Building an Isolated Security Camera VLAN: Inter-VLAN Routing and RTSP Stream Extraction for Lorex Systems

Placing IP surveillance cameras directly on a general home or office subnet introduces security vulnerabilities and broadcast traffic overhead. Continuous 4K video feeds generate sustained network utilization that can degrade Wi-Fi latency for workstations and mobile devices.

To secure video feeds and isolate traffic, network administrators isolate IP cameras and Network Video Recorders (NVRs) within a dedicated Virtual Local Area Network (VLAN).

This guide walks through configuring an isolated 802.1Q security VLAN, creating inter-VLAN firewall rules for Real-Time Streaming Protocol (RTSP) streams, and testing camera reachability.

1. Subnet Architecture and 802.1Q VLAN Tagging

A standard enterprise or prosumer router (running on pfSense, OPNsense, Ubiquiti UniFi, or a managed gateway) can divide a single physical network switch into segmented broadcast domains:

Gateway Provisioning

The primary router gateway on VLAN 1 typically resides on 192.168.1.1. To establish the security subnet:

1. Create a virtual interface tagged as VLAN 20 on the router uplink trunk port.
2. Assign the VLAN 20 gateway address as 192.168.20.1 with subnet mask 255.255.255.0 (/24).
3. Enable a local DHCP server on VLAN 20 distributing addresses from 192.168.20.100 to 192.168.20.200.

For complete physical wiring diagrams, PoE power budgeting formulas, and hardware mounting workflows, consult our Lorex camera setup guide.

2. Firewall Rules: Restricting Inbound and Outbound Video Traffic

The primary security objective of a camera VLAN is preventing unauthorized internet communication (telemetry beacons or unpatched firmware exploits) while allowing authorized local PCs to pull video streams.

Required Firewall Rule Hierarchy (Applied to VLAN 20 Interface):

1. Rule 1: Block All Outbound WAN Access

   • Source: VLAN 20 Subnet (192.168.20.0/24)
   • Destination: Any (WAN)
   • Action: Block / Drop
   • Reason: Completely blocks cameras from initiating outbound external internet connections.

2. Rule 2: Allow Local NTP Time Synchronization

   • Source: VLAN 20 Subnet (192.168.20.0/24)
   • Destination: Gateway (192.168.20.1)
   • Port: UDP 123 (NTP)
   • Action: Allow
   • Reason: Keeps camera hardware clocks accurate for video timestamps without requiring public internet access.

3. Rule 3: Inter-VLAN Stream Routing (Established / Related Sessions)

   • Source: Trusted LAN (192.168.1.0/24)
   • Destination: VLAN 20 Subnet (192.168.20.0/24)
   • Ports: TCP 80 (HTTP Admin), TCP 554 (RTSP Media), TCP 35000 / 37777 (Media Client)
   • Action: Allow
   • Reason: Permits trusted computers or your Home Assistant server to initiate RTSP streaming sessions into VLAN 20, while blocking cameras from initiating unsolicited connections back into your trusted LAN.

3. RTSP Stream Extraction and Home Assistant Integration

Once inter-VLAN firewall rules are in place, third-party software (such as Blue Iris, Frigate, Home Assistant, or VLC) can pull direct H.264 / H.265 video streams across the router gateway:

Dahua / Lorex RTSP Path Syntax:

rtsp://<username>:<password>@192.168.20.120:554/cam/realmonitor?channel=1&subtype=0

• 192.168.20.120: The static IP address assigned to the NVR on VLAN 20.
• channel=1: Refers to physical camera channel 1.
• subtype=0: Requests the high-bitrate 4K Main Stream.
• subtype=1: Requests the low-bitrate Sub Stream (ideal for multi-camera live dashboard grids).

4. Diagnostics and Connectivity Verification

Before deploying cameras permanently, verify that network packets pass correctly between subnets:

1. Verify Inter-VLAN Ports: From a trusted computer on 192.168.1.50, verify that RTSP Port 554 and Web Port 80 on 192.168.20.120 are reachable using this network port checker utility.
2. Inspect Switch Trunking: If the NVR fails to receive a DHCP lease on VLAN 20, verify that the managed switch port connecting to the NVR is set to an Untagged Access Port on VLAN 20, rather than a tagged trunk.
3. Resolve Connection Drops: If physical link lights illuminate but the video stream drops or fails to authenticate, review our guide to fix a Lorex camera that keeps going offline.

For manufacturer gateway references, hardware default IP tables, and network diagnostic tools, visit the Router IP Guide homepage.