Blue Iris

I maintain 3 blue iris systems, all 3 have been upgraded to V5, and are working with the exception of 1 site. UI3 is working, however the mobile app says "Unable to connect. Please try again. Reason: Unable to reach server"
Dell Precision 3431
Win10Pro 1909
Blue Iris 5.0.9.3 x64
Android Blue Iris App 2.0.71
Windows Defender Firewall disabled
No 3rd party/AV firewall
Sonicwall firewall configured with port forward and firewall access rule
UI3 accesible from external systems, including the Android device in question.

Steps taken:
Recreated firewall rules on sonicwall. No advanced/application level filtering in place.
Created new blue iris user and tested UI3 access with new account successfully
Repaired Blue iris app, and reapplied 5.0.9.3 update
Rebooted server multiple times throughout process, after any changes were made to server.
Checked blue iris webserver/advanced auto-ban, disabled auto ban and tried 24 hours later
Deleted server in android app and recreated. Also cleared all app data and recreated server connection again. Attempted connection over WLAN and WWAN connections from device to connect via different ip's.
Remote Access wizard shows green checkmarks until the router page. The site has business class internet with a static ip. The blue iris server has a static LAN address.


1. Does the mobile app connect on some alternate port, or protocol than the http port? The mobile app worked in the past, but I don't check it frequently, and now it's no longer working. My C:\BlueIris\log folder is empty? Status shows connections to UI3 properly, but doesn't seem to have any significant data on failures.

2. Where do I find/enable logs that show every connection attempt, along with debug info?

My experience is limited but have extensive firewall experience with other Enterprise grade firewalls. One site was responsible for their own Internet access and their IT group used a SonicWall. No matter what they did it wouldn't work and kept blaming out network equipment. They had to wipe the SonicWall and set it all up again and it started to work.

Can you do a capture on the SonicWall from the ingress (WAN) and the egress (LAN) to see the following:

1) That the traffic is actually hitting the firewall

2) the the traffic is egressing the firewall to the Blue Iris server

If both are true, then you know it is an issue with Blue Iris. If one or both are not true, then it isn't even worth looking at the Blue Iris server.

I did a packet capture and traffic was being passed , however I noticed my intrusion prevention was stepping in and blocking some of the traffic. I'm posting my resolution here to assist with future users who encounter the same issue.

To determine if this is your issue, login to your Sonicwall device, go to the Investigate tab of the interface, then click on Event Logs on the left side.
I'd change the show: setting to "last 60 seconds". Attempt to login a few times on your android device, then refresh the event log view, or wait for the automatic refresh. If you see "IPS Detection Alert: INFO JSON Request Inbound, SID: 14749, Priority: Low" in your logs, then these steps should resolve your issue.

Click on the Manage tab at the top, then Intrusion Prevention on the left side, under "Security Services".
Scroll down to the "IPS Policies" section. At the top right of the section there is a "Lookup Signature ID" box with a magnifying glass next to it. Type in 14749 in the signature ID field, then click on the magnifying glass.
This should launch a new window, titled "Edit IPS Signature", with the JSON Request signature available for editing. I chose to disable prevention by changing "Prevention: Use Category Setting" to "Disable". I left detection enabled, for future diagnostics. Click on OK at the bottom, and re-test the Android application.