Arlo Netgear Cameras

Andrew, it sounds like you want Accessing Internal or DMZ Webserver from Internal Network.

Cheers - Bob

Yes, I don't really like it much either.  As you can see, they don't provide a range of IPs that they utilize https://community.netgear.com/t5/Arlo/Internet-Connection-through-proxy-OR-firewall/td-p/1201096

I wish they would just use a domain name rather than raw IP addresses.

This is a big hole, as you say, but I don't think it'll be often that https requests are made to direct IP addresses so I'm ok with it.

Invalid method is telling you that the applucatiob does not follow the specification for http.  That is why you have to bypass the proxy.  The problem is in tbe application, not in UTM.

Andrew Parker said:

This is a big hole, as you say, but I don't think it'll be often that https requests are made to direct IP addresses so I'm ok with it.

 

Part of security management involves evaluating what risks are acceptable to you.   Why does your camera security system need to connect to the vendor at all?   Does that create any risk to you if the vendor is hacked?

If they are doing https without DNS names, then they are not checking certificate integrity, so tbe cameras will not be aware if the traffic gets diverted to a bad guy's server.  I always cringe when a security product neglects security.

Is your login to the vendor site secured with two-factor authentcation?  What is your risk of a password guessing attack?

Could you get the same result with a configuration that is entirely in-houze and accessed with VPN, or is the vendor performing monitoring that adds a lot of value?

There is much more to your situation than the question of how to create a hole in UTM's defenses that will let tbe camera software work.

Does this issue relate to all Arlo security cameras? I wonder if the same issue occurs with Arlo Q cameras since they don't use the Arlo base station.

Having the same issue with my Arlo setup. The solution worked but indeed a big hole.

just re-resd this post.

In the intervening tume, I learned that "input-output error" is a very poor way of saying that UTM could not negotiate an acceptsble ciphersuite.   It should only occur when HTTPS inspection is enabled, because that is the only time that UTM is negootuating the ciphersuite.  I started seeinv it afterUTM dropped support for TLS 1.0, in response to threat research announcements.   Workarounds are to bypass https inspection for that source address or change profile to yranspsrent mode.

Late correction:. It is https inspection that triggers negotistion, not proxy mode.

Assuming that the base station is trusted, create your exceptions based on source address, rather than destinstion address.   This will limit your risk by changing nothing for other source devices.