Why You Need a VPN for Remote RTSP
Most IP cameras only listen on private local addresses such as 192.168.x.x. That is why your RTSP URL works at home but fails on cellular or hotel Wi‑Fi.
Forwarding port 554 on your router seems convenient, but it is one of the worst ways to expose a camera. Shodan routinely indexes 1M+ exposed cameras and camera interfaces, and attackers actively scan for weak passwords and outdated firmware.
The safer approach is a VPN. Tailscale makes your phone appear as part of your home network, so the camera stays private and SmartRTSP keeps using the same local RTSP address. WireGuard, OpenVPN, and ZeroTier can also do this, but Tailscale is usually the easiest to set up.
What is Tailscale?
Tailscale is a free mesh VPN built on WireGuard. It creates a private network called a tailnet and assigns stable 100.x.x.x addresses to your devices.
No port forwarding, no public IP, and no complex firewall rules. Tailscale works through NAT and is especially good for home users who just want secure remote camera access.
For personal use, Tailscale supports up to 3 users and 100 devices, which is more than enough for most home camera setups.
How to Set Up Tailscale for RTSP Camera Access
Install Tailscale on a home server, NAS, Mac, or PC
Pick a device that stays on and sits on the same network as your cameras. Download Tailscale from tailscale.com, install it, and sign in with Google, GitHub, Microsoft, Apple, or email.
Install Tailscale on your iPhone
Search for Tailscale in the App Store, install it on your iPhone, and sign in with the same account. You can do the same on your Mac if you want secure access there too.
Enable subnet routing for your camera network
This is the key step. Your home device needs to advertise the local camera subnet so remote devices can reach addresses like 192.168.1.108.
After advertising the route, approve it in the Tailscale admin console at admin.tailscale.com → Machines → your home device → Edit route settings.
Enable the subnet route on your iPhone
Open Tailscale on your iPhone, tap the home machine, and enable its advertised subnet. Some versions label this as using the device as an exit node or subnet router; for RTSP camera access you primarily need the subnet route enabled.
Add the camera in SmartRTSP with its normal local IP
Open SmartRTSP and add the camera exactly as you would at home. Use the local RTSP address, such as:
No public IP, DDNS, or port forwarding required — Tailscale handles the private routing.
Tailscale vs Other Remote Access Methods
| Method | Setup difficulty | Security | Free? | Notes |
|---|---|---|---|---|
| Tailscale | Easy | ★★★★★ | Yes | Recommended for most people |
| WireGuard (manual) | Hard | ★★★★★ | Yes | Best control, but more complex |
| ZeroTier | Medium | ★★★★☆ | Yes | Good alternative to Tailscale |
| Port forwarding | Easy | ★☆☆☆☆ | Yes | Dangerous — camera exposed to internet |
| Cloud cameras (Ring, Blink) | None | ★★★☆☆ | No | Easy, but usually subscription-based and not RTSP |
Troubleshooting Tailscale + RTSP
- !Camera still not reachable. Confirm the subnet route is approved in the Tailscale admin console. If it is pending, your iPhone cannot reach the 192.168.x.x camera subnet.
- !SmartRTSP times out. If subnet routing is not working yet, test the Tailscale IP of the home machine first. The
100.x.x.xaddress confirms the VPN itself is connected. - !Video feels slow. Tailscale adds very little latency because WireGuard is fast. If playback is poor, the usual bottleneck is your home upload speed or using a high-bitrate main stream instead of a sub-stream.
- !Cannot connect at all. Make sure Tailscale is active on both devices and that the home machine is online. If the home node sleeps, routing to your cameras stops too.