|
Dominican Republic North Coast CCTV Security Cameras |
|
Computer CCTV Systems - DVD Digital Video Recorders |
|
Sales & Installation |
|
|
|
Remote Viewing A DVR from Behind a NAT Router or How Network Address Translation Works The DV Series DVR has several advanced features that allow it to support remote access to live & stored video images from remote sites via the Internet. The DV Series DVR supports dynamic IP addressing and Network Address Translation (NAT) routers. This application note will explain how to configure a DV Series DVR to work with consumer and commercial NAT routers, which in turn allows the user to access a DV Series DVR through a cable modem or DSL line. This application note assumes that you have a basic working knowledge of Internet networking. Advanced knowledge of Internet issues is not required. Background Information If you are reading this article, you are most likely connected to the Internet and viewing it at the DVSS Web site. There's a very good chance that you are using Network Address Translation (NAT) right now. The Internet has grown larger than anyone ever imagined it could be. Although the exact size is unknown, the current estimate is that there are about 100 million hosts and more than 350 million users actively on the Internet. That is more than the entire population of the United States! In fact, the rate of growth has been such that the Internet is effectively doubling in size each year. So what does the size of the Internet have to do with NAT? Everything! For a computer to communicate with other computers and Web servers on the Internet, it must have an IP address. An IP address (IP stands for Internet Protocol) is a unique 32-bit number that identifies the location of your computer on a network. Basically, it works like your street address -- as a way to find out exactly where you are and deliver information to you. When IP addressing first came out, everyone thought that there were plenty of addresses to cover any need. Theoretically, you could have 4,294,967,296 unique addresses (232). The actual number of available addresses is smaller (somewhere between 3.2 and 3.3 billion) because of the way that the addresses are separated into classes, and because some addresses are set aside for multicasting, testing or other special uses. With the explosion of the Internet and the increase in home networks and business networks, the number of available IP addresses is simply not enough. The obvious solution is to redesign the address format to allow for more possible addresses. This is being developed (called IPv6), but will take several years to implement because it requires modification of the entire infrastructure of the Internet.
This is where NAT (RFC 1631) comes to the rescue. Network Address Translation allows a single device, such as a router, to act as an agent between the Internet (or "public network") and a local (or "private") network. This means that only a single, unique IP address is required to represent an entire group of computers. But the shortage of IP addresses is only one reason to use NAT. Let's take a closer look at NAT and exactly what it can do...
What Does NAT Do? The client calls the main number to your office, which is the only number the client knows. When the client tells the receptionist that she is looking for you, the receptionist checks a lookup table that matches your name with your extension. The receptionist knows that you requested this call, and therefore forwards the caller to your extension. Developed by Cisco, Network Address Translation is used by a device (firewall, router or computer) that sits between an internal network and the rest of the world. NAT has many forms and can work in several ways:
The internal network is usually a LAN (Local Area Network), commonly referred to as the stub domain. A stub domain is a LAN that uses IP addresses internally. Most of the network traffic in a stub domain is local, so it doesn't travel outside the internal network. A stub domain can include both registered and unregistered IP addresses. Of course, any computers that use unregistered IP addresses must use Network Address Translation to communicate with the rest of the world. NAT can be configured in various ways. In the example below, the NAT router is configured to translate unregistered (inside, local) IP addresses that reside on the private (inside) network, to registered IP addresses. This happens whenever a device on the inside with an unregistered address needs to communicate with the public (outside) network.
NAT overloading utilizes a feature of the TCP/IP protocol stack, multiplexing, that allows a computer to maintain several concurrent connections with a remote computer (or computers) using different TCP or UDP ports. An IP packet has a header that contains the following information:
The addresses specify the two machines at each end, while the port numbers ensure that the connection between the two computers has a unique identifier. The combination of these four numbers defines a single TCP/IP connection. Each port number uses 16 bits, which means that there are a possible 65,536 (216) values. Realistically, since different manufacturers map the ports in slightly different ways, you can expect to have about 4,000 ports available.
Dynamic NAT and Overloading
Here is how overloading works:
Look at this table to see how the computers on a stub domain might appear to external networks.
As you can see, the NAT router stores the IP address and port number of each computer in the address translation table. It then replaces the IP address with its own registered IP address and the port number corresponding to the location, in the table, of the entry for that packet's source computer. So any external network sees the NAT router's IP address and the port number assigned by the router as the source-computer information on each packet. You can still have some computers on the stub domain that use dedicated IP addresses. You can create an access list of IP addresses that tells the router which computers on the network require NAT. All other IP addresses will pass through untranslated. The number of simultaneous translations that a router will support is determined mainly by the amount of DRAM (Dynamic Random Access Memory) it has. But since a typical entry in the address-translation table only takes about 160 bytes, a router with 4 MB of DRAM could theoretically process 26,214 simultaneous translations, which is more than enough for most applications. IANA has set aside specific ranges of IP addresses for use as non-routable, internal network addresses. These addresses are considered unregistered (for more information check out RFC 1918: Address Allocation for Private Internets, which defines these address ranges). No company or agency can claim ownership of unregistered addresses or use them on public computers. Routers are designed to discard (instead of forward) unregistered addresses. What this means is that a packet from a computer with an unregistered address could reach a registered destination computer, but the reply would be discarded by the first router it came to. There is a range for each of the three classes of IP addresses used for networking:
Although each range is in a different class, you are not required to use any particular range for your internal network. It is a good practice, though, because it greatly diminishes the chance of an IP address conflict.
