Ubiquiti UniFi Video CCTV - Reverse Proxy Using Nginx

[dhicks]

Hello All,

 

We are using Ubiquiti's UniFi Video application to record and view our 15 CCTV cameras. This is an application with a web-based front-end, hosted on-site on a Debian VM.

 

We have an issue where some (but not all) workstations that need to access CCTV have issues with the self-signed certificate provided by the application. Everything worked fine, as far as I know, up until a few months ago, when some browsers started to simply stop accepting the self-signed certificate. I figured this was an issue with a browser update, so we tried with Firefox 32-bit ESR, but still with the same issue. We then figured the issue might be a Windows update, so re-imaged a workstation back to Windows 10 1803, still with no success.

 

Therefore, I figured the solution was to sort out a proper SSL certificate for the CCTV server. The process for replacing UiFi's certificate with another one comes under the "advanced" section of its documentation, so I figured the easiest (and best) solution would be to set up a reverse proxy server to allow us to connect to the server from outside, all with properly set-up SSL via Let's Encrypt. I set up a separate Debian 10 VM, installed Nginx, and have the follwing configuration:

 

server {
       server_name cctv.myschool.com;

       listen 443 ssl;

       # See: https://gist.github.com/vidia/fbef2ee643b23848d8b24211d5860b78
       # I'm not sure why the "/ws/" location needs separate settings, but the comments in the config given at the above URL
       # state "needed to allow the websockets to forward well".
       location /ws/ {
               proxy_pass http://192.168.x.y:7080;
               proxy_http_version 1.1;
               proxy_buffering off;
               proxy_set_header Upgrade $http_upgrade;
               proxy_set_header Connection "Upgrade";
               proxy_read_timeout 86400;
       }

       location / {
               # Note that here (and above) we are forwarding to HTTP on port 7080 on the Ubiquiti server. Traffic is sent
               # unencrpted, but only over the local network on the one switch in the server rack. We use equally easily have
               # used the HTTPS port, 7443, but that would add some further overhead (30%?) for extra encryption.
               proxy_pass http://192.168.x.y:7080/;
               proxy_set_header Host $host;
               proxy_set_header X-Real-IP $remote_addr;
               proxy_set_header X-Forward-For $proxy_add_x_forwarded_for;
       }

       ssl_certificate /etc/letsencrypt/live/cctv.myschool.com/fullchain.pem;
       ssl_certificate_key /etc/letsencrypt/live/cctv.myschool.com/privkey.pem;
       include /etc/letsencrypt/options-ssl-nginx.conf;
       ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem;
}

# Proxy port 7446, used by Ubiquiti for Websocket connections.
# Note that we're passing 7446 here (video-over-HTTPS websockets) to port 7446 on the Ubiquiti server - passing to 7445 instead (video-over-HTTP)
# doesn't seem to work.
server {
       server_name cctv.myschool.com;

       location / {
               proxy_pass https://192.168.x.y:7446/;
       }

       listen 7446 ssl;

       ssl_certificate /etc/letsencrypt/live/cctv.myschool.com/fullchain.pem;
       ssl_certificate_key /etc/letsencrypt/live/cctv.myschool.com/privkey.pem;
       include /etc/letsencrypt/options-ssl-nginx.conf;
       ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem;
}

# Redirect any HTTP requests to HTTPS.
server {
       if ($host = cctv.myschool.com) {
               return 301 https://$host$request_uri;
       }

       listen 80 ;
       server_name cctv.myschool.com;
       return 404;
}

 

We're forwarding ports 80 (HTTP), 443 (HTTPS) and 7446 (websocket data) on the gateway to the proxy server. Port 80 is only open so Nginx can redirect any requests made to it to HTTPS instead.

 

The above seems to be working fine. I don't get what the "/ws/" section is doing - I assume the URL is somerthing to do with Websockets, but why does Websocket functionality need its own namespace as well as a whole dedicated port? Also, we're proxying HTTP served from the Ubiquiti server with HTTPS on the proxy server, but why doesn't that work for the Websocket port, i.e. why can't I send data to port 7445 on the Ubiquiti server instead of 7446?

[localzuk]

Random question, why not use the Unifi video service via video.ui.com?

[dhicks]

Random question, why not use the Unifi video service via video.ui.com?

 

I got part-way through the setup above, then came accross the cloud service - I did try to get it set up, but nothing seemed to download from the Ubiquiti setup page after login, and there didn't seem to be much of an explanation on the site itself. I need a proxy service for other things anyway, so I figured I might as well get this proxy set up and working so I understood what it was doing.