Streaming Security Camera Video with VLC

Goal

Setup a streaming video solution that small locations can use easily for broadcasting small events, security video or other uses. Because those locations may not have a static IP, route video traffic from your main static IP (on your openvpn server) over a tunnel to the remote location.

Overview

The remote location will require internet access. They will be provided with the following equipment:

• Minibox style x86 computer
• Monitor/Keyboard/Mouse
• Axis P1344 camera w/ POE injector OR Axis Q-7401 capture box
• network (2 blue cables are straight through, red is crossover) + power cables

Setup instructions

Axis camera

• Power up camera.
• Connect to web interface of the camera.
• Set admin password (example root:test123).
• Setup -> Video Stream -> Audio -> Check Enable Audio checkbox.
• Setup -> Video Stream -> Image -> Resolution = 640x480.

Axis capture box

• Power up box.
• Connect to web interface of the camera.
• Set admin password (example root:test123).
• Setup -> Video Stream -> Audio -> Check Enable Audio checkbox.
• Setup -> Video Stream -> Image -> Resolution = 720x480.
• Enable anonymous video viewer.

Minibox

• Setup USB key w/ Alpine Linux 2.4.5.
• Enable apk cache.
• Install the following packages:

alpine-base xscreensaver xf86-input-evdev openssh vlc rsync vim openvpn gawk bash vlc-xorg alsa-utils alsaconf alsa-lib vlc-daemon gstreamer gstreamer-tools gst-plugins-ugly gst-plugins-good gst-plugins-base chrony xf86-video-vesa linux-firmware pciutils usbutils iptables dnsmasq beep shorewall dnscache slim udev nmap tcpdump xf86-video-openchrome abiword busybox evince firefox gnumeric lxdm ristretto sudo xf86-input-keyboard xf86-input-mouse xfce4 xorg-server iftop

• /etc/network/interfaces

auto eth0
iface eth0 inet dhcp

auto eth1
iface eth1 inet static
	address 10.14.197.1
	netmask 255.255.255.224

auto lo
iface lo inet loopback

• /etc/ssh/sshd_config - disable password auth
• /root/.ssh/authorized_keys - install all needed keys
• adduser jbilyk
• /etc/chrony/chrony.conf

chrony/chrony.conf 
# default config

server time.nrc.ca 
initstepslew 10 time.nrc.ca
commandkey 10
keyfile /etc/chrony/chrony.keys
driftfile /etc/chrony/chrony.drift

cmdallow 127.0.0.1

allow all

• rc-update add chronyd
• /etc/conf.d/dnscache

# DNSCACHE configuration variables:

# IPSEND - ip address to use for requests use 0.0.0.0 for default route
IPSEND=0.0.0.0

# CACHESIZE - Num bytes to use for the cache
CACHESIZE=1000000

# IP - IP addr to listen on
IP=127.0.0.1

#------------------------------------------------------------------------
# The following are flags.  Setting them to ANY value
# (even "false" or "off") will turn the feature on.
#------------------------------------------------------------------------

# HIDETTL - always return TTL as 0
#HIDETTL=

# FORWARDONLY - servers/@ are parent caches, not root servers
#FORWARDONLY=

# UPDATEHINTS - refresh zone hints
UPDATEHINTS=1

• rc-update add dnscache
• /etc/dnsmasq.conf (replacing MAC and IP on dhcp-host line as required)

domain-needed
bogus-priv
no-resolv
no-poll
server=10.14.197.1
interface=eth1
except-interface=lo
bind-interfaces
expand-hosts
domain=example.com
dhcp-authoritative
cache-size=0 # dnscache does caching
no-negcache
log-dhcp
dhcp-range=10.14.197.10,10.14.197.20,255.255.255.224,12h
dhcp-option=option:ntp-server,10.14.197.1
dhcp-option=6,10.14.197.1,10.14.0.1
dhcp-option=option:domain-search,example.com
dhcp-host=00:40:8c:c4:7e:99,10.14.197.5,24h # Axis Camera
dhcp-option=option:ntp-server,10.14.197.1
dhcp-option=2,-18000

• rc-update add dnsmasq
• /etc/openvpn/openvpn.conf

client
dev tun
proto udp
remote public.ip.addr.ess 1194
resolv-retry infinite
nobind

persist-key
persist-tun

ca ca.pem
cert cert.pem
key key.pem

comp-lzo
verb 3

script-security 2
up /etc/openvpn/up.sh
down /etc/openvpn/down.sh

• Extract your openvpn cert parts into /etc/openvpn/

openssl pkcs12 -in %CERTPFX% -cacerts -nokeys -out ca.pem
openssl pkcs12 -in %CERTPFX% -nocerts -nodes -out key.pem
openssl pkcs12 -in %CERTPFX% -nokeys -clcerts -out cert.pem

