Streaming Security Camera Video with VLC
Goal
Setup a streaming video solution that small locations can use easily for broadcasting small events, security video or other uses. Because those locations may not have a static IP, route video traffic from your main static IP (on your openvpn server) over a tunnel to the remote location.
Overview
The remote location will require internet access. They will be provided with the following equipment:
- Minibox style x86 computer
- Monitor/Keyboard/Mouse
- Axis P1344 camera w/ POE injector OR Axis Q-7401 capture box
- network (2 blue cables are straight through, red is crossover) + power cables
Setup instructions
Axis camera
- Power up camera.
- Connect to web interface of the camera.
- Set admin password (example root:test123).
- Setup -> Video Stream -> Audio -> Check Enable Audio checkbox.
- Setup -> Video Stream -> Image -> Resolution = 640x480.
Axis capture box
- Power up box.
- Connect to web interface of the camera.
- Set admin password (example root:test123).
- Setup -> Video Stream -> Audio -> Check Enable Audio checkbox.
- Setup -> Video Stream -> Image -> Resolution = 720x480.
- Enable anonymous video viewer.
Minibox
- Setup USB key w/ Alpine Linux 2.4.5.
- Enable apk cache.
- Install the following packages:
alpine-base xscreensaver xf86-input-evdev openssh vlc rsync vim openvpn gawk bash vlc-xorg alsa-utils alsaconf alsa-lib vlc-daemon gstreamer gstreamer-tools gst-plugins-ugly gst-plugins-good gst-plugins-base chrony xf86-video-vesa linux-firmware pciutils usbutils iptables dnsmasq beep shorewall dnscache slim udev nmap tcpdump xf86-video-openchrome abiword busybox evince firefox gnumeric lxdm ristretto sudo xf86-input-keyboard xf86-input-mouse xfce4 xorg-server iftop
- /etc/network/interfaces
auto eth0 iface eth0 inet dhcp auto eth1 iface eth1 inet static address 10.14.197.1 netmask 255.255.255.224 auto lo iface lo inet loopback
- /etc/ssh/sshd_config - disable password auth
- /root/.ssh/authorized_keys - install all needed keys
- adduser jbilyk
- /etc/chrony/chrony.conf
chrony/chrony.conf # default config server time.nrc.ca initstepslew 10 time.nrc.ca commandkey 10 keyfile /etc/chrony/chrony.keys driftfile /etc/chrony/chrony.drift cmdallow 127.0.0.1 allow all
- rc-update add chronyd
- /etc/conf.d/dnscache
# DNSCACHE configuration variables: # IPSEND - ip address to use for requests use 0.0.0.0 for default route IPSEND=0.0.0.0 # CACHESIZE - Num bytes to use for the cache CACHESIZE=1000000 # IP - IP addr to listen on IP=127.0.0.1 #------------------------------------------------------------------------ # The following are flags. Setting them to ANY value # (even "false" or "off") will turn the feature on. #------------------------------------------------------------------------ # HIDETTL - always return TTL as 0 #HIDETTL= # FORWARDONLY - servers/@ are parent caches, not root servers #FORWARDONLY= # UPDATEHINTS - refresh zone hints UPDATEHINTS=1
- rc-update add dnscache
- /etc/dnsmasq.conf (replacing MAC and IP on dhcp-host line as required)
domain-needed bogus-priv no-resolv no-poll server=10.14.197.1 interface=eth1 except-interface=lo bind-interfaces expand-hosts domain=example.com dhcp-authoritative cache-size=0 # dnscache does caching no-negcache log-dhcp dhcp-range=10.14.197.10,10.14.197.20,255.255.255.224,12h dhcp-option=option:ntp-server,10.14.197.1 dhcp-option=6,10.14.197.1,10.14.0.1 dhcp-option=option:domain-search,example.com dhcp-host=00:40:8c:c4:7e:99,10.14.197.5,24h # Axis Camera dhcp-option=option:ntp-server,10.14.197.1 dhcp-option=2,-18000
- rc-update add dnsmasq
- /etc/openvpn/openvpn.conf
client dev tun proto udp remote public.ip.addr.ess 1194 resolv-retry infinite nobind persist-key persist-tun ca ca.pem cert cert.pem key key.pem comp-lzo verb 3 script-security 2 up /etc/openvpn/up.sh down /etc/openvpn/down.sh
- Extract your openvpn cert parts into /etc/openvpn/
