Android Security Camera Network
Intro: Android Security Camera Network
My second instructable! This is my next logical step in my path to creating a cost-effective and flexible security network for my home/office. If you'd like to see how I started this - please do. I will not be covering how to make another low-cost security camera from an android device again in this instructable but will be describing how to setup your network properly.
We shall cover
- Using/viewing more than one device.
- Giving our android devices private static IP addresses for easier viewing.
- Setting up port forwarding.
- Viewing our IP cameras from outside the private/home network.
- Getting the maximum uptime out of our cameras. (Reducing software failures and issues.)
- As a bonus we will also cover how to make some of your in-home devices do some double duty.
STEP 1: It Takes Two to Tango
Cheesy step title, 'eh?
Let's assume that you want to have more than one nifty little android IP camera on your network. Well, as you discovered in the first instructable we can use viewers such IP cam viewer lite (google play store), which supports multiple cameras, a web browser or a real application to pull our video feed for us.
We're just going to merely replicate that action to get another feed. So in a web browser we will simply open another tab, enter our IP address and port 192.168.1.x:8080 and viola. iSpy we simply add another IP camera by clicking the Add button >> IP Camera >> MJPEG tab and enter our IP info.
However...
Yes, I put that in bold. Our router/gateways enjoy renewing our IP addresses on occasion if they are given the IP address through their built-in service called DHCP. So that information we entered earlier into our respective viewers/recorders may be invalid.
Let's fix it...
STEP 2: Static IP Addresses on Android
So let's cover how to get a static IP address on Android first. If you don't need assistance doing this, just click through to the next step.
Goto Settings >> Wifi (turn it on) >> Select the Wifi. A new screen should pop up. Some older versions of android require to long-press on the wifi selection or go into Advanced Settings.
Regardless, once you get there press Edit. Select "Show advanced options".
As you can see by the picture we need to select Static instead of DHCP under the IP settings.
Your gateway may be filled in automatically for you. If not, the gateway IP address is simply the IP addy of your router/gateway. Most consumer routers will have this on their info panel on the back. We can also open up a command prompt in Windows. Start >> Run >> CMD. Type in, without quotations, "ipconfig". Press Enter.
You will see a row that reads as Default Gateway. Viola.
If you're not sure about the prefix length just leave it as the default: /24
DNS is entirely up to you. Once again this may be filled in automatically, but if it is not consider using Google DNS or OpenDNS. Google DNS uses something called DNSSEC to supply a authentication layer to your DNS requests. Increased security! OpenDNS is well known for their smart filters and parental controls. I could not find documentation on whether or not OpenDNS actually uses DNSSEC or not but supposedly they have unique filtering system that doubles up on security.
Google DNS 1 is: 8.8.8.8
Google DNS 2 is: 8.8.4.4
Open DNS 1 is: 208.67.222.222
Open DNS 2 is: 208.67.220.220
We have reduced our chances of being subjected to a DNS middle man hack. We like that.
Next let's have a few words about your router...
STEP 3: I Have a Leaky Roof - Port Forwarding
What is port forwarding?
Essentially port forwarding is when your firewall directs traffic to a certain computer on your network.
Why do we need this?
If you want to be able to access your video feeds from outside your network. If not feel free to move on to the next step.
So how do I do this?
There are scores of routers out in the wild. I cannot possibly tell each and every reader how to exactly step-by-step forward a port on their router. Suffice it to say that I will give a generic overview. You may entirely skip this step by visiting Port Forward.Com or using your GoogleFu to find a guide for your specific router model. Heck maybe there is another instructable here that has your exact needs. By default, we will be forwarding the port 8080 - remember that.
Can I get a hint at least?
Sure, why not. Let's begin...
Accessing your router
As mentioned in the prior step the gateway IP address is the one we will be using for this step (hint: a lot of router's IP address is: 192.168.1.1). Type it into your browser address bar. Hit enter. You will be met with your router's system overview/setup page.
We will want to go into either our Home Network(ing) tab or Firewall option.
Go through the list of connected devices to find your android device hosting your video stream. We will want to Edit this device...usually it is seen as "Edit Firewall Options" or "Port options"/"Forwarding" something of that nature. You should get the separate page that asks for a port range. We're simply using 8080. So you will want to enter 8080 to 8080 for both TCP and UDP. Click Save/Apply. You may have to restart your router for this to take effect.
Are we there yet? No! Continue to the next step....
STEP 4: Dynamic DNS
Alright, so I couldn't come up with a snarky title for this step. Essentially we need to be able to reach our devices from out in the big wild internet. Well, the internet uses the DNS (Domain name system) to find the actual device/computer/server/etc. Unfortunately most of us using broadband/dsl - what have you - do not have access to a static IP from our internet service provider. If you do, great. Go on to the next step. If not, read on.
Duck DNS
Entirely free (ad-supported applications are on some platforms). These ads do not hinder us at all and do not show in the video feed by the way. You will need to visit Duck DNS and sign up for an account. Quite easy if you have a Google+.
Android has it easy
There is actually a nifty application that does this quite easily for us. Here is the play storelink.
Other platforms
Duck DNS hasinstall guides for nearly every platform out there, if you want to run the service on a separate device/server/computer. If your router is capable you may actually go to the DDNS tab and enter your account info along with your Duck DNS token. Tada!
If you have issues, let me know in a comment below. I'll do my best to work it out with you.
