Airport Network Static IP address

Either apply the static IP directly to the device.. eg a computer or camera you can type the static address directly to the device. That is the easiest if not always the best way.

Otherwise you just use dhcp reservation in your airport extreme.. since it is the main router.. as long as nothing else is NAT.. it should not be.. then you set the reservation by name or MAC address.

Click the + and you can add a reservation.

If the device you are setting the reservation on happens to be a mac.. there is an even easier method.

On exactly this unit where I did the screen shots.

I open a terminal in the Mac.. and type natutil -L

The dhcp address this computer has is then reserved in the airport.

You can then edit it if you wanted to change the IP.

But it is only usable from a Mac.

It must all be local.. Local IP, eg 10.0.1.100, local subnet 255.255.255.0 and local gateway, and DNS can be identical 10.0.1.1 for typical default AE setup.

Before we get too far down the road and hit a big roadblock, it would be helpful to understand the overall goal of what you are trying to accomplish here. In other words, are you trying to set up access to the "device" so that you can "see" it and "control" it from the Internet? If yes, then things are going to get more complicated.

Or, will you always be using your own network with the "device"?

Next, does the "device" connect to the AirPort Express using wireless, or is it connected to one of the Ethernet ports on the Express?

In either case you will need to look for a label on the device which displays it's MAC Address. There may be two of these addresses....one for wireless and another for Ethernet...or, if the device can only connect using wireless or Ethernet, then there will only be one MAC Address. That ID will have a form of.....xx : xx : xx: xx: xx: xx.....where the "x" might be either a letter or number. Jot that down carefully, but do not post that information here.

We are going to need more specific information about the port values, in particular whether they are Public or Private values and whether they might be TCP values or UDP values. For example, the setup for the device will look something like this:

The "Private IP Address" is only an example of what a "Reserved" or "Static" IP address might look like for the "device".

The setup for the "device" as far as assigning a "reserved" or "static" IP address on your network will look something like this:

Bob,

I have been following this thread as it is the closest one to an issue I am having and I hope you might be able to help. Let me lay out the basics here:

My goal is to be able to access IP cameras remotely when I am away from home. To this end, I have a series of cameras in place and each has been assigned an IP address. Currently, I can only access these cameras on my personal network at home. In this case, just putting the IP addresses in a Safari address area will pull up the camera.

However, the next step is to ensure the cameras are accessible remotely. And this is where the issue resides at the moment.

The tech guy appears to have used Airport Utility for mapping the IP address for each camera to a port. Here are two screen shots showing this.

In the first screen shot, you can see the port settings window with the cameras listed. On the second shot, you can see the port assigned to the first camera.

You will also notice that the tech person apparently chose NOT to use the DHCP Reservations approach and this is part of my question for you. But, the first part has to do with what happens when we try to check to see if a port is open. No port assigned to an IP camera shows it is open. However, port 80 (for HTTP) is open.

We have verified that the ISP is not blocking ports so this seems to be on my end of things.

In summary, I an trying to figure out:

1. Is this mapping of the camera IP addresses to ports being done correctly?

2. If not, what approach should be used?

3. Is there something we are missing with regard to actually ALLOWING the port to open insofar as the router is concerned?

I am using a new Airport Extreme router and the Airport Utility version is 6.3.2.

Let me know if I can offer more information to help get to the bottom of this.

Thanks.

I will jump in .. bob can add his points.

1. Is this mapping of the camera IP addresses to ports being done correctly?

The IP can be set on the camera. ie it is static setting on the device rather than in the Airport.. this is fine. It has to be set statically .. where doesn't actually matter that much although dhcp reservation system is neater. More importantly the camera must have the port reset.. ie it is using 8081 for port 80. If this is not set correctly then the setup is wrong.. you can port translate easier. Each camera must have a different port.. but all can translate to port 80. So instead of private port being 8081 it should be 80. You will know this is the case or not by how you access on the local lan. Do you access using IP plus port.. if not you must change the port in the Airport to private port 80. You should open each camera of course and check this is setup correctly.

3. Is there something we are missing with regard to actually ALLOWING the port to open insofar as the router is concerned?

Testing ports is useless.. there is only one valid test.. get on a wan account .. and see if you can access the camera. Most test sites will not be able to see things like cameras.. forget them.. !! Does it work.. that is all that matters.

Gary Kissler wrote:

However, the next step is to ensure the cameras are accessible remotely. And this is where the issue resides at the moment.

