Need help setting up SSH Tunnel with Motion Pi surveillance system

Question

Hi I have followed this guide https://pimylifeup.com/raspberry-pi-security-camera/ and setup a multi camera surveillance system using my pi a few usb cameras and 3 ip cameras.

I would like to access my pis webpage from my iphone over the internet when I am far from home. I would like my connection to be encrypted and safe from eavesdropping.

After some research I found that using a ssh tunnel would be the best way, I have found this guide https://charlesreid1.com/wiki/RaspberryPi/SSH_Stunnel but am confused to how the whole tunnel works?

Do I install stunnel on the motionpi? So its the "command and control server" the guide talks about or do i setup this command and control server on another system?

Any help with explanation of how ssh tunnels work and how to get the desired setup running is greatly appreciated.

Answer 1

If you are using Stunnel, you probably don't need an SSH tunnel unless you have a specific reason. Stunnel is designed to work as a TLS encryption wrapper between client and server so that whatever communication can be run over the TLS connection. If your purpose is solely to view your webcam via a secure channel, you can simply use ssh to create a tunnel like this:

ssh -f user@remoteServerIP -L 8080:webCamIP:8080 -N

• -f tells ssh to run in the background just before command execution.
• -L specifies that connections to the given TCP port on the client are to be forwarded to your internalCam IP address and port.
• -N tells the remote system to not execute a remote command.

Once the ssh tunnel is established, you can point your browser to your webcam just like you are at home.

Answer 2

Stunnel is a simple way to provide remote access to a particular service on your raspberry pi - provided that you can open ports on your firewall/router AND have either a static IP address or Dynamic DNS services. If you're not very savvy on networking and the term "NAT" doesn't mean anything to you, this is probably more complicated than you want to attempt.

There are a number of other ways to remotely access your raspberry pi at varying costs:

• https://ngrok.com/ -- This forwards an existing web services to a random URL. So you'd access something like https://asdfasdfasfcef43.ngrok.io -- Keep in mind that it doesn't add authentication (username/password) so you'd have to do that yourself
• https://remote.it/rpi/ -- Remote.it used to be Weaved and they provide remote access services. A tutorial from their old name days: https://www.hackster.io/idreams/access-your-raspberry-pi-over-the-internet-157ad1
• https://www.dataplicity.com/ -- Very very raspberry pi specific.

Lastly. If port forwarding isn't that scary to you, you could setup your webpage with SSL internally - then forward that to the outside world. There are a number of tutorials on how to password protect Apache/Nginx.