Arlo Netgear Cameras

We are having the exact same issue, UTM 9 with Arlo. You can do everything except view the live feed. When you do, you get :connection failed

I have tested switching between transparent and standard mode and it didnt work.

It appears to be with the Web Filtering. Turn that off or jump on a network that isnt part of the web filter policy and you can view live feed.

I have added arlo, netgear and AWS' websites to the Allow These Websites and subdomains in the Filter action for the main/only policy, no go. 

I have added arlo, netgear and AWS' to the Exceptions under Filtering Options, still no go.

I have added arlo, netgear and AWS' to the Websites under Filtering Options, with a trusted reputation, still no go.

I created a App Control Rule under Application Control for all of Amazon Web services, still no go. 

When checking the web filtering logs (along with any other), i see nothing at all for my IP, for the base stations IP, for the base stations name or anything for AWS

I eventually got it working

I think it was this that did it in the end  Web - Filtering Options - Misc - Transparent Mode Skip List / Add  Arlo Netgear or what ever you have called (being the Arlo router)  it to both and allow the traffic with the check box.

Hi, Andrew, and welcome to the UTM Community!

Did you solve your problem with the entry in the Source Skiplist?  If you're trying to contact the camera from an iOS device, then you might also need the Destination Skiplist.  It sounds like the camera is doing something other than HTTP/S conversation - a proprietary protocol maybe.

Cheers - Bob

Hi Bob.  So the camera system has a base station that connects to the network with an ethernet cable.  The base station creates its own wireless network that the cameras connect to.  So all communication is going through that base station.

If I do not add the base station to the Source Skiplist, then the "Internet" light on the base station is Yellow, meaning it's not connected to the Netgear servers, and when I try to access the cameras from the iOS app, it says the cameras are off line.  When I DO add the base station host to the Source Skiplist, the Internet light goes green and I can access the base station from the iOS app.

When my iPhone is on my internal network wifi, I cannot view the live stream from the cameras using the iOS app.  However, if I go onto LTE and off of my wifi, then I CAN successfully view the live feed.

So, the problem does not seem to be with the base station.  The problem is from the iOS app itself (can view live feed off network but not on network). If I could see what URL the iOS app is trying to access when I click the View camera feed button I could add an SSL decryption exception for it.  The problem is, all I see in the log is:

2017:08:28-16:01:54 firewall httpproxy[5721]: id="0003" severity="info" sys="SecureWeb" sub="http" request="0xa208600" function="ssl_connect" file="ssl.c" line="1564" message="ssl_handshake: Input/output error"

I figured this out for the iOS app.

First of all, in my Filter Action I had Log Blocked Sites, but I didn't have Log Accessed Sites checked.  I enable the Log Accessed Sites and started to see some more useful information in the Web Filter log.

I saw that when I clicked the Live feed button it would send https requests to various AWS owned IP addresses.  I did this a bunch of times and it sent the request to a new IP every time.  So I created this exception rule:

Now when I click the Live feed button in the iOS app from my wifi, the video feed works successfully.

That is an awful lot of IP-addresses (actually all existing IPv4 addresses and much much more) that you just skip SSL and certificate checks on.....

Thats a giant hole you shoot into your webfiltering checks...

Andrew, it sounds like you want Accessing Internal or DMZ Webserver from Internal Network.

Cheers - Bob

Yes, I don't really like it much either.  As you can see, they don't provide a range of IPs that they utilize https://community.netgear.com/t5/Arlo/Internet-Connection-through-proxy-OR-firewall/td-p/1201096

I wish they would just use a domain name rather than raw IP addresses.

This is a big hole, as you say, but I don't think it'll be often that https requests are made to direct IP addresses so I'm ok with it.

Invalid method is telling you that the applucatiob does not follow the specification for http.  That is why you have to bypass the proxy.  The problem is in tbe application, not in UTM.

Andrew Parker said:

This is a big hole, as you say, but I don't think it'll be often that https requests are made to direct IP addresses so I'm ok with it.

 

Part of security management involves evaluating what risks are acceptable to you.   Why does your camera security system need to connect to the vendor at all?   Does that create any risk to you if the vendor is hacked?

If they are doing https without DNS names, then they are not checking certificate integrity, so tbe cameras will not be aware if the traffic gets diverted to a bad guy's server.  I always cringe when a security product neglects security.

Is your login to the vendor site secured with two-factor authentcation?  What is your risk of a password guessing attack?

Could you get the same result with a configuration that is entirely in-houze and accessed with VPN, or is the vendor performing monitoring that adds a lot of value?

There is much more to your situation than the question of how to create a hole in UTM's defenses that will let tbe camera software work.

Does this issue relate to all Arlo security cameras? I wonder if the same issue occurs with Arlo Q cameras since they don't use the Arlo base station.

Does this issue relate to all Arlo security cameras? I wonder if the same issue occurs with Arlo Q cameras since they don't use the Arlo base station.