Security cameras are some of the least-maintained computers on any network. They run for years without a firmware update, and several big camera brands have had serious remote holes. Keeping them apart from your laptops and phones limits what an attacker gets if one is broken into. Done carelessly, though, separating them also breaks the recorder and the phone app.
Why bother separating them
A camera is a small Linux computer with a web server on it and, usually, a line out to its maker’s cloud. When one has a flaw, it tends to be a bad one. In 2021 Hikvision patched CVE-2021-36260, a command-injection bug in the web server of a long list of its cameras that let anyone who could reach the camera run commands on it without logging in. A long list of models was affected, and plenty of those cameras were never updated. Dahua had its own authentication-bypass flaws the same year.
On a flat home or office network, a compromised camera sits next to everything else. It can scan the network and probe the NAS. On a separate network segment, the same camera can reach almost nothing.
You may already be isolated
Before you change anything on the router, look at how the cameras are plugged in. If they connect to PoE ports on the back of an NVR, they probably aren’t on your network at all. Hikvision recorders, for example, put cameras on their PoE ports onto an internal network of their own, typically in the 192.168.254.x range, and only the recorder itself appears on your LAN. Your phone and PC talk to the recorder, and the recorder talks to the cameras.
That’s isolation for free. The recorder is now the one device on your network that needs looking after, with a strong unique password and current firmware.
| How the cameras connect | Where they sit | What to do |
|---|---|---|
| PoE ports on the NVR | The recorder’s own internal network | Secure the recorder; the cameras are already separated |
| A PoE switch on your LAN | Your main network | Move them to a camera VLAN, or onto the NVR’s ports |
| Wi-Fi, cloud app only | Your Wi-Fi | The guest network is usually fine |
| Wi-Fi, recorded by an NVR | Your Wi-Fi | Keep on the same network as the NVR, or use a VLAN with rules |
Can cameras go on the guest network?
Some can. A Wi-Fi camera that only talks to its maker’s cloud and is viewed through that maker’s app gains nothing from seeing your laptop, so the guest network suits it. It’s the same reasoning as for other cloud-only gadgets in our guest vs main Wi-Fi guide.
Anything that records to a local NVR, or that you view directly on the home network, can’t live there. Guest isolation stops devices on the guest network reaching the main one, so the recorder can no longer pull the camera’s stream. The camera looks fine in its own app and silently drops out of the NVR.
A camera VLAN, properly
On a router or firewall that supports VLANs, such as UniFi or pfSense, with a managed switch to match, the cleaner design is a separate VLAN for cameras and the recorder. The rules that make it work are few:
- Block traffic from the camera VLAN to your main LAN.
- Allow your main LAN to reach the recorder, so PCs and phones at home can view it.
- Block the cameras from the internet entirely. They don’t need it.
- Allow the recorder out to the internet only if you use the maker’s cloud app, such as Hik-Connect.
If you’re choosing a PoE switch for that VLAN, CCTV101’s guide to PoE budgets for CCTV explains why a switch with PoE on every port can still run out of power for eight cameras.
What breaks, and how to fix it
The phone app stops connecting at home. If the app reaches the recorder by its local address, the main LAN needs a rule allowing it through to the camera VLAN. Away from home, the cloud route works as before.
The recorder can’t find cameras automatically. Discovery uses broadcast and multicast traffic, which doesn’t cross VLANs. Add the cameras by IP address instead.
The clock drifts. Cameras cut off from the internet can’t reach time servers, and footage with the wrong timestamp is weak evidence. Let the cameras take their time from the recorder, or allow NTP out.
The cloud app shows the recorder offline. The recorder needs outbound internet and working DNS on its VLAN. Check the gateway and DNS settings on the recorder itself.
Two router settings to check today
Turn off UPnP on the router. Many cameras and recorders will ask the router to open ports for them automatically, which puts their web interface straight onto the internet, and UPnP lets them do it without asking you. And never forward a port to an individual camera. If you need remote access without the maker’s cloud, forward to the recorder only, or better, reach it over a VPN. Our Hikvision port forwarding guide covers the ports, and the reasons to think twice are in cloud vs port forwarding.
Passwords matter as much as network design. Current cameras make you set one at activation, but older ones shipped with defaults that are still published on our Hikvision and Dahua pages. If a camera is locked out, why your IP camera or NVR rejects the default password covers recovery.
Common questions
Should I put my security cameras on a separate network?
Yes, if they sit on your main network now. Cameras plugged into an NVR’s PoE ports are usually separated already. Otherwise a VLAN, or the guest network for cloud-only Wi-Fi cameras, keeps them away from your other devices.
Can I put IP cameras on my guest Wi-Fi?
Cloud-only cameras, yes. Cameras that record to a local NVR, no, because guest isolation stops the recorder reaching them.
Do CCTV cameras need internet access?
The cameras themselves don’t. The recorder needs outbound internet only if you use the maker’s cloud app to view it away from home.
Why can’t my NVR find cameras on another VLAN?
Automatic discovery doesn’t cross VLANs. Add each camera to the recorder by its IP address, and allow the recorder to reach the camera VLAN.
