Having a VLAN alone doesn't necessarily make it more secure, you have to have the cameras on a completely separate IP network and only allow traffic in and out of that network that is essential for you to access what is there and from hosts/places that are trusted. Your USG has multiple ports so you could just use one of the ports there and plug another switch and separate the networks this way.
If you tell me in more detail what you want to do I can give you more info.
Thanks I was wondering if that was true. I'm already using the separate port for my wifes "work from home" stuff
I've never considered it but perhaps I could plug her directly into the second port in the cable router? Her company provided their own device her phone, pc printer anyhow.
So if I have a separate wire plugged into the USG does that mean all of the wiring from there would have to be seperate? OR is the purpose of the second connection just to assign the separate ip addresses. I don't "think" its possible to separate the cabling.
There is several «how to» guides on youtube that describes how to setup a vlan. It is super easy 
here is two examples:
www.youtube.com
here is two examples:
Willie Howe
Willie Howe Technology - Your networking, VoIP, and security experts! Phone: 309.446.0048 Web: https://williehowe.com Email: willie at howex5 dot com
www.youtube.com
We set up a VPN but didn’t create a new VLan. We created a firewall rule to block our cameras to the Internet and turned off upnp in each camera. We tested if the cameras could get to the Internet by setting the time in each camera to an off time and entering a public time server. We found that the cameras couldn’t update their time.
Last edited:
so you can still access blue iris remotely but the cameras are not accessible correct? Now I'll have to look into the vpn.
Because we use a VPN we can access everything on our network including our cameras (using a web browser). The cameras cannot access the Internet.
OK.. thanks. Clearly i need to study more on those options as they don't quite make sense to me yet!
Checking my learning here...
And you wouldn't use LAN OUT because it needs to talk to your VPN?
When you create the rule, let it provision and then log into your camera and see if it can reach an external time server or if it can check for updated firmware. If it can’t, then you are good to go. The key is to wait for the rule to provision.