My 2c.

1. DHCP reservations have another use. If the power goes out from the cameras and they reboot, the DHCP will give them the same IP again.

2. Public ports/private ports are mapped, but the WAN IP that ISP allocates may change. DDNS is perhaps an option to consider.

3. WAN IP+Port also needs be forwarded to Private IP + Port combination to access the Camera web servers. If there is a control unit for the Cams, it may act as a proxy, which is specific to the design of the Camera system.

4. If your ISP gateway allows port 80 to be wide open, it is a security hole inviting an attacker.

It is clear that you have the AirPort setup in Router Mode of DHCP and NAT. But, it is important that you do not have another router "upstream" on the network.....which would place the AirPort in Double NAT status.

The very first thing that I would recommend is that you open AirPort Utility, click on the AirPort and then click on the listing for Status. There should not be a Double NAT message here. If there is, this will destroy port forwarding. Please advise.

What you should see next to Status is an indication of Setup over WAN, as in the illustration below, which means that instructions from the Internet will be forwarded to device(s) on your local network.

It would also likely help if you could provide the make and model number of the camera controller or cameras........so that another user who might have set up the same devices will see this post.

I second the thoughts of LaPastenague regarding "port checkers". Every one that I've ever tried has been pretty much useless. For example, I can access the data on a Time Capsule drive here at home from anywhere on the Internet. Port 548 must be "open" for this to occur.

Yet, I can be connected to the Time Capsule from across town or another state....or country, for that matter....and I can "see" and access the data on the drive, yet the "port checker" tells me that 548 is closed when I know it is not.

Bob (and others),

Many thanks for getting back to me. Let me try to respond to the various comments made for me to consider:

1. LaPastenague has said:

Each camera must have a different port.. but all can translate to port 80. So instead of private port being 8081 it should be 80. You will know this is the case or not by how you access on the local lan. Do you access using IP plus port.. if not you must change the port in the Airport to private port 80. You should open each camera of course and check this is setup correctly.

My response: I can access the various cameras on the LAN by just typing in the camera's IP address. Given this, I am trying to figure out if, instead of having the Private UDP Ports and Private TCP Ports area showing "8081" should now show "80." Or should I change the Public UDP Ports and Public TCP Ports from "8081" to "80?" Sorry for the confusion on my part of about this but I am not familiar with this setup process.

2. Loner T has said:

4. If your ISP gateway allows port 80 to be wide open, it is a security hole inviting an attacker.

My response: I am a bit confused over this one. I have used an open port check tool from canyouseeme.org to check on open ports and, from what I can tell, it draws upon the IP address for the Apple Extreme router and not the IP address supplied to me by the ISP. Are you suggesting that having port 80 shown as "open" is the issue? If so, I'm not sure how you could gain access without this port being open. Would appreciate some clarification on this point.

3. Bob Timmons has said:

The very first thing that I would recommend is that you open AirPort Utility, click on the AirPort and then click on the listing for Status. There should not be a Double NAT message here. If there is, this will destroy port forwarding. Please advise.

My response: I have followed this suggestion and there is NOT a Double NAT message showing. As for "Status," it shows that this was set up over WAN.

Bob also said:

It would also likely help if you could provide the make and model number of the camera controller or cameras........so that another user who might have set up the same devices will see this post.

My response: There are several IP cameras installed. All are Axis cameras. The one in question for the moment is Axis M3004-V. I am not sure about the "camera controller" question. There is a Netgear GS108PE switch in place and some items labeled "Pakedge W-6 WAP," "Pakedge S8PE 8-port Gigabit PoE switch," and "Pakedge 24-port Gigabit switch" installed. Sorry I cannot offer more explanation but this is WAY beyond me here.

It is not clear to me how to actually test whether the access of the IP camera is successful. I have been using my iPhone for this. I turn off the Wi-Fi connection and use the Verizon connection instead. Then I have typed in the camera's IP address but this does not access the camera. It is sounding like I need to do something different. Given what you have seen in terms of the IP address for this camera and the port labeling, can you tell me what I need to do to access the camera via Safari?

Many thanks to all who are weighing in on this.

