Advice needed re new CCTV system.

[larryhagman]

Hi, what a great forum! I just read a few threads and it seems I finally found some people who know what they are talking about!! I am hoping to get some guidance here as I am at my wit's end! Bought and returned two CCTV systems (Annke), due to failures and terrible support.

I am looking to replace my Annke 8 cam CCTV system due to fears over security vulnerabilities. I don't like the idea of people easily accessing my DVR/NVR and viewing my home in their leisure time

I heard about Unifi Protect, and it seems to handle security nicely, more nicely than any other system I have seen, thanks to the Cloud Key thing. However I am not sure it can do what I need. It seems to take care of security nicely but doesn't offer monitor connections (VGA/HDMI). Here are my requirements:

24hr recording of various 4mp to 8mp cameras (minimum 4 cameras needed, max 8)
2 or 3 dedicated monitoring stations (TVs ideally via HDMI and/or VGA)
2 dedicated monitoring stations using a Mac computer and a WIndows computer
App alerts and remote access - RELIABLE alerts, all I have tried are useless due to spiders, bad weather here, rain, car headlights, moths..... I need to be woken if someone is on my drive (major security troubles), but not woken for a spider eating a fly (I heard HikVision Acusense is finally a good solution!)
SECURE from hackers!

I am fairly sold on the Hikvision systems, with 2 Acusense cameras for good alerts on the two main areas where people enter my property (small farm), but 4 more cameras to cover buildings, yard etc.
However I have big concerns over the many vulnerabilities of Hikvision (and many other brands) cameras. I am not technical enough to know how to set up a VLAN and VPN (which was my friend's advice, but lost on me!).
I wish I could just have it not connected to the web, but that's out of the question due to needing the alerts and occasional logging in when i get an alert, to check it's not thieves/stalkers.

Any advice hugely appreciated, I have lost an entire week of work running cables and researching online. I am now back to square one, and hoping to make better choices this time. Grateful to anyone who cares to chip in here.

 

[SouthernYankee]

Read study plan before spending mney.

DO NOT USE CLOUD for surveillance cameras.

Securing cameras is very easy, do not give them access to the internet.
-------------------------------------------------------
My standard welcome to the forum message.

Please read the IP Cam Talk Cliff Notes and other items in the IP Cam Talk Wiki. (read on a real computer, not a phone). The wiki is in the blue bar at the top of the page.

Read How to Secure Your Network (Don't Get Hacked!) in the wiki also.

Quick start
1) If you do not have a wired monitored alarm system, get that first
2) Use Dahua starlight cameras or Hikvision darkfighter cameras if you need good low light cameras.
3) use a VPN to access home network (openVPN)
4) Do not use wifi cameras.
5) Do not use cloud storage
6) Do Not use uPNP, P2P, QR, do not open ports,
7) More megapixel is not necessarily better.
8) Avoid chinese hacked cameras (most ebay, amazon, aliexpress cameras(not all, but most))
9) Do not use reolink, ring, nest, Arlo cameras (they are junk), no cloud cameras
10) If possible use a turret camera , bullet collect spiders, dome collect dirt and reflect light (IR)
11) Use only solid copper, AWG 23 or 24 ethernet wire. , no CCA (Copper Clad Aluminum)
12) use a test mount to verify the camera mount location. My test rig: rev.2
13) (Looney2ns)If you want to be able to ID faces, don't mount cams higher than 8ft. You want to know who did it, not just what happened.
14) Use a router that has openVPN built in (Most ASUS, Some NetGear....)
15) camera placement use the calculator... IPVM Camera Calculator V3
16) POE list PoE Switch Suggestion List


Cameras to look at
IPC-T5442TM-AS-LED Review IPC-T5442TM-AS-LED (Full Color, Starlight+) - 4MP starlight
IPC-T5442TM-AS Review-OEM 4mp AI Cam IPC-T5442TM-AS Starlight+ - 4MP starlight+
IPC-B5442E-ZE Review - OEM IPC-B5442E-ZE 4MP AI Varifocal Bullet Camera With Starlight+
IPC-T2347G-LU Review of the Hikvision OEM model IPC-T2347G-LU 'ColorVu' IP CCTV camera. (DS-2CD2347G1-LU)
IPC-HDW2231R-ZS Review-Dahua IPC-HDW2231RP-ZS Starlight Camera-Varifocal
IPC-HDW2231T-ZS-S2 Review-OEM IPC-T2231T-ZS 2mp Varifocal Starlight Camera
IPC-HDW5231R-ZE Review-Dahua Starlight IPC-HDW5231R-ZE 800 meter capable ePOE
IPC-HFW4239T-ASE IPC-HFW4239T-ASE
IPCT-HDW5431RE-I Review - IP Cam Talk 4 MP IR Fixed Turret Network Camera
DS-2CD2325FWD-I
N22AL12 New Dahua N22AL12 Budget Cam w/Starlight -- low cost entry

