Streaming Security Camera Video with VLC

= Goal =
Setup a streaming video solution that small locations can use easily for broadcasting small events, security video or other uses. Because those locations may not have a static IP, route video traffic from your main static IP (on your openvpn server) over a tunnel to the remote location.
= Overview =
The remote location will require internet access. They will be provided with the following equipment:
* Minibox style x86 computer
* Monitor/Keyboard/Mouse
* Axis P1344 camera w/ POE injector OR Axis Q-7401 capture box
* network (2 blue cables are straight through, red is crossover) + power cables
= Setup instructions =
== Axis camera ==
* Power up camera.
* Connect to web interface of the camera.
* Set admin password (example root:test123).
* Setup -> Video Stream -> Audio -> Check Enable Audio checkbox.
* Setup -> Video Stream -> Image -> Resolution = 640x480.
== Axis capture box ==
* Power up box.
* Connect to web interface of the camera.
* Set admin password (example root:test123).
* Setup -> Video Stream -> Audio -> Check Enable Audio checkbox.
* Setup -> Video Stream -> Image -> Resolution = 720x480.
* Enable anonymous video viewer.
== Minibox ==
* Setup USB key w/ Alpine Linux 2.4.5.
* Enable apk cache.
* Install the following packages:
alpine-base xscreensaver xf86-input-evdev openssh vlc rsync vim openvpn gawk bash vlc-xorg alsa-utils alsaconf alsa-lib vlc-daemon gstreamer gstreamer-tools gst-plugins-ugly gst-plugins-good gst-plugins-base chrony xf86-video-vesa linux-firmware pciutils usbutils iptables dnsmasq beep shorewall dnscache slim udev nmap tcpdump xf86-video-openchrome abiword busybox evince firefox gnumeric lxdm ristretto sudo xf86-input-keyboard xf86-input-mouse xfce4 xorg-server iftop
* /etc/network/interfaces
auto eth0
iface eth0 inet dhcp
auto eth1
iface eth1 inet static
	address 10.14.197.1
	netmask 255.255.255.224
auto lo
iface lo inet loopback
* /etc/ssh/sshd_config - disable password auth
* /root/.ssh/authorized_keys - install all needed keys
* adduser jbilyk
* /etc/chrony/chrony.conf
chrony/chrony.conf 
# default config
server time.nrc.ca 
initstepslew 10 time.nrc.ca
commandkey 10
keyfile /etc/chrony/chrony.keys
driftfile /etc/chrony/chrony.drift
cmdallow 127.0.0.1
allow all
* rc-update add chronyd
* /etc/conf.d/dnscache
# DNSCACHE configuration variables:
# IPSEND - ip address to use for requests use 0.0.0.0 for default route
IPSEND=0.0.0.0
# CACHESIZE - Num bytes to use for the cache
CACHESIZE=1000000
# IP - IP addr to listen on
IP=127.0.0.1
#------------------------------------------------------------------------
# The following are flags. Setting them to ANY value
# (even "false" or "off") will turn the feature on.
#------------------------------------------------------------------------
# HIDETTL - always return TTL as 0
#HIDETTL=
# FORWARDONLY - servers/@ are parent caches, not root servers
#FORWARDONLY=
# UPDATEHINTS - refresh zone hints
UPDATEHINTS=1
* rc-update add dnscache
* /etc/dnsmasq.conf (replacing MAC and IP on dhcp-host line as required)
domain-needed
bogus-priv
no-resolv
no-poll
server=10.14.197.1
interface=eth1
except-interface=lo
bind-interfaces
expand-hosts
domain=example.com
dhcp-authoritative
cache-size=0 # dnscache does caching
no-negcache
log-dhcp
dhcp-range=10.14.197.10,10.14.197.20,255.255.255.224,12h
dhcp-option=option:ntp-server,10.14.197.1
dhcp-option=6,10.14.197.1,10.14.0.1
dhcp-option=option:domain-search,example.com
dhcp-host=00:40:8c:c4:7e:99,10.14.197.5,24h # Axis Camera
dhcp-option=option:ntp-server,10.14.197.1
dhcp-option=2,-18000
* rc-update add dnsmasq
* /etc/openvpn/openvpn.conf
client
dev tun
proto udp
remote public.ip.addr.ess 1194
resolv-retry infinite
nobind
persist-key
persist-tun
ca ca.pem
cert cert.pem
key key.pem
comp-lzo
verb 3
script-security 2
up /etc/openvpn/up.sh
down /etc/openvpn/down.sh
* Extract your openvpn cert parts into /etc/openvpn/
openssl pkcs12 -in %CERTPFX% -cacerts -nokeys -out ca.pem
