How are your camera vlan setup?

D

dannieboiz

Getting the hang of it
May 13, 2015
496
72
I started to setup VLANs on my network for the camera and as I'm doing this I think my process is counter productive in terms of security just because of how I'm doing this.

my BI PC is on VLAN 1, 10.10.1.1
Camera on VLAN 20, 10.10.20.1

I have created a trunk for all the camera ports and the BI PC to see Vlan 1 and VLAN 20. Then I realised that this is a waste of time in term of security since VLAN 1 and 20 can see each other. Or is it now?

In reality, the BI PC should be on the same VLAN 20 as the cameras, correct?
 
Many here follow these recommendations, not sure if you've read these yet:

Dual NIC setup on your Blue Iris Machine

In making your system more secure this is a great option to eliminate your cameras calling home / connecting to the internet This is a great place to start to setup a bit more secure network and learn more about IP/Subnets etc. before adding dual NICs: Router Security - Subnets and IP addresses...
ipcamtalk.com ipcamtalk.com

How to Secure Your Network (Don't Get Hacked!)

Many camera networks are unsecure, even those installed by professionals. This guide gives basic instruction in how to secure a camera network from the most common types of attacks. Perhaps the most important rule of securing a computer network is to not forward ports to unsecure services...
ipcamtalk.com ipcamtalk.com
 
  • Like
Reactions: dannieboiz
SpacemanSpiff said:
Many here follow these recommendations, not sure if you've read these yet:

Dual NIC setup on your Blue Iris Machine

In making your system more secure this is a great option to eliminate your cameras calling home / connecting to the internet This is a great place to start to setup a bit more secure network and learn more about IP/Subnets etc. before adding dual NICs: Router Security - Subnets and IP addresses...
ipcamtalk.com ipcamtalk.com

How to Secure Your Network (Don't Get Hacked!)

Many camera networks are unsecure, even those installed by professionals. This guide gives basic instruction in how to secure a camera network from the most common types of attacks. Perhaps the most important rule of securing a computer network is to not forward ports to unsecure services...
ipcamtalk.com ipcamtalk.com
Click to expand...

I have not seen those but will be reading them now.
 
Your BI machine can be on any VLAN of the system. You just need a rule to allow it to access the camera VLAN.
 
It should be in the switch itself if it does any routing at all.
 
Like looney2ns says "buy once, cry once".
 
  • Like
Reactions: looney2ns
sebastiantombs said:
Like looney2ns says "buy once, cry once".
Click to expand...
LOL I hear ya, I have a 48 port Cisco POE switch that I replace this with but the noise on those fans was too loud to be in my office. Been waiting to pick up a Ubiquiti POE switch but have not gotten to it yet.
 
I stick to 16 port PoE switches. No fans to worry about plus, after working in server rooms for years, "fan noise?? what fan noise??".
 
  • Like
Reactions: looney2ns
sebastiantombs said:
I stick to 16 port PoE switches. No fans to worry about plus, after working in server rooms for years, "fan noise?? what fan noise??".
Click to expand...
I have more than 16 POE devices hence 24 ports. My rack sits in my closet next to the desk I sit at 8 hours a day, it can get annoying.
 
I have more than 16 cameras, too, so I have two 16 port switches. A little redundancy in case on fails while waiting for a replacement.
 
  • Like
Reactions: looney2ns
dannieboiz said:
I have a L2 POE switch that I run everything off of, I assume this will be configured on my gateway? In my case it's PFSense
Click to expand...

If you are running PFSense on a device that has extra Ethernet ports, you can add a second network to run all of your security on and set rules under >firewall >rules > security lan
I use a Protectili fanless and have 6 ports to play with. One is dedicated to security cameras and has all WAN traffic blocked. Use your open VPN to remote access.

1658422408640.png


Or you can use a managed switchs to build and route your Vlan. For a inexpensive managed switch,
 
  • Like
Reactions: tech101, looney2ns and sebastiantombs
Old Timer said:
If you are running PFSense on a device that has extra Ethernet ports, you can add a second network to run all of your security on and set rules under >firewall >rules > security lan
I use a Protectili fanless and have 6 ports to play with. One is dedicated to security cameras and has all WAN traffic blocked. Use your open VPN to remote access.

View attachment 134106


Or you can use a managed switchs to build and route your Vlan. For a inexpensive managed switch,
Click to expand...
Actually this is a great idea... I do have ports to spare on the PFSense box.
 
  • Like
Reactions: Old Timer
PFsense can do VLANS, but I figured out this way and it's simple (KISS) and very easy to set up.

You can still use a PC on the LAN port to connect to the cameras and Blue Iris.

I also enable the NTP in the PFSense for all of the cameras to sync with. Works better then setting one up on the blueiris PC.
 
KISS is definitely the way to go. It's been on my bucket list and I never got to it. We are upping cybersecurity by 10 fold these days at work and I figure might as well do it for my house as well. I don't trust the built in camera access. This will make me feel better waking around the house naked. :rofl:
 
  • Haha
Reactions: Old Timer
You must log in or register to reply here.
Top Bottom