Other dahua 4MP starlight Dahua 4MP Starlight Lineup

My preferred indoor cameras
DS-2CD2442FWD-IW
IPC-K35A Review-Dahua IPC-K35A 3mp Cube Camera

If interested in Blue Iris and other setup items see the following post

Newbie Starter Guide to IP Cam System – VPN setup – Computer Hardware – Blue Iris – Dahua Cameras

This is an intermediate / newbie guide for people just starting out looking for a surveillance setup. I know this setup might not be for everyone and there are many options. You can find a lot of this information in the Wiki: IP Cam Talk Wiki | IP Cam Talk A great place to start in the Wiki...

ipcamtalk.com

Camera Sensor size info Sensor Size Chart Generally bigger is better

Before asking a question search the forum first...
The best way to search the forum is to use Google Advance search

Google Advanced Search

set site or domain to ipcamtalk.com
OR
in the google search window enter.. site:ipcamtalk.com ?????? ..where ?????? is the items/terms you are interested in.
Example site:ipcamtalk.com PALE MOON BROWSER

Read,study,plan before spending money ..... plan plan plan
Test do not guess

 

[larryhagman]

Thanks for the quick reply, even if it was automated/pasted . I am sure that makes things a lot more efficient
I am aware of most of the info there, certainly not all, but most. The opsec side I am conversant with, its the technical side for accessing cameras remotely where I will struggle. I use VPNs 247 on any machine I ever touch, including 'smart' phones. However I have no idea how to set up use of a VPN to access my NVR with. I am about to read VPN primer for noobs. I have a standard ISP router unfortunately so I don't think I can get VPN to work for accessing cameras.
I had one idea - Hikvision system to record full time, then one or maybe two cameras installed separately, just for remote access to check if anyone on the driveway. Its messy, and no that won't work because I need the quality motion alerts which I think are only doable using Hikvision Acusense cameras, which will of course need web access to alert me. Hmm, tricky stuff! Anyway, thanks, I will keep reading

 

[larryhagman]

Oh and PS - In case it makes a difference.....

I am not actually too concerned about hackers gaining access to my CCTV streams to VIEW. Obviously admin control would be a problem, but just viewing wouldn't. My cameras don't cover private home areas, just outside areas I wouldn't mind some script kiddie in Kansas seeing . However, I don't know if that web connection will pose risks to all other devices on my LAN. I doubt most hackers could do that, but I am sure there are many medium level ones who could. If so, that certainly would be a big problem and must be avoided.

 

[SouthernYankee]

You do not understand hacking. If they can get to the stream, they can get to the camera, so now they have a computer on your home network. What is your bank account "). They can use tour cameras of bitcoin mining.

Camera should not access the internet period.

 

[larryhagman]

Thanks. I do understand a bit about hacking. I know a few ethical hackers and net security people, but I don't know any near me who can help check/configure my system. I do understand your point though, yes any computer on any network, because a vulnerable exploit and potential botnet device or many other things. However I am trying to guage how much risk there is of that, versus just a hacked stream by nosey amateur hackers and bots etc. I know there is no such thing as COMPLETE security without unplugging, I do get that. However unfortunately I MUST get alerts, and ideally remote monitoring just to see what's going on when an alert comes in. But I also know that leaves me exposed. I am trying to suss out how much exposure that causes, and how to mitigate it. I believe there are ways to mitigate it, such as a VLAN and VPN, but I don't have the knowledge to set that up.

I am trying to think of work arounds. One idea is...

Some kind of beam across driveway which has a SIM card in it and will send me an SMS to alert me. That would mean I don't need cameras doing the notifications of motion detection. However, it doesn't provide me a way to see what's going on (and decide whether to call the cops or not).

