1. Skip to navigation
  2. Skip to content
  3. Skip to sidebar

Port-Forwarding 101

One of the many benefits of IP cameras is their ability to act independently of a PC. Being a standalone device you simply plug it into a broadband enabled router or switch and with a bit of work you can access your camera’s video footage and administrator pages from anywhere in the world. It is not uncommon for people to use cameras to keep an eye on their home, elderly relatives, driveways or even pets and they can do so from work, from holiday or even from another country, but external access made available through port forwarding is also necessary at larger scales.

Here at Network Webcams Tech HQ we find that most people run into a basic snag which prevents them from being able to access their camera over the Internet – by default, if you try and gain access to your home network from anywhere on the internet you will find that the firewall in your router will block that incoming access. This is great for your everyday security but not so great when you want to view your camera. ‘Port-Forwarding’ is rarely, if ever, enabled by default.

In this article I will explain just what that means and point out the things to consider when setting up your IP camera for remote Internet access.

There are 3 main areas you have to consider when setting up external access to your camera:

  • Local Area Network (LAN)
  • Firewall / Router
  • Wide Area Network (WAN)
Port forwarding schematic image

A graphical representation of basic port forwarding

I will look at these in order. In the Local Area Network section I will discuss how to set up the camera in preparation for external access. In the Firewall section I will look at configuring your router to allow incoming traffic from the Internet and finally in the Wide Area Network section I discuss how you access your camera from another computer on the Internet.

Local Area Network (LAN)

The Local Area Network is basically the structure of the computer equipment you have at home. This could include one or more computers/laptops, a router which is plugged into the phone line and of course your network camera. On the Local Area Network side of things we need to set up the camera in preparation for external access. Let’s take a look at the following items which need to be considered when preparing your camera:

  1. Set up your camera with a static local IP address
  2. Input the correct subnet mask and default gateway addresses
  3. Set up your DNS server addresses
  4. Configure the port number(s)

1. Static IP

If you allow the network to automatically allocate an IP address to the camera each time you turn it on then chances are the address could change in the future. You really want to ‘fix’ the IP address in the camera so that it never changes because when you configure the router you will point to the camera’s IP address. If this keeps changing then the rules in the router will break and not function. Remember that local IP addresses have to be unique for every device or you may find devices will clash and fail to communicate. You will be able to set a ‘static’ IP address in your camera. Some cameras will use the word ‘static’ while other cameras will say something like ‘use this IP address’. Consult you camera’s manual for the correct configuration.

Note that in some routers it is possible to assign port forwarding against the camera’s MAC address. This is useful if you want to keep your camera on a DHCP address and not ‘fix’ the IP.

2. Subnet Mask / Default Gateway

The subnet mask will almost always be 255.255.255.0 (the default for what’s known as a ‘Class C’ network). This gives the average home user 254 useful addresses to allocate to their home network, which is more than enough (unless you’re running a supercomputer made up of 253 Raspberry Pi!).

The Default Gateway (sometimes called Default Router) is nothing more than the local IP address of your router – i.e the last ‘hop’ before the data leaves your network and travels outwards to the Internet.

Make sure both of these are entered into the camera when you are entering the static IP address. If you miss this step your data will have nowhere to go.

3. DNS Server Addresses

There will normally be 2 of these in your camera (but not always). DNS servers take the names we give websites and translate them to their source IP addresses. It means we don’t have to remember lots of complicated numbers and can visit websites and networks by name instead of number. For example the URL http://www.google.co.uk translates to it’s original IP: 209.85.135.147. Without DNS translation you will find that your camera will be unable to FTP or email out correctly as it won’t be able to translate the domain names to their destination IP addresses.

Your DNS server addresses come from your ISP and should be detailed on the letter you received when you first connected to the service. If you don’t know what they are then you can input your router’s local IP address in the DNS server 1 (or Primary DNS server) position and the router will do it automatically for you. Google, kindly operate both a primary and a secondary DNS server for public use. the addresses are 8.8.8.8 and 8.8.4.4 respectively.

4. Configure the port number

Typically when one computer communicates with another computer over a network the information is carried using a specific port number. Many ports have specific uses such as email or FTP and a full list of common ports is available on the Internet. It’s not so important to know the full list though, you’ll be glad to hear…

You will find that the majority of network devices which are accessible using an Internet browser will be set as standard to port 80, including IP cameras and routers etc. This is due to the standard port for HTTP, or information being displayed through an browser, being port 80.

