Network-access field guide (Tunisia)

The pilot playbook says “log into the router and port-forward the camera.” That one sentence hides every hard part of a real pilot. This page is the deep version, written for the worst case: the owner is non-technical, has no IT or security team, doesn’t know a single password, and you want to configure as much as possible remotely.

The headline you can hold onto: you do not need the owner to understand anything, and after one plugged-in cable you can do the rest from your desk.

The mental model — three things must line up

A live pilot works only when all three of these connect:

1. The router — the ISP’s box on the wall. It’s the store’s door to the internet and the gatekeeper of its local network (LAN).
2. The camera / recorder — where the video actually is, sitting on that LAN behind its own password.
3. The path in — how your worker, outside the store, reaches the camera’s RTSP stream.

Most of this guide is about the path in, because that’s where pilots die. Skip ahead to the path in if you already have both passwords.

---

Part 1 — “The router”: what it actually is

When we say “log into the router,” we mean the modem/router the ISP installed — almost always a Huawei ONT (Optical Network Terminal) on fibre, or a Huawei/ZTE/Sagemcom modem on ADSL. It does three jobs: terminates the internet line, hands out local IPs (192.168.x.x), and runs the Wi-Fi.

You reach its admin page from a device on the store’s Wi-Fi, by typing its gateway IP into a browser.

The ISP box matrix

ISP	Typical box (fibre)	Admin page	Default login	Notes
Orange Tunisie	Huawei HG8245H / 658HG V2	192.168.1.1	admin / admin (limited menu)	Port-forwarding is hidden from admin. Use the superuser: telecomadmin / admintelecom.
Ooredoo	Huawei HG8244H	192.168.100.1	admin / admin	4G box (Huawei B-series): admin at 192.168.8.1, admin/admin.
Tunisie Telecom	Huawei HG8546M / ZTE ZXHN / Sagemcom (varies)	192.168.1.1 or 192.168.100.1	admin/admin or printed on the sticker	Model varies a lot — read the sticker on the box.

The superuser trap on Huawei ONTs

On Orange/Ooredoo Huawei ONTs the everyday admin account often can’t see the port-forwarding menu at all — it’s locked to the ISP superuser (telecomadmin / admintelecom). If you log in as admin and there’s no “Forward Rules” / NAT section, that’s why. This alone is a reason to prefer the tunnel box and skip port-forwarding entirely.

Where to actually get the router admin password

In order of preference — stop at the first that works:

1. The sticker on the box. Wi-Fi name/key and sometimes the admin login are printed on the bottom. The owner has physical access to this even if he “doesn’t know any password.”
2. The Huawei superuser above (telecomadmin / admintelecom) — works on most Orange/Ooredoo ONTs regardless of what the owner set.
3. Call the ISP with the line holder present (they’ll want the account owner’s ID / phone). Ask them to enable port-forwarding or read you the admin password.
4. Factory-reset the router — last resort only. It wipes the Wi-Fi name and password and can drop the internet until re-provisioned. Never do this on a working shop without the ISP on the line. Prefer the tunnel box instead.

---

Part 2 — Camera & recorder credentials: where they come from

The camera password was set by whoever installed the CCTV — an electrician or a security-camera shop, months or years ago. The owner almost never knows it. That’s normal. Here’s how you get in anyway.

The reality of Tunisian shop cameras

Most are Hikvision or Dahua, or an OEM rebrand of them (HiLook, Ezviz, Annke, or unbranded ONVIF cameras from the same factories). This matters because the discovery tools and default paths are known.

Brand	Old default login	Newer kit	Default IP	RTSP port
Hikvision	admin / 12345	Forces an activation password at install	192.168.1.64	554
Dahua	admin / admin	Forces a password at first setup	192.168.1.108	554

Getting the camera credentials — the ladder

1. Ask the owner for the installer’s phone number. Fastest path. The installer set it and usually remembers or has it written down. Often they’ll just read it to you.
2. Check the recorder (NVR/DVR). If there’s a recorder box, its own login often stores the per-camera credentials, and it may still be on a factory default. The NVR is frequently the easier way in than the camera.
3. Discover on the LAN with the vendor tool. From a laptop on the store Wi-Fi:
   • Hikvision: SADP tool — scans the LAN, lists every Hik device, its IP, and model.
   • Dahua: ConfigTool — same idea.
   • Brand-agnostic: an ONVIF scan, or nmap -sn 192.168.1.0/24 to find live IPs, then probe port 554.
4. Reset the password (if truly lost): SADP/ConfigTool can reset via the device serial + start-time → a vendor “security code,” or there’s a physical reset button on the camera/NVR. After reset you set your own password.