I am not sure how, but if I could set up a Hikvision system on LAN, but not on the internet, that could work. All my monitors dotted around this place could view the cameras if needed but no phone apps could if it wasnt connect to the web. I could maybe live with that. But then I am not sure how to connect to LAN without it being connected to the web. It's tricky stuff this. Sure, safest approach is never connect cams to internet, but I really would like remote access.

This problem led me to finding (via recommendation from a security guy) the Cloud Key 2 Plus and the Unifi Protect system, which is somehow a lot more secure although I don't understand exactly how.

Thanks again for chipping in

 

[larryhagman]

Maybe a dumb question, but I want to confirm...

When you said "Camera should not access the internet period." - Would you call my DVR "accessing the internet" if it was behind a VPN router? I assumed you meant never have cameras available over the internet for anyone, including me, in other words local unplugged system only. Is that what you meant, or did you just mean never have a system wide open to the internet like how they come by default (HikVision etc)? thanks

 

[SouthernYankee]

In you case the DVR has analog cameras, not IP cameras. If the IP cameras are connected to the Poe switch on the back of the nvr that is ok. You access the nvr via a VPN. You block the nvr from direct access to the internet directly via Mac address parental controls.

No direct access for the cameras to the internet.

 

[larryhagman]

Thanks Yankee. That brings up a point I am often confused about, which may be showing my ignorance.... DVR or NVR? I 'assumed' (assumption being the mother of all fuck ups ) that a DVR is a CCTV hard drive "box", and once connected to the web, it becomes an NVR. Sounds like I am wrong there. Either way.... yes you're right, I have analogue Annke system (this one ANNKE 8CH Ultra HD 4K CCTV Camera System H.265 DVR Kit and 8X 4K Outdoor IP67 Weatherproof Camera with EXIR LED IR Night Vision, Email Alert with Snapshots, Smart Search, Remote Access, NO HDD: Amazon.co.uk: DIY & Tools). I am sending it back. The support is just hilariously bad. I am using this opportunity to try and replace it with something better, with support which understand plain English, which care a shit about customers, and which I can HOPEFULLY access remotely in a secure way. That last part is where I am stuck.

Hikvision - This is the system I want (DS-7608NI-I2-8P), and mainly their Acusense cameras for good motion alerts to phone app, if at all possible reasonably securely. I have a slightly complex/non-standard network configuration here due to being two households. Briefly....

Fiber into the premises with a good 150mbps connection. The Fiber modem sends cable to a BT Homehub 5 ISP router (yuk, i know). I do not use WiFi so I have that turned off, but I have a ton of ethernet cables from that Homehub to devices, computers, and wired over poles to barn and workshop, which is where the CCTV system lives. There is one ethernet from the Homehub which goes to the other house (elderly relatives who use wifi) into an Amplifi HD wifi router. This is one of the questions I have, if I wired CCTV via THEIR Amplifi router (cabled), would that only expose devices hanging off that Amplifi router, or would it expose my devices hanging off the upstream HomeHub cable router? If in doubt, assume the worst, so I do assume the worst. But if not, that could be good news. Anyway.. so the CCTV system sits on a LAN cable coming from my office here with BT HomeHub5 router. BUT, I have a spare WD WAP/Router in the workshop, which is not used but it's there hanging off the LAN in case we need temporary WiFi access over there. I coiuld in theory replace that router with something better (for VPN setup) or maybe flash Tomato or whatever. I have never DONE anything like that, but i have heard it mentioned often, including in the brilliant VPN thread on this forum.

So my CCTV DVR/NVR is hanging off that LAN, as are all my sensitive computers which I MUST protect from hackers (I know that applies to all devices, but these devices are much more worrying if they were hacked). I was hoping to replace the Annke system with a HikVision system, but I want nothing to do with HikVision or any of their vulnerable/spyware crap. But I know it will be a real challenge to do this myself. I wonder if you might know of anyone trustworthy who I could pay to remotely access my machine/help me set up the system as described above.

I think it is possible that I could manage it myself, but I am so short on time here and under a lot of stress so learning networking isn't easy (I have tried before and found it very hard).

I am working through the VPN thread, 66 pages, it's taking some time! It's pretty much completely over my head, I get the principles being discussed, but the tech side is a myriad of confusion for me so far.

 

[SouthernYankee]

In general
A DVR is a analog to digital recorder and uses COAX cables and analog cameras.
A NVR is a network video recorder, it use IP Ethernet cameras.