I would advise that you alter the default port number in the camera to something which is not being used in the list of common ports. We do this for a number of reasons. Like local IP addresses, port numbers have to be unique. If you have your camera on port 80 and your router on port 80 you will only be able to access one of these devices from the Internet using this method. It is also to promote security to your network. It will keep the camera safer if someone was to attempt to maliciously enter your network, as it won’t be available on the standard port and they will move on to the next router after finding nothing. Don’t worry though, even if someone did find a camera on your network it will be password protected and almost impossible to access without the password, provided you don’t use the default password and do keep the firmware up to date.

Important – when changing to a custom port number the URL for your camera will change both internally and externally. For example if we changed our camera on http://192.168.0.90 from port 80 to port 4440 we would have to use http://192.168.0.90:4440 to connect to the camera, specifying the port number explicitly at the end of the IP address. This is the same for accessing the camera externally.

Firewall

The firewall in your router does a great job of blocking unwanted traffic to your network. A good analogy is to think of it as a reception desk in a hotel. To gain entry to your room you must first speak to reception who will check you in and give you a key. If you attempt to enter a room unauthorised you will be stopped and ejected from the building (unless you sneak in through the backdoor, or dressed as a maid, but that’s a whole other blog post 😉 ).

What we ultimately want is to allow access to your camera from anywhere on the internet but stop all other unsolicted attempts to access your network. We do this by adding a firewall rule to your router.

Now we’re afraid there just isn’t enough room on this blog entry to provide port-forwarding instructions for every make and model of router but the general principle is the same for all. That principle is:

For any WAN user accessing your camera port >> allow access and forward them to the camera’s local IP address

You will be able to find instructions for your specific make and model of router from this great website:

https://portforward.com/router.htm

And you can see full instructions for a Netgear DG834 router below as an example:

HOWTO: Set Up External Access to Your Camera Using a Netgear Router

Wide Area Network (WAN)

The Wide Area Network (WAN) is essentially the Internet. When it comes to accessing your camera from the Internet you need to know what your external IP address will be. This will be your unique address for your network which you can use from anywhere on the Internet and it is known as your ‘public IP address’.

You can find out what your public IP address is by asking your ISP as they allocate you one when you sign up for your Internet service, or each time you connect. You can also find out for yourself by visiting the following website: www.mycamip.com. The site will show you the public IP from the network you view the site from.

Dynamic IP vs Static IP

Unfortunately most home domestic broadband accounts will have a dynamic public IP. This means that your address will change periodically which could prove problematic when trying to access your network from the internet.

There are two ways to get around this problem.

  1. Static IP
  2. Dynamic DNS

1. Static IP

The ideal scenario is that you receive a static IP address from your ISP. They can normally do this pretty easily but there will probably be a small charge for the service. This would mean that your public IP address would never change, so you should have no trouble connecting to your network externally.

2. Dynamic DNS

This provides you with a means to give your public IP address a meaningful name while in the background it will automatically track any changes to your public IP address.

A wide range of routers will support this function and offer connections with leading dynamic DNS services on the Internet such as DynDNS or No-IP. These services are normally free to use.

Alternatively, some IP camera manufacturers build in their own dynamic DNS services into their devices and can be activated as part of the initial set up procedure of the camera.

For more information about Dynamic DNS please read our blog article: Dynamic DNS, or Do I Really Need a Static IP Address?

See our HOWTO: guide for setting up your Axis camera with their Axiscam.net service: HOWTO: Register your Camera with Axiscam.net

Accessing your camera

Once you know your public IP address then accessing your camera should be easy from here on. Simply type in your address from anywhere on the Internet, remembering to specify the port number if it’s anything other than 80, and you should have access to your camera! An example would look something like: ‘http://mycamera.viewnetcam.com:4440’ which would be a Panasonic IP camera configured for access on Port 4440 and set up using Panasonic’s dynamic DNS service ‘Viewnetcam.com’.

NAT Loopback

One last thing to note. When accessing your camera using your public IP address you may run into a small problem known as NAT Loopback. What this generally means is that if you try to access your camera using your public IP address from the same network the camera is plugged into then you will find that you may not be able to connect. This is fairly normal and it’s quite common for your router to block this kind of traffic.

The only real way to remedy this is to have a router which supports a NAT Loopback function, such as a Draytec Vigor 2600, so the first thing to do is check for that. If it doesn’t then you will have to use your local IP address to access your camera from the local network and use your public IP address to access your camera from anywhere else from the Internet.

