VPNs for Video Surveillance Guide

By: IPVM Team, Published on Feb 07, 2017

Remote access in surveillance networks is a key cyber security and usability issue. With cyber attacks rising, how can users ensure their systems are secure without losing access from outside the network?

VPNs for Video Surveillance Guide

Virtual private networks (VPNs) have historically been used in complex / large systems to secure data but can also be used in smaller sites with relatively inexpensive. To better demonstrate this we purchased two Dell SonicWall SOHO routers and configured them to simulate a site to site VPN.

Inside, we look at VPN usage in video surveillance, including the following topics:

  • What is a VPN?
  • VPN protocols
  • VPN topologies
  • VPN price considerations
  • Benefits and drawbacks
  • Site to site VPN configuration
  • Remote access VPN configuration
  • Mobile device usage
  • Recommendations for VPN use

Virtual Private Networks

A VPN is a private network that creates a secure tunnel over the internet to connect two or more endpoints. These endpoints can be a VPN appliance, a workstation, or a mobile device. Encryption creates a secure connection from one endpoint to the other keeping data private, even while transmitted over the internet. For example, looking at a Wireshark trace of a secure tunnel, once the TLS connection is set up, only "Application Data" is shown, as packet contents are encrypted.

Wireshark Trace of Secure Tunnel

There are several VPN protocol options, which mainly vary in level of encryption and device compatibility. These include:

In this tutorial, our VPN setup used IKEv2 over IPSEC on SonicWALL devices.

VPN Topology

Get Video Surveillance News In Your Inbox
Get Video Surveillance News In Your Inbox

There are two commonly used VPN topologies, which have different use cases:

  • Site to site: A site to site VPN requires an appliance at both locations, which essentially routes the two remote networks together into a single virtual network. In security, this may be used to connect two facilities' camera LANs together so they may be managed and viewed as one, from either location.
  • Remote access: In a remote access VPN there is one VPN appliance (also known as a concentrator) and a workstation which connects via client software. This type of VPN may be used to connect remote users to a security network for viewing, or for configuration/troubleshooting tasks for integrators.

We discuss these topologies in more detail below.

VPN Pricing

VPNs are most often run on dedicated hardware, typically included on a router or firewall. Pricing for hardware VPN varies depending on capabilities (typically number of VPN tunnels) and throughput handling. Some may be found for <$100 USD online, while large capacity VPN concentrators sell for more than $10,000.

In addition to hardware VPN appliances, users may install software to turn a server/PC into a VPN concentrator. The most popular option for this is OpenVPN, which is priced at $15/year per client.

VPN Benefits/Drawbacks

There are three key benefits to VPNs:

  • Security: Because all traffic between VPN endpoints is encrypted and surveillance/security devices are not exposed directly to the internet, VPNs provide improved cyber security compared to port forwarding/DDNS. Note that cloud services such as Hik-Connect, Nest, etc., also encrypt this traffic.
  • Reliability: Because they use dedicated hardware, VPNs are typically more reliable than using cloud services or DDNS, which are outside of users' control.
  • Accountability: Unlike other remote access methods, VPNs keep full log information, allowing users to determine who access which device at a given time, etc., for better auditing.

However, there are two drawbacks which have kept VPNs from being more commonly used:

  • Cost: VPN hardware adds cost to a project, where manufacturer cloud services and port forwarding/UPnP are generally free. Dynamic DNS is most often not free, typically a few dollars per month to $100+/year.
  • Complexity: VPN setup requires IT expertise which many/most surveillance installers do not possess. Even among those in the IT field, many have never set up VPN policies.

Site to Site VPN Example

As an example of a site to site VPN, the diagram below illustrates a headquarters location with a VMS server and viewing station, along with a satellite office with multiple cameras and a viewing station. Using a site to site VPN, the entire security network functions as one.

Site to Site VPN

To better demonstrate this we purchased two SonicWall SOHO routers and configured them to simulate a site to site VPN.

Configuration Steps

In this section we outline the steps taken to configure our routers for site to site VPN use. The exact steps required by specific manufacturers vary, but basically VPN creation is a three step process:

Create VPN policy → Define networks → Select networks to connect

Create Policy

In this step, we select the type of VPN (site to site), protocol used, and give it a name and shared secret (similar to a password, used by both devices to connect).