-----------------------------------
My general VPN post
There are two types of VPN, do not get them confused.
The type depends on where the traffic conversation originates
1) origination: local home network, destination the internet.
This type of VPN purpose to hides your activity from the internet, it is outbound, it normally costs a monthly fee to use. Direction is from your home PC to the internet, going to your bank, google, porn sites,,,, this not what you want
2) Origination: the internet world wide web, destination: your home network
This VPN type is used to provide a secure connection onto your local network, in bound to you local home network, from your office computer, your cell phone in your car, tablet at the coffee shop.. This is what you want, it does not have a monthly fee and is normally completely free. OpenVPN is this type of VPN.

If you home internet provider is a cellular network, then DDNS (dynamic Domain Name System) may not work, the DDNS is needed for most Inbound VPN services (OpenVpn), so OpenVPN may not work for you.
-------------------------------------

I recommend use a router that supports a VPN connection. Most ASUS routers, some netgear routers the best is to support openVPN. I am not up on UK internet providers and there interface equipment. I would recommend doing a separate post to get information on setting up , configuring OpenVPN on your internet service provide in the UK.

 

[larryhagman]

Thanks again Yankee. There isn't much difference between UK and US. I can use all the same routers, Asus etc. DVR/NVR - gotcha. Thanks. I had a DVR. Dumped. Going for NVR next as I want PoE for longer cable runs and more reliability/better signal.

VPN - Yep, I use type 1 around the clock on all devices. This will be a problem, as I can't use that AND connect to my home VPN (type 2).

I have lost (invested!) another entire day. I am not much further forward. I don't understand how VPN (type 2) is any use in protecting me. If my NVR (let's say Hikvision as that's what I would like as I want the Acusense cameras for accurate alerts) is connected to my LAN, I assume that means it's connected to the web. That means I am exposed to the risk of a hacker hijacking my NVR and using it to attack other devices on my LAN. Am I wrong in this thinking? I have read tons of stuff today but everything I read suggests there is no way (not within my means anyway) to connect my Hik NVR to my LAN to get access remotely, without leaving it exposed to the world's hackers. If I am wrong, please say. I heard about very techniucal ways to do this with professiuonal grade network equipment etc, like a company setup with VLANs etc, but this is way beyond li'l old me.

I came back to square one, which seems to me like I have a choice between:

1. Hikvision system on the web, totally at risk, but take precautions on all my LAN devices to protect them from hacking (firewall etc). - great for good app alerts of motion, remote login and view live any time, functionally great, but security wise not so great.

2. Cloud Key 2 Plus (Amazon.com: Ubiquiti UniFi Cloud Key Gen2 Plus (UCK-G2-PLUS) 1TB 2.5” Hard Drive Included: Computers & Accessories) - Solves the security issue, but way overpriced, shit cameras (compared to Hik), even shittier alerts (unusable I am sure), but very nice app for remote view!

Option 1 is the better compromise, but still a huge compromise nonetheless.

The only other idea I have is some kind of mix and match. For example, forget about good camera alerts and use something like this

https://www.amazon.com/dp/B07SH52FTW/ref=twister_B07XT63CZL?_encoding=UTF8&th=1

. That will give me reliable alerts when I am here, and some of those systems can even send an email and/or SMS to phone. That alert could tell me to login, and I could have just ONE camera exposed to the world (maybe an ethernet standalone IP cam, cheap and cheerful, but insecure of course), PLUS a hikvision system recording only, no access to web or remote view whatsoever, so just in place for evidence if crime happens.

Confused.com

 

[SouthernYankee]

The type one VPN is next to useless please take some time and look at this video.



The type two VPN place your external device, your phone, on the internal home network across the internet, an encrypted communications. The devices on your home network that you need to access are not going to directly access the internet. When you open a port to allow access to your NVR, it is like locking your door and then leaving the window open. The hackers are running ports scanners all the time looking for open ports when they find an open port, then then determine what device is on the open port and try to exploit the weakness of the device.

