Direct answer
Put cameras on a dedicated VLAN or equivalent segment where practical. Permit only approved management, RTSP/ONVIF, DNS, time and update flows, then test from each authorized viewer path.
Why this happens
Flat networks let a vulnerable or misconfigured camera reach unrelated devices. Overly strict segmentation can also break discovery, time, updates or media and produce confusing partial failures.
Keep camera services private, minimize credential exposure and document every trust boundary.
A controlled test
Build the rule set from a data-flow diagram rather than opening broad address ranges and ports.
Change one variable at a time. Keep the camera model, firmware, endpoint and account recorded; then test network reachability, protocol response, media transport and decoding as separate layers.
Use a dedicated view-only account and a trusted local diagnostic tool. Redact credentials, private addresses and identifying data before sharing output.
Diagnostic sequence
| Check | Action | Evidence of progress |
|---|---|---|
| Inventory | List cameras, recorders, viewers and management hosts. | Every endpoint has an owner and purpose. |
| Flows | Document discovery, service, media, DNS, NTP and updates. | Each rule maps to a required function. |
| Default deny | Block unrelated east-west and outbound traffic. | The camera cannot reach arbitrary systems. |
| Validation | Test viewing, updates and recovery after rule changes. | Security controls preserve required operations. |
Evidence to keep
Keep a rule-to-function matrix and packet evidence for denied unexpected traffic. Review it when devices or firmware change.
Boundary and safety note
Segmentation reduces blast radius but does not replace unique credentials, supported firmware and secure remote access.
For remote viewing, use a managed VPN instead of exposing RTSP or camera administration ports directly to the public internet.
SmartRTSP
SmartRTSP is a camera-focused RTSP and ONVIF viewer for Apple devices, Windows and Android. It fits direct viewing, discovery and multi-camera checks; keep a dedicated NVR or VMS when continuous recording, evidence export or centralized enterprise controls are required.
Frequently asked questions
Will a VLAN stop ONVIF discovery?
It often stops local multicast discovery unless a scoped relay is designed; unicast service and media can still be allowed.
Should cameras access the whole internet?
No. Allow only vendor services or update paths that the approved deployment actually requires.
Can viewers live on another VLAN?
Yes, with explicit routes and least-privilege firewall rules for the required services.
Primary references
- U.S. FTC — How to secure home security cameras
- CISA — Secure by Design guidance
- ONVIF — Profiles and conformance overview
Related SmartRTSP guide
Open related guidePlace cameras on a controlled network and document viewer, recorder, DNS, time and update paths explicitly.