Always set your own password

Whatever you find, immediately change the camera to a strong, unique password you control before the stream ever touches the internet. Default-credential cameras exposed online are compromised within hours.

---

Part 3 — The path in, ranked for the worst case

Three ways to reach the stream from outside. For a non-technical owner behind (probable) CGNAT, they are not equal — the first one wins almost every time.

1. Plug-in tunnel / edge box — best for the worst case

Ship (or bring) a small device — a GL.iNet mini-router or a Raspberry Pi, or the eventual S3 mini-PC N100 itself — pre-configured with an outbound VPN tunnel (WireGuard / Tailscale). The owner does one thing: plug it into the router with an ethernet cable (and power). It “phones home” to you.

Why this dominates:

• Works behind CGNAT. The tunnel is outbound, so it doesn’t need a public IP, a port-forward, or the router admin password at all.
• Nothing is exposed. The camera never gets a public port. Far safer.
• One cable, zero skill. No menus, no passwords for the owner to find.
• Everything after is remote. Once the box is on the LAN and tunneled, you run SADP/ConfigTool, discover the camera, reset/set its password, and pull RTSP — from your desk.
• It’s just S3, early. If you were going to deploy an in-store box anyway, this is that box. Bring it forward, and S2’s whole networking problem disappears — and the video can stay in the store (edge-first, our real target).

This is the answer to “can everything be configured remotely?” — yes, after the owner plugs in one box.

2. ISP Fixed IP + port-forward — clean but paid and on-site

Orange Tunisie sells “IP Fixe” — a paid static public IP they explicitly market for connecting a surveillance camera. Tunisie Telecom offers a fixed IP on pro accounts too. Order it, then port-forward an external port to CAMERA_IP:554 on the router (needs the superuser).

• Pro: stable address, no extra device.
• Con: costs a monthly fee, needs router superuser access, needs one on-site visit, and exposes the camera — so you must secure it (strong password, non-standard port, IP allowlist to your worker).

3. Dynamic IP + DDNS + port-forward — avoid

The old way: the owner’s changing public IP tracked by a DDNS hostname, with a port-forward. Assume it won’t work: it dies the moment the ISP uses CGNAT (most connections now), and even without CGNAT the IP changes and the exposure risk is real. Only reach for it if you’ve proven a static-ish public IP and can’t get option 1 or 2.

---

Part 4 — CGNAT: assume it until proven otherwise

CGNAT (Carrier-Grade NAT) means the ISP shares one public IPv4 across many customers. When it’s on, port-forwarding is impossible — there’s no public port that reaches the store.

Treat every Tunisian connection as CGNAT until you prove it isn’t. The tell: Orange Tunisie sells a Fixed-IP add-on — you don’t sell what customers already have, so the default is shared/dynamic.

The 60-second check (on the store Wi-Fi): read the router’s WAN IP in its admin page (exact menu per interface in Inside the admin panel), and compare to whatismyip. If they differ, or the WAN IP is in 100.64.0.0/10 (100.64–100.127), it’s CGNAT → port-forwarding is dead → use the tunnel box.

The clean way to stop caring about any of this: the tunnel box makes CGNAT irrelevant. It’s outbound-only, so it doesn’t matter what the ISP does with public IPs.

---

Part 5 — In person or remote? The honest answer

Task	Remote?	How
Discover the camera’s IP on the LAN	❌ first time	Need to be on the LAN — either on-site, or via the tunnel box once it’s plugged in
Plug the tunnel box into the router	❌	Owner plugs one ethernet cable + power. That’s his whole job.
Find / reset the camera password	✅ (via box)	SADP/ConfigTool over the tunnel; physical reset button is the only maybe-on-site step
Set a strong camera password	✅	Over the tunnel
Build & test the RTSP URL	✅	VLC / ffprobe over the tunnel
Run the worker, get counts	✅	On your laptop / VM, or on the box itself
Re-configure, re-aim line, maintain	✅	100% remote thereafter

The one thing that isn’t remote is getting a device onto the store’s LAN the first time — because you can’t scan a network you’re not on. You solve it one of two ways:

• Mail a pre-configured box → the owner plugs one cable → everything else is remote. No visit at all.
• One 30-minute visit → do discovery on-site, leave with a working path.