 

[larryhagman]

"The type one VPN is next to useless please take some time and look at this video." - Disagree completely. I know that video well, and his many others, and much more on that subject. If I was saying "I use VPN to be anonymous", then I would agree with you. But I didn't say what I use it for. It is far from useless. Try using British Telecom as your ISP and you will quickly learn what I mean (This ain't the land of the first amendment, sadly, nor the second, even more sadly ). For interrupting the dragnet surveillance, behavioural analysis, interest mapping and all sorts of other similar crap, VPNs fuck up their little plan quite nicely! It doesn't mean they can't work out who you are if "they" really want to, sure, but it fucks up most automated dragnet systems as my IP bounces around all over the place. Ok I know.. browser fingerprints etc..... but I take care of that too, and various other things. I am not trying to "hide", I am just trying to be less easy to surveil automatically and track. VPNs do help in this regard. But that's not actually my main reason for using one. Mine is SEO. I need to use all sorts of different geographic locations to check search engine results and do stuff like that, so I basically have a VPN running constantly so I can just one click to change country. Nothing to do with security usually, although the VPN definitely helps on public wifi with security, provided it's a good one with AES 256 encryption etc. But enough of this

"When you open a port to allow access to your NVR" - not sure what this meant. I have no plans to open any ports. I know they sniff for open ports, that's kinda why I landed here to start with. I want a secure way to access my CCTV remotely from outside my LAN.

"The devices on your home network that you need to access are not going to directly access the internet." - This is VERY interesting. Thanks. Can you explain why not? I have a LAN, on which are many ethernet connected devices, plus a router which gives them all access to the web. How can I connect a CCTV NVR into that LAN, without it having access to the web? If I could understand this, we MAY have some progress here! Here's why.... I just realised I have an Amplifi HD router. I don't actually use it for wifi, it just sits as a cable router, I barely use any of its fancy (overpriced) features. I would never buy another, the company is a pile of trash in my experience and their products just aim to copy Apple's neat trick of making packaging feel sexy and increasing the perceived value of the contents by such fancy packaging. I fell for it myself! £300 for a router (that's over $400 in your money!) which performs NO better than my £30 TP Link second WAP bought from a garage sale! but I digress..... The point is that Amplifi now have a feature which MAY just be a Godsend for me and my situation here. It's called Teleport App. Teleport: About Teleport. This basically allows any user to have a VPN back to their home connection. The problem for me is I would have to disconnect my usual permanent "type 1 vpn" to connect using the Teleport app to my home (POSSIBLY not, but i assume so). But IF I can make sure my CCTV (hikvision) system is not open to the internet (hackers), AND access it remotely via a tunnel back to my router using Teleport app, we could be cooking with gas.

Really appreciate your input here, much appreciated. If I could find a solution I would be so pleased. I have had a friggin nightmare and was about to unplug everytthing and go without CCTV, it's getting that bad now . I also spoke to a few 'hacker types' (not hackers, but into that stuff from research angle, and hobbyist angle I suspect too), and they seemed to suggest if my CCTV can be accessed remotely, then it IS open to hacking. I maybe didn't explain it well enough though so it could be my bad there. Maybe you could briefly explain how my Hikvision NVR could be connected to my LAN (which is connected to the www), but without being exposed to hackers at all? I'd be very grateful if you could. Thanks

 

[SouthernYankee]

I have worked network/ software/hardware security for one of the biggest companies in the world. You would be shocked at the number of device that contain virus worms, malware, and general data collection crap. We have found crap in routers, switches, network cards, new USBs right out of the package.

For the NVR i world use a router that had parental controls, that block the MAC address in and outbound. If the NVR has not been hacked and just has security vulnerabilities. This will prevent it from being active on the internet. But some device that have been hacked, can change there MAC address on the fly and by pass this.

I believe that it is possible to run both inbound and outbound VPNs at the same time, but I do not know how to do it. You may be able to contact your VPN provider and ask then how to do it.

 

[larryhagman]

Yeah, you're not the first to tell me that and I believe you. It's shocking. I am slowly cleaning my stuff up here, one machine at a time. But it's a big task for someone who doesnt have your level of experience/knowledge, and I guess that's just how "they" like it! I will get there slowly! (I am running GrapheneOS on a Google Pixel phone, I decided to start with phones as my kids are getting into those now and I hate smart devices generally but can't stop the world turning, but I can train them to do things a bit more carefully. leading by example is kinda fun too. I enjoyed putting a .308 through my iphone, that's the last time it will push me to set up "Apple Pay" - I am so sick to death of these devices costing us an arm and a leg, only to TELL US how to fucking use em and how to behave! But let's remove the soap box )

Ok, I really appreciate the comments here, but I need to get to the bottom of one point here and hoping you can help...

You said: "For the NVR i world use a router that had parental controls, that block the MAC address in and outbound."

