Not safe to by Hikvision equipment since banned in US?

[Daniel15]

.... 2 network cards in your BI machine

This is a good idea, but using a separate VLAN is still useful even if you have two network cards. For example, if you want to use the same network switch for other devices too. Configure the switch ports used by the cameras, and the switch port used by the second network card, to use the camera VLAN untagged and as the PVID.

 

[TonyR]

Have done this many times with TVs......why the hell does a Samsung TV need to send data to China and India?

Hmmmm....you'd think it'd be South Korea since that's Samsung's home base.

 

[metrangia]

Cameras should always be on a separate VLAN that does not have internet access, regardless of brand or country of manufacture. The firewall on your router should be configured to allow inbound cross-VLAN connections from your regular VLAN to the camera VLAN, but not the other way around (i.e. your PC or Blue Iris server can access the camera, but the camera can't access them).

I'm new to this and would like to understand this better. I can see how I would want the cameras to have no access to the Internet. But if I want to access my recordings remotely through Blue Iris, that's OK, right? IOW, the cameras send the feed to BI. I don't access the cameras remotely, but can still view the feeds via BI. Is that considered safe?

 

[TonyR]

I don't access the cameras remotely, but can still view the feeds via BI. Is that considered safe?

Yes.
And you can isolate only the cameras from the Internet but allow BI to be remotely accessible via the Internet to view its cameras by using, among other methods, two NIC's in the BI server as show below. Each NIC is on a subnet diffeernt from the other NIC.

 

[wittaj]

+1 above. Plus when using BI, you are only seeing the video feed and not actually exposing the camera itself to the internet.

 

[Daniel15]

Yes.
And you can isolate only the cameras from the Internet but allow BI to be remotely accessible via the Internet to view its cameras by using, among other methods, two NIC's in the BI server as show below. Each NIC is on a subnet diffeernt from the other NIC.

View attachment 198655

This is a good diagram.

You'll also want to enable Windows' NTP server, update the firewall on the BI PC to allow the cams to connect to UDP port 123 (NTP), and configure the cameras to use it as their NTP server, so they can keep their time in sync, otherwise they'll drift over time. By default, they use a public time server, but that won't work without internet access. I use Windows Server 2022 for my Blue Iris server, but I think the NTP service is available on Windows 10 and 11 too.

I'd also recommend only accessing your Blue Iris server via a VPN rather than exposing it directly to the internet. Tailscale is very easy to set up and is what I'd recommend - install it on your Blue Iris server, update the Windows firewall if needed, install it on your phone or laptop or whatever, then accessing the Blue Iris' Tailscale IP from your phone or laptop should just work. Wireguard is good, but takes a while to set up (Tailscale is built on top of Wireguard and automates the setup). Other solutions like ZeroTier are fine too.

 

[nutshellml]

.... 2 network cards in your BI machine

Can you explain a little more? I'm setting up my home network and don't want to go back to way it was (just using the Blue Iris wizard to setup up remote access) I have Hik cameras, don't really want to mess with VLANs. I'm tech/pc savvy to a point, What would you recommend? 2 Network cards and how would that setup be/look like? THANKS!

 

[nutshellml]

Yes.
And you can isolate only the cameras from the Internet but allow BI to be remotely accessible via the Internet to view its cameras by using, among other methods, two NIC's in the BI server as show below. Each NIC is on a subnet diffeernt from the other NIC.

View attachment 198655

This is very helpful and intersting. I'm looking to re-setup my home network and concerned about the cameras exposed to internet, not so much for someone to watch them but to gain gateway to my home network. In this scenario above, that will elimate that totally? Will also still be able to view the cameras while outside my home network via BI, which will be secure and say someone may be able to watch but never access the cameras/home network direclty?

Any thoughts on how to assure my IoT devices are also secure? ie. My zwave locks/doorbell/switches etc?

 

[sdkid]

This is very helpful and intersting. I'm looking to re-setup my home network and concerned about the cameras exposed to internet, not so much for someone to watch them but to gain gateway to my home network. In this scenario above, that will elimate that totally? Will also still be able to view the cameras while outside my home network via BI, which will be secure and say someone may be able to watch but never access the cameras/home network direclty?

Any thoughts on how to assure my IoT devices are also secure? ie. My zwave locks/doorbell/switches etc?

If nothing else, use the tools in your router to block the camera IP's from accessing the internet. Every router is different, but there will be a way to block IP's on your lan from getting out to "phone home" or provide a target for some hacker.

 

[looney2ns]

This is very helpful and intersting. I'm looking to re-setup my home network and concerned about the cameras exposed to internet, not so much for someone to watch them but to gain gateway to my home network. In this scenario above, that will elimate that totally? Will also still be able to view the cameras while outside my home network via BI, which will be secure and say someone may be able to watch but never access the cameras/home network direclty?

Any thoughts on how to assure my IoT devices are also secure? ie. My zwave locks/doorbell/switches etc?