Security and Administration In specific circumstances, Static NAT, also called inbound mapping, allows external devices to initiate connections to computers on the stub domain. For instance, if you wish to go from an inside global address to a specific inside local address that is assigned to your Web server, Static NAT would enable the connection.
Some NAT routers provide for extensive filtering and traffic logging. Filtering allows your company to control what type of sites employees visit on the Web, preventing them from viewing questionable material. You can use traffic logging to create a log file of what sites are visited and generate various reports from it. NAT is sometimes confused with proxy servers, but there are definite differences between them. NAT is transparent to the source and to destination computers. Neither one realizes that it is dealing with a third device. But a proxy server is not transparent. The source computer knows that it is making a request to the proxy server and must be configured to do so. The destination computer thinks that the proxy server IS the source computer, and deals with it directly. Also, proxy servers usually work at layer 4 (transport) of the OSI Reference Model or higher, while NAT is a layer 3 (network) protocol. Working at a higher layer makes proxy servers slower than NAT devices in most cases.
A real benefit of NAT is apparent in network administration. For example, you can move your Web server or FTP server to another host computer without having to worry about broken links. Simply change the inbound mapping at the router to reflect the new host. You can also make changes to your internal network easily, because the only external IP address either belongs to the router or comes from a pool of global addresses. NAT and DHCP (dynamic host configuration protocol ) are a natural fit. You can choose a range of unregistered IP addresses for your stub domain and have the DHCP server dole them out as necessary. It also makes it much easier to scale up your network as your needs grow. You don't have to request more IP addresses from IANA. Instead, you can just increase the range of available IP addresses configured in DHCP to immediately have room for additional computers on your network.
Multi-Homing In addition to maintaining a reliable connection, multi-homing allows a company to perform load-balancing by lowering the number of computers connecting to the Internet through any single connection. Distributing the load through multiple connections optimizes the performance and can significantly decrease wait times. Multi-homed networks are often connected to several different ISPs (Internet Service Providers). Each ISP assigns an IP address (or range of IP addresses) to the company. Routers use BGP (Border Gateway Protocol), a part of the TCP/IP protocol suite, to route between networks using different protocols. In a multi-homed network, the router utilizes IBGP (Internal Border Gateway Protocol) on the stub domain side, and EBGP (External Border Gateway Protocol) to communicate with other routers. Multi-homing really makes a difference if one of the connections to an ISP fails. As soon as the router assigned to connect to that ISP determines that the connection is down, it will reroute all data through one of the other routers. NAT can be used to facilitate scalable routing for multi-homed, multi-provider connectivity. For more on multi-homing, see Cisco: Enabling Enterprise Multihoming. For lots more information on NAT and related topics, check out the links on the next page. Lots More Information! Related Articles
Example Using DV Series DVRs 
The above illustration shows an alternative networking setup. In this setup, only the router has an IP address assigned by the ISP. The computers attached to the LAN have IP addresses assigned to them by the router. In addition, these IP addresses are "private" IP addresses that are not valid addresses on the open Internet. The router must be a special kind of router, called a "network address translation" (NAT) router. This type of router converts the IP address shown to the world on outbound connections from a private IP address to the IP address assigned to the router. It also maintains information that allows it to return requested data from the Internet to the machine that requested it.
This illustration shows a diagram of how the private IP addresses of computers behind the router get converted to a valid address for communication over the Internet. You can think of an Internet communication as a person-to-person telephone call. The IP address is similar to a telephone number; it connects you with a destination but doesn't specify who you want to communicate with at that address. When you want to talk to a specific person on the remote side, you tell whoever answers the telephone that you want a particular person, and then you get to talk to that person. Similarly, when an Internet connection is made, you must specify an IP address and a port number. The port number is similar to saying you want to talk to a particular person. In this case, though, the port number is how you identify which "service" you want on the remote machine. The computer on the LAN is requesting a connection with port 80, which is a port reserved for Web servers. A computer on the LAN sends a packet out to the Internet through the NAT router. The computer uses its own IP address as the "from" address, but this address is invalid on the open Internet because it is a private IP address. The NAT router sees the private IP address and rewrites the "from" address on the packet with its own address, which is a valid address assigned by an ISP. The rewritten packet is then forwarded to the Internet. Port numbers play an important part in the translation. In figure 3, the LAN computer has sent a packet from port 20167 (this number is not important, but merely serves as a number we can refer to as we go). The router can either send this packet from its own port 20167, or it can send it from another port if port 20167 on the router is already in use. The router has sent the packet from port 31284. No matter what the router decides about which port to use, it remembers which port it used to send the packet (31284 in this example), so any data packets sent in response to this packet get routed back to the computer that requested them. It can do this because the return packets will be sent to port 31284, which the router remembers was associated with port 20167.