Gary Kissler wrote:

2. Loner T has said:

4. If your ISP gateway allows port 80 to be wide open, it is a security hole inviting an attacker.

My response: I am a bit confused over this one. I have used an open port check tool from canyouseeme.org to check on open ports and, from what I can tell, it draws upon the IP address for the Apple Extreme router and not the IP address supplied to me by the ISP. Are you suggesting that having port 80 shown as "open" is the issue? If so, I'm not sure how you could gain access without this port being open. Would appreciate some clarification on this point.

Typically you connection is

Internet <-> YourISP <-> YourWANIP (Public/Private depending on your ISP) <-> Airport Extreme <-> YourCameraIP (Private IP)

One method of finding your public WAN IP is to use http://whatismyipaddress.com.

Remote access to me means you are coming from the Internet, through your ISP, through the Extreme to the Camera. As you have noted, if you are on your local LAN, you can see your cameras, but once your are 'outside', the port forwarding should work end-to-end.

Another method of finding your WAN side IP address is to open up AirPort Utility and click on the AirPort Extreme.

The IP address shown there is the WAN IP address. Mine is fixed or static from my Internet Service Provider, since I need to know exactly what this IP address is to be able to connect back to the local network from the Internet.

The LAN address.....since you are using the 192.168 range for IP address assignments on the local network would be 192.168.1.1.

Would be helpful if you had a link to the camera setup and installation instructions or manual, since there are different methods that can be used to connect from the Internet to a device(s) on a local network.

It is not clear to me how to actually test whether the access of the IP camera is successful.

Don't mean to be cute here, but the only "test" would be an actual working connection. When it works, it works. If it does not work, you have to keep working.

Loner T and Bob:

Let me respond to your comments below...

I have used that link to confirm my WAN IP and, as Bob suggested, I confirmed this by using the Airport Utility as well.

As for a link to the camera setup, etc. the tech person has not yet provided this to me but I will be asking about this when he returns this week. Once I have this, I will respond with the information here.

Bob, don't worry about being "cute" as you are dealing with someone who is about a clueless as possible so my question is probably just a reflection of this. Specifically, what I was asking was what, exactly, do I need to type into the browser address window to test the access to the camera. So far, I have just typed in the camera's IP address but this is to access it via the LAN. I am just trying to determine if I have to type something different to access it remotely.

I have yet to hear your recommendations on one of the other points I raised. I think this might actually be a critical piece of the puzzle. Here is what I had said...

My response: I can access the various cameras on the LAN by just typing in the camera's IP address. Given this, I am trying to figure out if, instead of having the Private UDP Ports and Private TCP Ports area showing "8081" should now show "80." Or should I change the Public UDP Ports and Public TCP Ports from "8081" to "80?" Sorry for the confusion on my part of about this but I am not familiar with this setup process.

Many thanks for your patience on this one.

In one of your screen shots you have public and private both ports to be 8081, but if the web server(s) that are used by camera for access honor both, you cannot tell.

One test from the OSX terminal is

1. telnet <CameraIP> 80

2. telnet <CameraIP> 8081

If both respond with same data then the Camera treats them the same.

To exit from the telnet session, use the Escape key type close at the "telnet>" prompt.

The same test can be repeated from a browser by using http://<CameraIP:8081 and http://<CameraIP (TCP port 80 is the default for http).

Here is an example, the Escape sequence in this example is a Control+] pressed together.

Escape character is '^]'.

^]

telnet> close

Specifically, what I was asking was what, exactly, do I need to type into the browser address window to test the access to the camera.

That is why we need the setup instructions from the manufacturer....to get that information.

So far, I have just typed in the camera's IP address but this is to access it via the LAN. I am just trying to determine if I have to type something different to access it remotely.

Yes, the setup to access the camera(s) remotely is entirely different. Depending what method is used, the access address might include instructions including the protocol to be used, the WAN IP address of your network, and the assigned port number for the camera.

For example, to access a hard drive on my local network, I type in the following on a browser address bar from my laptop, or the Connect to Servicer command from the Finder's Go menu:

afp://12.34.56.789:8888

The "12.34.56.789" is the WAN IP address and "8888" is the value in the public UDP and TCP port slots. But, "afp" won't work on an iPhone or iPad, so more info is needed if you want to use an iPhone or iPad.

I have yet to hear your recommendations on one of the other points I raised. I think this might actually be a critical piece of the puzzle. Here is what I had said...

I don't know. Need clarification from the camera setup guide or tech support folks for each of the public and private TCP and UDP port values.

Can you provide details (manufacturer/brand/model) of your Camera system? It would be a good resource to study.