installed cam, forwarded necessary ports to get remote viewing in onvifer app. all is fine.. i can connect with the IP cam remotely when ports are enabled...and cant when I disable the ports.

the problem lies with the original app. with ports disabled I can still view the camera over my mobile network. this strikes me as inconsistent or even security risky. somehow this app goes through my router with relevant ports disabled and remote management off

another thing to note is that the original app first didnt work remotely but it started working after i did the setup work for the other app.

IP cam is Vstarcam.. app that came with it is eye4. I know the app is kinda iffy. but its a popular positively reviewed ip cam, and the app is used.. I doubt the makers are malicious but the app could still be full of security holes

maybe someone have some pointers/suggestions whats going on and how to make this a secure as possible.

thnx

now that I think about it. it could be the other way around..the app isnt going through my router security. its the IP cam thats streaming to a server where the app connects to.

but still...at first I wasnt able to do that. maybe things changed when the cam got my wan-ip?

okay so indeed the camera has a couple more ports opened in the upnp section of portforwarding. its my first time dealing with this stuff..but my guess is that the ports I opened myself are part of the onvif (some sort of security cam standard) system.

and in addition to that the IP cam has other ports that it opens that are app/device specific.

edit: meh disabling upnp ports doesnt stop the stream.

this thread turning into a selfhelp course. although its not helping

imo - don't configure remote access for a security camera by opening ports. even the good cameras have at least occasional security issues, and the mediocre and below ones have been laughably bad. see mirai and others. disable upnp entirely as well.

thnx! followed that advice..disabled upnp and disabled the ports I forwarded(i can always open them when needed)

Im starting to understand whats happening...the cam also streams to another http port than the onvif one and the original app listens to that port.

upnp is the devil, hopefully it gets killed one day soon

If you haven't already, check to make sure you can change any default passwords

IP cams are pretty notorious for security issues. Some people mitigate this by setting up the IP cams on either a physically separate network or setting up a non-internet connected VLAN on a multiple VLAN capable router (think enterprise or prosumer). Ubiquiti and Mikrotik both have some good and reasonably priced routers in this space. This sort of setup will require some research and either learning or hiring out router config.

thanks guys,

yeah I changed the default password. but i haven't seen an option to change the default user name which is pretty bad imo. I concur with the IP cam being a network security risk but its a nice thing to have they go for dirt cheap and work great from a technical aspect.

the software side seems put together with not much thought.. for example if you log in on the local ip cam, the wlan network key is there in plain sight. so you get into the camera you get into the network just like that. and in user setting where you see the username (unchangeable) the password is behind asterisk why not do that for both passwords.

the android app connected to a bunch of ip's totally unrelated to the function of the app (alibaba and other advertising stuff, and who knows what) I blocked all those with NoRoot firewall (very nice btw for click and blocking specific connects per app, other FW's disappointed in that respect)

That's the thing we've been learning about cheap hardware - the tradeoff is that you likely become part of a massive botnet. In some cases it's by default passwords you can't change, in others it's thanks to backdoor accounts the manufacturer won't tell you about, in others still it's using outdated components or software with massive security risks.

No matter what, you get what you pay for.