And that forms the basics of port forwarding. Nowadays, with on-the-go access a standard demand, port forwarding is more relevant than ever – we all have mobile phones and tablets – and more and more of our devices have remote access features built in. Port forwarding needs will diminish over the coming years as more and more manufacturers embrace https tunnelling (a whole other topic!) which eliminates the need for port forwarding.

One final thing. With hacks on the rise and the prevalence of cameras which are less than mature in their software development, we would recommend to think carefully before opening ports and allowing remote access. Consider whether it’s really necessary for your needs and also consider whether you need access from one or a few locations (and can perhaps allow access only from a limited set of IP addresses).

As usual, if you have any questions please leave your comments below.

[Note: this post updated October 2017]

Published on October 22nd, 2007 by Greg

38 Responses to “Port-Forwarding 101”

  1. rams says:

    hey guys

    can we connect our camera through the protocol mmc
    because In my office firewall, there is a policy which denies multimedia traffic to pass through http protocol

    therefore one of my collegues has setup ip camera through mmc protocol
    can i get more details on it

  2. David Hysom says:

    Thanks for an informative, well-written post! It’s answered a lot of questions I’ve had — got my first cctv a few weeks ago, and have so far been unable to view it over the internet. Looks like know I know what to do to fix. Thanks again!

  3. Greg says:

    Thanks David,

    If you run into problems you can check out the rest of our blogs where you can find excellent help specific to your case.

    https://www.networkwebcams.co.uk/blog/

  4. raja says:

    hi all

    i need your help on my Ipcam.

    i have :-
    1 ipcame
    1 Wierd DSL router (my internet)
    1 wireless router(wifi access)

    Currently my ip cam is connedted to DSL router, its working fine with my dyndns.But i want to change my ipcam connect to my wireless router

    Do i need to configure port forwarding to my wireless router? and do i need to delete the port forwarding at my DSL router ?

    please mail raja99a@yahoo.com

    Thanks
    🙂

  5. Greg says:

    @raj: This is when port-forwarding gets tricky Raj.

    Start at the Internet side and think about an incoming connection:

    A request to access your camera will enter your network at the gateway which is your DSL router. So you need to add a rule in the DSL router to forward the request to your wireless router.

    Once the request hits your wireless router you need to add a rule to forward the request to the camera.

    To be honest I would suggest you pick up a cheap DSL wireless modem router which can handle both, it will be easier and a tidier solution.

  6. IP Girl says:

    I am doing all that but when I enter the DNS with the port I am being routed my ISPs portal and not my camera….Keep in mind my ISP placed a wireless receiver on top my roof, to which I connected to Wireless Router then camera and PC….

    So I believe it is only going as far as the dish on top my roof and that its not accessing the router or whats internal to my LAN……….

    Helppppp how do I fex this??

  7. IP Girl says:

    Is it that my ISP has to add the rule to the dish on top of my roof to forward all requested to my Wireless Router?

  8. Greg says:

    I would contact your ISP for clarification on this.

  9. siren says:

    What can I do to remote view thru internet if my company blocks?
    I’ve tried using other ports, remote pc access, non works.

  10. Greg says:

    Have you tried having the camera on port 80? Your company shouldn't block that port. Otherwise you may need to have a word with the IT dept and see what they suggest?

  11. toykie says:

    Hi! Please help me, we set-up a panasonic camera and we assigned a static IP for the cam with port 10080. We also use DDNS service from dyndns.org. But once we access the camera we are directed to the router’s configuration page. We used port 80 before but it has a problem, it always times out.. please help.. do we have to use same IP address for the router and camera?

  12. Kevin says:

    Try accessing your camera by adding the port number at the end of the url. The format is:

    http://*ip-address*:port

    i.e.

    http://192.168.0.5:10080

    You cannot use the same IP as your router for the camera.

  13. toykie says:

    hi.. we have tried that it works fine (http://*ip-address*:port) before, when we used port 80. we can access it inside LAN but when we use DDNS via dyndns.org, it times out.. is this what you call the NAT loop back? we contacted our ISP but they claimed that they are not blocking the ports..

  14. Greg says:

    @toykie:

    Yes, if you are using the dyndns.org address from the same local network as the camera then you could be suffering NAT loopback.

    Try the dyndns.org address from another computer across the Internet. To see if it works.

  15. hitmanpty says:

    exelent explanation. very well done

  16. Don says:

    I’m just trying to access a client’s webcam for which I have the IP address. The camera is mounted to display the client’s Digital LED Sign display, which is controlled by a partner 500 miles away.

