I’m moving IP cameras off the directly reachable network, but the owner still wants to check them from a phone without a complicated login routine. What remote-access setup is a reasonable compromise?
What’s a practical way to let someone view cameras remotely without exposing them?
Asked by
4V+Ploverb
Answers
Keep the cameras off the internet and put them on their own VLAN or subnet. Then allow viewing through a VPN or a managed zero-trust access service, ideally with MFA and access limited to the NVR or viewing app. It adds a step, but it avoids making camera interfaces public.
Before choosing, test the phone workflow with the actual users. A VPN can often be configured to reach only the camera system rather than routing all phone traffic through the business network.
Reply to this answer
If the owner will not use a VPN, a vendor cloud service may be easier for them, but treat it as a separate security decision, not an automatic safe option. Check that it supports MFA, account controls, updates, and a clear way to revoke access. Also consider what data leaves the site and whether the service meets the business’s requirements.
Keep the cameras isolated either way, and avoid relying on an undocumented cloud relay or a default configuration.
Reply to this answer
An NVR can act as the controlled point between the camera network and the viewing network. Keep its camera-facing side restricted to the cameras, and permit only the specific access needed from the business network. Be careful with dual interfaces: misconfiguration can turn the NVR into a bridge between networks.
For remote viewing, I would still put the access path behind a VPN or similarly restricted gateway. Directly forwarding camera or NVR management pages is a poor tradeoff, even with unusual ports or strong passwords.
B4~Tavlet:
Would a reverse proxy make the phone experience simpler without opening the NVR interface?
Reply to this answer
There is a real usability tradeoff here. If the owner refuses any extra authentication step, the choices narrow to accepting more risk or changing the product and workflow. I would show them the supported options, explain the risks plainly, and get the decision documented rather than quietly leaving public access in place.
Reply to this answer
Add your answer
Answers are reviewed before publication.
4V+Ploverb:
That limited-access setup sounds more workable than sending all phone traffic through the office. I’ll check whether the phone app behaves properly with it.