Dahua 2-wire intercom setup: the field-tested procedure and seven failure modes

The short version

Dahua's 2-wire IP intercom range lets you modernise an entrance where only two conductors run to the gate. Once working it is excellent: video, keypad PIN, RFID fobs, calls to a phone and remote unlock. Getting there is where installers lose hours.

The failure is rarely hardware. It is almost always addressing. Three devices — a door station, an indoor monitor and a "hub" that has no IP address at all — have to end up on one subnet, with a SIP relationship between the two IP hosts and a working internet path for the door station. The manuals describe each device in isolation and never give the commissioning order, and the app everyone reaches for cannot set a door code. That one undocumented fact causes most of the pain.

1. The hardware, and what each box actually does

Consequence: only two of the three boxes have an IP. The switch will never appear in a port scan — identify it by its LEDs.

Switch LED cheat-sheet: POWER solid red = powered. RUN flashing green = healthy. E1 flashing green = uplink (router side) OK. E2 flashing green = cascade OK. P flashing green = a door station or monitor is talking on the bus. P solid or off = no 2-wire device seen — a wiring or bus fault.

2. The mental model

        HOUSE LAN (e.g. 192.168.0.0/24)

   [Wi-Fi / phone] ---- [Router] ---- [Wi-Fi extender / AP]
                                             |
                                   [ VTNS2003B-2 "hub" ]     one RJ-45 uplink; NO IP
                                             |
                          2-wire bus (48 V + network over two wires)
                           |                               |
                  [ DHI-VTO3222E-P ]              [ VTH1550CHW-2-S1 ]
                   gate door station                indoor monitor
                   IP host + SIP server             IP host + SIP client

Five truths the manuals don't state plainly:

1. The two wires carry both power and data. The VTNS2003B-2 is effectively a powerline-to-Ethernet bridge. There is no separate data pair.
2. The hub has no IP. It is invisible to ping, to a scanner and to the app.
3. Door station and monitor must share one subnet. The door station is the SIP server and the monitor registers to it as a Room No. (e.g. 9901). On our deployment the two were registered to each other; whichever arrangement your firmware uses, the two SIP addresses must point at each other's current IPs.
4. Basic intercom works with no internet. Call, monitor, unlock and PIN all run over the 2-wire bus and the LAN. Internet is only needed for the mobile app.
5. The keypad PIN lives on the door station, set in its web UI — not on the monitor screen and not in the app.

3. The documentation gaps we confirmed

1. No end-to-end commissioning order across the three manuals. Nothing says addressing and SIP must be fixed in a particular sequence.
2. The hub's IP-less, bridge-only nature is buried. Installers reasonably expect a "hub" to be something you can log into.
3. The door code cannot be set from the monitor or the app. The app's Access screen only views unlock records and performs a remote unlock.
4. The monitor's "VTO Set" list is undocumented — in particular that the entry's address is what the Monitor button uses, and that an entry pointing at the monitor's own IP produces "Failed to monitor. The network is abnormal."
5. Conflicting factory defaults. Different generations default to 192.168.1.108 or 192.168.1.110, and a monitor and door station can both ship on 192.168.1.108.
6. No guidance on Wi-Fi extenders. Most extender modes create a second subnet, which silently breaks discovery and the cloud path.
7. The monitor can be a DHCP client whose address silently moves, breaking the SIP link with no obvious warning.

4. The seven failure modes

5. The working commissioning procedure (order matters)

Addressing convention used here: the client LAN is a generic 192.168.0.0/24; the Dahua factory subnet is 192.168.1.x. Substitute your own.

5.1 Physical and LED check

• Hub powered (48 V) and its P LED flashing green.
• Door station and monitor on the same 2-wire pair. A parallel "party-line" bus is normal.
• Hub RJ-45 uplink into the LAN — ideally straight to the router, or to an access point in bridge mode.

5.2 Decide the addressing before touching a device menu

• Put the door station and monitor on the house LAN, each with a unique static IP, the correct mask, and gateway and DNS set to the router.
• Avoid DHCP for both. An address that changes later silently breaks the SIP link.

