Blue Iris Over Internet

A site to site VPN setup can be pretty complicated. Some routers let you open a port with a restricted source IP address so it is only accessible to the IP address you specify. That is almost as good as using a VPN, if you can do it that way.

I haven't done this myself, but if you install Tailscale on the BI server, and on some machine at the remote location, I believe Tailscale has a feature that lets you use a node as an exit point to access other devices on its LAN. Apparently the correct term for this is "subnet router" but it does seem to be supported. Looks complicated.

wittaj said:

In fact recently I tried it.

So I tried streaming one camera from my neighbor (they were aware of the risks of doing that but said they do nothing sensitive online - elderly couple that just use it for surfing net and no banking or anything) because they had a better angle for LPR and their ISP threw a fit within 2 days and called them and said if whatever device is IPC-LPR isn't removed from their internet they will be cut off. We found out Spectrum unlimited really is limited LOL.

Who knows if the camera was hacked that quick and being used as a DDoS or if the ISP truly didn't like that unbuffered data being sent, but it didn't last long.

Even more disturbing is the ISP knew the name of the device in question. In theory they shouldn't know about how many or names of devices on the home side of their modem...

Click to expand...

What bit rate were you using, and was it the same ISP at both houses?

Assuming it is the same ISP, then both of your houses are probably connected to the same network cabinet and the traffic likely never even left town and cost them basically nothing. But local traffic in this manner is such a rare scenario that I doubt their monitoring/metering was even built to distinguish local traffic from everything else. Hard to say if hacking was involved. That could certainly amplify the amount of network traffic being used and make it be flagged quicker. As for them knowing the name of the device, I assume either the neighbor's ISP-provided router was spying on them, or the ISP's monitoring tools were able to discern the device name by probing the device through the port you opened.

My brother's house gets internet service from a relatively small regional ISP, and there I run a wireguard VPN server which is used to stream in video from three remote locations:

• Starlink remote -- 3 cameras -- 3 Mbps total.
• Spectrum cable remote -- 4 cameras -- 3 Mbps total.
• Spectrum cable remote -- 1 camera -- 1.5 Mbps total.

Each 1 Mbps is about 11 gigabytes per day, or 329 gigabytes per month. We've never gotten a complaint from any of the ISPs involved. That could be because of the VPN usage making the data opaque to all the ISPs, or it could just be a sign that the networks in my area are not as heavily oversubscribed and congested as in your area.

As I've said before, port forwarding doesn't have to be risky. If your router allows you to restrict access to a particular source IP or IP range when creating the port forwarding rule, then you can use that to ensure there is no unauthorized access. Unfortunately many home routers (especially those provided by an ISP) are garbage that can't do this.

Additionally, if IPv6 is available at both locations and is properly supported by the firewall in the router at the camera location, then you can assign the camera its own public IPv6 address and open the necessary port or ports in the router's firewall (with a source IP restriction in place ideally). There is a learning curve to figuring out IPv6, much like there is for IPv4. But once you wrap your head around it, some aspects are really nice, such as not needing to worry about Network Address Translation (NAT). Your router is given a certain IPv6 address prefix, for example 2001:1234:5678:1234::/64. That specifies the digits which all your IPv6 addresses must start with, and generally that should never change unless you move or change internet providers. Then you have an effectively unlimited number of public IPv6 addresses to assign to your devices however you see fit. So you could assign a camera the address 2001:1234:5678:1234::100 for example, which is shorthand for 2001:1234:5678:1234:0000:0000:0000:0100. That address could then be accessed from any IPv6-enabled host in the world as long as your firewall rules permit the access. To create a web link to that address, you wrap the IPv6 address in square brackets and then add the port number if it isn't the default number for the protocol (just like with IPv4). So for example to link to that address, port 8080, using the HTTP protocol, the URL is The length is a bit unwieldy, which is why it is recommended to use a proper DNS service so you don't have to be working with raw IPv6 addresses all the time.