The old chestnut - Live View Failed using web browser over the internet?

[George-H]

This seems to be an issue to which I've yet to see a working solution - at least one I can to get to work.

I have (now) two remote sites.

One has 5 Hikvison DS-2CD2146G2-ISU cameras, plus 4 Foscams and an old Foscam FN3109HC NVR (long story). That all works fine with the Foscam NVR recording the Hikvision video via ONVIF. I can view all 9 cameras via the Foscam NVR over the internet by ONLY forwarding HTTPS through the firewall.

I can view the live view of any of the Hikvision cameras via web browser at the site but ONLY if I am on the local LAN. I've NEVER been able to get the live view to work from anywhere else over the internet no matter what ports I forward HTTP, RTSP, SERVER or anything else. All I can do is login the web gui then I get "Live view failed".

The second (new) site has two DS-2CD2146G2-ISU cameras plus a Hivkvision DS-7604NI-K1-4P(C) NVR (all brand new). Exactly the same issue. I can login to the camera and NVR web GUIs on the local LAN and view the live view. From somewhere else over the internet - "Live view failed".

So please, has anyone EVER found a solution to this for HikVision that actually works?

Before anyone asks, NO, I will NOT use Hik-Connect. I must work without the involvement of any 3rd party service even if it is HikVisions.

I've also tried Edge in IE mode and the Chrome IE tab - don't work. At least not in this situation, viewing remotely over the internet using ONLY a web browser and forwarding the minimum number of ports and NOT using the default ones.

Theoretically using the web gui, the ONLY port you should need for live viewing over the internet is HTTPS (why oh why would anyone use HTTP these days?). If anyone knows different I'd love to read their explanation complete with how you are supposed to tell a web browser to use custom ports for RTSP or SERVER. The standard security recommendations being to NOT use the default ones over the internet.

Does anyone know a solution to this issue?

It does leave me wondering why a much lower quality bit of Foscam kit (NVR and cameras) can do something which HikVision seem unable to.

I'd love to be proved wrong by being showin how to make it work.

Just out of interest, the ONE way I found to remote live view HikVision cameras over the internet is on my Android phone using TinyCam Pro and forwaring a custom HTTPS port and RTSP (telling TinyCam to use ONVIF).

However, I need it to work over the internet from a remote PC just using a web browser.

Any suggestions/ideas please?

 

[David]

@George-H,
I use the VPN server on my router, when I access remotely I'm connected to the home LAN, with the same functionality. Most public wifi networks are ok, some mobile networks can be a problem. A router WAN public IP address helps.
These days my VPN connection uses TLS(SSL) and is secure, another option is L2TP with IPSec.

David

 

[George-H]

Hi David,

A good suggestion which I am already in the process of implementing.

The older site, with the most cameras and the Foscam NVR, already has a Draytek Vigor 2865 which is there for precisely that purpose. Full remote management of the CCTV system and the PCs on site. It also has an Axis C1310-e network horn speaker which is really fun!

The new small site I'm buying another Vigor 2865 for to replace the existing BT Business Hub 2.

VPN is the more secure way to do it.

However, it is still quite annoying that getting live view to work through the web GUI using just a web browser with HikVision, from other locations over the internet, seems to be almost impossible.

I'd understand it if HikVision just stated "For XYZ reasons this is not supported". But they don't. At least not anywhere I can find.

Of all the things Foscam do - and most of it isn't very good - the ONE thing they did really well was the live view on their FN3109HC NVR. Do port forwarding of a custom port for HTTPS and it just works (at least using Edge in IE mode or the IE Tab extension in Chrome and their plugin). It even automatically switches between the sub streams for the 9 up view and main stream if you double click on the feed from a single camera. Even their own VMS software can't do that. But then their VMS software is so garbage as to be unusable.

Addition to my original post - I forgot to mention that I'm not using the PoE ports on the NVR. I'm using a separate PoE switch with the NVR's main LAN port and all of the cameras connected to that. I want to get everything working before adding the additional complexity of having to configure port forwarding on the NVR as well. At least until I become more familiar with HikVision NVRs. The NVR is relatively basic and the intrusion and line crossing configuration on the cameras GUI is much superior to that in the NVR's GUI.

 

[David]

VPN is the more secure way to do it.

Definitely, around 2014 I bought a Draytek 2762ac mainly for VPN. I am looking to upgrade it. I also use the Draytek VPN app on all my devices.

Before my vpn I had similar problems to you, vpn is a lot better.

David

 

[JB1970]

All I can do is login the web gui then I get "Live view failed".

There should be no issues viewing the cameras via web browser. It's usually just a case of ensuring you have Local Service Components/WebComponents installed and an up to date browser. It's a pain in the backside for a Mac user but should be fine with Windows. Alternatively you could use iVMS-4200 which gets around the various web browser compatibility issues. The cameras or NVRs are added using the server port so that would need forwarding (though you could avoid that by using VPN as @David suggested)

Before anyone asks, NO, I will NOT use Hik-Connect. I must work without the involvement of any 3rd party service even if it is HikVisions.

