First time home CCTV network setup

[dex90]

Hi everybody!

I am soon to become a fresh home security system owner and I am trying to understand a few things about the camera setup, especially the network side is a bit unclear to me. As far as sensors for siren alarm are concerned, I got that covered with a security contractor but I wanted to try to setup the cameras myself as I plan to often upgrade and play with different positions, camera types, maybe even some machine learning software.

My goal is to have good night vision capabilities and license plate readability during day and night. I plan to install 10-12 cameras around my medium sized house, I’ll combine some 2MP big sensor night vision ones with 4K for daily viewing of traffic passing by and looking at my driveway.

My biggest confusion was why are cameras even using http and not https? Is this because it became a norm to use VPN on all cctv networks that makes adding 1 more encryption layer less interesting? Should I setup a VPN even if I don’t want to access cameras remotely (say, while on vacation or from work)?

Here is a picture of my current home network:


The modem/router that I got form my ISP does not support adding VPN and I can’t install a different firmware on it, plus the hardware of it is complete crap because the internal web server for the GUI takes ages to load settings pages. So, I bet I need to connect another router/switch after the ISP router to go from there. I have a dynamic IP but even if it was static, I don’t think I can initiate a connection from a remote connection to my home network without having some sort of server hosted somewhere that will first allow for correct IP resolving and let my router accept incoming connection as a reply to outgoing connection that the router made to that external server. I hope that makes sense, it might be completely wrong, please do correct me.

I made another network scheme and wish to ask you if this is the correct setup:


Here I added another VPN capable router between my modem/router and my switch that feeds into all PC’s. This new router connects to NVR, that connects directly to some cameras and to one POE+ switch. Not sure how many cameras can those POE switches support but judging by the cat cable connectors, it seems quite many.

I never had to deal with port forwarding before. As for IP resolution, normally I just looked at the DHCP table on the ISP’s modem/router what local IPs are assigned to machines in my network and copied it from there. I saw a recommendation to change my home local area IP range to something non standard (other than 192.168.1.*). UPnP is already disabled on my ISP router/modem.

If VPN is running on the “VPN capable router”, does that mean it will only tunnel traffic form that router towards my remote connection? My local camera traffic going from camera towards the NVR or a different computer on local network will still be unencrypted, right? If yes, I am a bit unhappy with that as it means if there was any compromised device added to the network later, it would see all the local traffic unencrypted.

Would it be better to add a dedicated computer for viewing and storing video? If I understand this correctly, I should be able to use any computer on local netowrk to open stream on the fly to quickly check who is at the door of I am at PC?

I saw an advice I should be recording at all times and not only when camera detects movement. Is the movement detection timed recording that unreliable?

Sorry for the long post, I did read IP Cam Talk Cliff Notes and Newbie Starter Guide to IP Cam System – VPN setup – Computer Hardware – Blue Iris – Dahua Cameras and VPN Primer for Noobs but it is a lot to take in.
I hope someone will take time to read my nooby comments and questions.

Thank you all for a great community, it is the best and biggest I found for home cctv networking questions so far.

 

[torerosoturno]

Hi,

There is a lot to unpack here, so I will respond to a few things:

My biggest confusion was why are cameras even using http and not https? Is this because it became a norm to use VPN on all cctv networks that makes adding 1 more encryption layer less interesting? Should I setup a VPN even if I don’t want to access cameras remotely (say, while on vacation or from work)?

If you are accessing the cameras from within your local network (e.g. 192.168.1.###), then there shouldn't be any need to encrypt the communication between your device and the camera itself, assuming that your local network is secure. As a side note, using HTTPS requires an SSL certificate, which could be generated from Cloudfare or Let's Encrypt, but this is more work in itself and sort of pointless for a device only exposed to local networks. Hypothetically, maybe the camera does has an HTTPS address, but you need a SSL certificate for it, or else you will get stern warnings from your browser about the website (the IP camera's dashboard) that your are trying to access - this is an issue I've seen with my router.

There is no real point in setting up HTTPS unless you plan to communicate with a web-site/web-interface in an insecure manner (read as connecting from the internet). But you should never expose your cameras to the wild, because most are insecure in various other protocols. Yes, maybe HTTPS will be encrypted, but the same camera could have a hard-coded telnet password that every bot would use to gain access to your camera.

Personally, if you never desire to connect to the cameras while on vacation or from work, there is no real need to set up a VPN. Just secure your router to make sure the cameras aren't broadcasting their open ports to the world.

But if you do want to set up a VPN, I would suggest just replacing the IP-provided router with your VPN-capable router. Are you required to use theirs? Most ISPs charge you fees for using their routers, from my experience.

I have a dynamic IP but even if it was static, I don’t think I can initiate a connection from a remote connection to my home network without having some sort of server hosted somewhere that will first allow for correct IP resolving and let my router accept incoming connection as a reply to outgoing connection that the router made to that external server. I hope that makes sense, it might be completely wrong, please do correct me

Regarding getting a static IP address, this could easily be handled by setting up a dynamic domain name service (DDNS). I use Dyn (before it was DynDNS but Oracle bought them). They've been reliable so far.

My local camera traffic going from camera towards the NVR or a different computer on local network will still be unencrypted, right? If yes, I am a bit unhappy with that as it means if there was any compromised device added to the network later, it would see all the local traffic unencrypted.

You are correct - the communication within the local network will not be affected by the VPN. The VPN only protects the local network from outside intrusion. If you are really concerned about the communication between devices on your local network, you would want to harden each individual device, such as configuring SSH for each device and tunneling all traffic through it. But this is beyond the scope of this forum, I think. As for the cameras, the traffic would go directly to the NVR if you are connecting via Ethernet. I'm fairly certain the unecrypted RTSP protocol is used to transfer video from the camera to the NVR. You'd want to turn off SSH/telnet/uPnP on the NVR in this case, so that it isn't accessible remotely.

Hope this helps! Good luck!

 

[torerosoturno]

Oh, one more thing - if you prevent the NVR from being accessible remotely, you won't be able to check the cameras remotely, which sort of defeats the purpose of setting up a VPN to begin with. So some faith in the security of your local network, provided by OpenVPN or WireGuard, is needed.

 

[dex90]

Thank you @torerosoturno for your reply. I made my first camera purchase since I posted this question and I am having a blast admiring the performance of the low light imaging and IR lit recordings. I also settled to not have remotely accessible cameras for now but I will explore this route so I can enable this function during holydays. I ordered a VPN capable router and when it arrives I’ll ask ISP to turn off the router part of my router/modem. No sinful port forwarding for me Although I do remember that some private torrent trackers tell their users to open ports that the torrent client uses and to make sure the IP for which the port is open is always their PC's local IP. I wonder how risky that is. I imagine it is way worse when IPs assigned to cameras have open ports into the internet.

 

[torerosoturno]

Great, I'm glad your camera is working well! It's fine to take some time to set up a VPN - while it can be set up quickly, I think there is lots to learn about asymmetric cryptography to understand what you are doing. I know it took me some time to learn, at least.

What router are you getting? Have you decided what type of firmware you will use for it?

As an aside, I've never used port forwarding for torrents, although I've never really used many private trackers. My download speeds were always 'good enough', and I always felt uncomfortable using uPnP or opening up random ports.