Define VPN Policy

Define Local and Remote Networks

Next, we must define networks for both the local and remote site in order to create routing rules. There are two key notes in this step:

  1. This must be performed on both devices. In other words, in our example, we must define the satellite office network (192.168.2.x) on not only the HQ router, but the satellite as well. The same must be done for the HQ network (192.168.1.x) on both devices.
  2. These networks must not use the same subnet in order to route properly. This is why we used 192.168.1.x for the HQ and 192.168.2.x for satellite.

Note that counterintuitively, both these networks are assigned to the "LAN" zone in this example. Despite one logically being the "WAN", SonicWALL reserves that terminology for other uses, so both are LAN.

Select Networks To Connect

With them defined, we can now select the two networks to be connected via the VPN. On the HQ appliance, we select the HQ network defined above as "local", and choose "Satellite Office" as the destination network. On the Satellite Office appliance, we would do the reverse.

Select Networks to Connect

Enable Policy To Connect

Once we configure both VPN appliances with the above, we can enable the policy to connect the two sites. In the video below, we show that the sites are unable to communicate with each other until the VPN tunnel is established. When the VPN is active devices start responding to ping requests and the camera can be remotely viewed / administered.

Remote Access VPN

In many situations we do not require an entire site to connect to our network, and often our users connect from networks that we do not control. We can provide individual users with VPN access. The configuration starts the same as a point to point solution, create VPN policy. After that we walk through creating a VPN user, and configuring the client software.

Remote Access VPN

Define Policy

The configuration starts with creating a VPN policy on the appliance located at the site that requires access. This simply requires the connection type, a name, and shared secret. Note that this shared secret is similar to, but separate from, individual user passwords.

VPN Policy For Remote Access

Create Account(s)

After the policy is built on the VPN appliance, we create user accounts. These credentials are used on client devices when connecting to the VPN.

User Settings

Define Access

Finally, users are assigned one or more network which they may access via the VPN. These networks are defined above in the Define Local/Remote Networks section.

Assign LAN Access to Users

Accessing VPN Via Client

With the above user created, we may now use the software client to access the VPN, shown below:

Remote VPN Example: VMS Client to Server

The animation below demonstrates a common use case for remote VPN, connecting a client machine to remote server(s). In the example below, servers are unreachable when the VPN is disconnected, but come online once the connection is established, with live video loading in only a few seconds.

Remote VPN Example: Mobile Device to Server

Many/most VPNs may be used on mobile devices in addition to hardware/software clients. For example, the image below shows Exacq Mobile running on an iPhone, connected to a remote server via the SonicWALL Mobile Connect app. VPN status is indicated in the top bar, next to the mobile carrier status.

Exacq Mobile Client Via VPN over LTE

Conclusions

Given the increase in cyber attacks (both severity and frequency) along with the falling costs of VPN hardware, we expect VPN usage to become more common in 2017 and beyond, as it provides better security and accountability than other remote access methods. These issues are likely to only increase in importance as cyber security issues continue to increase.

5 reports cite this report:

Locking Down Network Connections Guide on Apr 23, 2019
Accidents and inside attacks are risks when network connections are not locked down. Security and video surveillance systems should be protected...
IP Network Hardware for Surveillance Guide on May 02, 2018
Video surveillance systems depend on IP networking equipment. In this guide, we explain the key pieces of equipment and features, explaining where...
Remote Network Access for Video Surveillance Guide on Feb 21, 2018
Remotely accessing surveillance systems is key in 2019, with more and more users relying on mobile apps as their main way of operating the system....
Favorite Software For Remotely Supporting Video Surveillance Systems on Feb 07, 2018
Being able to remotely support video surveillance systems is important both to reduce costs (eliminating truck rolls) and for...
Hacked Hikvision IP Camera Map USA And Europe on Jan 22, 2018
The interactive map below shows a sample of hacked and vulnerable Hikvision IP cameras across the USA and Europe. Hover over a marker to see an...
Comments (22) : PRO Members only. Login. or Join.