openssl pkcs12 -in %CERTPFX% -cacerts -nokeys -out ca.pem openssl pkcs12 -in %CERTPFX% -nocerts -nodes -out key.pem openssl pkcs12 -in %CERTPFX% -nokeys -clcerts -out cert.pem
- rc-update add openvpn
- /etc/resolv.conf.tail
nameserver 127.0.0.1
- /etc/conf.d/vlc
# Sample vlc params suitable for running as a daemon ## --daemon detach from prompt ## --file-logging enable file logging ## --logfile logfile name/path ## -vvv verbose logging ## -I dummy disable X11 interface ## --sout PARAMS encoding parameters ## Do NOT quote 'PARAMS' otherwise shell expansions will broke vlc VLC_OPTS="-I dummy --daemon --file-logging --logfile /var/log/vlc/vlc.log --loop --rtsp-caching=200 rtsp://10.14.197.5:554/axis-media/media.amp?videocodec=h264 --sout #standard{access=http,mux=ts,dst=0.0.0.0:8080}"
- rc-update add vlc
- /etc/shorewall/params
A_IF=tun0 B_IF=eth1 E_IF=eth0
- /etc/shorewall/interfaces
A $A_IF detect dhcp B $B_IF detect dhcp E $E_IF detect dhcp
- /etc/shorewall/policy
A all REJECT info B A ACCEPT B E ACCEPT all all REJECT info
- /etc/shorewall/rules
# FW management ACCEPT A fw tcp 22,80,443 # Manage the camera from the HQ if need be ACCEPT A B tcp 80 ACCEPT fw all icmp 8 ACCEPT fw E tcp 53,80 ACCEPT fw E udp 53,1194 ACCEPT fw B ACCEPT B fw udp 53 ACCEPT B fw tcp 53 ACCEPT A fw tcp 8080
- /etc/shorewall/zones
fw firewall A ipv4 B ipv4 E ipv4
- /etc/shorewall/shorewall.conf
STARTUP_ENABLED=Yes ... IP_FORWARDING=On
- rc-update add shorewall
- rc-update add lxdm
- home/jbilyk/.config/autostart/firefox.desktop
[Desktop Entry] Encoding=UTF-8 Version=0.9.4 Type=Application Name=firefox Comment= Exec=nice -n 5 firefox OnlyShowIn=XFCE; StartupNotify=false Terminal=false Hidden=false
- Set FF homepage to 10.14.197.5 (replacing with ip address of Axis)
- lbu commit
- Plug in internet connection to eth0.
- Plug in crossover cable to axis PoE injector and straight through to Axis.
- Plug in line-out from mixer to axis.
- Power up blackbox with monitor, keyboard, mouse connected.
- Once desktop appears, power on axis.
OpenVPN router
- /etc/shorewall/rules
DNAT E G_196:10.14.196.10 tcp 8080 - public.ip.addr.ess
- /etc/shorewall/masq
tun0 0.0.0.0/0 10.14.196.1 tcp 8080
End User Instructions
Please verify that all of the following components shipped properly:
- Router
- Monitor
- Camera
- Camera power injector
- 2 x 50' blue network cables
- 1 x 14' red network cable
- 2 x 6' black power cables
- 1 x AC power brick
- 1 x monitor video cable
- 1 x keyboard
- 1 x mouse
- Place router in desired location. It should be placed on a flat, stable surface.
- Place monitor nearby to the router.
- Use one 6' power cord, connect to the monitor and power the monitor on.
- Connect the monitor video cable from the monitor "RGB" port to the corresponding port on the router.
- Place camera power injector in desired location.
- Connect red network cable from the "Data In" jack on the power injector to the router port labelled "Camera".
- Connect Internet connection to the router port labelled "Internet" using a blue network cable.
- Connect keyboard and mouse to USB ports on the rear of the router.
- Plug the AC power brick into the router and then an available power outlet. The router will turn itself on automatically.
- Wait for a 3 toned beep from the router and the desktop environment to appear. (Note: Mozilla Firefox will open with the error message "Well, this is embarassing". This is normal.).
- Connect blue network cable from the camera to the "Data & Power Out" jack on the power injector.
- Once the light on the top of the camera turns green, click "Start New Session" in Firefox. A video window should appear after a brief delay.
- Adjust the focus and zoom of the camera manually using the dials on the front of the camera.
- To test the stream on the remote location end, open VLC on a computer with Internet connectivity, then run File -> Open Network Stream and connect to http://public.ip.addr.ess:8080.