Dual NIC setup on your Blue Iris Machine

In making your system more secure this is a great option to eliminate your cameras calling home / connecting to the internet This is a great place to start to setup a bit more secure network and learn more about IP/Subnets etc. before adding dual NICs: Router Security - Subnets and IP addresses...

ipcamtalk.com

How to Secure Your Network (Don't Get Hacked!) | IP Cam Talk

 

[Daniel15]

Any thoughts on how to assure my IoT devices are also secure? ie. My zwave locks/doorbell/switches etc?

Z-Wave and Zigbee are essentially automatically secure, as there's no way the devices can directly reach the internet. Z-Wave and Zigbee are totally separate networks. Proprietary controllers / gateways can access the internet, but the best practice for Zigbee is to use a PoE Zigbee coordinator like the SLZB-06 (SLZB-06 Zigbee Ethernet PoE LAN USB WiFi Adapter CC2652P | Zigbee2MQTT | Home Assistant | SMLIGHT | SMLIGHT Official Homepage) along with Zigbee2MQTT and something like Home Assistant. I'm less familiar with Z-Wave as most of my smart devices use Zigbee.

If you have wi-fi IoT devices, the best approach is to put them on a separate VLAN. This requires wifi access points that support multiple SSIDs and let you change the VLAN per SSID. Low-end consumer-grade access points normally don't support this, but prosumer and business-focused ones do. I've got two TP-Link Omada EAP670 access points, but the Ubiquity Unifi U6 and U7 series are popular too. The best practice for wifi will be to eventually use Wifi HaLow for IoT devices, but support isn't widespread yet.

 

[Daniel15]

2 Network cards and how would that setup be/look like? THANKS!

Check if your motherboard has two Ethernet ports - some of the higher-end ones do. If not, buy another NIC. A Gigabit NIC is around $15 (e.g.

https://www.bhphotovideo.com/c/product/900387-REG/TP_Link_tg_3468_32_Bit_Gigabit_PCIE_Network.html

) but these days you may as well buy a 2.5Gbps NIC since they're not much more expensive (e.g.

https://www.bhphotovideo.com/c/product/1731392-REG/tp_link_tx201_2_5_gigabit_pcie.html

) and you may want to update your home network to 2.5Gbps or higher one day.

Connect one NIC to a switch that only has the cameras attached to it. I usually use the "worse" NIC for this (i.e. slower speed, Realtek chip instead of a better one, etc). Connect the other NIC to your regular network. Ensure they're using different subnets.

If you're running Blue Iris in a VM (for example, on a Proxmox or Unraid system), use PCI passthrough to pass through the camera NIC directly to the VM.

 

[nutshellml]

Z-Wave and Zigbee are essentially automatically secure, as there's no way the devices can directly reach the internet. Z-Wave and Zigbee are totally separate networks. Proprietary controllers / gateways can access the internet, but the best practice for Zigbee is to use a PoE Zigbee coordinator like the SLZB-06 (SLZB-06 Zigbee Ethernet PoE LAN USB WiFi Adapter CC2652P | Zigbee2MQTT | Home Assistant | SMLIGHT | SMLIGHT Official Homepage) along with Zigbee2MQTT and something like Home Assistant. I'm less familiar with Z-Wave as most of my smart devices use Zigbee.

If you have wi-fi IoT devices, the best approach is to put them on a separate VLAN. This requires wifi access points that support multiple SSIDs and let you change the VLAN per SSID. Low-end consumer-grade access points normally don't support this, but prosumer and business-focused ones do. I've got two TP-Link Omada EAP670 access points, but the Ubiquity Unifi U6 and U7 series are popular too. The best practice for wifi will be to eventually use Wifi HaLow for IoT devices, but support isn't widespread yet.

Thanks, was hoping to avoid VLANs as I’m not too familiar with them. I’ll be using Home Assistant, will I be able to integrate or use AI or Motion triggers from BI for HA? I did that years ago with Vera

 

[Daniel15]

. I’ll be using Home Assistant, will I be able to integrate or use AI or Motion triggers from BI for HA? I

Yeah, that will work fine. I'm using Blue Iris for my NVR, and have automations configured in both Home Assistant and Node-RED. Blue Iris can send MQTT events on alerts (i.e. when motion is detected), then Home Assistant and Node-RED can listen for that.

I think there's a Home Assistant custom component for Blue Iris, but I'm not using it. I just use iframes to UI3 to show cameras, and MQTT for doing things when alerts are triggered.

 

[The Automation Guy]

Thanks, was hoping to avoid VLANs as I’m not too familiar with them. I’ll be using Home Assistant, will I be able to integrate or use AI or Motion triggers from BI for HA? I did that years ago with Vera

VLANs are really not complicated, but do require network switches and routers that support them. If you have inexpensive consumer grade network equipment, you might not be able to utilize VLANs even if you wanted to.

 

[nutshellml]

Yeah, that will work fine. I'm using Blue Iris for my NVR, and have automations configured in both Home Assistant and Node-RED. Blue Iris can send MQTT events on alerts (i.e. when motion is detected), then Home Assistant and Node-RED can listen for that.

I think there's a Home Assistant custom component for Blue Iris, but I'm not using it. I just use iframes to UI3 to show cameras, and MQTT for doing things when alerts are triggered.

Got one more ? - Are you running Home Assistant and BI on same PC? Or using Raspberry Pi? Trying to figure out which route to go...