openssl pkcs12 -in %CERTPFX% -nocerts -nodes -out key.pem
openssl pkcs12 -in %CERTPFX% -nokeys -clcerts -out cert.pem
* rc-update add openvpn
* /etc/resolv.conf.tail
nameserver 127.0.0.1
* /etc/conf.d/vlc 
# Sample vlc params suitable for running as a daemon
## --daemon			detach from prompt
## --file-logging		enable file logging
## --logfile			logfile name/path
## -vvv				verbose logging
## -I dummy			disable X11 interface
## --sout PARAMS		encoding parameters
##				Do NOT quote 'PARAMS' otherwise shell expansions will broke vlc
VLC_OPTS="-I dummy --daemon --file-logging --logfile /var/log/vlc/vlc.log --loop --rtsp-caching=200 rtsp://10.14.197.5:554/axis-media/media.amp?videocodec=h264 --sout #standard{access=http,mux=ts,dst=0.0.0.0:8080}"
* rc-update add vlc
* /etc/shorewall/params
A_IF=tun0
B_IF=eth1
E_IF=eth0
* /etc/shorewall/interfaces
A	$A_IF		detect		dhcp
B	$B_IF		detect		dhcp
E	$E_IF		detect		dhcp
* /etc/shorewall/policy
A	all	REJECT		info
B	A	ACCEPT
B	E	ACCEPT
all	all	REJECT		info
* /etc/shorewall/rules
# FW management
ACCEPT		A		fw		tcp	22,80,443
# Manage the camera from the HQ if need be
ACCEPT		A		B		tcp	80
ACCEPT		fw		all		icmp	8
ACCEPT		fw		E		tcp	53,80
ACCEPT		fw		E		udp	53,1194
ACCEPT		fw		B
ACCEPT		B		fw		udp	53
ACCEPT		B		fw		tcp	53
ACCEPT		A		fw		tcp	8080
* /etc/shorewall/zones
fw	firewall
A	ipv4
B	ipv4
E	ipv4
* /etc/shorewall/shorewall.conf
STARTUP_ENABLED=Yes
...
IP_FORWARDING=On
* rc-update add shorewall
* rc-update add lxdm
* home/jbilyk/.config/autostart/firefox.desktop
[Desktop Entry]
Encoding=UTF-8
Version=0.9.4
Type=Application
Name=firefox
Comment=
Exec=nice -n 5 firefox
OnlyShowIn=XFCE;
StartupNotify=false
Terminal=false
Hidden=false
* Set FF homepage to 10.14.197.5 (replacing with ip address of Axis)
* lbu commit
* Plug in internet connection to eth0.
* Plug in crossover cable to axis PoE injector and straight through to Axis.
* Plug in line-out from mixer to axis.
* Power up blackbox with monitor, keyboard, mouse connected.
* Once desktop appears, power on axis.
= OpenVPN router =
* /etc/shorewall/rules
DNAT		E		G_196:10.14.196.10	tcp	8080	-	public.ip.addr.ess
* /etc/shorewall/masq
tun0			0.0.0.0/0	10.14.196.1	tcp	8080
= End User Instructions = 
Please verify that all of the following components shipped properly:
* Router
* Monitor
* Camera
* Camera power injector
* 2 x 50' blue network cables
* 1 x 14' red network cable
* 2 x 6' black power cables
* 1 x AC power brick
* 1 x monitor video cable
* 1 x keyboard
* 1 x mouse
* Place router in desired location. It should be placed on a flat, stable surface.
* Place monitor nearby to the router.
* Use one 6' power cord, connect to the monitor and power the monitor on.
* Connect the monitor video cable from the monitor "RGB" port to the corresponding port on the router.
* Place camera power injector in desired location.
* Connect red network cable from the "Data In" jack on the power injector to the router port labelled "Camera".
* Connect Internet connection to the router port labelled "Internet" using a blue network cable.
* Connect keyboard and mouse to USB ports on the rear of the router.
* Plug the AC power brick into the router and then an available power outlet. The router will turn itself on automatically.
* Wait for a 3 toned beep from the router and the desktop environment to appear. (Note: Mozilla Firefox will open with the error message "Well, this is embarassing". This is normal.).
* Connect blue network cable from the camera to the "Data & Power Out" jack on the power injector.
* Once the light on the top of the camera turns green, click "Start New Session" in Firefox. A video window should appear after a brief delay.
* Adjust the focus and zoom of the camera manually using the dials on the front of the camera.
* To test the stream on the remote location end, open VLC on a computer with Internet connectivity, then run File -> Open Network Stream and connect to http://public.ip.addr.ess:8080.
Category:Server
Category:Multimedia