network IP, without a default route, the best it can do is an arp-whois for the remote IP (NAT doesn't rewrite the source), which will not get any response. With a default gateway, it can do the arp-whois for the gateway IP, address the TCP packet to the remote IP, but the ethernet frame to the gateway MAC.

Hope that made some sense.

Pablo said...

I meant arp-whohas. I confused my protocols :)

adam said...

Thanks for the explanation Pablo. It makes sense. I wonder how many other folks have been hit by this problem. It's easy to blame the router since it seems like the port forwarding that is broken, when in fact it's just the gateway config on the camera (or other device) that is hosed.

Well at least now folks have some chance of finding your explanation!

Anonymous said...

turned out, your site is the only place to have the sample picture taken with that cam :-)
are you satisfied with this device? does it support motion detection? can it send the pictures (or may be videos) when the motion is detected? is it a PoE device? or you have to power it separately?

victormog said...

I have a similar problem, I can't access my DCS-910 from outside my network. It works properly when I type 192.168.1.129, but I can't access it from MyDynDNS.dnsalias.com:1010.

I have forward the TCP port 1010 in the router configuration to the private IP 192.168.1.129.

You are the only person I have found in the internet who has solved the problem, Could you help me?

Thank you very much in advance.

adam said...

Did you check the default that the default gateway on your camera is set properly as described above?

Another option is to use sensr.net. Configure your camera to push images to our site every second via FTP. Then you don't need to worry about port forwarding. We also provide archiving, sharing, and alerts for your camera.

Post a Comment