Arlo Netgear Cameras

We are having the exact same issue, UTM 9 with Arlo. You can do everything except view the live feed. When you do, you get :connection failed

I have tested switching between transparent and standard mode and it didnt work.

It appears to be with the Web Filtering. Turn that off or jump on a network that isnt part of the web filter policy and you can view live feed.

I have added arlo, netgear and AWS' websites to the Allow These Websites and subdomains in the Filter action for the main/only policy, no go. 

I have added arlo, netgear and AWS' to the Exceptions under Filtering Options, still no go.

I have added arlo, netgear and AWS' to the Websites under Filtering Options, with a trusted reputation, still no go.

I created a App Control Rule under Application Control for all of Amazon Web services, still no go. 

When checking the web filtering logs (along with any other), i see nothing at all for my IP, for the base stations IP, for the base stations name or anything for AWS

I eventually got it working

I think it was this that did it in the end  Web - Filtering Options - Misc - Transparent Mode Skip List / Add  Arlo Netgear or what ever you have called (being the Arlo router)  it to both and allow the traffic with the check box.

I eventually got it working

I think it was this that did it in the end  Web - Filtering Options - Misc - Transparent Mode Skip List / Add  Arlo Netgear or what ever you have called (being the Arlo router)  it to both and allow the traffic with the check box.

I have all the addresses listed for Web Protection\Filtering Options\Exceptions

As for your transparent mode skiplist, what did you add/enter in for your "Arlo Netgear" Host Network Definition?

I tried it with the base station IP address and still doesnt work for me. 

Thanks

I also in Web Profiles Misc settings turned on  Bypass Streaming.

Thanks for the reply, i have setup everything identical to what you supplied and it is still happening. 

If i turn web filtering off, it works. If i turn it on, it doesnt. 

I tried switching between Standard and Transparent mode but for both, it doesnt work.

I tried adding all the sites to the "Allow these websites" for the only profile we are using, still doesnt work.

I check the existing and live logs but i cannot find anything referncing the Alro's IP, MAC or Device Name, so i cant get anything out of it. 

Timing wise in the web filter logs, it looks like it is these errors (like NicholasChase stated):

Hi, Michael, and welcome to the UTM Community!

Clearly, you're not skipping the Proxy or there would be nothing in the logs.  In Standard mode, you must skip the proxy in 'Proxy Settings' in your browser as the 'Transparent Mode Skiplist' applies only to Transparent mode.

In the Skiplist, does the definition for your camera violate #3 in Rulz?

Cheers - Bob

I'm also experiencing issues with Netgear Arlo Pro cameras.  From the iOS app on my iPhone, I can open the app, connect to my account see all my cameras, change settings and view previous recordings successfully.  However, when I try to view the live feed from a camera it fails to start the video feed.

Here are my settings. UTM 9.502-4, Web Filtering in Transparent mode, Decrypt and Scan HTTPS traffic.  The following Exception:

The following Transparent Mode Skiplist:

It may be worth noting that I get the same functionality if I completely disable that Exception rule and remove the Arlo Base Station from the Skip Mode Destination List, so it seems the only thing doing some good is the Arlo Base Station in the Skip Mode Source list. (Without that the Base Station shows a yellow light meaning it can't connect to Netgear servers and the iOS app can't connect at all.)

Everytime I click the Live feed button in the iOS app, I see this line in the Web Filter log:

2017:08:28-16:01:54 firewall httpproxy[5721]: id="0003" severity="info" sys="SecureWeb" sub="http" request="0xa208600" function="ssl_connect" file="ssl.c" line="1564" message="ssl_handshake: Input/output error"

As you can see this is very unhelpful and doesn't give me any clues on what urls to attempt to add to the Exception rule.  If I change Decrypt and Scan HTTPS to URL Filtering Only, then I can view the live feeds successfully the iOS app.  Any ideas?

Hi, Andrew, and welcome to the UTM Community!

Did you solve your problem with the entry in the Source Skiplist?  If you're trying to contact the camera from an iOS device, then you might also need the Destination Skiplist.  It sounds like the camera is doing something other than HTTP/S conversation - a proprietary protocol maybe.

Cheers - Bob

Hi Bob.  So the camera system has a base station that connects to the network with an ethernet cable.  The base station creates its own wireless network that the cameras connect to.  So all communication is going through that base station.

If I do not add the base station to the Source Skiplist, then the "Internet" light on the base station is Yellow, meaning it's not connected to the Netgear servers, and when I try to access the cameras from the iOS app, it says the cameras are off line.  When I DO add the base station host to the Source Skiplist, the Internet light goes green and I can access the base station from the iOS app.

When my iPhone is on my internal network wifi, I cannot view the live stream from the cameras using the iOS app.  However, if I go onto LTE and off of my wifi, then I CAN successfully view the live feed.

So, the problem does not seem to be with the base station.  The problem is from the iOS app itself (can view live feed off network but not on network). If I could see what URL the iOS app is trying to access when I click the View camera feed button I could add an SSL decryption exception for it.  The problem is, all I see in the log is:

2017:08:28-16:01:54 firewall httpproxy[5721]: id="0003" severity="info" sys="SecureWeb" sub="http" request="0xa208600" function="ssl_connect" file="ssl.c" line="1564" message="ssl_handshake: Input/output error"

I figured this out for the iOS app.

First of all, in my Filter Action I had Log Blocked Sites, but I didn't have Log Accessed Sites checked.  I enable the Log Accessed Sites and started to see some more useful information in the Web Filter log.

I saw that when I clicked the Live feed button it would send https requests to various AWS owned IP addresses.  I did this a bunch of times and it sent the request to a new IP every time.  So I created this exception rule:

Now when I click the Live feed button in the iOS app from my wifi, the video feed works successfully.

That is an awful lot of IP-addresses (actually all existing IPv4 addresses and much much more) that you just skip SSL and certificate checks on.....

Thats a giant hole you shoot into your webfiltering checks...

Andrew, it sounds like you want Accessing Internal or DMZ Webserver from Internal Network.

Cheers - Bob