Securing camera on network

[nos]

Greetings all. I've been testing motion capture on a grey-market Hikvision cube wired to a non-WAN connected Asus router. Images are written to usb drive on router. I want to connect it to main router (R7800 w/ Voxels latest) in order to continue capturing motion AND receive email alerts upon detections. Can't run cable from ipcam to the R7800, so it has to be wireless. Rather than using usb with the R7800, I'll spin up a Proxmox container for either NVR or ftp service. My question, given the issues with ipcams in general, and Hikvison in particular, is how to secure the camera on network (no connections to any external sites/servers) while having alerts sent and also access cam feed via local VPN server?

 

[ironclad]

My question, given the issues with ipcams in general, and Hikvison in particular, is how to secure the camera on network (no connections to any external sites/servers) while having alerts sent and also access cam feed via local VPN server?

The caveman solution: All cameras should go behind the NVR. This goes for wired and wireless cameras. Buy an adapter that uses MediaTek MT76 drivers:
https://www.amazon.com/dp/B086L3D3NB/?tag=snbforums-20

Pass the adapter to a Linux host and configure hostapd to spin up a WiFi network. Don't configure routing. Connect the camera to WiFI. You will have to read some manuals to set up hostapd properly, I recommend referring to these:

7612u/Bridged_Wireless_Access_Point.md at main · morrownr/7612u

Linux Support for USB WiFi Adapters that are based on the MT7612U Chipset - 7612u/Bridged_Wireless_Access_Point.md at main · morrownr/7612u

github.com

My blog_title_here · WiFi hostapd configuration for 802.11ac networks

blog.fraggod.net

Your NVR software should be the one sending email alerts. Use Wireguard to VPN. If your NVR software can't relay camera streams for any reason you can use socat.

As for NVR software I've tried out a few and I think Shinobi is the least worst out of the free ones.

 

[nos]

Would an iptables rule-set be better option?