IP camera project: isolate cameras on their own VLAN, then view them in Home Assistant with go2rtc

IP Based Cameras including Onvif compliant and proprietary systems
Post Reply
User avatar
ZerOne
Site Admin
Posts: 216
Joined: Sun Dec 13, 2020 8:21 am

A project for putting IP cameras on a separate network segment with no internet, while still getting live view in Home Assistant. It focuses on the network and access side. The Frigate NVR thread in the IP NVR forum covers recording. Based on the Home Assistant ONVIF and go2rtc pages and the go2rtc project's README, as at October 2026. Router and firewall menus vary completely between brands, so I describe rules in general terms. I have not run this exact setup, so test each step.

Step 1: create the camera network
  • Create a VLAN or separate network for cameras (for example 192.168.50.0/24) on a router, firewall or managed switch that supports VLANs. Put the PoE switch ports for the cameras into it.
  • Give each camera a fixed address (DHCP reservation) and change the default password, then update firmware.
  • Make a dedicated viewer user on each camera. The Home Assistant ONVIF page recommends a standard user for Home Assistant.
Step 2: firewall rules

In plain terms:
  • Allow the Home Assistant or go2rtc host to initiate connections to the cameras (RTSP, and the camera's ONVIF port if you use ONVIF; check the camera's settings for the port numbers).
  • Block the camera network from reaching the internet.
  • Block the camera network from starting connections to the rest of your LAN (replies to the host's connections are normally allowed automatically).
  • Cameras often need the time. Either allow NTP to a local server (your router often provides one) or set the camera clock from the host. Without it, timestamps drift.
  • Do not port-forward anything to the cameras.
Note that WS-Discovery and mDNS multicast do not cross VLANs, so automatic discovery will not find the cameras. Add them by IP address.

Step 3: find the stream URL

Find your camera's RTSP URL in its manual or the manufacturer's documentation. You can check a URL from the host with ffprobe (part of FFmpeg), which prints stream details:

Code: Select all

ffprobe -rtsp_transport tcp "rtsp://USER:PASSWORD@192.168.50.21/PATH"
PATH differs between vendors, so use your camera's documented one. If the password contains special characters, you may need to URL-encode them. See the Detecting and Connecting to IP Cameras thread for finding a camera.

Step 4: Home Assistant
  • ONVIF integration: Settings > Devices and services > Add integration > ONVIF, then enter the camera IP, ONVIF port and the viewer user. The integration needs ffmpeg and creates entities for H.264 profiles, and has an RTSP transport option (tcp, udp, udp_multicast, http). If a stream is unreliable, try tcp. It also supports ONVIF events (motion and similar) where the camera provides them.
  • go2rtc: Home Assistant's go2rtc integration connects to a go2rtc instance to provide a WebRTC proxy for cameras. The HA docs say it is set up automatically with default_config on Home Assistant OS and Container installs. The debug UI is off by default, and the docs say to enable it only while debugging, since it exposes port 11984.
Step 5 (optional): a standalone go2rtc

If you want one camera connection restreamed to several viewers (so the camera serves a single stream), run go2rtc yourself (Docker image or binary, see its README). A minimal config:

Code: Select all

streams:
  front_main: rtsp://USER:PASSWORD@192.168.50.21/PATH
  front_sub: rtsp://USER:PASSWORD@192.168.50.21/SUBPATH
By default, the go2rtc README says the web UI and API are on port 1984, RTSP on 8554 and WebRTC on 8555, and that anyone on your local network can watch video from your cameras through them. It also warns that if an attacker reaches the API, they can use sources like exec and get full access to your server. Its security section suggests binding to localhost where possible:

Code: Select all

api:
  listen: "127.0.0.1:1984"
rtsp:
  listen: "127.0.0.1:8554"
The README also describes options to limit which modules are loaded, restrict API paths and enable local authentication. Read its security section before exposing anything. Be aware that binding to localhost means only software on the same machine can reach it, so if Home Assistant runs elsewhere you will have to bind to a specific LAN address and firewall it to the Home Assistant host. Never expose the go2rtc ports to the internet.

Step 6: remote viewing

Use a VPN into your network (WireGuard or similar), or Home Assistant's own secured remote access, not port-forwarding. Make sure your Home Assistant login uses a strong password and two-factor authentication.

Checks
  • From a device on the camera VLAN, confirm you cannot reach the internet or your other devices.
  • Confirm the cameras still stream after a router reboot.
  • Check the host's CPU use. Use sub-streams for live view where possible.
Links
Question for the group: what router or firewall are you using for camera VLANs, and did you hit any problems with discovery, NTP or two-way audio across the VLAN boundary?
Top
Post Reply

Return to “IP Camera Discussion”