Port Forwarding being blocked after working for months , network engineers new security?

[Aberdeenacd]

I have a network camera using RTSP on port 554 at home. I have been accessing it faultlessly from away from home for 6 months. ( I use VLC app on desktop - Win11 or Ubuntu desktops - for viewing the streaming    video )

Suddenly find it does not work away and online port checker tools say this port is blocked. I have another device - a radio - that I also access away from home that uses  a port 5555. This still works ok. I checked my settings on the router - Hauwei HG633 - and they seem as set before and ok. The camera streaming is accessed on  home LAN perfectly. Reasonably confident that my port forwarding is correct. Just leaves explanation  that some external hand that has set a block on port 554. I know that network engineers can block for security reasons but I need 554 open as the camera  access port is not user alterable. I need engineers to check my line to see if 554 is indeed blocked and unblock if it is. My home public IP address has  changed several times but I'm on top of that. Yes camera has static address. A simple setting of port forwarding of 554 external and 554 internal.

Can someone get engineers to check - PLEASE!

[Aberdeenacd]

A remark for the attention of  Mandisa of the Support Team from Aberdeenacd.

I have placed the required address details in My Profile / Private Notes.

I appreciate the unexpected and generous gesture.

A long road has been trodden but we found a solution with the help of your technical

wizard , Keith French , and a lot of head scratching.

Thanks all for the solution.

[Mandisa-TT]

Thank you so much for your findings @KeithFrench I’ve discussed the situation with my manager, and I’m happy to inform you @Aberdeenacd that we will be sending out a new WiFi Hub to you. This should resolve the issues you've been experiencing with port forwarding when using a WiFi extender.

Can you please add your delivery address on the private note on your profile and let me know when done and I will send through the order. 

[KeithFrench]

Hi @Mandisa-TT 

This is an old bug with this ancient HG633 router. When used with a WiFi extender, if the device is connected to the extender's WiFi, rather than the router's WiFi, port forwarding will fail to work. This is because instead of forwarding the port to the device's IP address like any other router, it forwards it to the device's MAC address. The only resolution to this is to change the router to a different model.

[Mandisa-TT]

Thank you so much @KeithFrench, @Aberdeenacd please refer to KeithFrench last post.

[KeithFrench]

Hi @Aberdeenacd @Mandisa-TT 

From the Wireshark trace, I can confirm that the port mapping in your HG635 router has forwarded TCP port 554 to your PC, OK. There is no response, because obviously, you do not have this port open on your PC. Please reinstate the rule so that it points to your Tapo. So the router is not to blame. What I need to do now, is to investigate why this port is not reaching your camera on your local network. Please can you answer these questions:-

• Does the camera appear in the HG635's  Home Network > LAN Devices > Manage Devices as an active device?
• If it does, did it appear in the listing automatically, or did you have to add it manually?
• How does it connect to the router? I assume via wireless?
• If the camera supports both Ethernet & wireless connections, is the port mapping rule on the HG635 pointing to the correct interface's MAC address?
• Does it connect directly to the router or via an extender of some sort?
• Please can you PM me the full IP configuration of this camera?
• I assume it has a DHCP Reserved IP address?
• Does the camera use randomised MAC addressing by any chance?

[Mandisa-TT]

Thank you so much @KeithFrench 

[KeithFrench]

Hi @Aberdeenacd @Mandisa-TT 

I have the Wireshark trace & will respond when I get a response to a PM.

[Mandisa-TT]

Hi @Aberdeenacd thank you for the information. @KeithFrench appreciate your help.

[Aberdeenacd]

 Aberdeenacd  --     Adding to my original thread , here is an encrypted   Wireshark network capture file taken when I used online port checker tool to probe access to port 554 whilst port mapping was set to point to Local Host Win 10 desktop. 

Will PM  password.

[Mandisa-TT]

Thank you @KeithFrench for your help.

[KeithFrench]

Hi @Aberdeenacd 

As you seem to be using TCP (according to your rule and the fact that you are trying to use a port checking website, I think the next stage is to try & ping the camera. However, use a utility called "TCPing" from a Windows PC locally connected to your router.

The easiest way to download & install this is to go to the command prompt & enter this command to install it via the new Windows package manager:-

winget install pj.tcping

This will also add it to the PATH environment variable in Windows, so it can be used anywhere.

Now run it from the command prompt like this:-

tcping <camera IP address> 554

Please PM the results to me.

Thanks.

[KeithFrench]

Hi @Aberdeenacd 

Having tested TCP port 554 on my network proves that there is not a general block on the TalkTalk network for this port. I have never seen them block any ports on the network. I therefore need to find out why this is not working. However, before doing that, please can you answer these questions:-

• RTSP can use port 554 on TCP or UDP, which is yours using, or does it use both?
• I assume that you have tried rebooting the camera?

[mandisa1-TT]

Thank you so much @KeithFrench 

Hi there @Aberdeenacd please do PM @KeithFrench he is one of our experts

[KeithFrench]

Hi @Aberdeenacd 

The most common cause of this would be the changing of the public WAN IP address, but this is obviously not so in your case, with one rule still working. Is this use of port 554, TCP or UDP? I assume that it is the former?

I have just tested TCP port 554 for you (on a different router, as I no longer have one of those routers) and it worked the first time.

Please can you PM me (to preserve your privacy) screenshots of the rule that does not work, so that I can check it for you.

The information below is provided by TalkTalk. For confirmation, please contact @Lorrainef, the manager of the TalkTalk support staff on this forum.

KeithFrench is one of our valued Community Stars and can help with a range of issues related to wireless and networking. At times, he may ask you to send him test results via a Private Message to help analyse/diagnose an issue. Although Keith does not work for TalkTalk, he very kindly shares his time and knowledge to help others.

If you need further help or if we need to take any details such as personal information about your account, like phone numbers, account numbers, etc, one of the TalkTalk team will jump in and help out.

[mandisa1-TT]

@KeithFrench I would appreciate your advice on this.