Hik-Connect the app shouldn't be confused with Hik-Connect the service. You can use the app in Visitor Mode without either the mobile device or the NVR/camera being logged into the Hik-Connect service. That will allow live view, playback and access to remote configuration via the server port.

 

[George-H]

There should be no issues viewing the cameras via web browser. It's usually just a case of ensuring you have Local Service Components/WebComponents installed and an up to date browser. It's a pain in the backside for a Mac user but should be fine with Windows. Alternatively you could use iVMS-4200 which gets around the various web browser compatibility issues. The cameras or NVRs are added using the server port so that would need forwarding (though you could avoid that by using VPN as @David suggested)



Hik-Connect the app shouldn't be confused with Hik-Connect the service. You can use the app in Visitor Mode without either the mobile device or the NVR/camera being logged into the Hik-Connect service. That will allow live view, playback and access to remote configuration via the server port.

Hi JB1970

Agreed - there should be no issues. And it does indeed work fine when on the same lan as the cameras and NVR (or connected to that lan via VPN).

However, using the same test PC (a laptop in this case) which definitely has the Local Service Components/WebComponents installed, when trying to access either the camera web GUI or NVR web GUI over the internet through the site's router/firewall using port forwading it does not work.

I can access the web GUI but no live video. I've never been able to get it to work in this situaton using any of my HikVision cameras. Doesn't matter what ports I forward, even forwarding ALL of HTTPS, SERVER, RTSP ports - still Live Video Failed.

The cameras at the larger site are 4 x G3 and 1 x G5 and the new small site are both G5. None of them or the DS-7604NI-K1-4P(C) work in this situaton.

It SHOULD work and, unless someone can explain clearly otherwise, it SHOULD work only forwarding the HTTPS port. But it does not.

 

[JB1970]

which definitely has the Local Service Components/WebComponents installed

Check which version you have installed. I had an issue recently being unable to get live view working even locally until I updated. Latest Local Service Components is 1.0.0.60 and I needed to manually uninstall the previous version first.

it SHOULD work only forwarding the HTTPS port. But it does not.

I've not tried TBH and have always had the server port forwarded as thats what's needed for the apps to connect via IP/Domain.

 

[George-H]

My PCs currenrtly have 1.0.0.60. They updated automatically over the weekend.

I did try forwarding the server port as well - doesn't work when done over the internet.

Having to open ports other than just HTTPS also creates issues when following good practise of changing the ports to non-default values. Specifying which port to connect to for HTTPS is easy. Using a none default port for RTSP is also easy when I use the Andoid TinyCam Pro app as I can specifcy which port to use for RTSP.

How on earth at the remote web browser end do you specify a different server port which can then be forwarded by a firewall rule to the appropriate HikVision device.

So on a site with multiple devices you can't forward the server port to more than 1 as there is no way of directing it to differnet devices by defining a different server port for each.

 

[JB1970]

How on earth at the remote web browser end do you specify a different server port which can then be forwarded by a firewall rule to the appropriate HikVision device.

So on a site with multiple devices you can't forward the server port to more than 1 as there is no way of directing it to differnet devices by defining a different server port for each.

As I mentioned I'm using the server port for the apps so that makes it very simple; as the apps (Hik-Connect and iVMS-4200) are added by just the server port. I can just set a different port for each NVR or Camera that is directly accessible (cameras on the remote LAN that are not connected to an NVRs PoE ports) and forward that port in the router to it's local IP. Alternatively I'd leave the ports on the devices at default and map different numbers in the port forwarding rule.

Really the easiest setup I think is using iVMS-4200 adding each device via its server port as defined in the port forwarding rule. Example:

TCP 50001 to 8000 192.168.0.101 for Cam 1
TCP 50002 to 8000 192.168.0.102 for Cam 2

and so on.

 

[George-H]

I appreciate the suggestions.

However, I need it to work via a web broweser and not one of HikVisions apps.

 

[David]

So on a site with multiple devices you can't forward the server port to more than 1 as there is no way of directing it to differnet devices by defining a different server port for each.

If I've understood you correctly this is possible. Expanding on @JB1970 comments.....

Port forwarding rules
WAN public port 50001 to LAN side port 8000 192.168.0.101 for Cam 1
WAN public port 50002 to LAN side port 8000 192.168.0.102 for Cam 2

To remotely access each one the URL is.....
my_domain.com:50001 for cam1 or <your_wan_publicIP>:50001
my_domain.com:50002 for cam2
etc.

Save each one as a bookmark / favourite that will synchronise to your other devices.

Better still carry on with the VPN option. As you use Draytek routers you can easily overcome CGNAT using the Draytek VPN matcher service.

David

 

[JB1970]

If I've understood you correctly this is possible. Expanding on @JB1970 comments.....

