Frigate & Blue Iris Camera VLAN: Zero-Trust NVR Network Guide

Updated 2026-11-12 • By Devon Brooks, CISSP (Network Security & VPN Specialist)

Most off-the-shelf PoE security cameras phone home to overseas P2P cloud relays, ship outdated embedded Linux kernels, and stream unencrypted RTSP credentials. By placing cameras on an internet-blocked Camera VLAN (e.g., VLAN 30) and linking your Frigate or Blue Iris NVR via a local Dual-NIC topology or firewall pinhole, you eliminate outbound camera snooping without breaking Home Assistant or WireGuard remote viewing.

Why Security Cameras Require a Zero-Trust VLAN (and Never Port Forwarding)

Budget and prosumer ONVIF/RTSP cameras from Reolink, Amcrest, Hikvision, Dahua, and EmpireTech offer exceptional 4K low-light sensors for $60 to $150—and notoriously poor software security. Historically, dozens of embedded IP camera firmwares have leaked root telnet shells, hardcoded ONVIF bypasses, or silent outbound P2P heartbeats dialing foreign cloud servers.

Securing a self-hosted NVR like Frigate NVR (open-source Linux/Docker with Coral/OpenVINO AI) or Blue Iris (Windows NVR) solves both privacy and reliability at the same time:

• Zero Camera Internet Egress: Cameras communicate strictly locally on their dedicated subnet using PoE Ethernet, never resolving external DNS or opening outbound cloud sockets.
• No Inbound Router Port Forwarding: Never forward RTSP port 554, HTTP port 80, or Blue Iris port 81 directly on your WAN firewall. Use WireGuard VPN, Tailscale, or an authenticated Home Assistant / Cloudflare Tunnel proxy to check live cameras away from home.
• Deterministic Storage Ingestion: Isolating high-bitrate continuous UDP/TCP RTP streams prevents multicast/ARP interference from slowing down workstations or Wi-Fi video calls.

Architecture Choice: Dual-NIC Bypass vs. Router-on-a-Stick Hairpin

Before creating firewall rules, choose how your NVR server connects physically to the Camera VLAN. This single hardware choice determines whether your router CPU breaks a sweat routing 4K surveillance streams:

Option A: Dual-NIC NVR Architecture (Recommended for 6+ 4K Cameras)

• Topology: Your NVR mini PC or tower server has two physical Ethernet ports. NIC 1 (eth0) plugs into your Trusted LAN / Homelab VLAN (192.168.10.20) with a Default Gateway pointing to your router. NIC 2 (eth1) plugs directly into an access port on your isolated Camera VLAN PoE switch (192.168.30.20/24) with NO Default Gateway and NO DNS configured on NIC 2.
• Why It Excels: Even ten 4K cameras streaming 8 Mbps each push ~80 Mbps (nearly 10 GB per hour) non-stop 24/7. With a Dual-NIC setup, every single camera packet flows straight through your Layer 2 PoE switch silicon directly into NIC 2—0% of camera video hits your firewall/router CPU! And because the Camera VLAN switch has a WAN-drop rule on the router (or no gateway at all), cameras are physically air-gapped from the internet.

Option B: Single-NIC Firewall Pinhole (Compact Mini PCs)

• Topology: If your NVR host (e.g., an Intel N100 mini PC running Proxmox + Frigate) only has one 2.5GbE port, place Frigate either inside VLAN 30 (blocking WAN from cameras except Frigate host's outbound Home Assistant notifications) OR place Frigate on Server VLAN 10 and open an explicit firewall Allow Rule: Source Frigate/Blue Iris IP → Destination Camera VLAN 30 on TCP 554 (RTSP), 80/443 (ISAPI/HTTP API), and 8000/8099 (ONVIF/backchannel).
• Bandwidth Rule of Thumb: Confirm your router-on-a-stick LAN trunk is 1 Gbps or 2.5GbE full-duplex so hairpinning camera traffic across VLANs does not saturate slower consumer router CPUs.

Configuring RTSP, ONVIF & NTP on Isolated Cameras

Once your Camera VLAN (192.168.30.0/24) is isolated from the internet, apply these four camera and NVR tuning steps so streams run tear-free for years:

1. Create Static DHCP Reservations per Camera MAC: Inside your router (or run DHCP directly on VLAN 30), bind static IPs cleanly (e.g., .101 Front Porch, .102 Driveway, .103 Backyard) and assign a clear hostname before disabling camera UPnP and P2P QR cloud services inside each camera's web UI.
2. Point Every Camera to Local NTP (UDP 123): Isolated cameras cannot reach pool.ntp.org. On your router firewall, add one pinhole permitting Camera VLAN 30 to reach your Router Gateway IP (192.168.30.1) or local NVR NTP service on UDP Port 123, or enable SNTP inside Blue Iris / OPNsense NTP daemon. This guarantees your video timestamps stay synced to the exact second for motion scrubbing and forensic exports.
3. Split Main Stream (Record) & Sub Stream (AI Detect): Running Coral TPU, Intel OpenVINO, or CPU AI object detection directly on an 8 MP 4K H.265 stream wastes GPU/CPU decode cycles. Inside each camera's Video Encoding settings:
   • Main Stream: 4K (3840x2160), 15 FPS, CBR (Constant Bitrate) 6,144–8,192 kbps, Keyframe / I-frame interval matched to FPS (15) (ensures instant scrubbing and zero pre-motion misses), H.264 or H.265.
   • Sub Stream: 640x480 or 1280x720, 5–10 FPS, H.264 (for 100% browser WebRTC/MSE playback compatibility inside Frigate's go2rtc and Home Assistant dashboards), 512–1,024 kbps.
4. Prefer TCP Transport for RTSP Stability: In Frigate (go2rtc / ffmpeg args) and Blue Iris, ensure RTSP streams pull via rtsp_transport=tcp (or Blue Iris “Use RTSP/stream timecode + TCP”) rather than UDP when crossing switches/VLANs, preventing gray macroblock tearing on keyframe boundaries.

