Manual

Recipe: reaching a camera or doorbell from outside

See the footage from your phone, without hanging the camera on the internet.

The goal: you can watch your camera or doorbell from anywhere, and nobody else can. A camera wired straight to the internet is the most common way a network is opened from the inside: old firmware, a default password, and search engines that look for exactly those devices.

What you need

  • A router with at least three wired ports, so the VLAN role is available.
  • The address or MAC of your camera or recorder, and the port it serves its stream on.
  • A fixed address from your ISP, or IP Cloud DDNS if you do not have one.

Step 1: a VLAN of their own

  1. Pick the Office router with VLANs role, at home as well.
  2. Add a row to the VLAN table: id 40, name vlan40-cam, Router address 192.168.40.1/24.
  3. Leave DHCP on, switch Isolated on and Internet off.
  4. Keep your own network at the top of the table. The first VLAN is what wired ports get when you do not list them separately.

Those two ticks do different things. Isolated produces a rule that drops new connections from the camera VLAN to your other networks. Internet switched off adds a second rule that drops traffic from that VLAN towards the WAN side. Together the camera can start nothing at all, while you can still reach it: replies to a connection you start come back as usual.

Step 2: the ports

  1. In Port assignment, set the port carrying the recorder or the PoE switch to Mode access with Untagged VLAN (pvid) 40, if only cameras sit behind it.
  2. If a switch with mixed traffic sits in between, make that port a trunk and tick VLAN 40 under VLAN membership.

Step 3: who may reach the cameras

Go to Firewall & NAT and set Traffic between VLANs to Only what is ticked in the matrix. Tick the cell that lets your work VLAN start connections towards the camera VLAN, and nothing else on that row. Leave the opposite direction empty: a camera has no reason to open a connection to your laptop.

With the matrix chosen, the Isolated tick on a VLAN is no longer used: the matrix decides everything between networks. The Internet tick still applies.

Step 4: a VPN instead of a port forward

Add the VPN block in the wizard, or switch the VPN section on in advanced mode.

  1. Fill in Public address or hostname of this router. Without a fixed address, turn on IP Cloud DDNS under Management access and use the mynetname.net name.
  2. Leave the WireGuard interface as it comes: wg-rw, UDP port 13231, tunnel address 10.10.10.1/24, Tunnel counts as LAN on.
  3. Generate a key pair for the router and for the peer with the button beside each. Without one, the client configuration has no public key in it.
  4. Next to the script the tool puts an [Interface] and [Peer] block per client: that is the file for the WireGuard app on your phone.

The firewall rule for UDP 13231 is added for you; you do not have to open that port by hand.

Testing it

  1. Turn Wi-Fi off on your phone, connect the VPN and open the camera at its address in the camera VLAN.
  2. On the router, run /ip firewall filter print stats and watch the counter on the rule commented vlan40-cam: no internet climb as the camera tries to call home.
  3. Check /ip dhcp-server lease print to confirm the camera has an address from the right range.

If it really has to be a port forward

Fill in protocol, External port(s), To internal address and optionally Internal port under Port forwards (dst-nat). There is no field to limit the sender, so you do that with two rules under Custom filter rules, in this order:

  1. Chain forward, action accept, Dst. address the camera's address, Src. address the network you connect from, In-interface list WAN.
  2. Chain forward, action drop, Dst. address the camera's address, In-interface list WAN.

Custom rules are written before the isolation and matrix rules and before the closing drop, so these two do exactly what they say. It only helps when you come from a known range of addresses. If you cannot name one, the forward protects nothing and the VPN is the only honest answer.

What to watch out for

  • No internet also means no cloud. The manufacturer's app stops working from outside, and the camera gets no firmware updates. That is the trade. To keep the cloud, leave Internet on and keep Isolated ticked.
  • No time over DHCP in a VLAN. The NTP server field for clients sits in LAN & DHCP, not in the VLAN table. A camera with no internet and no time stamps its footage wrongly, so point it at the router as its NTP server on the camera itself.
  • Split tunnel and VLANs. If you switch All traffic through the VPN off on a peer, read the AllowedIPs line in the client configuration: it lists the tunnel network and the LAN, not your VLAN subnets. Add the camera subnet yourself, or keep the full tunnel on.
  • Leave UPnP off. Under Services & tools it is off by default. On means the camera can open a port by itself, and then none of the above was worth doing.

Related: VLANs, WireGuard and Port forwarding. For a larger camera system with its own recorder: Camera system (CCTV).

Want to try it right away? Open the configurator