How to View IP Cameras Remotely Without Exposing Them Online
Practice4 minInnovialabs editorial team
In short
The safest way to watch cameras remotely is through a VPN to the office network; a vendor P2P app is an acceptable compromise, while forwarding camera or NVR ports to the internet should be avoided.
The short answer
Do not make cameras or the recorder directly reachable from the internet. In order of preference:
- VPN to the office or home network, then view cameras as if you were on site.
- The vendor's P2P cloud app, if it is kept updated and protected with a strong account.
- Port forwarding — only as a last resort, and better not at all.
Cameras and NVRs are small computers with a web interface, services and firmware that is updated rarely. Once they are visible on the internet, they are scanned and probed automatically.
Three ways to connect compared
| Method | How it works | Pros | Risks |
|---|---|---|---|
| VPN | The phone or laptop joins the local network through an encrypted tunnel | Cameras stay closed from the internet; one secure entry point | Needs a router or server with VPN and some setup |
| P2P cloud | The NVR connects to the vendor's server; the app connects through it | Works without a public IP, quick setup | You depend on the vendor's security and account protection |
| Port forwarding | The router forwards an external port to the camera or NVR | Simple and works with any client | The device's web interface and services are exposed to the whole internet |
VPN is the best default. Modern options such as WireGuard, the VPN server built into many business routers, or a mesh VPN service let you open access only to the camera subnet for specific users.
P2P is convenient when there is no public IP address or no one to maintain a VPN. Use it only from the official app, enable two-factor authentication on the account if the vendor offers it, and keep the NVR firmware current.
Port forwarding of HTTP, RTSP or vendor ports is the most common reason cameras end up on public search engines for connected devices. If you have no other choice, at least restrict access to known IP addresses on the router and use a non-default port — although the latter only reduces noise and is not protection.
Why default passwords and old firmware are dangerous
- Default and weak passwords. Lists of factory logins for popular brands are public. Bots try them automatically.
- Unpatched vulnerabilities. Camera firmware has had serious flaws, including ones that allowed access without a password. Updates close them only if you install them.
- Botnets. A compromised camera can be used to attack other systems while still showing video normally — you may never notice.
- Pivot into the network. A camera in the same network as accountants' computers becomes a door to them.
Hardening checklist
Accounts
- Change every default password, including on cameras the NVR manages.
- Create separate accounts: an administrator for setup and view-only accounts for staff.
- Disable or rename built-in accounts where possible.
Firmware and services
- Update cameras and the NVR to the current firmware from the official vendor site.
- Disable UPnP on the router and on the NVR, so devices cannot open ports themselves.
- Turn off unused services: Telnet, SSH, FTP, unencrypted HTTP if HTTPS is available.
- Disable P2P on devices if you use a VPN instead.
Network
- Put cameras in a separate VLAN or subnet.
- Allow cameras to talk only to the NVR; block their own internet access if the system works without it.
- Allow remote users into the camera subnet only through the VPN.
Monitoring
- Enable login logs and check them periodically.
- Set correct time and NTP so recordings and logs match.
- Review the device list and user accounts at least when staff leave.
Common mistakes
- Forwarding ports during installation "temporarily" and forgetting about them.
- One shared account for everyone, with the password sent in a chat.
- Buying cameras with no update history from vendors that do not publish firmware.
- Cameras and office computers in one flat network.