    I’d like to know simply where can I enter the IP address to view the camera’s images?

    Thanks.

  17. Greg says:

    You should just be able to enter the IP address of the camera into a web browser.

    Be sure that you are using an 'external' IP address and not a 'local' IP address. Local IP addresses won't work across the Internet. (local IP addresses typically start with 192.168…)

  18. Raj Kalangutkar says:

    Hi I tried port forwarding on my router and as far as I know I have configured it correctly. I also I have the ISA server installed on my network. So when I try to access my camera over the internet it points to my router configuration page. Now I do not know if it is anything to do with the ISA server or it is something to do with me trying to access the camera over the internet but from the same network as the camera. Or is it that I have to do some sort of routing??

  19. Greg says:

    @Raj:

    Sounds very much like a problem you get when you try to access your camera using the Internet address from the same local network as the camera.

    Try testing from a different computer in another location or ask someone to test the connection for you.

  20. Stuart says:

    I have a BL-C210 and have set up using a PC and the disc supplied. Can access the camera on the PC and 2 other MACs on the local network. However, when I enter my viewnetcam domain I get the router homepage. I will try from a remote connection later and see if it works. I guessing it’s a port forwarding or LAN access problem? Great site by the way, very informative.

  21. Greg says:

    @Stuart:

    Yes, you'll need to check that the port forwarding is in place.

    It could also be NAT loopback. This is when the port forwarding is already set up but you aren't able to access the camera from the same local network using the public (external) IP address.

    NAT loopback is quite normal and common and very dependent on the type of router you have. We say use the local IP address on the local network and your Viewnetcam address from any other location on the Internet.

  22. Dewald says:

    I don’t understand why the camera should have a different port number than 80 when used on a LAN. The camera is uniquely identified by its IP address. Is the port number not just used by the camera’s software? There shouldn’t be any software conflict inside the camera.

  23. Greg says:

    Hi Dewald,

    It's fine to use port 80 for the camera.

    The only reason for changing it would be if you have multiple cameras because (generally) you will only have 1 external IP address and to differentiate between cameras when accessing remotely we would use different HTTP port numbers.

    However if you have a router which supports port mapping you could still keep all cameras on port 80 on the LAN and just map different external ports to the local IP addresses of the cameras.

    Of course the other reason for changing the camera is if you need to access another device on your network using port 80.

  24. aggelos says:

    Hello, i want to install 2 ip cameras(haven’t bought them yet). I have read several manuals about the installation, but i have a question to ask. The manuals refer that i have to give a unique ip adress for each camera but i thought that if i give for example for the cam1 the local ip adress 192.168.1.200 and portforwarding 1000 and for the other camera 192.168.1.201 and portforwarding 1001 i will not have access to the first camera with local ip adress(192.168.1.200) because the last local ip adress of the pc would be 192.168.1.201. I thought that i could give the cameras the same local ip adress but in diffferent ports, so i could watch my space through ddns. Is my thought right?

  25. Greg says:

    The local IP addresses of the cameras must be unique so putting on on 192.168.1.200 and one on 192.168.1.201 is right.

    When you access the cameras remotely from the Internet you will (typically) only have 1 public IP address so to be able to select which camera you want to view you would give them different port numbers.

    On a class C subnet (192.168.1.xxx) you can have from 192.168.1.1 to 192.168.1.254 to allocate to your devices (Your router is probably on 1 or 254 though).

  26. moondraker says:

    Hi,

    I am having a unique problem , my ISP does not allow port forwarding , ifound out that after struggling for two days with port forwarding on my router , is there any way I could by pass the ISP using proxy’s or external servers to connect my camera to the internet .

    Any suggestions would be welcome.

    Thanks in advance.

    ciao….

  27. James says:

    @Moondraker,

    Not really. Unfortunately, if your ISP is limiting remote access then your only option is an outbound connection from the camera. If you have access to an FTP server then you could upload an FTP stream but this would be slow and rather clunky.

    Depending on your camera, you might be able to use a service such as <a href="http://www.securitystation.com/&quot; name="SecurityStation web-based IP camera recording" rel="nofollow">SecurityStation</a>. This would only work for Plug-and-Play cameras, but the software on these would stream footage to the SecurityStation service. You could then view live streams as well as record footage off-site.

    Again, I cannot say this for certain that it will work as I don't know the limitations imposed by the ISP, but using SS with a single camera is free of charge, so there's no harm in trying it. I'd have a quick word with their technical guys and ensure that your camera will be supported.