Can you explain what you mean? I understand you can get routers with parental controls (I haven't used this feature but will research this myself, my Amplifi router probably already has the functionality, pretty sure it does). But I dont know what you're suggesting doing exactly. Are you saying I can make the CCTV (Hikvision for instance) on my LAN AND give it access to the www, by using a dedicated router for it and tell that router to only allow a certain mac address? If so, which mac address do I allow? I am not asking for a detailed explanation of how to do it, just an explanation of the principle of what you're suggesting as I don't follow.

I was assuming I need to block the NVR from ALL internet access, ONLY local LAN access (if that's even possible?), and then I may be able to use the Teleport function to get into my LAN from anywhere (VPN) and that way I can check cameras remotely as if I am sitting here at home on my LAN. Only problem with this is I assume the Hikvision box won't be able to send me app or email alerts on motion, which pretty much destroys the entire purpose of what I am after, so I won't waste 1-2k on a hik setup.

IF you're saying I could give the Hik access to the www without risking hackers getting into it, then I don't need to frig around with VPN tunnel back to my LAN.

Final question, an important one if you know the answer.... is it possible to set up a Hikvision (or any other) NVR so that it can SEND email alerts via the LAN, somehow without being connected to the www? I assume not, but just in case! Thanks again Yankee.

 

[larryhagman]

PS, just to clarify, my main needs are:

Recording 4-6 cameras
Alerts (app or email) when away from home
Remote login to view cameras.

If I could solve the alerts problem, bearing in mind the ONLY camera-based solution is Hikvision Acusense, based on my research (ignoring thermal due to price), then I only need a way to log into 2 cameras just to check driveway when I am alerted to movement. I don't need to log in to view more cameras than that. So i wondered even about those damn NEST type things, so long as ethernet was doable instead of wifi. So if you know of a secure way of having remote IP cams just for dedicated logging in to view, I wouldn't necessarily need access to my NVR which could be totally off grid.

I need to find a motion detector which can send SMS, I think I found one. That would deal with the alerts nicely, and means I no longer need to spend a fortune on Hik Acusense cameras. So a cheaper system like Reolink could become an option.

 

[looney2ns]

You are re-inventing the wheel. On a real computer, study the Cliff Notes and all the links that @SouthernYankee has provided. He's giving good advice.
Use search at upper right corner of this page.
Tackle one thing at a time.
Reolink is garbage.
Stay away from Nest, Ring, Arlo and Wifi cams in general.
Acusense is not the only camera based solution.
You don't know what you don't know.

 

[larryhagman]

Thanks, but none of that is very specific. What wheel am I trying to reinvent? I resarched heavily for 1-2 weeks (using a "real" computer, which is all I use). I am yet to find something on a par with Acusense cameras for accurate motion detection alerts with few to no false alerts. This is a critical need I have. If you know of any, feel free to let me know. But if you're just saying there are other options, but you don't know or won't say, and I should just go find them...... well I spent 1-2 weeks doing precisely that and found none. Feel free to educate me by all means, I would appreciate having other options. But I am yet to find one and can't afford more time looking (and don't expect to find one). Of course for megabucks there are a few alternatives (heat based motion alerts using thermal cams for instance, but megabucks).

I have read all the links already.

I do not use WiFi AT ALL, ever, certainly not for cameras. I did once install Nest cams in a mad hurry when we had a threat and I had to leave the property for a weekend, but those are down and won't be used again. I actually had to buy WiFi for that express purpose, which is also removed now! Reolink research I did showed them to be very decent for bang for buck (resolution for money), but I want better, and Hikvision appear to be pretty damn good, and in particular the Acusense is a must as I need audio and I must have good alerts.
You seem to be just referring me to read stuff I have already read, and have investigated pretty thoroughly. I do have fairly specific needs though.

For the record, another few days of solid research and learning (networking) found me what I think is a reasonable solution......

Ubiquiti Edge Router X. this allows mac address filtering (block cams from being accessible over web), so the only web-connected device will be the NVR. However the Edge router makes it easy enough for someone like me to create a second LAN (like a VLAN, but hardwired/physically separate). So the NVR will sit on its own LAN which has firewall rules preventing any connections from it into my main trusted network (and other devices therefore). On top of that, I also have a possible way to access my home network from outside using a VPN, but I am fairly happy with the second LAN option for now.