IP camera network design - VLAN, NICs, etc

[el_pedr0]

I'm just starting to think about how to configure my network ip cameras and would welcome suggestions.

My current constellation:
Gateway/Router: Asus RT AC68U running Merlin
Main switch: Netgear ProSafe GS748T V5
Server: X11SM-F with two onboard NICs. Proxmox hypervisor.

I have a Netgear Smart GS724TPv2 Gig Switch which can be dedicated to the IP cameras.

I'm planning on installing zoneminder or frigate as a VM on my server because I don't want to buy/power yet another box.
I will want to be able to access the camera feeds when I'm away from the house, but am happy to vpn into my router to appear as though I'm on the local network.
This is in a home environment.
I want something that is sensibly secure.

Should I be thinking about a VLAN for the cameras? Would zoneminder/frigate go in that same VLAN? Would that involve dedicating one of my physical NICs on my server for the Zoneminder/frigate VM?

 

[bbunge]

I'm just starting to think about how to configure my network ip cameras and would welcome suggestions.

My current constellation:
Gateway/Router: Asus RT AC68U running Merlin
Main switch: Netgear ProSafe GS748T V5
Server: X11SM-F with two onboard NICs. Proxmox hypervisor.

I have a Netgear Smart GS724TPv2 Gig Switch which can be dedicated to the IP cameras.

I'm planning on installing zoneminder or frigate as a VM on my server because I don't want to buy/power yet another box.
I will want to be able to access the camera feeds when I'm away from the house, but am happy to vpn into my router to appear as though I'm on the local network.
This is in a home environment.
I want something that is sensibly secure.

Should I be thinking about a VLAN for the cameras? Would zoneminder/frigate go in that same VLAN? Would that involve dedicating one of my physical NICs on my server for the Zoneminder/frigate VM?

You can do a VLAN for the cams if you want to isolate them but it really is not necessary. Bandwidth wise if the cams are on the same switch as the NVR all the cam traffic will be within the switch. I would keep it simple. I have a Netgear PoE switch running my cams all which have static IP addresses. My Debian 12 server running Zoneminder is connected to the same switch and all are on a UPS. If I have to fiddle with the router the cams can still record to Zoneminder. I also have micro SD cards in my cams that record motion just in case. I am messing with, or testing, Zoneminder installs.
As for outside the LAN checking the recordings you basically have two options: port forward (I used port 443) to Apache/Zoneminder or VPN in through the router. I have used both but the VPN route is more secure.
PM me if you have any questions about Zoneminder. I've been involved with that group for some time now.

 

[el_pedr0]

Thanks for the reply - I likely will take you up on your zoneminder offer at some point.

I've just had another realisation: Two of my cameras are on the outside and are wired. So my ethernet cable is technically accessible. Maybe that alone makes VLAN the right way to go? (Not that I can really envisage someone going to the effort of cutting and replugging the cable to gain access to my network!)