Cameras at one location with a recorder next to them is a solved problem. Cameras at five locations with one recorder at the head office is a bandwidth question dressed up as a network design. So start by doing the sums.
The arithmetic first
A camera sends continuously, day and night, without a pause. Count on the bitrate the camera itself reports, not the one in the brochure. Rough orders of magnitude:
| Image | Per camera | 8 cameras | 16 cameras |
|---|---|---|---|
| 1080p, 15 fps, H.264 | 2 to 4 Mbit/s | 16 to 32 Mbit/s | 32 to 64 Mbit/s |
| 4K, 15 fps, H.265 | 6 to 12 Mbit/s | 48 to 96 Mbit/s | 96 to 192 Mbit/s |
That is upload from the branch, permanently. Most business lines do not have that room, and the line is doing the real work at the same time. This is why "everything to the recorder at the head office" nearly always falls over in practice.
What does cross the tunnel
The workable shape is almost always the same: record locally, watch centrally.
- A recorder or a NAS per location that takes the streams. That traffic stays inside the building, on a switch, and never touches the uplink.
- Over the tunnel goes only what a person asks for: a live image, a fragment, an export. That is a few Mbit/s now and then instead of tens of Mbit/s continuously.
- Optionally a second, low-rate stream per camera to the head office for the overview screen. Nearly every camera can produce a substream of a few hundred kbit/s, and eight of those do fit.
If recording really has to be central, because a recorder in a branch could be stolen for instance, choose it deliberately: a heavier uplink per branch, or local recording plus a central copy of the motion fragments only.
The VLAN without internet
Cameras do not belong on the internet. Put one row in the site's VLAN table for cameras, with Internet off. That produces one firewall rule per router that drops traffic from that VLAN towards the WAN interfaces. Cameras that want to call a cloud cannot, and firmware that wants to update itself cannot either. That is the point.
Do not also mark the camera VLAN as Isolated if the images have to cross the tunnel. Isolated means: towards WAN and nowhere else, and a site tunnel counts as LAN. The cameras would no longer reach the recorder at the head office. Internet off and isolation off is the right combination; the fine separation is arranged below.
If you want more precision than on or off, set Traffic between VLANs under Firewall to matrix and tick who may start a connection to whom. Workstations may reach cameras, cameras may reach nothing, for example. The matrix writes a closing drop per network towards everything in the LAN list.
And there is the second trap: the tunnel is in that LAN list as well, but it is not a column in the matrix, because the matrix only knows the VLANs of that one router. Traffic from the camera VLAN towards the tunnel is therefore blocked, however you tick. Add a custom forward rule in the Firewall section with the tunnel as its out-interface, and put in the comment why it is there.
On the board
- Drag a camera block onto the network board at each location and connect it to the port the camera is on. The tool makes that an access port on the VLAN you give the block, and puts a comment on it.
- Fill in a fixed address on the block if the camera has one. The checks then verify that the address sits in the right network, that it is not the network, broadcast or router address, that it is not used twice, and that it falls outside the DHCP range.
- Set PoE per port in the Bridge and ports section, or per port on the board. A camera that does not come back after an outage is often a port you want to be able to switch off and on remotely.
- Give the recorder a block of its own, with its VLAN and its address, so the checks cover it too.
What goes wrong
- The uplink is narrower than you thought. The tool works out the speed of every cable and reports it when the internet subscription is faster than the port it lands on, with a suggestion for a better port. It does not calculate anything about the tunnel: that remains your sum.
- A VLAN that stops halfway. If the switch the camera hangs on does not carry the camera VLAN, the check says that the VLAN stops at that cable, or that the host uses a VLAN the switch does not carry on the port it is cabled to.
- An MTU that is not the same everywhere. Large packets then disappear without an error, and that looks like stuttering images. The tool compares the MTU per cable and per connected network and names the exact two ports.
- Cameras using multicast. Turn IGMP snooping on for the bridge, or every stream goes to every port.
Further reading: A camera network, Camera images drop out and MTU and jumbo frames.