Related Reports

Biometrics Usage Statistics 2019 on Jun 17, 2019
While face and fingerprint recognition are used regularly for smartphones, it is not as common in physical security. In this note, we examine...
Farpointe Data Conekt Mobile Access Reader Tested on Jun 13, 2019
California based Farpointe Data has been a significant OEM supplier of conventional access readers for years to companies including DMP, RS2, DSX,...
Manufacturer Favorability Guide 2019 on Jun 12, 2019
The 259 page PDF guide may be downloaded inside by all IPVM members. It includes our manufacturer favorability rankings and individual...
Dumber Techs, Bad Box Movers, Says Australian Distributor on Jun 10, 2019
Techs today are "dumber" than they used to be, despite better education and training and that makes a typical day "frustrating" for one...
OSDP Access Control Guide on Jun 04, 2019
Access control readers and controllers need to communicate. While Wiegand has been the de facto standard for decades, OSDP aims to solve major...
Vidsys New President Interviewed on May 31, 2019
A decade ago, PSIM was hot with projections then of a billion dollar market by now. This has not come close to happening. However, Vidsys, one of...
China Jaywalking Facial Recognition Guide on May 27, 2019
News reports touting the PRC's AI prowess often showcase facial recognition cameras being used to automatically catch and fine jaywalkers.  In...
Average Frame Rate Video Surveillance 2019 on May 23, 2019
What is the average frame rated used in video surveillance systems? In IPVM's 2011 statistics, the average was 6-8fps increasing to ~10fps in...
Access Control Job Walk Guide on May 22, 2019
Significant money can be saved and problems avoided with an access control job walk if you know what to look for and what to ask. By inviting...
Facial Recognition Systems Fail Simple Liveness Detection Test on May 17, 2019
Facial recognition is being widely promoted as a solution to physical access control but we were able to simply spoof 3 systems because they had no...

Most Recent Industry Reports

Genetec Synergis Cloudlink - Complex, Costly and Confusing on Jun 18, 2019
Genetec's Synergis Cloud Link is complex, costly and confusing compared to competitor access control architectures. Inside this note, we examine...
Startup Vaion Launching End-to-End AI Solution Backed with $20 Million Funding on Jun 17, 2019
An EU / USA video surveillance startup, Vaion, founded by ex-Cisco Senior Directors is launching an end-to-end VSaaS platform with $20 million in...
The Scheme Hikvision and China Importers Use To Avoid Tariffs on Jun 17, 2019
Hikvision and numerous China importers are avoiding 25% tariffs by including an SD card slot in their IP cameras to claim they are 'digital still...
Sighthound Transforms Into Enterprise AI Provider Profile on Jun 14, 2019
Sighthound is now rapidly expanding its R&amp;D team, building an enterprise AI service. This may come as a surprise given their origins 6 years...
ADT Eliminating Acquired Brands, Unifying Under 'Commercial' Brand on Jun 14, 2019
ADT is eliminating the brands of the many integrators it has acquired over the past few years, including Red Hawk, Aronson Security Group (ASG),...
NSA Director Keynoting Dahua and Hikvision Sponsored Cybersecurity Conference [Canceled] on Jun 13, 2019
The technical director for the NSA’s Cybersecurity Threat Operations Center will be keynoting a physical security cybersecurity conference that is...
Farpointe Data Conekt Mobile Access Reader Tested on Jun 13, 2019
California based Farpointe Data has been a significant OEM supplier of conventional access readers for years to companies including DMP, RS2, DSX,...
Embattled $400 Million China Funded Philippines Surveillance System Proceeds on Jun 13, 2019
An embattled 12,000 camera surveillance system project that will cost ~$400 million will proceed.  The project contract was awarded, had its...
False Verkada 'Unrivaled' Low Light Performance Claim Removed on Jun 12, 2019
Verkada falsely claimed that it delivered 'UNRIVALED LOW LIGHT PERFORMANCE' until IPVM questioned. In fact, Verkada's low light performance is...

The world's leading video surveillance information source, IPVM provides the best reporting, testing and training for 10,000+ members globally. Dedicated to independent and objective information, we uniquely refuse any and all advertisements, sponsorship and consulting from manufacturers.

About | FAQ | Contact