Remote Viewing Safely via WireGuard & Home Assistant

Cutting cameras off from manufacturer cloud apps does not mean sacrificing smartphone alerts or instant live streams on cellular networks:

• On-Demand WireGuard Split Tunnel: Configure the WireGuard iOS/Android app with On-Demand Activation enabled for untrusted cellular/public Wi-Fi. Opening the Home Assistant Companion App or Blue Iris UI3 mobile web viewer routes encrypted requests through your home router straight to the NVR—never exposing an NVR login page to internet port scanners.
• Frigate + go2rtc Sub-Second WebRTC: Frigate's integrated go2rtc restreams RTSP feeds over MSE (Media Source Extensions) or WebRTC (UDP 8555) locally so opening a dashboard loads 8 live cameras simultaneously in under 300 milliseconds without each client taxing the camera's weak single-core RTSP server.
• Reolink & Amcrest ONVIF Caveat: For Reolink PoE cameras in Frigate, pull the HTTP-FLV stream via go2rtc (or update firmware to v3.1+ for stable RTSP/ONVIF) rather than raw RTSP alone, avoiding Neolink/ffmpeg reconnect loops during night IR cut-filter switching.

Camera VLAN Firewall Matrix (Trusted LAN, NVR & Isolated Camera Subnet)

Frigate & Blue Iris Zero-Trust Camera VLAN Setup Checklist

1. Create a dedicated Camera VLAN (e.g., VLAN 30 / 192.168.30.0/24) on router and PoE switch access ports.
2. Disable P2P Cloud, UPnP, and UID remote features inside every camera's initial local web setup.
3. Assign static DHCP IP reservations per camera MAC address and label ports physically on the PoE switch.
4. Apply WAN Block and Inter-VLAN Drop firewall rules targeting VLAN 30 (keeping UDP 123 local NTP open).
5. Standardize camera I-frame interval to match FPS (e.g., 15 FPS / 15 GOP) and enable H.264 on sub-streams.
6. Connect Frigate/Blue Iris via a Dual-NIC (no gateway on camera NIC) or single explicit NVR-to-Camera firewall pinhole.
7. Test remote camera playback strictly over WireGuard or authenticated Home Assistant proxy—verify WAN port scanners see zero open NVR ports.

Frequently Asked Questions

If I block my IP cameras from the internet, can I still watch them from my phone away from home?

Yes! Your phone connects to your Frigate or Blue Iris NVR (either via WireGuard VPN, Tailscale, or an authenticated Home Assistant server), not directly to the cameras. The NVR pulls the isolated local camera feeds and securely streams them over your encrypted VPN tunnel.

Why should I give my Blue Iris or Frigate computer a second network card (Dual NIC)?

A Dual-NIC server physically plugs into your regular LAN on NIC 1 and directly into the PoE Camera VLAN switch on NIC 2 (leaving NIC 2's Gateway and DNS blank). All continuous multi-megabit 4K RTSP video stays strictly inside Layer 2 switching without forcing your router firewall to route gigabytes of video across VLANs.

Why do my Reolink or Hikvision cameras stop recording at the exact same timestamp or drift off by minutes?

When you cut a camera off from the internet, it can no longer synchronize its clock with public NTP servers. Enable an NTP server on your local router/OPNsense box (or Windows Time/NTP on Blue Iris) and point every camera's NTP setting to your local gateway IP on UDP Port 123.

Should my cameras use H.264 or H.265 with Frigate and go2rtc?

Use H.265 (HEVC) on Main Streams if you prioritize 40-50% hard drive storage savings, OR stick to H.264 on Main Streams and definitely use H.264 on Sub Streams (640x480 / 720p) for universal zero-transcode browser and mobile WebRTC playback across Safari, Chrome, and Home Assistant.

Related Home Security Devices & Engineering Guides

• NVR Storage Calculation Guide: 4K Camera Bitrate & Terabytes — Calculate how many terabytes your NVR needs for 30 days of continuous 4K security footage. Compare H.265 vs H.264 bitrates, frame rates, and drive sizing.
• PoE Cable Distance & Voltage Drop Guide: 802.3af/at/bt Standards — Calculate PoE voltage drop and maximum Ethernet distances. Learn IEEE 802.3af/at/bt limits, 23 AWG Cat6 vs 24 AWG Cat5e resistance, and conduit heat dissipation.
• Home Security Camera Network Setup (Wired PoE vs WiFi) — Plan a reliable home security camera network. Calculate 4K H.265 bitrates, verify -65 dBm WiFi RSSI, install outdoor PoE surge arrestors, and bind static IPs.
• Smart Doorbell WiFi Setup: Fixing Weak Signal & Chimes — Fix smart video doorbell WiFi dropouts and chime reboots. Overcome brick wall attenuation, verify 16-24V AC transformer power, and lock to a 2.4GHz SSID.