Now follow me to the next step...
STEP 5: You Spy, You!
Alright! So, you've made it here. Take a breath. Get a beer.
Accessing
For example's sake, my Duck DNS account is named Knockknock. Well, all I need to do to access my computer from an outside network is to setup my port forwards and from an external device type in: https://knockknock.duckdns.org:8080
Magic!
So the DDNS service resolves our IP address for us and redirects our traffic directly to our IP. Your router's firewall picks up the appropriate traffic and directs it to your device.
Will this work for them all?
Most certainly. You will just have to go back into your router setup/firewall and open the port for each device you wish to access in this manner.
Is this secure?
Yes and no. I would suggest using a username and password along with pre-appending https instead of http. However, someone on your local network can still snoop your packages if the internet connection has not been properly secured with an authenticated DNS service. No fear though! I will be making a separate guide on tunneling your traffic through some encryption protocol at a later time. For now, be wary of your usage. If you're simply watching your driveway or your trash bins (yogi the bear) then it may not concern you much.
STEP 6: Maximum Uptime
So let's talk a little about getting the most out our network and by extension our cameras.
A small checklist for your camera
- Does your device really need a battery? No? Try it without one. Less heat.
- Make sure the screen is off and that the video can be viewed without it on.
- Put the camera in a well-ventilated area that is not moist.
- Make sure IP webcam is set to stream on boot.
- Bad performance? Try reducing your video resolution.
- AutomateIt with the reboot plugin can fix a lot of your problems.
- Rooted phones have a lot more options. CPU usage/underclocking/reboots by schedule/etc.
A few tips
- Upgrade your router. If you're like me and tried to do this with an old b/g router. Get a N router. I would not suggest the newer AC routers as the speed will slow to meet that of your slowest device anyhow.
- Place your router centrally.
- Increase the power output by one or two selections if your router gives you the option. Not too much though. We don't want to fry it.
STEP 7: Until Next Time!
Thank you for reading! I plan on covering DVR software more in depth along with motion detection and alerts.
Be sure to follow me!
10 Comments
zikzak1 7 years ago
Read through your first installment and found that last year I actually
bought IP Webcam Pro! I wasnt able to get around to using it though. One
old Samsung S3 I had factory reset to try and get the most memory out
of but found it wanted to be activated again. (Verizon carrier, but not
activating this phone again) Workaround was when it gets to the
activation screen (right after choosing language), click the Emergency
button. Enter *#83786633 followed by the home key. Then use as normal.
Dont know if that info will help anyone, but I hope so :) Not sure if I
am adding 2 phones plus an existing IP Cam, but adding one phone for
sure. Glad you got into the networking part of this for people. Most
have very limited experience with firewalls and routers. Static vs
dynamic addressing goes right over their heads. You do a fine job of covering all the bases for good networking! I use pfSense for a firewall and have it as my LAN DNS server. I can put 5 DNS servers into the router. I can set it to do DNS caching too, which is nice, but not real necessary for home use. I might make mention of a utility from Gibson Research called DNSBench. It will help you identify DNSSEC DNS servers. If you take the time to build a full custom list of the fastest DNS servers for your location, it will take a while. It will query close to 5k DNS servers and tell you which are fastest. Then whittle down the list to only those with DNSSEC. After that, you can run a related test to check the spoofability of the ones you have entered into your firewall. Awesome stuff! Keep on Keepin on! And Thank You :)
bigfoot-walker25 8 years ago
soapbox23 8 years ago
Great instructable! I was able to set up 2 phones that worked excellent. I wanted to ask more about the security stuff...how did you set up https for the web addresses? I tried just using my duckdns address with https but it doesn't allow me to go through. Do I need to do additional setup? I'm already using a username and password so it's a bit secure but I'd feel more comfortable being able to use https. Please let me know if you can and thanks for sharing this!
Intervein 8 years ago
soapbox23 8 years ago
On chrome, it shows an error "The webpage is not available. ERR_CONNECTION_CLOSED" and when I click details it says "The webpage at https://myusername.duckdns.org:port/ might be temporarily down or it may have moved permanently to a new web address.
Intervein 8 years ago
You may want to try a different port than 8080 or 80. This could be your ISP, as some block ports that they consider "unsafe". I will probably do a guide on setting up a SSL server to encrypt the traffic soon, which would be a work around for anyone having issues attempting to push HTTPS traffic through any port. You could always try the HTTPS everywhere extension for Chrome which supports forcing a secure connection; however, if you do want to connection from say...a public wifi then I do suggest waiting on my SSL server guide, which will cover some basics about a VPN as well.
Another note: make sure your address does not have a slash at the end--after the port number.
soapbox23 8 years ago
I actually did use different ports than 8080 as I felt they weren't that "secure" being that they're usually default ports for something. I'd be interested about setting up an SSL server. Also I'm able to access all of my cameras no problem (I don't have a / after the port either) but I'm just concerned about the security. I should be able to whitelist mac addresses for all devices I want to view the feeds on, right?
Intervein 8 years ago
Mac address white listing is considered a poor security measure. However combined with username/password, mac whitelisting/ip whitelisting, and then perhaps a SSL tunnel for encryption upon all of that you'll have a lot of bases covered.
soapbox23 8 years ago
I see. Well, again thanks and I look forward to you posting your SSL instructable!
soapbox23 8 years ago