• rc-update add openvpn
• /etc/resolv.conf.tail

nameserver 127.0.0.1

• /etc/conf.d/vlc

# Sample vlc params suitable for running as a daemon

## --daemon			detach from prompt
## --file-logging		enable file logging
## --logfile			logfile name/path
## -vvv				verbose logging
## -I dummy			disable X11 interface
## --sout PARAMS		encoding parameters
##				Do NOT quote 'PARAMS' otherwise shell expansions will broke vlc

VLC_OPTS="-I dummy --daemon --file-logging --logfile /var/log/vlc/vlc.log --loop --rtsp-caching=200 rtsp://10.14.197.5:554/axis-media/media.amp?videocodec=h264 --sout #standard{access=http,mux=ts,dst=0.0.0.0:8080}"

• rc-update add vlc
• /etc/shorewall/params

A_IF=tun0
B_IF=eth1
E_IF=eth0

• /etc/shorewall/interfaces

A	$A_IF		detect		dhcp
B	$B_IF		detect		dhcp
E	$E_IF		detect		dhcp

• /etc/shorewall/policy

A	all	REJECT		info
B	A	ACCEPT
B	E	ACCEPT
all	all	REJECT		info

• /etc/shorewall/rules

# FW management
ACCEPT		A		fw		tcp	22,80,443

# Manage the camera from the HQ if need be
ACCEPT		A		B		tcp	80

ACCEPT		fw		all		icmp	8
ACCEPT		fw		E		tcp	53,80
ACCEPT		fw		E		udp	53,1194
ACCEPT		fw		B
ACCEPT		B		fw		udp	53
ACCEPT		B		fw		tcp	53
ACCEPT		A		fw		tcp	8080

• /etc/shorewall/zones

fw	firewall
A	ipv4
B	ipv4
E	ipv4

• /etc/shorewall/shorewall.conf

STARTUP_ENABLED=Yes
...
IP_FORWARDING=On

• rc-update add shorewall
• rc-update add lxdm
• home/jbilyk/.config/autostart/firefox.desktop

[Desktop Entry]
Encoding=UTF-8
Version=0.9.4
Type=Application
Name=firefox
Comment=
Exec=nice -n 5 firefox
OnlyShowIn=XFCE;
StartupNotify=false
Terminal=false
Hidden=false

• Set FF homepage to 10.14.197.5 (replacing with ip address of Axis)
• lbu commit
• Plug in internet connection to eth0.
• Plug in crossover cable to axis PoE injector and straight through to Axis.
• Plug in line-out from mixer to axis.
• Power up blackbox with monitor, keyboard, mouse connected.
• Once desktop appears, power on axis.

OpenVPN router

• /etc/shorewall/rules

DNAT		E		G_196:10.14.196.10	tcp	8080	-	public.ip.addr.ess

• /etc/shorewall/masq

tun0			0.0.0.0/0	10.14.196.1	tcp	8080

End User Instructions

Please verify that all of the following components shipped properly:

• Router
• Monitor
• Camera
• Camera power injector
• 2 x 50' blue network cables
• 1 x 14' red network cable
• 2 x 6' black power cables
• 1 x AC power brick
• 1 x monitor video cable
• 1 x keyboard
• 1 x mouse

• Place router in desired location. It should be placed on a flat, stable surface.
• Place monitor nearby to the router.
• Use one 6' power cord, connect to the monitor and power the monitor on.
• Connect the monitor video cable from the monitor "RGB" port to the corresponding port on the router.
• Place camera power injector in desired location.
• Connect red network cable from the "Data In" jack on the power injector to the router port labelled "Camera".
• Connect Internet connection to the router port labelled "Internet" using a blue network cable.
• Connect keyboard and mouse to USB ports on the rear of the router.
• Plug the AC power brick into the router and then an available power outlet. The router will turn itself on automatically.
• Wait for a 3 toned beep from the router and the desktop environment to appear. (Note: Mozilla Firefox will open with the error message "Well, this is embarassing". This is normal.).
• Connect blue network cable from the camera to the "Data & Power Out" jack on the power injector.
• Once the light on the top of the camera turns green, click "Start New Session" in Firefox. A video window should appear after a brief delay.
• Adjust the focus and zoom of the camera manually using the dials on the front of the camera.
• To test the stream on the remote location end, open VLC on a computer with Internet connectivity, then run File -> Open Network Stream and connect to http://public.ip.addr.ess:8080.