Port Forwarding a BT Smart Hub for a Hikvision DVR or NVR

How-To

Most of the port forwards we end up troubleshooting over the counter should never have been set up in the first place. The installer wanted remote viewing. The customer had a BT Smart Hub. Forwarding a port is what everyone reaches for, because that is how it has always been done and nobody has revisited it since. It still works. It is also the fastest way to put a login page in front of every scanner on the internet.

Try this first

Hik-Connect does remote viewing without opening a single port. The recorder makes an outbound connection to Hikvision’s servers and your phone connects to the same service. Nothing on the network gets exposed. For most installations that is simply the right answer. Quicker to set up. It also rides out your BT address changing, which is the thing that quietly kills a forward months after you have left site.

It is under Configuration, Network, Advanced Settings, Platform Access. Set a verification code, then add the device in the app by scanning the QR code on screen. Done.

What you are actually publishing

Forward a port and the recorder’s web interface is visible to anybody who cares to look. Plenty of people are looking. Automated scanners sweep the whole IPv4 range around the clock, and CCTV recorders are a favourite target because so many of them are still sitting on default credentials and firmware from four years ago.

A compromised recorder is worse than a privacy problem. It gets recruited into a botnet, and it hands whoever found it a foothold on the same network the cameras sit on, which on a small business site is usually the same network as everything else in the building. So if you genuinely need direct access, for a customer’s VMS or some integration that cannot talk to the cloud service, do the job properly with the precautions further down. The bare minimum will not cover you here.

Doing it on a BT Smart Hub

Menus shift slightly between hub generations. The Smart Hub 2 words things a bit differently to the original, and the Business Smart Hub differently again. Path is broadly the same on all of them.

1. Pin the recorder’s address down first. Either a static IP on the recorder, or a reservation in the hub’s connected-devices list. A forward pointing at an address that has since moved is the single most common reason this stops working three weeks later.
2. Browse to 192.168.1.254 and sign in with the admin password printed on the hub.
3. Advanced Settings, then Firewall. Port Forwarding sits under that.
4. Add a rule and pick the recorder out of the device list. Enter the port.
5. Apply, then reboot the recorder so it re-registers.

Port 80 is the web interface on a Hikvision recorder. 8000 carries the client protocol. RTSP lives on 554. Change the HTTP port on the recorder away from 80 before you forward anything at all, because 80 pulls in more scanning traffic than every other port put together.

If you are forwarding anyway

Fine. Some jobs genuinely need it. Do all of the following, though, not the two you can be bothered with on the day.

• Change the default password to something long and unique. This one control matters more than everything else on the list put together.
• Update the firmware before you expose it, and keep updating it afterwards.
• Move off the default ports. It will not stop anybody determined. It does take you out of the bulk scans.
• Do not forward RTSP unless something genuinely needs it. That one is very often left unauthenticated.
• Restrict by source address if the hub lets you and you always connect from the same place.

The middle option

A VPN back into the site gives you full local access with nothing published to the internet at all. That is the arrangement we would suggest to any installer looking after a customer’s system on an ongoing basis, and most business routers have one built in already, so the cost of it is your time rather than another box on the order. It swallows a slow afternoon the first time. After that you stop thinking about it.

There is a related guide on securing a Hikvision recorder, and you can browse the recorder range or ring 0121 655 0146 if you want to talk a setup through.

Frequently asked questions

Do I need to port forward to view my CCTV remotely?

No. Hik-Connect gives you remote viewing without opening any ports, and it is the safer option for nearly every installation.

What ports does a Hikvision DVR use?

Port 80 is the web interface and 8000 is the client protocol. RTSP uses 554. Move the HTTP port off 80 if you are exposing the recorder.

Why did my port forwarding stop working?

Almost always because the recorder’s local IP address changed. Reserve its address on the hub, or set a static IP on the recorder itself.

Is port forwarding a CCTV recorder safe?

It carries real risk. Recorders are actively scanned for and regularly compromised. If Hik-Connect or a VPN will do the job, use one of those instead.