Isolating home security cameras and providing remote access?

[MadPup]

I'm a noob am not sure how I should be asking this question, so please bare with me.

I have a mix of (wireless) Wyze and (wired) Dahua cams on my home network. I don't have an NVR - I store events locally on SD cards on the cams. I have a mesh network provided by three RT-AC68U routers, all running the latest Merlin firmware. I'm looking to set things up so that that cameras have least access to my LAN, and so that I can access all cameras remotely. Currently I can access the Wyze cams remotely, but they have access to my LAN. The Dahua's have access to my LAN but I have blocked Internet access so I cannot get to them remotely. Is there a way to have all of these cameras isolated from the LAN and be safely accessible (by VPN?) from anywhere?

 

[L&LD]

Welcome to the forums @MadPup.

Look at guest networks and/or YazFi via amtm scripts.

Asuswrt-Merlin AddOns

This forums is for discussions about AddOns for Asuswrt-Merlin, i.e. Diversion, Skynet, etc.

www.snbforums.com

 

[bennor]

For the WiFi IoT devices the normal suggestion, for those using Asus-Merlin firmware, is to use the YazFi WiFi Guest Network addon script. However YazFi doesn't currently work on AiMesh nodes. It only works on the main WiFi router and the WiFI guest network clients connected to the main router's WiFi. And YazFi generally doesn't work to isolate wired LAN clients.

YazFi - YazFi v4.x - continued

v4.4.4 Updated 2023-11-26 Feature expansion of guest WiFi networks on AsusWRT-Merlin, including, but not limited to: * Dedicated VPN WiFi networks * Separate subnets for organisation of devices * Restrict guests to only contact router for ICMP, DHCP, DNS, NTP and NetBIOS * Allow guest networks...

www.snbforums.com

You may have to look into VLAN and see if there are any options that will allow both the use of both WiFi and Wired network clients. Due to the age of the RT-AC68U one may find setting up VLAN to be difficult or complicated/complex due to the likely use of SSH to issue various commands.

Tutorial - How to use VLANs on your non-pro Asus router with 386 or 388 code (no scripting required)

With 386 and 388 code base, you can make use of two built in VLANs (plus the main LAN VLAN 1) to further segment your wired and wireless network, even on non-pro models. This definitely works in router mode on all models that support AIMESH and these code versions. From what I have seen (but...

www.snbforums.com

Otherwise you may have to look at other options, including potentially a newer router, one that supports what you are trying to do.

I don't use AiMesh, but do use YazFi to isolate several Wyze cameras and other IoT devices. No issues accessing the Wyze cams from the internet.

 

[jsbeddow]

Just setup an OpenVPN server connection to your home network, then you can directly access the wired Dahua cameras via their IP address (hopefully fixed/static IP addressing has been applied to each camera).
Can't help you with the Wyze cameras, as I've never used those. I assume they have to be accessed through their proprietary cloud system, no local LAN access?

 

[bbunge]

Have an old PC that is not being used? Zoneminder is a great open source Linux product that is easy, for me at least, to set up. I am currently running five cams with an i3 Dell mini PC with 8 GB RAM. I could add several more cams. Zoneminder can be run on a Raspberry Pi. I have set it up on a Pi 3b+ (1GB RAM) but it runs much better on a Pi4 (8GB RAM). With Zoneminder I can set it up with port forwarding on my router or rely on a VPN to get to it. https://zoneminder.com/

 

[jsbeddow]

On that note (security camera software), my preference is for the Windows based BlueIris. Just do a Dual NIC based computer setup and that makes it simple to isolate the cameras from directly reaching out to the internet (they can be on one NIC and switch on a subnet with no gateway defined), then the other NIC in the computer running BlueIris can reside on your normal home LAN, making it accessible to viewing the cameras. Search the IPCAMTALK forum for a sticky on DualNIC setups for more details.