  28. josephine says:

    Hi i would really love you help.

    I can access my secuirty cam on my computer but on port 85 only have set up port 8090
    and 101 for my iphone.

    the 85 port is only working…
    .thou on my iphone it needs to install active x which it seems it cannt.

    The log in screen appears but i can not log in.

    have installed different apps on my phone but know seem to work. eg. eagle eye (which i saw working overseas).i cam viewer ,super cam

    for the life of me i cannt get it to happen

    any suggestions would be appreicated

    thanks jo

  29. Ghandi says:

    Thanks for the comprehensive lecture.I actually know a lot from this, which I have not known before. Well, like you said ” I should find out my network public IP address” yes, I have done that. My IP is 41.***.***.118, port 80. So, from my understanding I now used it as http://41.***.***.118:80 then search for it on the browser. But it displays error. Pls what else do I do to make it work?

    Thanks,
    Ghandi

  30. James Drinkwater says:

    @Ghandi,

    Make sure you check from somewhere else. If you check from the same location you may encounter problems with NAT-loopback.

  31. John D says:

    I have several Panasonic netcams setup for access through Viewnetcam. Everything works when first setup. After a while outside access stops working on some or all . Sometimes internet access starts working again, but it may be weeks before it happens. I used an online utility to check port forwarding and found that the ports are closed for the cameras that are not accessible. There are no port forwarding entries in the router, for the accessible or the unaccesible cameras. How is port forwarding happening with no PF settings in the router and why might it randomly fail to work?

  32. James Drinkwater says:

    @John D:

    I see this happen quite regularly. Your cameras have a system called uPnP (Universal Plug-n-Play) which will automatically try and port forward through your router. However, it's flaky. It will sometimes not work at all. Other times it will work for a while and then randomly drop. It's best to be avoided. This will be why there are no port forwarding rules in your router.

    The best way to avoid this is to turn uPnP off completely in the "Internet" page on your camera. Following this, set the port forwarding up manually in your router. You can then be sure that the rules are stable.

  33. Helen says:

    Help! I bought a night Owl Surveillance Kit, I am having trouble setting it up on the internet. It is asking for the Remote ID, can you please tell me what the Remote ID is and how do I get it?

  34. Kevin Bowyer says:

    Hi Helen,

    Never heard of that one and it's not the kind of thing we can support. I'd suggest going back to the retailer or manufacturer, who should be able to help you.

  35. joseph says:

    please I have never configured an IP camera before and I have bought one…please help with the configuration to my router

  36. Bhushan says:

    Basically,
    My machine is connected to LAN with router having public IP which is connected to internet.
    Now my machine has IP address assigned by LAN (e.g. 172.36.28.3). But public IP of the network from ISP is something like 74.23.10.35.

    So whenever I check my ip address (on http://whatsmyip.net/) it gives IP address of router(which is public IP),

    My requirement is to have TCP communication between external machine having IP address lets say "113.26.2.56" and my machine "172.36.28.3".

    I have tried various DDNS tools such as NO-IP, DynDNS. But all of them are taking IP address of router.

    My confusion is how to tell the router that whenever any request is received for Port no 5001, route it to my local machine.

    Thanks in advance !!!

  37. james says:

    FCC law sates that ips can not block any port, or change any conection unless they tell you they must list all ports that are block and must disclose such list to you, if they have not done this u mayhave case to sue them. also note the fcc also made changes to speed, that up load speed cant be less then 5 mbs and made lot other changes,
    I sugest that if they find that there isp is blocking ports have not told u u seek a lawyer
    or u can get information off net sue small clames cort, throw if u want isp to change u need a lawyer. I know for fack some things isp wont alow u to do they wont disclose it and most there desktop workers don't even know it only there highest level it people do,
    there maybe a case to also sue the it people as well, they to are breaking the law by just blocking the ports. I cant get my cam to work throw my router is in dmz dmz should have no blocks on it, note some ports should be block NetBIOS ports, ssl ports. and log in ports unless u have reson to use such ports over the net. I no lawyer think that anything u do is do the resuch, check what I say is true then move to your next step, I do beleave lawsutes is only way to stop this from going on

  38. Art says:

    Got a problem with tp link camera
    I set on static ip : 10001
    Therfore it works only if ip added as dmz or port in range 25000:50000 are open will randomely connect over an app
    Even if 10001 not forwarded

    Im using ddns from asus
    over external ip gain access over gate 10001