Direct answer
ONVIF discovery commonly uses WS-Discovery multicast on the local network. Routers and VLAN boundaries do not forward that traffic by default, so use an approved discovery relay or add the known device service manually over explicitly allowed routes.
Why this happens
Discovery, service calls and RTSP media are different flows. A camera can be fully reachable by IP while the multicast probe never crosses the boundary.
Discovery only locates a device service; media profiles, credentials and routing still require their own checks.
A controlled test
Prove discovery on the camera VLAN first, then test unicast device-service and RTSP reachability from the client VLAN.
Change one variable at a time. Keep the camera model, firmware, endpoint and account recorded; then test network reachability, protocol response, media transport and decoding as separate layers.
Use a dedicated view-only account and a trusted local diagnostic tool. Redact credentials, private addresses and identifying data before sharing output.
Diagnostic sequence
| Check | Action | Evidence of progress |
|---|---|---|
| Local discovery | Search from the same subnet as the camera. | The device announces itself locally. |
| Routing | Reach the camera service by its known IP from the client VLAN. | Unicast service traffic passes the policy. |
| Media | Test the selected RTSP stream separately. | The media path is permitted. |
| Relay | Add a scoped discovery relay only when operations require it. | Multicast is forwarded narrowly and documented. |
Evidence to keep
A simple flow map listing discovery multicast, ONVIF service and RTSP media ports prevents an unnecessary “allow everything” firewall rule.
Boundary and safety note
Do not bridge camera and client VLANs broadly just to make automatic discovery convenient.
For remote viewing, use a managed VPN instead of exposing RTSP or camera administration ports directly to the public internet.
SmartRTSP
SmartRTSP is a camera-focused RTSP and ONVIF viewer for Apple devices, Windows and Android. It fits direct viewing, discovery and multi-camera checks; keep a dedicated NVR or VMS when continuous recording, evidence export or centralized enterprise controls are required.
Frequently asked questions
Why can I open RTSP but not discover the camera?
Unicast media can be routed while multicast discovery remains local to the camera subnet.
Should I forward UDP 3702 to the internet?
No. Discovery should stay inside controlled networks.
Can I add an ONVIF camera manually?
Many clients allow a known device-service address or IP, avoiding cross-VLAN multicast.
Primary references
- ONVIF — Profiles and conformance overview
- ONVIF — Profile T for advanced video streaming
- CISA — Secure by Design guidance
Related SmartRTSP guide
Open related guideDesign a routed camera network where discovery failure does not get mistaken for media failure.