Integrations

Remote Access

Reach your home camera network through an encrypted VPN or private overlay.

Never publish a camera RTSP or ONVIF port directly to the internet. Many camera endpoints do not provide the authentication hardening, encryption, rate limiting, or patch cadence expected of a public service. Keep the camera private and extend the LAN with a VPN.

Recommended methods

Method Difficulty Best for Camera URL
Tailscale VPN Easy Simple private access with subnet routing Usually the original LAN IP
WireGuard VPN Medium Routers and firewalls with native WireGuard Original LAN IP

Method 1 — Tailscale VPN Recommended

Tailscale creates a private encrypted network. Because most cameras cannot run Tailscale themselves, use an always-on router, Mac, NAS, or small computer on the camera LAN as a subnet router.

  1. 1 Install Tailscale on a supported router or an always-on device at home. Sign in to your private tailnet.
  2. 2 Configure that device to advertise the camera LAN as a subnet route, then approve the route in the Tailscale admin console.
  3. 3 Install Tailscale on the phone, tablet, Mac, Windows PC, or Android device used for remote viewing and sign in to the same tailnet.
  4. 4 Enable Tailscale away from home. With subnet routing, SmartRTSP normally keeps using the camera's original LAN URL.
Full step-by-step guide: SmartRTSP Remote Access via Tailscale →

Method 2 — WireGuard VPN

If your router supports WireGuard (ASUS, OpenWrt, pfSense, UniFi), you can set up a VPN server on the router itself.

  1. 1 Enable WireGuard in your router admin panel. Generate a client config.
  2. 2 Install WireGuard on the remote viewing device and import the client configuration securely.
  3. 3 Connect away from home and confirm the VPN route includes the camera subnet. SmartRTSP then uses the original LAN URL.

Do not use camera port forwarding

DDNS does not add security. It only gives a changing public IP a stable name. Forwarding TCP 554, an ONVIF service port, or a camera web console still exposes the device directly.

If a public rule already exists, remove it after the VPN path works. Rotate the camera password if the endpoint may have been reachable from the internet.

Test the real remote path

  1. 1. Confirm local live view and recording first, then enable the VPN.
  2. 2. Disable Wi-Fi on the viewer so the test cannot silently use the home LAN.
  3. 3. Open a sub stream, then the main stream; verify decoded video, audio, reconnection, and PTZ if used.
  4. 4. Repeat after switching between cellular and Wi-Fi. A VPN handshake alone is not proof that media works.

Use the full camera validation checklist for reproducible troubleshooting.

HomeKit Bridge Performance & Battery