Either way, ongoing operation is fully remote. You never need the owner to touch a menu, read a password, or understand what RTSP is.

---

Part 6 — Worst-case runbook (owner knows nothing)

The store owner is elderly, non-technical, has no IT team, doesn’t know the Wi-Fi password let alone the camera’s. Here’s the whole play, mostly from your desk:

1. Don’t ask for passwords he doesn’t have. Ask only for: the camera installer’s phone number, and permission to send/plug a small box.
2. Pre-configure a tunnel box (GL.iNet / Pi / S3 mini-PC) with WireGuard or Tailscale pointing at your endpoint. Test it on your own network first.
3. Get it plugged in — mail it with a one-line note (“plug the black cable into any free port on your internet box, then the power”), or a courier/friend does it, or a single short visit.
4. Box phones home. You now have a foothold on the store LAN, behind CGNAT, no router password used.
5. Discover the camera over the tunnel: SADP / ConfigTool / ONVIF / nmap.
6. Get in: installer’s password → or NVR-stored creds → or reset (tool code, or ask the owner to hold the camera’s reset button for 10s).
7. Set your own strong password, note the model, build the RTSP URL.
8. Pull the sub-stream to the worker (on the box itself, ideally — video never leaves the shop) and start counting.
9. Everything after is remote — dashboards, re-aiming the count line, maintenance.

At no point did the owner need to understand anything or find a password. That’s the standard we hold: we handle everything; his job is one cable.

---

Inside the admin panel — click by click

You only need this for the port-forward path (option 2 above) and the CGNAT check. The tunnel box needs none of it. The three interfaces you’ll meet in Tunisia:

A · Huawei ONT — Orange HG8245H, Ooredoo HG8244H, most TT HG8546M (the common one)

Log in as telecomadmin / admintelecom.

• Read the WAN IP (CGNAT test): top tab Status → WAN → read the IP Address of the INTERNET/route line. Compare to whatismyip. Differs, or in 100.64–100.127 → CGNAT → stop, use the tunnel box.
• Add the port-forward: Forward Rules → Port Mapping Configuration → tick Enable Port Mapping, then:
  • Mapping Name: metrica-cam · Type: User-defined
  • WAN Name: the INTERNET connection (the routed one — not “bridge”/“voip”)
  • Internal Host: the camera IP (e.g. 192.168.1.64)
  • Protocol: TCP/UDP · External port start+end = 8554 · Internal port start+end = 554
  • Click Apply.
• Avoid Forward Rules → DMZ — it exposes the whole camera; use only if port mapping won’t stick.

B · ZTE ZXHN — some Tunisie Telecom lines

Log in at 192.168.1.1, admin / sticker password.

• WAN IP: Status / Network → WAN → read the IP.
• Port-forward: Application → Port Forwarding → Create New Item → Name, Protocol TCP, the WAN connection, LAN Host IP = camera, WAN Port = 8554, LAN Port = 554 → Apply. (Some models: Advanced → NAT → Port Forwarding.)

C · Sagemcom F@st — older Tunisie Telecom

Log in, admin / sticker password.

• WAN IP: the home / status page.
• Port-forward: Advanced → NAT / Port Mapping (sometimes “Games & Applications” or Firewall → Port Forwarding) → add a rule: external 8554 → internal camera:554, TCP → save.

Do these on every interface, or the forward breaks

1. Reserve the camera’s LAN IP first — DHCP reservation by MAC (usually LAN → DHCP), so the camera keeps the same IP the rule points at.
2. Use a non-standard external port (8554), never 554.
3. Test from outside the store (phone on mobile data): open rtsp://user:pass@PUBLIC_IP:8554/… in VLC. Works on Wi-Fi but not from outside → CGNAT or ISP blocking → tunnel box.

Part 7 — What to actually ask the owner

Keep the ask tiny and buy-nothing. Translate to French / Tunisian Darja:

Hi [name] — to set it up I need almost nothing from you:

1. The phone number of whoever installed your cameras (an electrician or a camera shop). I’ll get the technical bits from them.
2. Permission to send you a small box — you just plug it into your internet router with the cable I include. Nothing to buy, nothing to configure.
3. If it’s easy: from your recorder, save a few hours of yesterday’s video to a USB — I’ll show you your real visitor numbers with zero setup (this is the S1 step and it needs no network at all).

Your video stays private — I only keep anonymous counts, no faces.

Do not ask him for the router admin password, the camera password, or to open any menu. Those are your job, and the tunnel box means you rarely need the router one at all.