Manual

Recipe: a camera network

Cameras on their own VLAN, an NVR that may reach them, and nobody else.

Goal: a camera network that does not disturb the rest and is not disturbed itself: its own VLAN, no internet, and only the NVR and you getting in.

What you need

  • The number of cameras, what they draw, and which PoE standard they use.
  • An NVR or a server that stores the footage, and the answer to where it sits: with the cameras, or on the office network.
  • A PoE switch, preferably the same switch the NVR is on.
  • An address range for the cameras that is not in use anywhere else.

Step 1: the VLAN

  1. Use the Office router with VLANs role. Without VLANs there is nothing to separate with.
  2. Add a VLAN for the cameras to the table, say 40, with an address of its own such as 192.168.40.1/24.
  3. Switch Internet off for that VLAN. That produces a firewall rule dropping everything from that VLAN towards WAN.
  4. Make sure your own network sits at the top of the table. The first VLAN is what wired ports get by default.

Step 2: who may reach the cameras

If the NVR sits in the same VLAN as the cameras, ticking Isolated is enough: cameras and NVR talk to each other and to nothing else.

If the NVR sits on the office network, isolated does not work, because that is exactly what blocks traffic between VLANs. Use the matrix instead:

  1. Go to Firewall & NAT and set Traffic between VLANs to Only what is ticked in the matrix.
  2. Tick office towards cameras. The NVR can then open connections to the cameras.
  3. Leave cameras towards office unticked. Replies always come back, so the footage arrives fine.

As soon as the matrix is on, the Isolated tick on a VLAN is no longer used: the matrix decides everything. The tool says so too.

Step 3: fixed addresses

A VLAN's DHCP pool starts at .10, so the addresses below it stay free. Give the NVR 192.168.40.2 and the cameras fixed addresses in the same range.

Fixed addresses over DHCP (static leases) live only in LAN & DHCP in this tool, so for the ordinary LAN, not per VLAN. For a camera VLAN you therefore set the addresses on the cameras and the NVR themselves, outside the pool. If you really want the tool to hand out leases, the camera network belongs on the LAN and not in a VLAN.

Step 4: ports and PoE

  • In the port assignment, set the ports the cameras hang on to access with the camera VLAN.
  • If the NVR is in the camera VLAN, that is an access port too. If it has to be in two networks, set the port to trunk with the office VLAN as the untagged VLAN (pvid) and the camera VLAN tagged alongside. The NVR then has to be able to make a VLAN interface itself.
  • On a MikroTik with PoE-out you set auto-on, forced-on or off per port, in the Bridge & ports section or by right-clicking the port on the network board. With off you power a camera down and up remotely, which is nicer than a ladder.
  • Use forced-on only for passive-PoE equipment. A camera that negotiates 802.3af or at belongs on auto-on.
  • The PoE budget is not in this tool. Add up what your cameras draw and lay that next to what your switch can deliver in total; that is more often the limit than the number of ports.

Step 5: bandwidth

Cameras send continuously. A few megabit per camera sounds like nothing, but it never stops, and with twenty cameras you have a serious constant stream towards the NVR. Two rules help:

  • Put cameras and NVR on the same switch. The traffic then goes port to port and never reaches the router. Only what you watch remotely crosses the router.
  • Give the NVR a gigabit port. All the traffic from all the cameras comes together there.

If the traffic does have to cross the router, use the Limits per host/network list in QoS and put the camera network in it with a down and an up limit. Expect QoS to switch FastTrack off; on a small router that costs throughput.

Step 6: no internet, but the right time

A camera without internet cannot reach a time server out there, and footage with the wrong timestamp is worth little. Turn on the NTP server for the LAN in Services and tools and enter the router's address in that VLAN on the cameras, here 192.168.40.1.

A VLAN's DHCP passes a lease time, DNS and a domain name, but has no NTP option, so you fill that in on the camera itself.

Step 7: testing

  • Put the cameras and the NVR on the network board as systems, with their VLAN and address, and press Traffic. That shows whether office may reach the cameras and the cameras may not reach office.
  • On the router: /ip firewall filter print stats. The rule dropping internet for the camera VLAN should start counting as soon as a camera tries. If it counts zero, something is going around that rule.
  • Ping a camera from the NVR. That has to work.
  • Ping a camera from an office PC. That should only work if you ticked it in the matrix.
  • Check with /interface ethernet poe monitor ether5 that a camera is getting power, before you start hunting a network problem.

What to watch out for

  • Cameras that phone home. Many brands want a cloud connection for their app. Switch internet off and that app stops working. Choose that deliberately: it is usually exactly why you switched internet off.
  • The NVR wants out too. For updates, mail or push notifications. Sitting in the camera VLAN with no internet, it cannot. Put the NVR in a VLAN of its own that does have internet, or on the office network.
  • Automatic camera discovery does not cross VLANs. ONVIF discovery uses multicast and stays inside its own network. With the NVR elsewhere, add the cameras by address.
  • The camera VLAN untagged on a desk port. That puts your camera network within reach of every workstation.
  • Cameras on the factory password. A separate VLAN is no substitute for changing it.

See also VLANs, PoE-out and Recipe: a single camera.

Want to try it right away? Open the configurator