Port forwarding rules
WAN public port 50001 to LAN side port 8000 192.168.0.101 for Cam 1
WAN public port 50002 to LAN side port 8000 192.168.0.102 for Cam 2

To remotely access each one the URL is.....
my_domain.com:50001 for cam1 or <your_wan_publicIP>:50001
my_domain.com:50002 for cam2
etc.

Save each one as a bookmark / favourite that will synchronise to your other devices.

Better still carry on with the VPN option. As you use Draytek routers you can easily overcome CGNAT using the Draytek VPN matcher service.

David

Unfortunately it'll only work as above for iVMS-4200 or for Hik-Connect which are using the server port, rather than using it in a url. What George needs is for https browsing remotely to work. The same would apply - either using a different port number for https on each device or translating an individual port number in the router to 443 on the specific device.

It just seems that for reasons unknown, live view works using https locally, but not from another location using forwarding.

 

[JB1970]

@George-H a couple of other things to check....

Have you enabled 'https browsing' in the cameras? By default https is enabled but https browsing is disabled as shown in the image below:

Could that be blocking the port forwarded live view...

Also for plugin free live view (where supported) you need to enable websockets which is also disabled by default as shown below:

 

[George-H]

@George-H a couple of other things to check....

Have you enabled 'https browsing' in the cameras? By default https is enabled but https browsing is disabled as shown in the image below:

View attachment 9389

Could that be blocking the port forwarded live view...

View attachment 9390

Also for plugin free live view (where supported) you need to enable websockets which is also disabled by default as shown below:

View attachment 9391

Thanks JB - I'll give enabling Websockets a try.

One of the first things I do is enable HTTPS as I simply refuse to do port forwarding for HTTP. Although I notice that the response of the web gui on G5 cameras via HTTPS feels decidedly "sluggish" compared to G3 via HTTPS. Although I've yet to upgrade them to the latest firmware.

At least I can get in to the all the configuration stuff remotely!

And this just arrived a short while ago (see pic) which I'll be installing at the weekend. Proper VPN access!

 

[George-H]

Unfortunately enabling Websockets - then rebooting the camera just to be sure - made no difference.

)

Still exactly the same in both Chrome and Edge (in or out of IE mode).

 

[George-H]

Even though it is really bad practise, when I am next there I might just for completeness try forwarding HTTP.

I don't think I can remotely access the existing BT router to set up the rule.

Once the DrayTek is in place... We are into a whole different ball game LOL

 

[David]

Even though it is really bad practise, when I am next there I might just for completeness try forwarding HTTP.

I don't think I can remotely access the existing BT router to set up the rule.

Once the DrayTek is in place... Where are into a whole different ball game LOL

For me, moving to Draytek all those years ago made remote access much more secure and easier.

 

[JB1970]

Even though it is really bad practise, when I am next there I might just for completeness try forwarding HTTP.

I don't think I can remotely access the existing BT router to set up the rule.

Once the DrayTek is in place... Where are into a whole different ball game LOL

Just to confirm. Did you enable 'https browsing' as well as 'https' - there's a separate selection for each...

Websockets, I believe, only applies to plugin free browsing. So that would require both the camera firmware and teh specific browser to be compliant.

 

[George-H]

For me, moving to Draytek all those years ago made remote access much more secure and easier.

Absolutely!

Hell, on the main site I can connect using the Android OpenVPN client, Remote Desktop (from my phone) into one of the PCs there and use that to manage all the cameras essentially locally using a web browser from my phone without any other software than the VPN client.

Although I see occasional routing issues with the DrayTek if there is a power failure to the site. When the power comes back on it sometimes doesn't seem to know how to reach some devices on the local network (which are all on static IPs internally). If I can get onto the PC there (via VPN and Remote Desktop), rebooting the cameras gets them going again.

 

[George-H]

Just to confirm. Did you enable 'https browsing' as well as 'https' - there's a separate selection for each...

Websockets, I believe, only applies to plugin free browsing. So that would require both the camera firmware and teh specific browser to be compliant.

As I mentioned, the very first thing I do is enable HTTPS:

In addition to the 5 x DS-2CD2146G2-ISU at the larger site (4 x G3 and 1 x G5) and the 2 x DS-2CD2146G2-ISU (both brand new G5) at the new small site. I have a further 4 x DS-2CD2146G2-ISU (again brand new G5) waiting to replace the remaining Foscams at the larger site. The Foscam's motion detection is crude beyond belief.

I'm holding off replacing the larger site's Foscam FN3109HC NVR with a £500+ HikVision NVR until I can get remote (over the internet) live viewing working using HTTPS.

If I can't, then I'm quite simply not spending a ton of money on a new HikVision NVR when a cheap crappy Foscam does a far better job of this one task - connecting the NVR web interface via HTTPS (not other ports) and live viewing all 9 cameras simultaneously using using Edge in IE mode.

And I can playback the recordings from the Foscam NVR's web interface from almost anywhere.

I have to say that I'm really disappointed that this crappy Foscam is doing this job much better than HikVision. I was expecting more from HikVision.

Obviously not your your fault