The above illustration shows how Network Address Translation works for return packets. Note that the NAT router rewrites the packet "to" address information on return packets, because the remote side sent the packets to the router, not the computer on the LAN. Figure 4: NAT translation on return data packets outbound connections (where the computers behind the NAT router initiate the connection) are easy, because the router knows where the connection came from and where it is going. But what about inbound connections, where someone from the Internet wants to establish a connection with a computer behind the NAT router? This is a situation that is impossible to resolve, because the person from the Internet only knows router's IP address, not the IP address of any of the machines behind the router. Even if the person knew the actual IP address assigned to a particular computer behind the router, that information would be useless because all of those addresses are private addresses. No router between that person and the NAT router will pass along a request to or from any IP address in the private range. So how can we allow access to computers on the LAN through the NAT router? The answer is by using a technique called "port mapping" or sometimes "port forwarding." With this technique, you can tell the NAT router to send all requests for connections to a particular port to the same port on a particular IP address behind the router. For instance, you can configure the router to send all requests for a connection to port 2345 on the router's IP address to port 2345 on IP address 192.168.1.32. This ability allows us to expose a DV Series DVRs remote access features by setting up a port forwarding entry to forward connections to any given port to the appropriate DV Series DVR. Since the DV Series DVR software allows the user to specify which port is to be used for remote access, each DV Series DVR can listen on its own port, and the NAT router can be configured to connect remote users to the proper DV Series DVR. Setting up a NAT network of DV Series DVRs This section will explain how to set up a network of DV Series DVRs behind a NAT router and a cable modem. The first thing to do is connect the NAT router (such as a Linksys BEFSR41) to the cable modem and verify the basic operation of the router and the cable modem. Consult the router and cable modem documentation for instructions on how to do this. Once the router and cable mode are working properly, connect the DV Series DVRs to the router. The most common situation will be to configure the router to act as a DHCP (Dynamic Host Configuration Protocol) server, and to configure the DV Series DVRs to obtain their IP addresses automatically. The only problem with this setup, as you will see later, is that in order to configure the router to allow external access to the DV Series DVRs, the router must know the IP address of each DV Series DVR on the network. So the best thing to do is to assign an IP address to each DV Series DVR by hand. Choose an IP address in the same private IP address range as the router (usually 192.168.1.x or 192.168.0.x) but outside the range of IP addresses that the router will use for DHCP requests. For example, if you have configured the router to assign IP addresses in the range between 192.168.1.32 and 192.168.1.64, start assigning IP addresses to your DV Series DVRs at 192.168.1.65 or above. The next step is to configure each DV Series DVR behind the NAT router to use a unique port number for remote access. For instance, you might set up DV Series DVR #1 to use port 9999 for remote access, DV Series DVR #2 to use port 9998, DV Series DVR #3 to use port 9997, etc. The actual numbers chosen are not important, but each DV Series DVR must have its own port to use for remote connections. You can configure the port setting on an DV Series DVR by clicking on the "telephone" icon on the tool bar or by selecting "Configure | Remote Access" from the menu bar. If you change the port number, you will have to restart that DV Series DVR before the change takes effect. The final step is to configure the NAT router to route incoming connections to the proper machine. Consult the documentation for your router, but most routers have a web-based configuration interface. Look for a tab that is labeled "port forwarding" or perhaps "external routing." Again, consult your router's documentation for full instructions. When you configure the router's port forwarding setup, you will need a list of all the DV Series DVRs connected to the router, along with the IP address and port number used for each DV Series DVR. Generally you will see a screen similar to the one in figure 5 below (this is a screenshot from a Linksys BEFSR11)
These are screenshots from a Linksys Router’s configuration page. As an example, let's say you had three DV Series DVRs behind the router, configured as shown below. Station IP Address Port Number 1. 192.168.1.128 9028 2. 192.168.1.129 9029 3. 192.168.1.130 9030 With this setup, you would enter information into the router's configuration screen so it looked like the one in illustration on the right. The important parts of the configuration are the port ranges, the protocol (TCP) and the IP Address. Remember to check the "enabled" box if your router has one. Some routers will have you specify a single port, while others will use a range of port numbers. For routers that use a single port, enter in the port you set for that DV Series DVR. For routers that use a range, enter the same port number for both the "high" and "low" values. The DV Series DVR uses the UDP protocol. You will have to set up the router for UDP. Once you have entered all the relevant information, click "Apply" or "submit" or "save" or whatever button is required to save your configuration. When the router returns to the configuration page, confirm that everything you have entered is correct, and proceed to testing. Testing In order to test the setup, you will need to attempt remote access from outside the router. The easiest way to do this is to have another person attempt the connection for you. Uses the Client Software provided and remotely connect to the router's IP address, not the private IP addresses you assigned to the DV Series DVRs. For example, if the router had been assigned IP address 64.34.27.23 and you wanted to connect to DV Series DVR #1 from the setup above, you would use the NetDVR to connect to 64.34.27.23, port 9028. The router would then pass this connection through to 92.168.1.128, port 9028, which would connect you to DV Series DVR #1. |
