Cannot RTSP from external network

Networking & Firewalls
1

I have a Hikvision IP camera which I am trying to stream using RTSP by coming through Pfsense 2.7 using my internet domain name.

I can RTSP stream the IP camera just fine when it is accessed from my internal (10.0.0.237) network. I can also access it just fine from the internet to view the internal web viewer. I cannot seem to access it from the internet when trying to RTSP stream.

I am using Pfsense 2.7 on my Router and have port forwarded the HTTP port (93) to the appropriate internal address and this allows access to the web viewer.
I have also port forwarded the RTSP port (567) to the same internal address but this does not seem to allow the RTSP through as I have tried three different iOS streaming apps and none connect.

Since it streams and views fine on my internal network I know the IP camera and ports number setup are working fine. Since I can view the internal web viewer remotely I know the Pfsense port forwarding and firewall process are working fine (at least for the HTTP port).

This leads me to think that I am missing something in Pfsense in regards to what I actually need to port forward. Apparently I either have it setup incorrectly in Pfsense or I need to allow something else through Pfsense to view the RTSP stream.

I have the NAT rule setup in Pfsense on the WAN interface as a TCP/UDP pointing to the camera’s internal address and RTSP port number just like I have on the HTTP port rule.

10.0.0.237:93 Views just fine
rtsp://10.0.0.237:567/Streaming/channels/101 Streams just fine

xxxxxx.ddns.net:93 Views just fine (my external domain name port forwarded in Pfsense)
rtsp://xxxxxx.ddns.net:567/Streaming/channels/101 never connects (my external domain name port forwarded in Pfsense)

I can ping xxxxxx.ddns.net fine so I know my router is seeing the RTSP request just fine.

Can anyone tell me if I need to open more ports in Pfsense and what they are or how to configure the RTSP port in Pfsense to allow external streaming?

2

Not an issue I have encountered but I never publicly expose cameras that way. I see you have posted in the Netgate forums as well

3

Instead of port forwarding unauthenticated cameras, have you considered enabling a VPN in pfSense?

4

Yes I posted the issue to numerous sites and still have not gotten any helpful answers.

5

LOL I use to do as you are trying to do, it worked though I wasn’t using pfSense at the time.

As others have said, it’s better to setup a VPN and access your cameras over VPN.

If you are still not sure, checkout Shodan you can view all sorts of IP cameras there !