5.3 Find the devices

• If they are still on the factory subnet, put a laptop on 192.168.1.x (a USB-Ethernet adapter into the hub works well), or scan the LAN.
• Identify Dahua units by MAC OUI and an HTTP page title of WEB. Expect two hosts; the hub will not appear.
• Identification endpoint (HTTP Digest): GET /cgi-bin/magicBox.cgi?action=getDeviceType returns e.g. type=DHI-VTO3222E-P.

5.4 Give the door station a working network path

Set IP, mask, gateway and DNS, reboot, then check /cgi-bin/configManager.cgi?action=getConfig&name=VSP_PaaS returns Online=true. That is the gate to the mobile app.

5.5 Fix the SIP relationship

• Door station (server): IsMainVTO=1; SIPServer / OutboundProxy = its own IP (or the monitor's, where the two register to each other).
• Monitor (client): SIPServer, OutboundProxy, Proxy and STUNServer = the door station's current IP.
• Monitor device list (VTOInfo / RemoteDevice): the GATE entry's address = the door station IP, enabled. Disable any entry at 0.0.0.0 or at the monitor's own IP.
• Reboot both. The monitor should register and the Monitor button should show the gate camera.

5.6 Set the keypad door code

On the door station web UI: Local Device Config → Access Control → Config → Public Password → Setting → Add. Enter a user name and a 4–6 digit code, apply, then test at the keypad with # code #. The DMSS app cannot do this. Detail in Part 3.

5.7 Commission cards and fobs

Enable card reading under Card Settings if required, issue the cards through the door station, and test every fob against the live device.

5.8 Mobile app

Add the door station to DMSS (Part 6). It must already be cloud Online from step 5.4.

5.9 Make the addressing permanent

Set both IP hosts to static — the monitor especially, as it often defaults to DHCP — and record the addresses and credentials for the handover.

5.10 Acceptance test

• Gate button rings the indoor monitor, shows the camera, two-way audio works.
• Gate button rings the phone; answer and unlock work.
• Unlock from the indoor monitor.
• Unlock from the phone app.
• The keypad code opens the gate.
• Every fob opens the gate.
• The electric strike releases from every one of the above.

6. Talking to the devices directly

Two interfaces matter. The door station answers the legacy CGI over HTTP Digest:

# identify
curl -k --digest -u admin:PW "https://<VTO-IP>/cgi-bin/magicBox.cgi?action=getDeviceType"

# read a whole config section
curl -k --digest -u admin:PW "https://<VTO-IP>/cgi-bin/configManager.cgi?action=getConfig&name=Network"
#   -> Network | SIP | VTOInfo | RemoteDevice | AccessControlGeneral | VSP_PaaS | ...

# write (brackets in names need curl -g to disable globbing)
curl -g -k --digest -u admin:PW \
  "https://<VTO-IP>/cgi-bin/configManager.cgi?action=setConfig\
&Network.eth0.IPAddress=192.168.0.60&Network.eth0.DefaultGateway=192.168.0.1\
&Network.eth0.DnsServers[0]=192.168.0.1"

# set the door code
curl -k --digest -u admin:PW \
  "https://<VTO-IP>/cgi-bin/configManager.cgi?action=setConfig&AccessControlGeneral.CommonPassword=<CODE>"

The indoor monitor exposes only the newer RPC2 JSON-RPC API — covered in Part 5.

Discovery that actually worked

• A TCP port scan won't find the monitor. Discover by ARP/MAC OUI.
• A simple host sweep plus a targeted probe of ports 80, 443, 554, 5000 and 37777 and an HTTP title grab reliably separated the Dahua devices from everything else on the LAN.
• Useful identifiers: web title WEB; SDK port 37777; RTSP 554; stream port 5000.

7. Quick troubleshooting matrix

8. Defaults, ports and config keys

Config keys used (door station, CGI): Network.eth0.* · SIP.* (IsMainVTO, SIPServer, OutboundProxy, SIPServerID, UserID) · AccessControlGeneral.CommonPassword · VTOInfo.* · RemoteDevice.* · VSP_PaaS.Online · MobilePhoneApplication.PushNotificationEnable.

Written from one real deployment. Client-identifying details have been removed; technical values are generic examples. Firmware and hardware generations differ — verify each step against your own models. Corrections are welcome and will be published with attribution.