Security Camera VLAN on a Separate Network: Practical Architecture

Putting cameras on a separate network is useful only if the firewall policy is designed around the recorder, management devices and the services the cameras actually need.

Updated September 13, 2026 · SecurityVerdicts research desk

Simple architecture: cameras live on a dedicated VLAN; they can reach the NVR and only the infrastructure services you intentionally allow; trusted management devices can reach the cameras; cameras cannot initiate connections to ordinary laptops, file servers or other trusted LANs.

What belongs on the camera VLAN?

Fixed IP cameras are the obvious members. Depending on the design, a door station, video intercom or camera-side PoE switch can also live there. The NVR can either sit inside the same VLAN or on a trusted server VLAN with explicit firewall access to camera streams.

Recommended traffic model

Source	Destination	Default policy
Camera VLAN	NVR / Frigate server	Allow required stream and event traffic
Camera VLAN	Trusted user LAN	Block by default
Trusted admin device	Camera VLAN	Allow management as needed
Camera VLAN	Internet	Block for local-only systems; selectively allow if vendor features require it
Camera VLAN	DNS / NTP	Allow only if your design requires these services

Local-only cameras are easiest to restrict

Cameras that expose RTSP, ONVIF or another documented local interface can usually send video directly to an NVR without talking to vendor cloud services. Consumer app-first cameras may need outbound internet for authentication, alerts, remote viewing or firmware functions, so a blanket block can break features.

Do not expose camera ports directly to the internet

If remote viewing is required, terminate access at a VPN, trusted reverse proxy or the recorder's secured remote-access layer rather than forwarding RTSP, ONVIF or camera web-management ports from the public internet.

Discovery can fail across VLANs

Some apps expect cameras and phones to share a broadcast domain. When devices are segmented, automatic discovery may stop working even though direct IP access still works. Configure static DHCP reservations and document camera addresses so discovery is not required for day-to-day operation.

NVR placement choices

NVR inside camera VLAN: simplest camera-to-recorder traffic, but user access to the NVR must cross the firewall. NVR on server VLAN: cleaner central management, but the firewall must explicitly allow all required camera streams and event traffic. Both designs can be secure when rules are narrow and documented.

Test the failure modes

Block internet access and confirm recording continues.
Reboot the router and confirm the NVR reconnects to every camera.
Verify that a camera cannot reach a normal workstation.
Confirm time synchronization still works.
Test remote viewing through the intended secure path.

Goal: segmentation should reduce camera privileges without making the surveillance system fragile. If a rule is required, document why it exists.